verify_pefile_signature(9)
π verify_pefile_signature(9) π
okay so this is a page from the Kernel API Manual, bestie, and it's all about verify_pefile_signature β literally the vibe check for PE binary signatures π¦
β¨ NAME β¨
verify_pefile_signature β Verify the signature on a PE binary image π₯
π SYNOPSIS π
int verify_pefile_signature (const void *pebuf , unsigned pelen , struct
key *trusted_keys , enum key_being_used_for usage );
πΈ ARGUMENTS πΈ
pebufβ Buffer containing the PE binary image. this is the whole entire thing we're checking, no cap πpelenβ Length of the binary image. how many bytes ofpebufwe're actually looking at β¨trusted_keysβ Signing certificate(s) to use as starting points. like, these are the keys we already trust, our little starter pack π«Άusageβ The use to which the key is being put. iykyk, it tells the kernel what this key is for π
π DESCRIPTION π
So what this does is: validate that the certificate chain inside the PKCS#7 message inside the PE binary image intersects keys we already know and trust. intersecting chains, main character energy honestly π
Returns, in order of descending priority β and yes the order MATTERS, like don't @ me:
-ELIBBADif the image cannot be parsed, or:-EKEYREJECTEDif a signature failed to match for which we have a valid key, or:0if at least one signature chain intersects with the keys in the trust keyring, or:-ENODATAif there is no signature present.-ENOPKGif a suitable crypto module couldn't be found for a check on a chain.-ENOKEYif we couldn't find a match for any of the signature chains in the message.
May also return -ENOMEM. π yeah. memory said no.
bestie heads up: that return list is a priority order, so read it top to bottom before you go assuming anything π
π¦ SEE ALSO π¦
- Kernel file
./crypto/asymmetric_keys/verify_pefile.cβ go read the source, it ate π
and that's the whole page, bestie! π this one lives in ./crypto/asymmetric_keys and the version/date stamp on it is October 2026 β so yeah, she's from the future, iconic behavior honestly π§βπ
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms