Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I’m trying to track down a kernel binary; is there a way to determine the version (build string) of a Linux ‘uImage’ binary?
Running
strings uImage
piped into various trailing grep statements leads me to think I’m dealing with a compressed image…
I just realized, the kernels I have immediate access to do have the version string stored uncompressed amongst the headers.
strings uImage | grep 2.6ought to be good enough for any 2.6 kernel which covers pretty much everything in the last 5+ years).(original answer follows)
It’s theoretically possible, but not entirely trivial.
Modern Linux kernel versions use a format called bzImage (for x86/x86_64, YMMV on other platforms). It actually consists of an ELF header and some other minutia (like a bit of decompression code) followed by, yes, a compressed image of the actual kernel.
Traditionally, the compression algorithm was zlib (contrary to popular misconception, ‘bzImage’ did not stand for “bzipped image”, but for “big zImage” — the original zImage format not being able to handle large kernels), though versions after 2.6.30 also support bzip2 and LZMA.
What you’ll probably have to do is determine exactly where the compressed data starts (sorry, can’t help you there, but trial and error might work), and write a bit of code to run it through the library for whichever compression algorithm is in use.