2

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get over repacking the vmlinux into zImage/bzImage.

I extracted the kernel using extract-vmlinux (modified to show offset here):

$ ../../extract-vmlinux zImage > vmlinux
Found valid magic - decompressed using unlzma (tail -c+15967 "zImage" | unlzma)
Header at: head -c15966
Compressed at: tail -c+15967

$ binwalk zImage

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
15966         0x3E5E          LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: -1 bytes

Next, without any modifications, I wanted to recompress it back and keep the header, as to my knowledge it has the decompression code:

$ cat <(head -c15966 zImage) <(lzma -z < vmlinux) > zImage-repacked
$ ls -l
-rw-r--r-- 1 user user 3032080 Jun  5 22:32 zImage
-rw-r--r-- 1 user user 3024065 Jun  6 00:04 zImage-repacked

$ binwalk zImage-repacked

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
15966         0x3E5E          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes

The image came ~8k short, which didn't worry me (as my compression might have been more aggressive). However the image is now broken:

$ ../../extract-vmlinux zImage-repacked > /dev/null
extract-vmlinux: Cannot find vmlinux.

I also found that the extract-linux script pipes everything after the offset to unlzma but there's 9441 bytes of something which unlzma ignores. When removed I'm getting a pure archive which matches the size saved just after it:

$ tail -c+15967 zImage | head -c-9441 | unlzma > /dev/null ; echo $?
0
$ tail -c+15967 zImage | head -c-9441 | unlzma | wc --bytes
13871216
$ tail -c+15967 zImage | head -c-9437 | tail -c4 | od -i --endian=little
0000000    13871216
0000004

I know the classical wisdom is "you have to recompile" but we're on RE - this is not possible ;)
How can I approach re-packing of the modified vmlinux back to LZMA-zImage?

Improve this question
4
  • 1
    So to anyone visiting from Google - this is MUCH harder than just throwing some lzma & cat. This requires a pretty extensive process but, contrary to what many claim, it is possible. I will be releasing a tool for exactly that purpose. I will provide more detailed answer later.
    – kiler129
    Jun 9, 2021 at 2:50
  • any chance for an update on this? This looks like a good question! I'm interested reading a solution
    – NirIzr
    Feb 8 at 18:48
  • 1
    @NirIzr: I totally forgot to update the post but I prepared the tool which I used for my research project: github.com/kiler129/recreate-zImage
    – kiler129
    Feb 9 at 21:51
  • Thanks! I'll follow up on this if I have issues :)
    – NirIzr
    Feb 27 at 14:25

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.