3.1 Giải mã 100% code extract-vmlinux của Linux Kernel – Nhảy vào làm

#!/bin/sh
# SPDX-License-Identifier: GPL-2.0-only
# ----------------------------------------------------------------------
# extract-vmlinux - Extract uncompressed vmlinux from a kernel image
#
# Inspired from extract-ikconfig
# (c) 2009,2010 Dick Streefland <dick@streefland.net>
#
# (c) 2011      Corentin Chary <corentin.chary@gmail.com>
#
# ----------------------------------------------------------------------

set -ux

check_vmlinux()
{
	# Use readelf to check if it's a valid ELF
	# TODO: find a better to way to check that it's really vmlinux
	#       and not just an elf
	readelf -h $1 > /dev/null 2>&1 || return 1

	cat $1
	exit 0
}

try_decompress()
{
	# The obscure use of the "tr" filter is to work around older versions of
	# "grep" that report the byte offset of the line instead of the pattern.

	# Try to find the header ($1) and decompress from here
	for	pos in `tr "$1n$2" "n$2=" < "$img" | grep -abo "^$2"`
	do
		pos=${pos%%:*}
		tail -c+$pos "$img" | $3 > $tmp 2> /dev/null
		check_vmlinux $tmp
	done
}

# Check invocation:
me=${0##*/}
me1=$0
img=$1
total=$#
if	[ $# -ne 1 -o ! -s "$img" ]
then
	echo "Usage: $me <kernel-image>" >&2
	exit 2
fi

# Prepare temp files:
tmp=$(mktemp /tmp/vmlinux-XXX)
trap "rm -f $tmp" 0

# That didn't work, so retry after decompression.
try_decompress '3721310' xy    gunzip
try_decompress '3757zXZ00' abcde unxz
try_decompress 'BZh'          xy    bunzip2
try_decompress '135'   xxx   unlzma
try_decompress '211114132' xy    'lzop -d'
try_decompress '02!L30'   xxx   'lz4 -d'
try_decompress '(265/375'   xxx   unzstd

# Finally check for uncompressed images or objects:
check_vmlinux $img

# Bail out:
echo "$me: Cannot find vmlinux." >&2

root@DevSecOps.Edu.VN:~# ./extract-vmlinux-new1 /boot/vmlinuz-`uname -r` > vmlinux-`uname -r`
+ me=extract-vmlinux-new1
+ me1=./extract-vmlinux-new1
+ img=/boot/vmlinuz-6.2.0-39-generic
+ total=1
+ [ 1 -ne 1 -o ! -s /boot/vmlinuz-6.2.0-39-generic ]
+ mktemp /tmp/vmlinux-XXX
+ tmp=/tmp/vmlinux-Wgn
+ trap rm -f /tmp/vmlinux-Wgn 0
+ try_decompress 3721310 xy gunzip
+ tr 3721310nxy nxy=
+ grep -abo ^xy
+ pos=10743949
+ tail -c+10743949 /boot/vmlinuz-6.2.0-39-generic
+ gunzip
+ check_vmlinux /tmp/vmlinux-Wgn
+ readelf -h /tmp/vmlinux-Wgn
+ return 1
+ try_decompress 3757zXZ00 abcde unxz
+ tr 3757zXZ00nabcde nabcde=
+ grep -abo ^abcde
+ try_decompress BZh xy bunzip2
+ tr BZhnxy nxy=
+ grep -abo ^xy
+ try_decompress 135 xxx unlzma
+ tr 135nxxx nxxx=
+ grep -abo ^xxx
+ try_decompress 211114132 xy lzop -d
+ tr 211114132nxy nxy=
+ grep -abo ^xy
+ try_decompress 02!L30 xxx lz4 -d
+ tr 02!L30nxxx nxxx=
+ grep -abo ^xxx
+ try_decompress (265/375 xxx unzstd
+ tr (265/375nxxx nxxx=
+ grep -abo ^xxx
+ pos=17321
+ tail -c+17321 /boot/vmlinuz-6.2.0-39-generic
+ unzstd
+ check_vmlinux /tmp/vmlinux-Wgn
+ readelf -h /tmp/vmlinux-Wgn
+ cat /tmp/vmlinux-Wgn
+ exit 0
+ rm -f /tmp/vmlinux-Wgn

root@DevSecOps.Edu.VN:~# file vmlinux-`uname -r` | tr ',' 'n'
vmlinux-6.2.0-39-generic: ELF 64-bit LSB executable
 x86-64
 version 1 (SYSV)
 statically linked
 BuildID[sha1]=2a3defeb6f65ab82b04220896fb7f396de6a54e5
 stripped

root@DevSecOps.Edu.VN:~# readelf -h vmlinux-`uname -r`
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x1000000
  Start of program headers:          64 (bytes into file)
  Start of section headers:          73400752 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         5
  Size of section headers:           64 (bytes)
  Number of section headers:         39
  Section header string table index: 38

cat -n pos_params.sh

/pos_params.sh D e v S e c O p s . E d u . V N

cat extract-vmlinux-new

#!/bin/sh
# SPDX-License-Identifier: GPL-2.0-only
# ----------------------------------------------------------------------
# extract-vmlinux - Extract uncompressed vmlinux from a kernel image
#
# Inspired from extract-ikconfig
# (c) 2009,2010 Dick Streefland <dick@streefland.net>
#
# (c) 2011      Corentin Chary <corentin.chary@gmail.com>
#
# ----------------------------------------------------------------------

check_vmlinux()
{
        # Use readelf to check if it's a valid ELF
        # TODO: find a better to way to check that it's really vmlinux
        #       and not just an elf
        readelf -h $1 > /dev/null 2>&1 || return 1

        #cat $1
        exit 0
}

try_decompress()
{
        # The obscure use of the "tr" filter is to work around older versions of
        # "grep" that report the byte offset of the line instead of the pattern.

        # Try to find the header ($1) and decompress from here
        for     pos in `tr "$1n$2" "n$2=" < "$img" | grep -abo "^$2"`
        do
                echo $pos
                pos=${pos%%:*}
                echo $pos
                tail -c+$pos "$img" | $3 > $tmp 2> /dev/null
                check_vmlinux $tmp
        done
}

# Check invocation:
me=${0##*/}
img=$1
if      [ $# -ne 1 -o ! -s "$img" ]
then
        echo "Usage: $me <kernel-image>" >&2
        exit 2
fi

# Prepare temp files:
tmp=$(mktemp /tmp/vmlinux-XXXXXX)
trap "rm -f $tmp" 0

# That didn't work, so retry after decompression.
try_decompress '3721310' xy    gunzip
try_decompress '3757zXZ00' abcde unxz
try_decompress 'BZh'          xy    bunzip2
try_decompress '135'   xxx   unlzma
try_decompress '211114132' xy    'lzop -d'
try_decompress '02!L30'   xxx   'lz4 -d'
try_decompress '(265/375'   xxx   unzstd

# Finally check for uncompressed images or objects:
# check_vmlinux $img

# Bail out:
# echo "$me: Cannot find vmlinux." >&1