Information About Kernel Image

Information About Kernel Image

Post by Quan » Mon, 18 Mar 2002 16:07:06



Given the kernel image /boot/vmlinuz-2.4.8mdk or something similiar,
how do you get information about the image such as:
  o The release string, for example (2.4.8-26mdk)
  o The date/time when the kernel was build
  o etc...

Thanks,
Quang

 
 
 

Information About Kernel Image

Post by Quan » Mon, 18 Mar 2002 16:54:23



> Given the kernel image /boot/vmlinuz-2.4.8mdk or something similiar,
> how do you get information about the image such as:
>   o The release string, for example (2.4.8-26mdk)
>   o The date/time when the kernel was build
>   o etc...

> Thanks,
> Quang

Well, shortly after I posted the article I od'ed the kernel images I have
and found that the info I need is at the offset 0xA2A of the image.  But
can I depend on this?

Here's the little prg I wrote for the test:

Quote:> #include <stdio.h>
> #include <sys/stat.h>
> #include <sys/types.h>
> #include <fcntl.h>
> #include <unistd.h>

> int main(int argc, char **argv)
>       {
>       int fd;
>       off_t off;
>       char info[1024];

>       /*---------------------------------------------------------------------
>        * Check the args
>        *-------------------------------------------------------------------*/
>       if (argc < 2) {
>               printf("Usage: %s <kernel_image> \n", argv[0]);
>               return 0;
>       }

>       /*---------------------------------------------------------------------
>        * Open the kernel image
>        *-------------------------------------------------------------------*/
>       if ((fd = open(argv[1], O_RDONLY)) < 0) {
>               perror("open");
>               exit(1);
>       }

>       /*---------------------------------------------------------------------
>        * Seek to info we need
>        *-------------------------------------------------------------------*/
>       if ((off = lseek(fd, 0xA2A, SEEK_SET)) < 0) {
>               perror("lseek");
>               exit(1);
>       }

>       /*---------------------------------------------------------------------
>        * Read the info
>        *-------------------------------------------------------------------*/
>       if (read(fd, info, sizeof(info)) < 0) {
>               perror("read");
>               exit(1);
>       }

>       /*---------------------------------------------------------------------
>        * Print the info
>        *-------------------------------------------------------------------*/
>       printf("Info = %s\n", info);
>       close(fd);
>       return 0;
>       }


 
 
 

Information About Kernel Image

Post by Michael Muelle » Tue, 19 Mar 2002 00:35:20


Hi Quang,


> > Given the kernel image /boot/vmlinuz-2.4.8mdk or something similiar,
> > how do you get information about the image such as:
> >   o The release string, for example (2.4.8-26mdk)
> >   o The date/time when the kernel was build
> >   o etc...

> > Thanks,
> > Quang

> Well, shortly after I posted the article I od'ed the kernel images I have
> and found that the info I need is at the offset 0xA2A of the image.  But
> can I depend on this?

No, you can not rely on this. With kernel 2.2.x or 2.5.x the setup code
is different and due the information is found somewhere else.
Additionally your method as the one described here works for the i386
architecture only.

Within the setup code (setup.S) of each version you find a data area at
offset 2 (offset 0x202 of the kernel image):

:    .ascii  "HdrS"          # header signature
:    .word   0x0203          # header version number (>= 0x0105)
:                            # or else old loadlin-1.5 will fail)

Check atleast for the signature above.

: realmode_swtch:
:    .word   0, 0            # default_switch, SETUPSEG
: start_sys_seg:
:    .word   SYSSEG
:    .word   kernel_version  # pointing to kernel version string
:                            # above section of header is compatible
:                            # with loadlin-1.5 (header v1.5). Don't
:                            # change it.

Last of the above is an interesting one. The value can be found at
offset 0x20e of the kernel image. Add 0x200 to the word value from there
and you have the position of the string you already found.

It is still left to you to parse this string in order to extract the
information. Some examples of the string (without leading ": "):


2001

Michael

 
 
 

Information About Kernel Image

Post by Quan » Tue, 19 Mar 2002 08:00:57



> : realmode_swtch:
> :    .word   0, 0            # default_switch, SETUPSEG
> : start_sys_seg:
> :    .word   SYSSEG
> :    .word   kernel_version  # pointing to kernel version string
> :                            # above section of header is compatible
> :                            # with loadlin-1.5 (header v1.5). Don't
> :                            # change it.

> Last of the above is an interesting one. The value can be found at
> offset 0x20e of the kernel image. Add 0x200 to the word value from there
> and you have the position of the string you already found.

So what do we have in term of algorithm?  I'm confused.   Could you write
some pseudo code to describe your idea?

Thanks,
Quang

 
 
 

Information About Kernel Image

Post by Eric P. McC » Tue, 19 Mar 2002 08:08:59




> > : realmode_swtch:
> > :    .word   0, 0            # default_switch, SETUPSEG
> > : start_sys_seg:
> > :    .word   SYSSEG
> > :    .word   kernel_version  # pointing to kernel version string
> > :                            # above section of header is compatible
> > :                            # with loadlin-1.5 (header v1.5). Don't
> > :                            # change it.

> > Last of the above is an interesting one. The value can be found at
> > offset 0x20e of the kernel image. Add 0x200 to the word value from there
> > and you have the position of the string you already found.
> So what do we have in term of algorithm?  I'm confused.   Could you write
> some pseudo code to describe your idea?

What part don't you understand?

  1. open("/vmlinuz");
  2. lseek(0x20e);
  3. read(&offset, 2);
  4. offset += 0x200;
  5. lseek(offset);
  6. read(&kernel_version_string, ...);

Hell, I was able to construct that much just from what you quoted.

--

"I woke up this morning and realized what the game needed: pirates,
pimps, and gay furries."  - Rich "Lowtax" Kyanka

 
 
 

Information About Kernel Image

Post by Quan » Tue, 19 Mar 2002 09:56:34


What part don't you understand?

Quote:

>   1. open("/vmlinuz");
>   2. lseek(0x20e);
>   3. read(&offset, 2);
>   4. offset += 0x200;
>   5. lseek(offset);
>   6. read(&kernel_version_string, ...);

> Hell, I was able to construct that much just from what you quoted.

Exactly just that...  After reading over and over a number of times I
finally paid attention to the comment "# pointing to the kernel version
string" and got it straight.  The assembly stuff just threw me off. ;-)

Thanks Eric and Michael.

--
Quang

 
 
 

Information About Kernel Image

Post by Quan » Tue, 19 Mar 2002 09:56:34


What part don't you understand?

Quote:

>   1. open("/vmlinuz");
>   2. lseek(0x20e);
>   3. read(&offset, 2);
>   4. offset += 0x200;
>   5. lseek(offset);
>   6. read(&kernel_version_string, ...);

> Hell, I was able to construct that much just from what you quoted.

Exactly just that...  After reading over and over a number of times I
finally paid attention to the comment "# pointing to the kernel version
string" and got it straight.  The assembly stuff just threw me off. ;-)

Thanks Eric and Michael.

--
Quang

 
 
 

1. Problems creating a binary image from an elf32-powerpc kernel image

Hi,
   I have a elf32-powerpc kernel image with the following sections.

zvmlinux.mbx:     file format elf32-powerpc

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .text         0000534c  00180000  00180000  00010000  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .rodata       00000750  00185350  00185350  00015350  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, DATA
  2 .data         00000328  00186000  00186000  00016000  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  3 .data.init    00000000  00187000  00187000  00017000  2**0
                  CONTENTS
  4 .bss          00003200  00187000  00187000  00017000  2**2
                  ALLOC
  5 image         00082181  00000000  00000000  00017000  2**0
                  CONTENTS, READONLY

when I try to extract the binary image using "ppc_8xx-objcopy -O
binary zvmlinux.mbx vmlinuz.bin" the resulting file size is just 25384
bytes!
Looks like it is definitely missing out the "image" section. I tried
booting the binary image and as expected the decompressor code in the
image fails with a
"Uncompressing Linux...bad gzipped data" error. So the text section
seems to be fine at least.

Any help on this is greatly appreciated!

Thanks
Sameer.

2. Solaris for the PC?

3. HP DeskJet 722C problem

4. Linux Kernel Information & Install Kernel Script

5. sudden timewarps when using gettimeofday()

6. Image file information dump?

7. XF86 3.3 and lk401 setup?

8. need tiff image format information

9. Image Maps and CGI on Apache ... looking for more general information

10. Custom Logs With Web App Specific Information That Is NON Cookie NON Header Information?

11. looking for information on how to query a pc for system hardware information