I have an aarch64 kernel image with the following magic number:

root@localhost:/# cat msImage|xxd -l4  
00000000: 4d5a 0091                                MZ..

root@localhost:/# file msImage 
msImage: MS-DOS executable, MZ for MS-DOS

Is it possible to extract the bootable zImage from this ? and also extract the aarch64 elf binary? how?


1 Answer 1


The overall format of an AArch64 Linux kernel can be found in https://www.kernel.org/doc/Documentation/arm64/booting.txt

Of particular note (emphasis mine):

The AArch64 kernel does not currently provide a decompressor and therefore requires decompression (gzip etc.) to be performed by the boot loader if a compressed Image target (e.g. Image.gz) is used. For bootloaders that do not implement this requirement, the uncompressed Image target is available instead.

and indeed, I downloaded a sample image from Linaro and its header matches the structure in section 4, i.e. the image is uncompressed.

hex dump of the header:

0000000000: 4D 5A 00 91 57 00 00 14 │ 00 00 08 00 00 00 00 00  MZ.............
0000000010: 00 70 A8 00 00 00 00 00 │ 00 00 00 00 00 00 00 00  ...............
0000000020: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00  ...............
0000000030: 00 00 00 00 00 00 00 00 │ 41 52 4D 64 40 00 00 00  ........ARMd@...

You can see the magic field at offset 0x38 (0x644d5241 or "ARM\x64" as text).

The "MS-DOS executable" text shown by file is a red herring: the overall image format is actually Portable Executable (PE), which has to start with the MZ signature. Linux kernel employs a few tricks to appear like a valid PE file so that it can be booted by a UEFI-compliant firmware.

There is no "elf bibnary" to extract because the kernel has been linked into the PE file format and does not contain any ELF headers anymore. IF you want to disassemble it, just disassemble it as raw AArch64 binary (e.g. pass -bbinary -maarch64 flags to an ARM objdump) - the second instruction will jump to the real entrypoint:

0000 4D 5A 00 91    ADD             X13, X18, #0x16
0004 57 00 00 14    B               stext

(see arch/arm64/kernel/head.S in kernel sources for more details).

  • "just disassemble it as raw AArch64 binary" How? I'm trying to run it through objdump and I get File format not recognized. also, in addition to disassembling it, I also want to boot the image and the device I'm booting this on has problems with this type of image and I have to use a zImage to boot Aug 9, 2018 at 15:45
  • What device? are you sure it needs an aarch64 kernel and not plain arm?
    – Igor Skochinsky
    Aug 9, 2018 at 15:48
  • Please add all relevant details to the question or make a new one; I answered what was asked
    – Igor Skochinsky
    Aug 9, 2018 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.