| created on | January 7, 2026 |
UEFI Images are a class of files that contain executable code, aka EFI applications. UEFI images can be loaded and executed by an UEFI firmware. The first set of bytes in the UEFI Image file contains an image header that defines the encoding of the executable image.
UEFI uses a subset of the PE32+ image format with a modified header signature, which distinguishes UEFI images from normal PE32 executables. The “+” addition to PE32 provides the 64-bit relocation fix-up extensions to standard PE32 format.
The table below lists the Subsystem values:
| P32+ Subsystem type for EFI images | Value | Code Memory Type | Data Memory Type |
|---|---|---|---|
| EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION | 10 | EfiLoaderCode | EfiLoaderData |
| EFI_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER | 11 | EfiBootServicesCode | EfiBootServicesData |
| EFI_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER | 12 | EfiRuntimeServicesCode | EfiRuntimeServicesData |
A UEFI application image is always unloaded when control is returned from the image’s entry point. A UEFI driver image is only unloaded if control is passed back with a UEFI error code.
The Machine Value in the PE32+ image file header indicates the machine code type of the image. The table below lists the machine code types and their corresponding machine values:
| PE32+ Machine type for EFI images | Value |
|---|---|
| EFI_IMAGE_MACHINE_IA32 | 0x014c |
| EFI_IMAGE_MACHINE_IA64 | 0x0200 |
| EFI_IMAGE_MACHINE_EBC | 0x0EBC |
| EFI_IMAGE_MACHINE_x64 | 0x8664 |
| EFI_IMAGE_MACHINE_ARMTHUMB_MIXED | 0x01C2 |
| EFI_IMAGE_MACHINE_AARCH64 | 0xAA64 |
| EFI_IMAGE_MACHINE_RISCV32 | 0x5032 |
| EFI_IMAGE_MACHINE_RISCV64 | 0x5064 |
| EFI_IMAGE_MACHINE_RISCV128 | 0x5128 |
| EFI_IMAGE_MACHINE_LOONGARCH32 | 0x6232 |
| EFI_IMAGE_MACHINE_LOONGARCH64 | 0x6264 |
All sections of the PE32+ image are loaded into memory. After the appropriate fix-ups have been performed, control is transferred to a loaded image at the AddressOfEntryPoint reference according to the normal indirect calling conventions of applications based on supported 32-bit, 64-bit, or 128-bit processors. All other linkage to and from an UEFI image is done programmatically.