Implementation of kernel vmlinuz extractor. #360
Conversation
| // Architecture | ||
| case strings.HasPrefix(t, "x86 "): | ||
| architecture = "x86" | ||
| case strings.HasPrefix(t, "ARM64 "): |
There was a problem hiding this comment.
Can these values ever appear? In the magic library code I just see "x86 boot executable" as an option but nothing related to ARM:
https://github.com/deitch/magic/blob/c67ab88f10cb7323bd698f7fe7fb0c41f3af4da5/pkg/magic/internal/kernel.go#L15
There was a problem hiding this comment.
Yes, here's an example of the metadata extracted from a vmlinuz archive on my Raspberry Pi:
/boot/vmlinuz-6.1.0-rpi7-rpi-v7: Linux kernel ARM boot executable zImage (little-endian)
There was a problem hiding this comment.
I just tried scanning this vmlinuz archive with Scalibr, and I encountered an error while extracting the magic type:
plugin_status: {
name: "os/kernel/vmlinuz"
status: {
status: PARTIALLY_SUCCEEDED
failure_reason: "home/bruno/go/pkg/mod/golang.org/[email protected]/src/debug/pe/testdata/vmlinuz-4.15.0-47-generic: error determining magic type: EOF\nhome/bruno/vmlinuz: error determining magic type: EOF\nhome/bruno/Downloads/vmlinuz-6.1.0-rpi7-rpi-v7: no match with linux kernel found\nusr/share/go-1.18/src/debug/pe/testdata/vmlinuz-4.15.0-47-generic: error determining magic type: EOF\n
...
As you highlighted above the library (github.com/deitch/magic/pkg/magic) doesn’t currently handle ARM-based kernel files correctly. Let me know if you prefer to remove support for ARM64 and ARM architecture in the code
There was a problem hiding this comment.
Are we aware of any other libraries that might be able to parse the ARM values properly?
If this just checks for specific magic bytes at specific offsets how hard would it be for us to implement our own parsing for ARM?
|
Some merge conflicts will need to be resolved here too |
Pull request for the kernel vmlinuz extractor.
Implemented: