On Mon, 2016-02-01 at 23:31 -0200, Tiago Ilieve wrote:
> > PS I have also found binwalk [2] useful when examining contents of
> > compressed kernel
> > apt-get install binwalk
>
> Thanks for the tip - although I got a little bit surprised with so
> many dependencies in what should be a simple command-line utility.
>
> Here's what I got from "binwalk /boot/vmlinuz-3.16.0-4-amd64":
>
> DECIMAL HEXADECIMAL DESCRIPTION
> -----------------------------------------------------------------------
> ---------
> 0 0x0 Microsoft portable executable
> 18356 0x47B4 xz compressed data
> 3108600 0x2F6EF8 xz compressed data
>
> Not sure about what bytes "0-18355" means. Maybe a false-positive?
>
> If I run it with "-e", it get two files ("47B4.tar" and "2F6EF8.tar")
> that can't be decompressed with "tar"/"unxz".
What does file(1) say about them? For me I see:
_vmlinuz-3.16.0-4-amd64.extracted/2F6EF8.xz: XZ compressed data
_vmlinuz-3.16.0-4-amd64.extracted/47B4: ELF 64-bit LSB executable, x86-64,
version 1 (SYSV), statically linked,
BuildID[sha1]=2883400c6927fe339cdd2c321d3d154c472ef418, stripped
_vmlinuz-3.16.0-4-amd64.extracted/47B4.xz: XZ compressed data
Do any of them match what you get out of extract-linux?
_vmlinuz-3.16.0-4-amd64.extracted/47B4 looks to me to be an ELF file which
I would expect to be bootable as a Xen PV guest, it has the required ELF
notes etc.
Did you see my other replies on debian-kernel yesterday? There are some
questions there which it would be useful to know the answers to.
Ian.
