Linux Kernel – How to Extract Filesystem Image from vmlinux.bin

archivelinux-kernel

jor1k ships a vmlinux.bin. I think there is an initrd inside, cause I don't know where else it would be. I am trying to extract the filesystem image so I can change it, but I don't know how to.

I tried using extract-vmlinux from the Linux source distribution, but it Cannot find vmlinux.

Best Answer

You can look for the cpio newc header (starting with 0707010):

$ grep -abo 0707010 vmlinux.bin | head -n1
2531404:0707010

The -a (for all files even binary ones), -b (for byte offset), and -o (for only the matching part (and report the byte offset of the matching part instead of the line containing the matching part)) are non-standard GNU extensions to grep but are handy to find out where a given string is to be found in a file (contrary to many other grep implementations, GNU grep also supports non-text files (that is, that may contain 0 byte values may have arbitrarily long sequence of bytes between two LF characters, may not end in a LF characters or may contain bytes or sequences of bytes that don't make valid characters in the current locale) which is a requirement in that regard.

$ tail -c +2531405 vmlinux.bin| cpio -t | head
bin
bin/sleep
bin/kill
bin/watch
bin/deluser
bin/getopt
bin/uname
bin/nice
bin/zcat
bin/cpio

(grep -b offsets start at 0, while tail -c ones start at 1).

Related Question