Grub4dos Internal variables, memory areas, advanced features and function calls

counter customisable

The following is a list of some grub4dos internal variables and functions from a 2013 or later version of a chenall build of grub4dos (as used in RMPrepUSB).

Memory areas used by grub4dos

The physical memory address range from 1M to 32M is reserved for grub4dos internal code and data. Grub4dos may fail to run on systems with less than 32MB of RAM. Ideally users should not use this range (32MB = 0x200,0000 = below (md)0x10000).
Some use of (md)0x300 is relatively safe if low memory is required.
Some areas below 1MB are also used by grub4dos.

Grub4dos executes grub4dos executables and kernel payloads at 32MB in memory, therefore it is best to use memory areas well above 32MB for any memory workspace if you intend to call grub4dos executables after loading kernel files, etc.

Note: In grub4dos, batch files and programs run in the same piece of memory as the 'kernel' command. Therefore you cannot use the kernel command directly from a batch file or grub4dos program.
To workaround this, either allocate memory to move the buffer by using call Fn.50 0x200000 as the very first line in menu.lst OR use configfile, e.g.
echo kernel /xxx/vmlinuz aaa bbb ccc > (md)0x220+1
echo initrd initrd.gz >> (md)0x220+1
configfile (md)0x220+1

(md) is a memory 'device'. (md)x+y where x is the start sector in memory and y is the length of memory in sectors (e.g. (md)4+2 = start at 2KB in memory for a length of 1KB. Note that the BIOS uses low memory!

Grub4dos use of memory - (md) uses 512-byte 'sectors':
0x0008200 320K fixed variables + grldr program = (md)0x41 to (md)0x300
0x0030000 64k sector buffer for current device = (md)0x180 to (md)0x1FF
0x0045000 environment variables = (md)0x228 to (md)0x288 approx.
0x0060000 end of grub4dos variables + wkspace = (md)0x300
0x007C000 used to load boot code, etc. = (md)0x3E0...

0x0090000 may be used by BIOS (avoid) = (md)0x480 to (md)0x4FF
0x00A0000 graphics memory (reserved) = (md)0x500 to (md)0x5FF
0x00C0000 BIOS area (reserved) = (md)0x600 to (md)0x7FF
0x0100000 may be used by BIOS (avoid) = (md)0x800 best to avoid up to (md)0x880

0x0800000 8M for mem array workspace = (md)0x4000 to (md)0x7FFF
0x0A00000 10M-14M for page map = (md)0x5000-0x6FFF
0x1000000 16M-19M used to store background bmp = (md)0x8000-0xD460 (end of buffer depends on size of bitmap, 1920x1440=0xD460, 800x600=0x8EA6, 1024x768=0x9800)

Avoid below (md)0x300 and (md)0x4000 to (md)0x7FFF area. Preferably use (md)0x10000 and above (above 32MB).

Use of around (md)0x8000 to 0x9800 can cause corruption of bitmap background when a menu is displayed in 1024x768 mode (even more used in higher res modes!).
However wenv/insmod seems to load files above 32MB - therefore use above 50MB = (md)0x19000 to be safe!

Many BIOSes use the last part of segment 9000:0 for a scratchpad. All IBM-compatible BIOSes use A000:0 - F000:FFFF.

Black areas are normally unused by grub4dos and IBM PC BIOS and hardware.

50 40 0.039 A000 000A00:0
60 48 0.0468 C000 000C00:0
80 64 0.0625 10000 001000:0
220 272 0.265 44000 004400:0
300 384 0.375 60000 006000:0
400 512 0.5 80000 008000:0
500 640 0.625 A0000 00A000:0
600 768 0.75 C0000 00C000:0
700 896 0.875 E0000 00E000:0
800 1024 1 100000 010000:0
880 1088 1.0625 110000 011000:0
900 1152 1.125 120000 012000:0
a00 1280 1.25 140000 014000:0
b00 1408 1.375 160000 016000:0
c00 1536 1.5 180000 018000:0
d00 1664 1.625 1A0000 01A000:0
e00 1792 1.75 1C0000 01C000:0
f00 1920 1.875 1E0000 01E000:0
1000 2048 2 200000 020000:0
2000 4096 4 400000 040000:0
3000 6144 6 600000 060000:0
3100 6272 6.125 620000 062000:0
3200 6400 6.25 640000 064000:0
4000 8192 8 800000 080000:0
5000 10240 10 A00000 0A0000:0
6000 12288 12 C00000 0C0000:0
7000 14336 14 E00000 0E0000:0
8000 16384 16 1000000 100000:0
9000 18432 18 1200000 120000:0
a000 20480 20 1400000 140000:0

(md)0x200 - 0x220 this seems to be used by chenall, et al. and so is probably safe!
(md)0x300 - 0x4FF 384-600KB approx. (0x3E0 may be used for chainloading by grub4dos)
(md)0x1000 - 0x3FFF 2-8MB
(md)0xD800 - 0xFFFFF (can start from 0x9800 as long as not using higher Res than 1024x768)
(md)0x19000 + (50MB+)

As most systems will have over 50MB of memory, use memory after (md)0x19000 to be ultra safe!

Using grub4dos variables

Grub4dos variables recognises a maximum name length 8 characters and each variable holds a maximum size of 511 characters or 512 bytes. The variable name is case sensitive, e.g.

set a=1
set A=2


e.g. do not exceed 8 characters for variable names or it could cause unexpected problems (FRED12345 in this example is shortened by grub4dos to FRED1234) ...

set FRED1234=Hi
set FRED12345=Lo
echo %FRED1234%
echo %FRED12345%


Note: Variables and their values are stored in memory and may share the same workspace area as modules loaded using the 'insmod' command. You may get crashes if you define too many variables and have lots of large modules loaded into memory (use delmod to remove the modules from memory after use).

#clear all variables except fred
set * && set fred=%fred%

You can define leading spaces in a variable and have characters like && or ;; by enclosing the argument in double-quotes (must start as "<variable>= with no spaces
set "a= fred && doris"

Be careful using && or || as the environment is not changed until the whole line has been executed - e.g. the following line will not print HELLO the first time it is run because A is not set until after the whole line has been executed:

set A=HELLO && echo %A%

Get the number of characters in any variable - this example prints 5
# set command will return the length
set a=freda
# do stuff here...
# get length of a into @retval
set a=%a%
echo Number of characters in variable a = [email protected]%

To display all variables beginning with AB use:
set AB
You can use IF EXIST to test for the existence of a variable

if exist FRED echo Variable FRED exists!

Increasing the variable space

Grub4dos has space for 60 variables, each one can have a value size of 512 bytes.

# check if a variable has been defined
if exist FRED1234 echo FRED1234 is set to %FRED1234% || echo Variable FRED1234 has not been defined!

In the latest versions of grub4dos (15 May 2013 and later) you can extend the variable space using an undocumented @extend command:
You can set up to max 65,536 variables using @extend.

set @extend BASE_ADDR SIZE

The BASE_ADDR is the memory start of extended variable.
SIZE is how many variables it will extended by (MAX is 0xFFFF)

e.g. add 10 variables (so we can have 70 variables in total) at 0x40000.

set @extend 0x40000 10

this needs memory (((10+63)/64) + 10)*512 = 5632. You must confirm the BASE_ADDR has enough space.

setlocal/endlocal will not work correctly however as any variables over the 60 that are set inside a setlocal section will remain after an endlocal!
So if you are using @extend and setlocal/endlocal, be sure to not use more than 60 variables inside the setlocal/endlocal segments!

set @extend 0x40000 10
set *
set 70 variables here...
>>> 10 variables will be listed!

The command:

set @extend

will display:


The first number is the base address in memory where the extra variable names are stored. The second number is the next unused block. The last number is the number of extra variables (above 60) that can be stored (10 variables = 200h*10 = 200 sectors from 0x40000 to 0x401FF).


You can get a substring of any variable like this: %variablename:~startpos,endpos%

The startpos shows where the substring begins ( + position from the beginning, - position from the end)
The endpos shows where it ends ( + position from the beginning, - position from the end)


set a=0123456789abcdefghijklmnopqrstuvwxyz
echo %a:~0,3% displays 012
echo %a:~2,3% displays 234
echo %a:~-3,3% displays xyz
echo %a:~3% displays 3456789abcdefghijklmnopqrstuvwxyz
echo %a:~3,-2% displays 3456789abcdefghijklmnopqrstuvwx
echo %a:~,-2% displays 0123456789abcdefghijklmnopqrstuvwx

A header file which may help if you understand C code can be found here.

Example - test string length of KEY is exactly 29 characters
set KL=0
if not "%KEY:~29,1%"=="" set KL=1 && echo TOO LONG!
if "%KEY%"=="%KEY:~0,28%" set KL=2 && echo TOO SHORT!
if not "%KL%"=="0" pause --wait=3 INVALID PRODUCT KEY "%KEY%"! && configfile /menu.lst

Filename strings in batch files (limitations)

Max no lines = 2048 in a batch file, Max. no. labels in a batch file = 128, file must start with !BAT on first line.

In a batch file, %0 is the full path of the batch file itself (if the batch file is in the root then no leading / is output), %~nx0 is the batch files filename + extension, %~n0 is just the filename and %~x0 is just the extension (e.g. .gb4).

n is filename, x is extension, p is the path and d is the drive name.

%0=/xx/fred.g4b (if in root then fred.g4b)
%~pnx0=/xx/fred.g4b (if in root then /fred.g4b)
%~0=parameter without quotes
%~f0=fully path of filename - e.g. if %0=fred.inf then %~f0=(hd1,0)/dir1/dir2/fred.inf if root was set to (hd1,0)/dir1/dir2

If you pass more than one filename to a batch file, %1 will be the second parameter, %2 the third, etc. %* is all parameters.

Batch file to get all parameters as arg1...argn and argc as number of parameters:

set argc=0
if "%1"=="" goto :fin
set /a argc=%argc%+1 > nul
set arg%argc%=%1
goto :LOOP

Note: BEWARE! in batch files beware of %0 %1 %2 accidents! e.g.

set f=3
echo %f%2

will not display 32 (it displays %f because %1, %2 %3 special variables are substituted first, so grub4dos translates this to %f+%2) - instead use this...

set f=3
echo %f%%2

%% in a batch file is reduced to %. Since %%2 does not mean anything to grub4dos on the first substitution pass, we get the expected answer.

If you have a filename or full or partial filespec, you can get bits of it like this:

# set current path to /_ISO folder
root ()/_ISO > nul
set file=/test/my.iso
call :show %file%

echo %%~d1=%~d1 %%~p1=%~p1 %%~n1=%~n1 %%~x1=%~x1 %%~f1=%~f1
goto :eof

we get:

%~d1=(hd0,0) %~p1=/_ISO/test/ %~n1=my %~x1=.iso %~f1=(hd0,0)/_ISO/test/my.iso

Accessing numbered variables

If we have a number of variables FRED1, FRED2, FRED3, etc, and we want to print out the value of each, we can use a counter like this

set FRED1=A
set FRED2=B
set FRED3=C
set N=0

set /a N=%N%+1 > nul
call echo %^FRED%N%%%
if %N%<=2 goto :LOOP


Note that using ^ anywhere inside a variable prevents it from being translated into a value. So %^FRED%N%%% gets translated by 'call' to %FRED1% and then echo displays the FRED1's value.

If not using a batch file use call echo %^FRED%N%% instead (in a batch file, %%=%).

Internal named variables

grub4dos has a few predefined variables - these can be used in a grub4dos command - e.g. echo [email protected]% or set [email protected]%

These are case sensitive:

@date - e.g. 2012-04-08
@time - e.g. 15:29:11
@random - 0 to 32767 - e.g. set /a num1to10=%@random% / 3277 + 1 or set /a [email protected]:~-1,1% + 1
@root - e.g. (hd0,0)
@path - e.g. (bd)/BOOT/GRUB/
@retval - e.g. 1 - NOTE: This is a 32bit value ranging from -2GB to +2GB
?_BOOT - disk&partition that contained the file \grldr that was used to boot to grub4dos, e.g. (hd0,0) - note: this is NOT the same as (bd) which is set to whatever partition contained the menu.lst file.
?_UUID - set after uuid command - e.g. uuid (bd)
? - result of last command - e.g. cat --locate=string --number=1 /myfile ;& set offset=%?% ;& echo string found at %offset% prints 0x1de or 0x0 if not found, @retval is 0 if not found or <count> if found

You can set the default file extensions of grub4dos executables using command --set-ext= (this is similar to typing just fred in the Windows command shell and Windows would run fred.exe) - for example, we can set the default extensions like this:

command --set-ext=.g4b;.g4x

If you then have a command like fred or /fred in a menu or batch file, grub4dos will try “fred" first and then fred.g4b and then fred.g4x.

Tip: use debug msg=3 to see the search paths used by grub4dos.

Fn calls

You can call an internal function like sprintf within a grub4dos menu or a grub4dos batch file. For example:

set a=aa
set b=bbb
call Fn.0 0 "stringa=%s stringb=%s" %a% %b%

this prints on the display
stringa=aa stringb=bbb

Here is a list of the Fn calls. I don't know all the details for all the parameters, but each parameter should be separated by a space.
Note that Fn. is case sensitive and must have a capital F and a lowercase n.

Some equivalent C library functions for these can be searched for here.

0 grub_sprintf syntax: call Fn.0 <memory location> <printf string> - if <memory location> = 0 then is output to screen, if <memory location>=0x60000 then the string is output to memory at (md)0x300. @retval returns the length of the string - e.g. call Fn.0 0x60000 "%pci%\r\n" = call func sprintf("%pci%") - another example: call Fn.0 0 "id="%s","%1"" %p_hwid% - This function is also useful for stripping quote marks from variables (but ensure there is only one pair or things can go wrong! Also note that Fn.0 0 fred will output 'fred' but Fn.0 0 1234 will not work as it is treated as a number - use Fn.0 0 "1234" instead.) call Fn.0 0 0xFFFF5 | set biosdate= will return the date of the BIOS on most systems - e.g. 06/23/99
1 grub_putstr
2 putchar - e.g. call Fn.2 49 prints '1' (if in the text mode console, call Fn.2 7 will 'beep' the internal speaker if your BIOS and hardware supports it - i.e. if it is a PC and has a 'beeper-speaker' fitted!)
3 get_cmdline_obsolete
4 getxy The return value is ((X << 8) | Y).
5 gotoxy - e.g. call Fn.5 0 11 set cursor pos to beginning of line 11
6 cls
7 wee_skip_to was obsolete setcursor
8 nul_terminate
9 safe_parse_maxint_with_suffix
10 substring
11 grub_strstr - see here - find string in string, returns @retval as position of string start, e.g. call Fn.11 0x6000 "$" || exit or call Fn.11 "%filefind%" "0" && echo found 0 in %filefind%
12 grub_strlen - e.g. call Fn.12 "freddy" ;; echo [email protected]% - prints 6
13 grub_strtok - see here for definition e.g. echo 123,456,789 > (md)0x200+1 ;; call Fn.13 0x40000 "," ;; echo First string at [email protected]% ;; call Fn.13 0 "," ;; echo Next string at [email protected]% ;; cat --skip=262152 (md)0+0x201 (note: memory is changed by each call a 0 is inserted at the delimiting character position -> 123<0>456<0>789
14 grub_strncat - Appends the first num characters of source to destination, plus a terminating null-character
15 grub_strcmp compare two strings - e.g. call Fn.15 XXX XXX ;; echo [email protected]% returns 0 (or -1 if no match)
16 grub_strcpy - copies string into destination
17 reserved
18 reserved
19 getkey - gets a kbd key from BIOS kbd buffer
20 checkkey- get kbd key without emptying buffer - e.g. call Fn.20 ;; set /A [email protected]%&0xff > nul ;; echo %key% prints 0x31 if number 1 key pressed (top 8 bits is scancode, bottom 8 are ASCII code, Function keys are 'special') @retval returns -1 if no key available.
22 grub_memcmp
23 grub_memmove
24 grub_memset (32-bit)
call Fn.24 0x83562 0xaa 0x100 - fill address 0x83562 in memory with byte 0xaa for size of 256 bytes. Note: address must be 32-bit value max 2GB if signed number (not 64-bit value)
25 grub_memset64 (64-bit) call Fn.25 0x83562 2 0xaa 0x12345678 0xA - fill 64-bit address 0x200083562 in memory (LSW MSW) with byte 0xaa for 64-bit size of 0xA12345678 bytes. Note: 64-bit values as unsigned 32-bit+32-bit (LSW MSW) New 2017-02 and later grldr only
26 grub_open - e.g. directly call grub_open file function it will put filesize at memory 0x8320 - this works well for non-compressed files too. call Fn.26 /myfile.gz ;; set /a filesize=*0x8320
27 grub_read
28 grub_close

32 devread
33 devwrite
34 next_partition
35 open_device
36 real_open_partition
37 set_device
41 parse_string
42 hexdump - e.g. call Fn.42 0x8000 0 3 - list 3 hex bytes at 0x8000
43 skip_to
44 builtin_cmd
45 get_datetime
46 find_command
49 get_mmap_entry
50 grub_malloc
51 grub_free51
52 list_partitions
53 realmode_run - executes a BIOS interrupt in real mode - e.g. see date.g4b batch file for example.
54 reserved for wee
55 reserved for wee
56 reserved for wee
57 reserved for wee
58 reserved for wee
59 reserved for wee
60 reserved for wee
61 dir - e.g. Fn.61 /dir/
62 print_a_completion
63 print_completions
64 lba_to_chs
65 probe_bpb
66 probe_mbr
67 unicode_to_utf8 e.g. call Fn.67 *0x82d0 0x60000 3 cat (md)0x300+1,1 | set nt_ver=NT
68 rawread
69 rawwrite
70 setcursor x (returns previous cursor state as [email protected]%) e.g. call Fn.70 0 to disable cursor and splashimage, call Fn.70 3 && clear will keep the splashscreen visible in console mode (but scrolling doesn't work when the cursor gets to the bottom of the screen so must clear the screen when get to bottom!) - 1=show cursor and disable splashimage, 2=normal splashimage mode,
71 grub_tolower
72 grub_isspace
73 grub_sleep e.g. call Fn.73 3 to sleep for 3 secs
74 mem64
75 envi_cmd
76 strncmpx
77 rectangle (x y w h border_width) - e.g. call Fn.77 180 180 100 100 2 - values in pixels not lines. Can be called multiple times for multiple rectangles on screen.
78 get_cmdline

Internal variable memory locations used by grub4dos

When grub4dos loads into memory, it will store certain internal, local values at defined places within memory. Sometimes it is useful to read or write to these locations.

For instance, the grub4dos version number is held at location 0x8278 in memory. So you can check what version the user is running by adding these lines to your grub4dos menu.lst file:

checkrange 20120201:-1 read 0x8278 || pause --wait=3 Please use grub4dos-0.4.5c-2012-02-01 or later! && exit 1

This checks the value of 0x8278 to ensure it is between 20120201 (the date that the grub4dos version was made) and -1 (which is the largest possible number). If this check fails then the message is displayed with a 3 second countdown and then the menu is exited.

Some variable locations + examples are given in the lists below: Use latest version available or these may not work (they may be subject to change)!

Address Bytes (Type) Description (see asm.S)
========= ============ ===================================================================
0000:8205 1 (BYTE) Control bits - default=0 (bit0=disable PXE, 1=disable kbd during boot, 2=disable unconditional cmd line entrance, 3=disable geometry tune, 4=dis cd-rom startup lookup, 5=enable HLT in checkkey idle loop for less CPU activity/heat)
0000:8208 4 (DWORD) install_partition (the boot partition) (??)
0000:8274 2 (WORD) default menu entry
0000:8276 1 (BYTE) current selected menu entry set /a SELMENU=*0x8276 & 0xff
0000:8278 4 (DWORD) grub4dos version - e.g. 20161109 = 0x133A255
0000:8280 4 (DWORD) boot_drive (the boot drive) set /A BD=*0x8280&0xf0 if %BD%==0x80 echo We booted from a hard disk!
0000:8284 4 (DWORD) pxe_yip (your ip)
0000:8288 4 (DWORD) pxe_sip (server ip)
0000:828C 4 (DWORD) pxe_gip (gateway ip)
0000:8290 8 (QWORD) filesize (file size by last "cat --length=0")
0000:8298 4 (DWORD) saved_mem_upper (extended memory size in KB)
0000:829C 4 (DWORD) saved_partition (current root partition) Only 2nd WORD is valid - use set /A PART=*0x829e&0xff (or set /a cur_pri=*0x829C>>16&0xFFFF)
0000:82A0 4 (DWORD) saved_drive (current root drive) set /a cur_drv=*0x82A0&0x7F
0000:82A4 4 (DWORD) no_decompression (no auto gunzip) 1=no decomp
0000:82A8 8 (QWORD) part_start (start sector of last partition)
0000:82B0 8 (QWORD) part_length (total sectors of last partition)
0000:82C0 8 (QWORD) saved_mem_higher (max contiguous mem in KB starting at 4G
0000:8304 4 (DWORD) ptr to current graphics mode - set /a n=23<<2+0x8304&0xffffffff ;; set /A n=%n%&0xffffffff ;; echo Current graphics mode is %n% (0=text mode)
0000:8308 1 (BYTE) symbol at left of highlighted menu entry (default=0x10 ►) - use 0 if not wanted or 0x1a for →
0000:8330 4 (DWORD) debug value max = -1 or 0x7FFFFFFF

grub4dos 0.4.6 only
0000:8350 1 (BYTE) number of USB drive loaded by usb driver after usb --init command - e.g. 01 - read 0x8350 & 0xff
0000:8351 8 (BYTES) USB drive numbers loaded by internal g4d USB driver in order e.g. 0x808182
0000:8359 4 (DWORD) Base address of USB driver data area