GenPE

UEFI Secure Boot 2023 CA updater — one exe for offline and imaged machines.

STABLE Products · 9 features · C (Win32) · UEFI · Secure Boot · Windows PE

overview

GenPE (UEFI.CA-2023.GenPE) is a single ~1.6 MB Windows executable that enrolls the Microsoft 2023 Secure Boot certificates into UEFI firmware, installs the 2023-signed boot manager onto the ESP, and marks Windows installs as updated — online or fully offline.

It exists for the machines Windows Update can't reach: offline boxes, custom WinPE media, and systems imaged or upgraded outside the servicing flow. GUI or CLI, same exe — built to run from a custom Windows PE disk.

features

  • ▸Enrolls the 2023 Secure Boot certificates — KEK, Windows UEFI CA, Microsoft UEFI CA (+ optional Option ROM CA)
  • ▸Installs the 2023-signed Windows boot manager onto the ESP
  • ▸Marks Windows installs as updated — the AvailableUpdates registry path, done directly
  • ▸Fully offline — Microsoft's own signed payloads embedded in the exe; nothing downloads
  • ▸Authenticated append writes only — existing db/KEK contents (OEM keys, custom certs) preserved
  • ▸Automatic KEK selection — picks the right OEM-signed KEK2K CA for the device
  • ▸dbx revocation updates — optional and guarded (--dbx, --dbx-svn, --dbx-2024)
  • ▸Point-and-click GUI or full CLI — same binary, ~1.6 MB, Windows system DLLs only
  • ▸Runs from custom WinPE — service machines that never see Windows Update

screenshots

GenPE.exe — the updater GUI: firmware cert status, install and OS marking in one window
GenPE.exe — the updater GUI: firmware cert status, install and OS marking in one window

documentation 1 pages

Overview README.md

open full docs →

stack

C (Win32) UEFI Secure Boot Windows PE

get started

quickstart
$ GenPE.exe              # GUI — status / cert install / boot-file update / OS marking
$ GenPE.exe --help       # CLI mode, same engine
▊