verify_pefile_signature(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

πŸ‘‘ verify_pefile_signature(9) πŸ’…

okay so this is a page from the Kernel API Manual, bestie, and it's all about verify_pefile_signature β€” literally the vibe check for PE binary signatures πŸ¦‹


✨ NAME ✨

verify_pefile_signature β€” Verify the signature on a PE binary image πŸ”₯

πŸŽ€ SYNOPSIS πŸŽ€

int verify_pefile_signature (const void *pebuf , unsigned pelen , struct
key *trusted_keys , enum key_being_used_for usage );

🌸 ARGUMENTS 🌸

  • pebuf β€” Buffer containing the PE binary image. this is the whole entire thing we're checking, no cap πŸ’–
  • pelen β€” Length of the binary image. how many bytes of pebuf we're actually looking at ✨
  • trusted_keys β€” Signing certificate(s) to use as starting points. like, these are the keys we already trust, our little starter pack 🫢
  • usage β€” The use to which the key is being put. iykyk, it tells the kernel what this key is for πŸ‘‘

πŸ’œ DESCRIPTION πŸ’œ

So what this does is: validate that the certificate chain inside the PKCS#7 message inside the PE binary image intersects keys we already know and trust. intersecting chains, main character energy honestly 🌈

Returns, in order of descending priority β€” and yes the order MATTERS, like don't @ me:

  • -ELIBBAD if the image cannot be parsed, or:
  • -EKEYREJECTED if a signature failed to match for which we have a valid key, or:
  • 0 if at least one signature chain intersects with the keys in the trust keyring, or:
  • -ENODATA if there is no signature present.
  • -ENOPKG if a suitable crypto module couldn't be found for a check on a chain.
  • -ENOKEY if we couldn't find a match for any of the signature chains in the message.

May also return -ENOMEM. 😭 yeah. memory said no.

bestie heads up: that return list is a priority order, so read it top to bottom before you go assuming anything πŸ’€

πŸ¦‹ SEE ALSO πŸ¦‹

  • Kernel file ./crypto/asymmetric_keys/verify_pefile.c β€” go read the source, it ate πŸ’…

and that's the whole page, bestie! πŸ“ this one lives in ./crypto/asymmetric_keys and the version/date stamp on it is October 2026 β€” so yeah, she's from the future, iconic behavior honestly πŸ§šβ­πŸ’–

πŸ“¦ where this page comes from