2

I posted this question earlier on SuperUser but I feel it is more suited for programmers.

If I understand correctly, according to GPT, the first 16 bytes of LBA 2 is the partition type GUID for the first partition on disk. In Windows Disk Management the first partition is designated as an EFI System Partition. However upon further investigation an EFI System Partition's GUID is:

C12A7328-F81F-11D2-BA4B-00A0C93EC93B

And yet the first 16 bytes tell me otherwise:

28732AC1-1FF8-D211-BA4B-00A0C93EC93B

Interestingly the first 3 sections act as little endian while the other 2 are big endian.

Why is this the case?

user247702
  • 23,641
  • 15
  • 110
  • 157
Chicken Wing
  • 53
  • 1
  • 5
  • 2
    Wikipedia says [because Microsoft](https://en.wikipedia.org/wiki/Globally_unique_identifier#Binary_encoding) – PeterT Apr 26 '16 at 17:58
  • So I assume this causes incompatibility with other software? – Chicken Wing Apr 26 '16 at 18:05
  • Since the way GUIDs are displayed textually is standardized I'll infer that the only software accessing the data directly is Microsoft's boot manager and all else accesses through some kind of interface. – Chicken Wing Apr 26 '16 at 18:29

1 Answers1

3

EFI_GUID datatype is declared as follows:

typedef struct {
  UINT32  Data1;
  UINT16  Data2;
  UINT16  Data3;
  UINT8   Data4[8];
} EFI_GUID;

Because original EFI architectures (IA64 LE and IA32e) were little-endian by default, so are the integers. I haven't really seen an UEFI implementation on big-endian machine, so I don't know if standard GUIDs will be stored otherwise.

CodeRush
  • 839
  • 4
  • 10
  • 1
    The UEFI specification states that "It should also be noted that TimeLow, TimeMid, TimeHighAndVersion fields in the EFI are encoded as little endian.", so any hypothetical future big-endian implementations would still need to comply. The remainder of the GUID is big-endian. – unixsmurf Apr 27 '16 at 17:13