VBUTIL_KERNEL(1)

💖 NAME 💖

okay so welcome to VBUTIL_KERNEL(1), bestie 💅 this is the manual page for vbutil_kernel, and it lives in the User Commands part of the manual. what it does: it's the utility that signs your custom kernels so they can boot on Chrome OS devices. that's the whole vibe. 🔥

---

✨ SYNOPSIS ✨

futility /usr/bin/vbutil_kernel --pack <file> [PARAMETERS]

---

🎀 DESCRIPTION 🎀

so there's like, four modes, and each one has its own little list of stuff you gotta give it. let's go, one at a time 🦋

🍓 --pack <file>

Required parameters — these are not optional, they are the moment, periodt:

• --keyblock <file> — the key block, in .keyblock format 🔑
• --signprivate <file> — the private key that signs the kernel data, in .vbprivk format
• --version <number> — kernel version
• --vmlinuz <file> — the Linux kernel bzImage file
• --bootloader <file> — bootloader stub
• --config <file> — command line file
• --arch <arch> — CPU architecture (and it defaults to x86)

Optional — the little extras that just hit different ✨

• --kloadaddr <address> — assign the kernel body load address
• --pad <number> — verification padding size in bytes
• --vblockonly — emit just the verification blob
• --flags NUM — flags to be passed in the header

OR 💀

🧚 --repack <file>

usage line:

futility /usr/bin/vbutil_kernel --repack <file> [PARAMETERS]

Required parameters:

• --signprivate <file> — the private key that signs the kernel data, in .vbprivk format
• --oldblob <file> — a previously packed kernel blob (verification blob included, obviously)

Optional:

• --keyblock <file> — the key block, in .keyblock format
• --config <file> — a new command line file
• --version <number> — kernel version
• --kloadaddr <address> — assign the kernel body load address
• --pad <number> — verification blob size in bytes
• --vblockonly — emit just the verification blob

OR 🌈

🔍 --verify <file>

usage line:

futility /usr/bin/vbutil_kernel --verify <file> [PARAMETERS]

Optional:

• --signpubkey <file> — the public key used to verify the kernel keyblock, in .vbpubk format
• --verbose — print a more detailed report 👀
• --keyblock <file> — outputs the verified key block, in .keyblock format
• --pad <number> — verification padding size in bytes
• --minversion <number> — minimum combined kernel key version

OR 🌸

🫶 --get-vmlinuz <file>

usage line (and yes it wraps, that's just how it is):

futility /usr/bin/vbutil_kernel --get-vmlinuz <file>
[PARAMETERS]

Required parameters:

• --vmlinuz-out <file> — vmlinuz image output file

---

okay and now, because this page said it once and then said it again, here's the whole thing over again — same facts, same energy, a rerun nobody asked for but everyone is getting 🙈

🍓 --pack <file>

futility /usr/bin/vbutil_kernel --pack <file> [PARAMETERS]

Required parameters:

• --keyblock <file> — the key block, in .keyblock format
• --signprivate <file> — the private key that signs the kernel data, in .vbprivk format
• --version <number> — kernel version
• --vmlinuz <file> — the Linux kernel bzImage file
• --bootloader <file> — bootloader stub
• --config <file> — command line file
• --arch <arch> — CPU architecture (defaults to x86)

Optional:

• --kloadaddr <address> — assign the kernel body load address
• --pad <number> — verification padding size in bytes
• --vblockonly — emit just the verification blob
• --flags NUM — flags to be passed in the header

OR 💅

🧚 --repack <file>

futility /usr/bin/vbutil_kernel --repack <file> [PARAMETERS]

Required parameters:

• --signprivate <file> — the private key that signs the kernel data, in .vbprivk format
• --oldblob <file> — a previously packed kernel blob (verification blob included)

Optional:

• --keyblock <file> — the key block, in .keyblock format
• --config <file> — a new command line file
• --version <number> — kernel version
• --kloadaddr <address> — assign the kernel body load address
• --pad <number> — verification blob size in bytes
• --vblockonly — emit just the verification blob

OR ⭐

🔍 --verify <file>

futility /usr/bin/vbutil_kernel --verify <file> [PARAMETERS]

Optional:

• --signpubkey <file> — the public key used to verify the kernel keyblock, in .vbpubk format
• --verbose — print a more detailed report
• --keyblock <file> — outputs the verified key block, in .keyblock format
• --pad <number> — verification padding size in bytes
• --minversion <number> — minimum combined kernel key version

OR 💜

🫶 --get-vmlinuz <file>

futility /usr/bin/vbutil_kernel --get-vmlinuz <file>
[PARAMETERS]

Required parameters:

• --vmlinuz-out <file> — vmlinuz image output file

---

lowkey important: --vblockonly means you get just the verification blob, not the whole thing. do not be surprised when the rest is not there, bestie 😭

---

and that's the page!! 🌈 this was vbutil_kernel, from May 2016, sitting pretty under VBUTIL_KERNEL(1) in the User Commands section. mwah, go sign something iconic 💖🎀👑