Given the kernel image /boot/vmlinuz-2.4.8mdk or something similiar,
how do you get information about the image such as:
o The release string, for example (2.4.8-26mdk)
o The date/time when the kernel was build
o etc...
Thanks,
Quang
Thanks,
Quang
> Thanks,
> Quang
Here's the little prg I wrote for the test:
Quote:> #include <stdio.h>
> #include <sys/stat.h>
> #include <sys/types.h>
> #include <fcntl.h>
> #include <unistd.h>
> int main(int argc, char **argv)
> {
> int fd;
> off_t off;
> char info[1024];
> /*---------------------------------------------------------------------
> * Check the args
> *-------------------------------------------------------------------*/
> if (argc < 2) {
> printf("Usage: %s <kernel_image> \n", argv[0]);
> return 0;
> }
> /*---------------------------------------------------------------------
> * Open the kernel image
> *-------------------------------------------------------------------*/
> if ((fd = open(argv[1], O_RDONLY)) < 0) {
> perror("open");
> exit(1);
> }
> /*---------------------------------------------------------------------
> * Seek to info we need
> *-------------------------------------------------------------------*/
> if ((off = lseek(fd, 0xA2A, SEEK_SET)) < 0) {
> perror("lseek");
> exit(1);
> }
> /*---------------------------------------------------------------------
> * Read the info
> *-------------------------------------------------------------------*/
> if (read(fd, info, sizeof(info)) < 0) {
> perror("read");
> exit(1);
> }
> /*---------------------------------------------------------------------
> * Print the info
> *-------------------------------------------------------------------*/
> printf("Info = %s\n", info);
> close(fd);
> return 0;
> }
> > Thanks,
> > Quang
> Well, shortly after I posted the article I od'ed the kernel images I have
> and found that the info I need is at the offset 0xA2A of the image. But
> can I depend on this?
Within the setup code (setup.S) of each version you find a data area at
offset 2 (offset 0x202 of the kernel image):
: .ascii "HdrS" # header signature
: .word 0x0203 # header version number (>= 0x0105)
: # or else old loadlin-1.5 will fail)
Check atleast for the signature above.
: realmode_swtch:
: .word 0, 0 # default_switch, SETUPSEG
: start_sys_seg:
: .word SYSSEG
: .word kernel_version # pointing to kernel version string
: # above section of header is compatible
: # with loadlin-1.5 (header v1.5). Don't
: # change it.
Last of the above is an interesting one. The value can be found at
offset 0x20e of the kernel image. Add 0x200 to the word value from there
and you have the position of the string you already found.
It is still left to you to parse this string in order to extract the
information. Some examples of the string (without leading ": "):
2001
Michael
> Last of the above is an interesting one. The value can be found at
> offset 0x20e of the kernel image. Add 0x200 to the word value from there
> and you have the position of the string you already found.
Thanks,
Quang
> > : realmode_swtch:
> > : .word 0, 0 # default_switch, SETUPSEG
> > : start_sys_seg:
> > : .word SYSSEG
> > : .word kernel_version # pointing to kernel version string
> > : # above section of header is compatible
> > : # with loadlin-1.5 (header v1.5). Don't
> > : # change it.
> > Last of the above is an interesting one. The value can be found at
> > offset 0x20e of the kernel image. Add 0x200 to the word value from there
> > and you have the position of the string you already found.
> So what do we have in term of algorithm? I'm confused. Could you write
> some pseudo code to describe your idea?
1. open("/vmlinuz");
2. lseek(0x20e);
3. read(&offset, 2);
4. offset += 0x200;
5. lseek(offset);
6. read(&kernel_version_string, ...);
Hell, I was able to construct that much just from what you quoted.
--
"I woke up this morning and realized what the game needed: pirates,
pimps, and gay furries." - Rich "Lowtax" Kyanka
Exactly just that... After reading over and over a number of times IQuote:> 1. open("/vmlinuz");
> 2. lseek(0x20e);
> 3. read(&offset, 2);
> 4. offset += 0x200;
> 5. lseek(offset);
> 6. read(&kernel_version_string, ...);
> Hell, I was able to construct that much just from what you quoted.
Thanks Eric and Michael.
--
Quang
Exactly just that... After reading over and over a number of times IQuote:> 1. open("/vmlinuz");
> 2. lseek(0x20e);
> 3. read(&offset, 2);
> 4. offset += 0x200;
> 5. lseek(offset);
> 6. read(&kernel_version_string, ...);
> Hell, I was able to construct that much just from what you quoted.
Thanks Eric and Michael.
--
Quang
1. Problems creating a binary image from an elf32-powerpc kernel image
Hi,
I have a elf32-powerpc kernel image with the following sections.
zvmlinux.mbx: file format elf32-powerpc
Sections:
Idx Name Size VMA LMA File off Algn
0 .text 0000534c 00180000 00180000 00010000 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
1 .rodata 00000750 00185350 00185350 00015350 2**4
CONTENTS, ALLOC, LOAD, READONLY, DATA
2 .data 00000328 00186000 00186000 00016000 2**2
CONTENTS, ALLOC, LOAD, DATA
3 .data.init 00000000 00187000 00187000 00017000 2**0
CONTENTS
4 .bss 00003200 00187000 00187000 00017000 2**2
ALLOC
5 image 00082181 00000000 00000000 00017000 2**0
CONTENTS, READONLY
when I try to extract the binary image using "ppc_8xx-objcopy -O
binary zvmlinux.mbx vmlinuz.bin" the resulting file size is just 25384
bytes!
Looks like it is definitely missing out the "image" section. I tried
booting the binary image and as expected the decompressor code in the
image fails with a
"Uncompressing Linux...bad gzipped data" error. So the text section
seems to be fine at least.
Any help on this is greatly appreciated!
Thanks
Sameer.
4. Linux Kernel Information & Install Kernel Script
5. sudden timewarps when using gettimeofday()
6. Image file information dump?
8. need tiff image format information
9. Image Maps and CGI on Apache ... looking for more general information
10. Custom Logs With Web App Specific Information That Is NON Cookie NON Header Information?
11. looking for information on how to query a pc for system hardware information