《浅析pc机上如何将vmlinuz- 2.6.31-14-generic解压出vmlinux》

浅析pc机上如何将vmlinuz-2.6.31-14-generic解压出vmlinux

luther@gliethttp:~$ vim /boot/grub/grub.cfg

可以看到我们进入的系统的内核为

linux /boot/vmlinuz-2.6.31-14-generic

查找1F 8B 08这是gzip的标志头

我找到的内容为

0000 366C: 1F 8B 08 00 8C 80 D8 4A 02 03 EC 3A 7F 74 53 55

0x0000366c等于13932

luther@gliethttp:~$ dd bs=1 skip=13932 if=/boot/vmlinuz-2.6.31-14-generic of=vmlinux.gz

luther@gliethttp:~$ file vmlinux.gz

vmlinux.gz: gzip compressed data, from Unix, last modified: Fri Oct 16 22:17:48 2009, max compression

luther@gliethttp:~$ gunzip vmlinux.gz

luther@gliethttp:~$ ll vmlinux

-rw-r--r-- 1 luther luther 7.9M 2010-05-16 12:06 vmlinux

luther@gliethttp:~$ vim linux-2.6.33.4/arch/x86/kernel/vmlinux_32.lds.S

// vim arch/x86/configs/i386_defconfig 我们获取的参数[luther.gliethttp]

// CONFIG_PAGE_OFFSET=0xC0000000

// CONFIG_PHYSICAL_START=0x100000

// #define __PAGE_OFFSET _AC(CONFIG_PAGE_OFFSET, UL)

#define LOAD_OFFSET __PAGE_OFFSET 其值为0xC0000000

/* Physical address where kernel should be loaded. */

#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START /

+ (CONFIG_PHYSICAL_ALIGN - 1)) /

& ~(CONFIG_PHYSICAL_ALIGN - 1))

SECTIONS

{

. = LOAD_OFFSET + LOAD_PHYSICAL_ADDR; // 0xC0000000 + 0x100000 = 0xc0100000是最终的地址

phys_startup_32 = startup_32 - LOAD_OFFSET;

luther@gliethttp:~$ objdump -DS vmlinux |more

vmlinux: file format elf32-i386

Disassembly of section .text.head:

c0100000 <.text.head>:

c0100000: f6 86 11 02 00 00 40 testb $0x40,0x211(%esi)

c0100007: 75 14 jne 0xc010001d

c0100009: 0f 01 15 22 8e 74 00 lgdtl 0x748e22

c0100010: b8 18 00 00 00 mov $0x18,%eax

c0100015: 8e d8 mov %eax,%ds

c0100017: 8e c0 mov %eax,%es

c0100019: 8e e0 mov %eax,%fs

c010001b: 8e e8 mov %eax,%gs

c010001d: fc cld

c010001e: 31 c0 xor %eax,%eax

c0100020: bf 00 a0 81 00 mov $0x81a000,%edi

luther@gliethttp:~$ vbindiff vmlinux

0000 1000: F6 86 11 02 00 00 40 75 14 0F 01 15 22 8E 74 00 ......@u ....".t.

0000 1010: B8 18 00 00 00 8E D8 8E C0 8E E0 8E E8 FC 31 C0 ........ ......1.

0000 1020: BF 00 A0 81 00 B9 A0 80 8A 00 29 F9 C1 E9 02 F3 ........ ..).....

0000 1030: AB BF C0 56 7C 00 B9 00 04 00 00 FC F3 A5 8B 35 ...V|... .......5

0000 1040: E8 58 7C 00 21 F6 74 0C BF E0 2A 7C 00 B9 00 02 .X|.!.t. ..*|....

0000 1050: 00 00 F3 A5 66 81 3D C6 58 7C 00 07 02 72 1C A1 ....f.=. X|...r..

0000 1060: FC 58 7C 00 3D 03 00 00 00 73 0E 8B 04 85 80 22 .X|.=... .s....."

0000 1070: 7C 00 2D 00 00 00 C0 FF E0 0F 0B BF 00 90 8A 00 |.-..... ........

0000 1080: BA 00 A0 81 00 B8 03 00 00 00 8D 4F 67 89 0A 89 ........ ...Og...

0000 1090: 8A 00 0C 00 00 83 C2 04 B9 00 04 00 00 AB 05 00 ........ ........

0000 10A0: 10 00 00 E2 F8 BD 03 90 A4 00 39 E8 72 DC 81 C7 ........ ..9.r...

0000 10B0: 00 00 00 C0 89 3D 80 A5 74 00 C1 E8 0C A3 84 F0 .....=.. t.......

0000 10C0: 81 00 B8 67 B0 81 00 A3 FC AF 81 00 E9 6D 6B 46 ...g.... .....mkF

而vmlinux的前0x1000字节为ELF标志头数据,真正的有效kernel数据从0x1000开始

luther@gliethttp:~$ vim linux-2.6.33.4/arch/x86/boot/compressed/vmlinux_32.lds

OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")

OUTPUT_ARCH(i386)

ENTRY(startup_32)

SECTIONS

{

/* Be careful parts of head_32.S assume startup_32 is at

* address 0.

*/

. = 0;

.text.head : {

_head = . ;

*(.text.head) // 文件头信息

_ehead = . ;

}

.rodata.compressed : {

*(.rodata.compressed)

}

.text : {

_text = .; /* Text */ // 从0x1000开始的kernel有效执行code机器码

*(.text)

*(.text.*)

_etext = . ;

}

......

}

让我们实际演练演练,我们读取释放到内存中的kernel代码

luther@gliethttp:~$ cat /proc/iomem |grep code

00100000-00575553 : Kernel code

0x00100000等于1048576

0x00575553等于5723475

luther@gliethttp:~$ sudo dd bs=1 skip=1048576 count=208 if=/dev/mem 2>/dev/null | xxd -g 1

0000000: f6 86 11 02 00 00 40 75 14 0f 01 15 22 8e 74 00 ......@u....".t.

0000010: b8 18 00 00 00 8e d8 8e c0 8e e0 8e e8 fc 31 c0 ..............1.

0000020: bf 00 a0 81 00 b9 a0 80 8a 00 29 f9 c1 e9 02 f3 ..........).....

0000030: ab bf c0 56 7c 00 b9 00 04 00 00 fc f3 a5 8b 35 ...V|..........5

0000040: e8 58 7c 00 21 f6 74 0c bf e0 2a 7c 00 b9 00 02 .X|.!.t...*|....

0000050: 00 00 f3 a5 66 81 3d c6 58 7c 00 07 02 72 1c a1 ....f.=.X|...r..

0000060: fc 58 7c 00 3d 03 00 00 00 73 0e 8b 04 85 80 22 .X|.=....s....."

0000070: 7c 00 2d 00 00 00 c0 ff e0 0f 0b bf 00 90 8a 00 |.-.............

0000080: ba 00 a0 81 00 b8 03 00 00 00 8d 4f 67 89 0a 89 ...........Og...

0000090: 8a 00 0c 00 00 83 c2 04 b9 00 04 00 00 ab 05 00 ................

00000a0: 10 00 00 e2 f8 bd 03 90 a4 00 39 e8 72 dc 81 c7 ..........9.r...

00000b0: 00 00 00 c0 89 3d 80 a5 74 00 c1 e8 0c a3 84 f0 .....=..t.......

00000c0: 81 00 b8 67 b0 81 00 a3 fc af 81 00 e9 6d 6b 46 ...g.........mkF