nx_pe_authhash.nx

nx_pe_authhash.nx -- F103e RUNG 1: the Authenticode PE hash. WHY THIS EXISTS (measured 2026-08-08): real EDK2 with Microsoft keys enrolled REFUSES our unsigned EFI application -- `BdsDxe: failed to load Boot0001 ... : Access Denied` -- while the SAME secboot firmware in SETUP mode (no Platform Key) runs it and prints NISHI. So the refusal is the ENROLLED KEY SET, not Secure Boot, and the remedy is to enroll our own key and SIGN the image. Debt 1786237435. Signing starts here, because every later step (SpcIndirectDataContent -> PKCS#7 SignedData -> WIN_CERTIFICATE) carries THIS hash and is worthless if it is wrong. The Authenticode hash is NOT the hash of the file. Three ranges are excluded, because each is written or rewritten AFTER signing and would otherwise invalidate the signature: 1. the OptionalHeader CheckSum (4 bytes @ OPT+64) 2. the Certificate Table data directory (8 bytes @ datadir[4]) -- it points AT the signature 3. the attribute certificate table itself (the appended signature blob) Everything else is hashed: headers up to SizeOfHeaders, then every section's raw data IN ASCENDING PointerToRawData ORDER (file order, NOT section-table order -- they are allowed to differ), then any trailing bytes that are not the certificate table. ★THE ANTI-VACUITY PROBLEM IS THE WHOLE POINT: a trivial "sha256 the whole file" implementation passes every test that mutates .text and fails ONLY on the exclusion ranges. So T1/T2 below mutate INSIDE the excluded fields and demand the hash NOT move -- those are the teeth a wrong implementation cannot pass, and they are the reason this organ is not just a call to sha256_digest. There is no external Authenticode oracle on this host (sbsign/pesign/osslsigncode all MEASURED MISSING), so the teeth ARE the specification, stated as properties rather than a golden vector. ⚠That is a REAL limit and it is named, not hidden: this proves the exclusion semantics and determinism; it does NOT prove byte-agreement with Microsoft's implementation. A golden vector from a signed EFI binary is the next tooth to add when one is obtainable. Usage: nx_pe_authhash <file> -> "<64 hex> <path>" exit 0 nx_pe_authhash selftest -> property teeth exit 0 GREEN / 1 RED Exit: 0 ok | 1 RED | 2 refused (not a PE we can hash) | 3 UNPROVEN (cannot read input) Log -> knowledge/status/nishi_os.log, canonical verdict= LAST (positional anchor). Sovereign: syscalls only, no openssl/sbsign. license_tier: ORIGINAL