Re: Initramfs from existing vmlinuz

["Martin Schlemmer" <Martin.Schlemmer@nwu.ac.za>]

[-- Attachment #1: Type: text/plain, Size: 1688 bytes --]

>>> On 2008/12/24 at 01:37 PM, "Martin Schlemmer" <Martin.Schlemmer@nwu.ac.za>
wrote:
>>>> On 2008/12/24 at 01:34 AM, Willy Tarreau <w@1wt.eu> wrote:
>> On Wed, Dec 24, 2008 at 12:28:53AM +0200, Martin Schlemmer wrote:
 
Hi
 
>>> I had a bit of an accident, and wondered if somebody already had to try to 
>> extract the initramfs image from an existing vmlinuz?
>>> 
>>>  I did try google, but either my search terms was not right, or nobody 
>> really touched on the subject before, because all the results mostly dealt 
>> with an external image.
>>> 
>>> Any advice will be appreciated.
>> 
>> yes, it happens to me from time to time.
>> You first have to extract and uncompress the ELF image from vmlinuz. For
>> this, look for the gzip signature 1F 8B 08 in your vmlinuz, and feed all
>> data starting from this point to zcat. Either you do the same on the
>> resulting file -and you may find several compressed images- or you simply
>> pass it through "objdump -h". It will show you a .init.ramfs section. Use
>> the fourth field as the file offset, and dump from that position. You'll
>> find your initramfs, likely starting with 1F 8B 08 since it's supposed
>> to be compressed with gzip.
>> 
>> You need an hex editor, dd, zcat and objdump for this. It's not much
>> complicated once you have the tools, but it might require a few attempts
>> before finding the right image (I tend to find config.gz before initramfs).
>> 
> 
> Appreciated, I should be able to go from here now - just getting the starting 
> point is sometimes the main issue.
> 

Simple Perl script to do above in case anybody might find it useful in the future.


M



[-- Attachment #2: extract_initramfs.pl --]
[-- Type: application/octet-stream, Size: 2103 bytes --]

#!/usr/bin/perl
#
# extract_initramfs.pl: extracts the initramfs out of a packed kernel image
#
# Copyright (C) Martin Schlemmer <azarah@nosferatu.za.org>
#
# Released under the terms of the GNU GPL
#

use strict;
use warnings;

use Cwd;
use Encode;
use IO::File;
use IO::Pipe;
use IO::Uncompress::Gunzip qw (gunzip $GunzipError);

if (! defined ($ARGV[0]) && ! defined ($ARGV[1])) {
	print "usage: $0 VMLINUZ [VMLINUX] [INITRAMFS_IMAGE]\n";
	exit (1);
}

if (! -f $ARGV[0]) {
	print "$ARGV[0] does not exists\n";
	exit (1);
}

my ($input,$vm_output,$rm_output) = @ARGV;

$vm_output = cwd . '/vmlinux',
	if (! defined ($vm_output) || $vm_output eq '');
$rm_output = cwd . '/initramfs.cpio.gz',
	if (! defined ($rm_output) || $rm_output eq '');

eval {
	my $fh = IO::File->new;

	$fh->open ($ARGV[0]) or die ($!);
	$fh->binmode;

	my $data;
	my $count = 0;

	do {
		$data = '';

		$fh->seek ($count++, 0) or die ($!);
		$fh->read ($data, 3) or die ($!);

	} until ($data =~ /^\x{1F}\x{8B}\x{08}$/ || $fh->eof);

	if ($data !~ /^\x{1F}\x{8B}\x{08}$/ || $fh->eof) {
		print STDERR "Could not find GZIP marker!\n";
		exit (1);
	}

	$fh->seek (--$count, 0) or die ($!);

	$data = '';

	while (! $fh->eof) {
		my $buffer;

		$fh->read ($buffer, 2048) or die ($!);
		$data .= $buffer;
	}
	$fh->close;

	my $image;

	gunzip \$data => \$image,
        or die ("Gunzip failed: $GunzipError\n");

	$fh->open ($vm_output, '>') or die ($!);
	$fh->binmode;
	$fh->write ($image) or die ($!);
	$fh->close;

	my $have_ramfs = 0;
	my $pipe = IO::Pipe->new or die ($!);

	$pipe->reader ('objdump', '-h', $vm_output) or die ($!);

	while (my $line = $pipe->getline) {
		if ($line =~ /^\s+\d+\s+(\S+)\s+(\S+)\s+\S+\s+\S+\s+(\S+)\s+/) {
			my ($section,$size,$offset) = ($1,$2,$3);

			next if ($section ne '.init.ramfs');

			$fh->open ($rm_output, '>') or die ($!);
			$fh->write ($image, hex ($size), hex ($offset)) or die ($!);
			$fh->close;

			$have_ramfs = 1;

			last;
		}
	}

	$pipe->close;

	die ('No \'.init.ramfs\' section found!') if (! $have_ramfs);
};
if ($@) {
	printf STDERR "$@\n";
	exit (1);
}

exit (0);