NESH — The New EFI Shell

1

One file

Everything is built into nesh.efi. Nothing to install.

2

One signature

One file to sign for Secure Boot.

3

A real language

NESH BASIC, instead of the old .nsh scripts.

4

From scratch

The UEFI Shell command set, rewritten. No EDK2 code.

The UEFI Shell command set, rewritten from scratch

Files, disks, UEFI variables, drivers and devices, PCI/SMBIOS/ACPI, memory, network, editors. UEFI Shell options are accepted too. More than 80 commands are documented in the user manual.

ifconfigpingtftphttpIPv4IPv6edithexedit

50+

NESH BASIC

Built-in functions for .nsb scripts.

Scripts that drive commands

Variables, loops, SUB/FUNCTION, strings, arrays, menus, files, and RUN/RUN$.

Script-friendly output

-data prints key=value records that scripts read with RECORDS and FIELD$.

Safe boot management

bootmgr: dry run, confirmation, automatic backups, check for missing files. bcfg too.

Runs UEFI Shell applications

NESH implements EFI_SHELL_PROTOCOL 2.2.

A friendly prompt

History with search, Tab completion, aliases, BASIC at the prompt.

Secure Boot aware

Low-level hardware writes are disabled while Secure Boot is active; reading stays allowed.

One file

Everything is built in: nesh.efi is about 363 KB. No EDK2 code: every command was rewritten from scratch.

examples\menu.nsbexcerpt

' menu.nsb - a maintenance menu: choose an action, do it, come back.
target$ = "fs1:"            ' where backups go

DO
  CLS
  PRINT "NESH maintenance - volume for backups: "; target$
  PRINT

  choice = MENU("What do you want to do?", _
                "Show the system|" + _
                "List the boot entries|" + _
                "Back up the boot loaders|" + _
                "Choose the backup volume|" + _
                "Leave the menu")

  SELECT CASE choice
    CASE 1
      RUN "sysinfo"
    CASE 2
      RUN "bootmgr list"

fs0:\> PRINT HEX$(&HFF * 16)
FF0
fs0:\> n = 0
fs0:\> FOR i = 1 TO 5
...   n = n + i
... NEXT
fs0:\> PRINT n
15

fs0:\> map -data
kind=volume
volume=fs0
label=QEMU VVFAT
size=528171008
free=527351808
readonly=yes
removable=no
boot=yes

-data prints key=value records, read with RECORDS and FIELD$. Examples shipped: bootmenu.nsb, findefi.nsb, inventory.nsb, linuxboot.nsb, menu.nsb.

fs0:\> map
Volume Label                 Size      Free  Flags
fs0    QEMU VVFAT          503.7M    502.9M  ro boot
fs1    NESHWORK             31.9M     31.9M

Device Type            Size  Volume
blk0   removable          -  (no media)
blk1   disk            504M
blk2   partition       503M  fs0
blk3   disk             32M  fs1

fs0:\> sysinfo
Firmware: Debian distribution of EDK II (revision 0x00010000)
UEFI:     2.7
Secure Boot: inactive
CPU:      QEMU Virtual CPU version 2.5+ / GenuineIntel
Memory:   511 MiB
Console:  100 x 31
Graphics: 1280 x 800 (mode 0 of 30), frame buffer at 0x80000000
Tables:   10 configuration tables, ACPI, SMBIOS

fs0:\> bootmgr
BootCurrent: 0001   BootNext: -   Timeout: 0 s
Ord  Id    Flg  Description
  1  0000  AH   UiApp
  2  0001  A *  UEFI Misc Device
  3  0002  A    UEFI Non-Block Boot Device
  4  0003  A    EFI Internal Shell
Flags: A active, H hidden, * current boot, N next boot. '-' in Ord: not in the boot order.

fs0:\> ping -n 3 10.0.2.2
Ping 10.0.2.2 16 data bytes.
16 bytes from 10.0.2.2 : icmp_seq=1 ttl=255 time=0ms
16 bytes from 10.0.2.2 : icmp_seq=2 ttl=255 time=0ms
16 bytes from 10.0.2.2 : icmp_seq=3 ttl=255 time=0ms

3 packets transmitted, 3 received, 0% packet loss
fs0:\> tftp 10.0.2.2 hello.txt fs1:\tftp.txt
Downloading hello.txt from 10.0.2.2 ...
20 bytes saved to fs1:\tftp.txt

Boot entries, with bootmgr

• Dry run — shows a change without making it
• Confirmation — asked before changing the boot entries
• Backups — made automatically
• Missing files — checked for

bcfg is there too.

Secure Boot aware

While Secure Boot is active, low-level hardware writes are disabled; reading stays allowed. NESH prints this line when it is active:

Secure Boot is active: low-level hardware writes are disabled.

0.3.0currentOctober 2026

• No more Linux crash at boot — NESH starts in the text mode the firmware set, as the UEFI Shell does. The switch to 100 columns of 0.2.1 also changed the graphics mode on some firmware, and Linux booted from NESH crashed (found on a Chuwi tablet). mode in startup.nsb still chooses another size.
• The cursor shows in edit, in its prompts (Find, Replace, Go to line) and in hexedit: the firmware drew it in an invisible colour.
• New licence — the NESH Freeware Licence; since 10 October 2026 also the PolyForm Noncommercial License 1.0.0, at the user's choice.
• New home — this site, with the downloads and the two manuals, redesigned.

0.2.1September 2026

• 100 columns at start, when the firmware has such a text mode (withdrawn in 0.3.0).
• mode -fill makes the text console use the whole screen.
• A bootable USB image, nesh-usb.img, next to nesh.efi.
• New example scripts: a maintenance menu, and booting one Linux kernel with different options.
• UEFI applications without the .efi extension run too. Licence: Apache 2.0 with the Commons Clause (since 10 October 2026 also the PolyForm Noncommercial License 1.0.0, at the user's choice).

0.2.0September 2026

• Screen resolution — gop 1024 768, gop -max, gop -fit; a change of resolution now lasts.
• Paging — long output stops at every screenful with -- More --; the new more command.
• Help for the language — help NAME also explains BASIC statements and functions.
• Secure Boot tested with test keys; an unsigned image is now reported as refused by Secure Boot.

0.1.0September 2026

• The first release — the shell, with history, Ctrl-R search and Tab completion.
• NESH BASIC scripts, with RUN and RUN$ to drive the commands.
• The UEFI Shell command set, rewritten from scratch, and EFI_SHELL_PROTOCOL 2.2 for UEFI Shell applications.
• bootmgr, the editors, and the network commands on IPv4 and IPv6.