5

jor1k ships a vmlinux.bin. I think there is an initrd inside, cause I don't know where else it would be. I am trying to extract the filesystem image so I can change it, but I don't know how to.

I tried using extract-vmlinux from the Linux source distribution, but it Cannot find vmlinux.

Janus Troelsen
  • 1,463
  • 1
  • 15
  • 27

2 Answers2

8

You can look for the cpio newc header (starting with 0707010):

$ grep -abo 0707010 vmlinux.bin | head -n1
2531404:0707010

The -a (for all files even binary ones), -b (for byte offset), and -o (for only the matching part (and report the byte offset of the matching part instead of the line containing the matching part)) are non-standard GNU extensions to grep but are handy to find out where a given string is to be found in a file (contrary to many other grep implementations, GNU grep also supports non-text files (that is, that may contain 0 byte values may have arbitrarily long sequence of bytes between two LF characters, may not end in a LF characters or may contain bytes or sequences of bytes that don't make valid characters in the current locale) which is a requirement in that regard.

$ tail -c +2531405 vmlinux.bin| cpio -t | head
bin
bin/sleep
bin/kill
bin/watch
bin/deluser
bin/getopt
bin/uname
bin/nice
bin/zcat
bin/cpio

(grep -b offsets start at 0, while tail -c ones start at 1).

Stéphane Chazelas
  • 522,931
  • 91
  • 1,010
  • 1,501
  • Thanks! I was searching for ext2 headers (0xEF53) manually, but I got false positives. Tried flipping the byte order, got other false positives. That demotivated me. Surprising how extract-vmlinux can't find CPIO initramfs'es, but I'm sure there is an explanation. – Janus Troelsen Apr 29 '13 at 07:42
  • this trick doesn't work anymore, do you know why? – Janus Troelsen Dec 31 '14 at 14:24
  • 1
    @JanusTroelsen Late to the party, but here goes: If your cpio Archive is gzip'ed, you have to search for 0x1f8b first (magic bytes of gzip) and `zcat` the result into `cpio -t` instead. Grepping for gzip: `grep -aob $'\x1f\x8b' `. Also note that the CPIO might be within initramfs, which might also be gziped. If so, you have to search for gzip twice! – evnu Jun 19 '15 at 09:24
-3

The first step is file vmlinux.bin.

Sorry, but "vmlinux.bin: data" usually means so much for this. If file doesn't recognize a file then the standard utilities will not be able to help you.

But from reading the download page it seems that this is the OpenRISC 1000 version of the Linux kernel. Thus it makes perfect sense that file does not recognize it.

I don't know OpenRISC 1000 but I guess that in such a special case there is no need for an initrd.

Stéphane Chazelas
  • 522,931
  • 91
  • 1,010
  • 1,501
Hauke Laging
  • 88,146
  • 18
  • 125
  • 174