linux-kernel - Re: Initramfs from existing vmlinuz

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081223233410.GC6800@1wt.eu>
Date:	Wed, 24 Dec 2008 00:34:10 +0100
From:	Willy Tarreau <w@....eu>
To:	Martin Schlemmer <Martin.Schlemmer@....ac.za>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Initramfs from existing vmlinuz

On Wed, Dec 24, 2008 at 12:28:53AM +0200, Martin Schlemmer wrote:
> Hi
> 
> I had a bit of an accident, and wondered if somebody already had to try to extract the initramfs image from an existing vmlinuz?
> 
>  I did try google, but either my search terms was not right, or nobody really touched on the subject before, because all the results mostly dealt with an external image.
> 
> Any advice will be appreciated.

yes, it happens to me from time to time.
You first have to extract and uncompress the ELF image from vmlinuz. For
this, look for the gzip signature 1F 8B 08 in your vmlinuz, and feed all
data starting from this point to zcat. Either you do the same on the
resulting file -and you may find several compressed images- or you simply
pass it through "objdump -h". It will show you a .init.ramfs section. Use
the fourth field as the file offset, and dump from that position. You'll
find your initramfs, likely starting with 1F 8B 08 since it's supposed
to be compressed with gzip.

You need an hex editor, dd, zcat and objdump for this. It's not much
complicated once you have the tools, but it might require a few attempts
before finding the right image (I tend to find config.gz before initramfs).

Regards,
Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/