+<li>Boot the computer. As with shim, this can be a challenge; you may need
+ to boot with Secure Boot disabled, use a Secure Boot–enabled live
+ CD, or do the installation from Windows.</li>
+
+<li><a href="getting.html">Download rEFInd</a> in binary form (the binary
+ zip or CD-R image file). If you download the binary zip file, unzip it;
+ if you get the CD-R image file, burn it to a CD-R and mount it.</li>
+
+<li>Download PreLoader from <a
+ href="http://blog.hansenpartnership.com/linux-foundation-secure-boot-system-released/">its
+ release page</a> or by clicking the following links. Be sure to get
+ both the <tt><a
+ href="http://blog.hansenpartnership.com/wp-uploads/2013/PreLoader.efi">PreLoader.efi</a></tt>
+ and <tt><a
+ href="http://blog.hansenpartnership.com/wp-uploads/2013/HashTool.efi">HashTool.efi</a></tt>
+ files.</li>
+
+<li>Copy the <tt>PreLoader.efi</tt> and <tt>HashTool.efi</tt> binaries to
+ the directory you intend to use for rEFInd—for instance,
+ <tt>EFI/refind</tt> on the ESP.</li>
+
+<li>Follow the installation instructions for rEFInd on the <a
+ href="installing.html">Installing rEFInd</a> page; however, give rEFInd
+ the filename <tt>loader.efi</tt> and register <tt>PreLoader.efi</tt>
+ with the EFI by using <tt>efibootmgr</tt> in Linux or <tt>bcdedit</tt>
+ in Windows. Be sure that rEFInd (as <tt>loader.efi</tt>),
+ <tt>PreLoader.efi</tt>, and <tt>HashTool.efi</tt> all reside in the
+ same directory.</li>
+
+<li>Reboot. With any luck, you'll see HashTool appear with a warning
+ message stating that it was unable to launch <tt>loader.efi</tt> and
+ declaring that it will launch <tt>HashTool.efi</tt>. Press the Enter
+ key to continue.</li>
+
+<li>HashTool should now appear. It should give you three or four options,
+ including <tt>Enroll Hash</tt>, as shown here. Select this option</li>
+
+ <br /><img src="HashTool1.png" align="CENTER" width="641" height="459"
+ alt="HashTool provide a somewhat nicer user interface than
+ MokManager's." border=2> <br />
+
+<li>You can now select the binary you want to authorize. You should first
+ select <tt>loader.efi</tt>, since that's rEFInd. The program presents
+ the hash (a very long number) and asks for confirmation. Be sure to
+ select <tt>Yes</tt>.</li>
+
+ <br /><img src="HashTool2.png" align="CENTER" width="638" height="455"
+ alt="Be sure to select the right binary when you enroll its hash."
+ border=2> <br />
+
+<p class="sidebar"><b>Note:</b> Unfortunately, HashTool's file selector can't change filesystems. Thus, if you want to boot a Linux kernel using rEFInd and PreLoader, you'll need to copy the kernel to the ESP, at least temporarily. Alternatively, as noted earlier, you can copy <tt>HashTool.efi</tt> to the directory that holds the kernels or to another directory on that partition that rEFInd scans—but be sure to rename <tt>HashTool.efi</tt> or rEFInd will ignore it. You'll then see a boot loader entry for HashTool.</p>
+
+<li>Repeat the preceding two steps for any additional binaries you might
+ want to enroll. These include any EFI filesystem drivers you're using,
+ any boot loaders you're launching from rEFInd (other than those that
+ are already signed, such as Microsoft's boot loader), and possibly your
+ Linux kernel.</li>
+
+<li>At the HashTool main menu, select <tt>Exit</tt>. rEFInd should
+ launch.</li>