分析利器(binwalk)，针对新类型initrd进行解压

新型的initrd的解压方法
（以下内容转自：https://blog.csdn.net/xiaofeng_yan/article/details/83303544 ，特别感谢该博主，转发此博客，供大家学习进步）
安装：
apt-get install binwalk
若是安装不上，需要更新/etc/apt/source.list
$ file …/initrd.img
…/initrd.img: ASCII cpio archive (SVR4 with no CRC)

#cpio -idvm < …/initrd.img
kernel
kernel/x86
kernel/x86/microcode
kernel/x86/microcode/.enuineIntel.align.0123456789abc
kernel/x86/microcode/GenuineIntel.bin
4712 块

奇怪，没有根文件的目录和文件，只有一个微码的文件。通过Google了解，目前的initrd方式有了变化。通过反复的验证，正确的步骤如下：
步骤一：可以通过lsinitramfs命名来查看initrd含有的文件
#lsinitramfs …/initrd.img
kernel
kernel/x86
kernel/x86/microcode
kernel/x86/microcode/.enuineIntel.align.0123456789abc
kernel/x86/microcode/GenuineIntel.bin
.
lib64
lib64/ld-linux-x86-64.so.2
sbin
sbin/rmmod
sbin/blockdev
sbin/dmsetup
sbin/losetup
sbin/mount.fuse
sbin/cryptsetup
sbin/lvm
sbin/mount.ntfs-3g
sbin/modprobe
sbin/udevadm
sbin/mount.ntfs
sbin/mount.cifs
sbin/vgchange
sbin/mdmon
sbin/blkid
sbin/iscsistart
sbin/mdadm
lib
lib/modules
lib/modules/4.19.0-0.bpo.5-amd64
lib/modules/4.19.0-0.bpo.5-amd64/modules.softdep
lib/modules/4.19.0-0.bpo.5-amd64/modules.builtin
lib/modules/4.19.0-0.bpo.5-amd64/modules.alias
lib/modules/4.19.0-0.bpo.5-amd64/kernel
lib/modules/4.19.0-0.bpo.5-amd64/kernel/crypto
lib/modules/4.19.0-0.bpo.5-amd64/kernel/crypto/cryptd.ko
lib/modules/4.19.0-0.bpo.5-amd64/kernel/crypto/ccm.ko
lib/modules/4.19.0-0.bpo.5-amd64/kernel/crypto/crc32c_generic.ko
lib/modules/4.19.0-0.bpo.5-amd64/kernel/crypto/cbc.ko
lib/modules/4.19.0-0.bpo.5-amd64/kernel/crypto/crypto_simd.ko
…

binwalk …/initrd.img

DECIMAL HEXADECIMAL DESCRIPTION

0 0x0 ASCII cpio archive (SVR4 with no CRC), file name: “kernel”, file name length: “0x00000007”, file size: “0x00000000”
120 0x78 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86”, file name length: “0x0000000B”, file size: “0x00000000”
244 0xF4 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86/microcode”, file name length: “0x00000015”, file size: “0x00000000”
376 0x178 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86/microcode/.enuineIntel.align.0123456789abc”, file name length: “0x00000036”, file size: “0x00000000”
540 0x21C ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86/microcode/GenuineIntel.bin”, file name length: “0x00000026”, file size: “0x0024CC00”
2412208 0x24CEB0 ASCII cpio archive (SVR4 with no CRC), file name: “TRAILER!!!”, file name length: “0x0000000B”, file size: “0x00000000”
2412544 0x24D000 gzip compressed data, from Unix, last modified: 2019-08-24 08:48:57
29169100 0x1BD15CC Broadcom header, number of sections: 1789150184,

通过binwalk能够看到“ gzip compressed data,”的字段，说明从2412544 字节段开始是gzip压缩的格式。从这开始是根文件系统。之前的microcode的文件。说明是microcode文件和根文件是压缩到一起的文件

#binwalk -y gzip …/initrd.img

DECIMAL HEXADECIMAL DESCRIPTION

2412544 0x24D000 gzip compressed data, from Unix, last modified: 2019-08-24 08:48:57
这里有个数字“2412544 ”,下面开始解压文件
$dd if=…/initrd.img bs=2412544 skip=1 | zcat | cpio -id --no-absolute-filenames -v
#ls
bin conf etc init lib lib64 run sbin scripts

这里有个注意的地方，如果binwalk显示不都是gzip格式的。比如：
$ binwalk /mnt/casper/initrd
（binwalk工具https://github.com/ReFirmLabs/binwalk）
DECIMAL HEXADECIMAL DESCRIPTION

0 0x0 ASCII cpio archive (SVR4 with no CRC), file name: “.”, file name length: “0x00000002”, file size: “0x00000000”
112 0x70 ASCII cpio archive (SVR4 with no CRC), file name: “kernel”, file name length: “0x00000007”, file size: “0x00000000”
232 0xE8 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86”, file name length: “0x0000000B”, file size: “0x00000000”
356 0x164 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86/microcode”, file name length: “0x00000015”, file size: “0x00000000”
488 0x1E8 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86/microcode/AuthenticAMD.bin”, file name length: “0x00000026”, file size: “0x00006B2A”
28072 0x6DA8 ASCII cpio archive (SVR4 with no CRC), file name: “TRAILER!!!”, file name length: “0x0000000B”, file size: “0x00000000”
28672 0x7000 ASCII cpio archive (SVR4 with no CRC), file name: “kernel”, file name length: “0x00000007”, file size: “0x00000000”
28792 0x7078 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86”, file name length: “0x0000000B”, file size: “0x00000000”
28916 0x70F4 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86/microcode”, file name length: “0x00000015”, file size: “0x00000000”
29048 0x7178 ASCII cpio archive (SVR4 with no CRC), file name: “kernel/x86/microcode/GenuineIntel.bin”, file name length: “0x0000002A”, file size: “0x00170C00”
1539600 0x177E10 ASCII cpio archive (SVR4 with no CRC), file name: “TRAILER!!!”, file name length: “0x0000000B”, file size: “0x00000000”
1540096 0x178000 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes

这个initrd使用lzma压缩的。那么解压时候就不能用zcat命令了。应该使用如下命令：
dd if=/mnt/casper/initrd bs=1540096 skip=1 | lzcat | cpio -id --no-absolute-filenames -v
lzcat=xz --format=lzma --decompress --stdout（参见https://www.computerhope.com/unix/xz.htm）
至此，解压结束。
如何重新压缩回去呢？参见：https://askubuntu.com/questions/777260/how-to-repack-initrd-img
find kernel/ | cpio -o -H newc > new_initrd.img
cd rootfs
find . | cpio -o | gzip -9 >> …/new_initrd.img