linux-kernel - Re: [PATCH] scripts: add extract-vmlinux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 11 Aug 2011 13:28:21 +0200
From:	Paul Bolle <pebolle@...cali.nl>
To:	Corentin Chary <corentin.chary@...il.com>
Cc:	linux-kernel@...r.kernel.org, Michal Marek <mmarek@...e.cz>,
	Dick Streefland <dick@...eefland.net>,
	WANG Cong <xiyou.wangcong@...il.com>
Subject: Re: [PATCH] scripts: add extract-vmlinux

On Thu, 2011-08-11 at 10:53 +0200, Corentin Chary wrote:
> This script can be used to extract vmlinux from a compressed
> kernel image (bzImage, etc..). It's inspired from (a subset of)
> extract-ikconfig.

This is more specific than what this scripts actually does, isn't it? At
least when I tried to read this script my impression is that it does two
things:
- check whether the input file is a valid ELF file;
- if not; try to find a compressed ELF file somewhere in the input file.

There's no checking whether the input file is a kernel image and there's
no checking whether the found ELF file actually is was a, well, vmlinux.
Both checks are perhaps far from trivial. Anyhow, if that's correct this
should be made more clear. Perhaps the script should even be called
something like extract-elf.

> It's something a lot of people have been looking for (mainly
> people with xen < 4 that doesn't support bzImages at all).
> 
> Signed-off-by: Corentin Chary <corentin.chary@...il.com>
> [...]
> +try_decompress()
> +{
> +	for	pos in `tr "$1\n$2" "\n$2=" < "$img" | grep -abo "^$2"`
> +	do
> +		pos=${pos%%:*}
> +		tail -c+$pos "$img" | $3 > $tmp 2> /dev/null

Perhaps a few comments on the above lines would be nice. Without those
comments I must guess you're finding compressed data somewhere in the
input file. It also seems you're looping through the entire input file.
Or are (sequences of) commands like the above considered obvious?

> +		check_elf $tmp
> +	done
> +}
> +
> [...]
> +# Initial attempt for uncompressed images or objects:
> +check_elf $img
> +
> +# That didn't work, so retry after decompression.
> +try_decompress '\037\213\010' xy    gunzip
> +try_decompress '\3757zXZ\000' abcde unxz
> +try_decompress 'BZh'          xy    bunzip2
> +try_decompress '\135\0\0\0'   xxx   unlzma
> +try_decompress '\211\114\132' xy    'lzop -d'

Perhaps you could first test whether these commands are available before
running try_decompress() with them?


Paul Bolle

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/