Kernel image 信息

三种文件介绍：

Image: the generic Linux kernel binary image file.

zImage: a compressed version of the Linux kernel image that is self-extracting.

uImage: an image file that has a U-Boot wrapper (installed by the mkimage utility) that includes the OS type and loader information.

 

查看uImage 信息：

#binwalk uImage

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x41C2F835, created: 2020-07-06 12:28:58, image size: 2763304 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x6CD7401D, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.14.17"
16919         0x4217          gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)

从uImage 获取zImage，一般uImage只是在zImage前面加了64bytes的header，所以跳过前64bytes 即是zImage：

dd if=uImage of=zImage skip=64 bs=1

zImage 是一个自解压的image，里面的kernel是压缩后的，需要把完整的kernel 解压出来，上面可以看到是通过gzip压缩的，gzip压缩的特征码是 1F 8B, 通过搜索这个特征码得到压缩后的kernel：

dd if=zImage bs=1 skip=$(LC_ALL=C grep -a -b -o $'\x1f\x8b' zImage | head -n 1 | cut -d ':' -f 1) of=image.gz 

然后将kernel解压出来即可得到kernel image：

gzip -d image.gz

参考信息：

https://stackoverflow.com/questions/9535227/getting-uname-information-from-a-compressed-kernel-image

https://acassis.wordpress.com/2015/06/04/how-to-recover-and-decompress-a-linux-kernel-dumped-mtd-partition/

https://github.com/torvalds/linux/blob/master/scripts/extract-vmlinux