16

I want to generate System.map from vmlinuz,cause most of machines don't have the file System.map.In fact,vmlinuz are compressed to vmlinuz or bzImage.

It's any tool or script can do this?

I tried:

dd if=/boot/vmlinuz skip=`grep -a -b -o -m 1 -e $'\x1f\x8b\x08\x00' /boot/vmlinuz | cut -d: -f 1` bs=1 | zcat > /tmp/vmlinux

It was failed:

zcat: stdin: not in gzip format
32769+0 records in
32768+0 records out
2

4 Answers 4

22

To extract the uncompressed kernel from the kernel image, you can use the extract-vmlinux script from the scripts directory in the kernel tree (available at least in kernel version 3.5) (if you get an error like

mktemp: Cannot create temp file /tmp/vmlinux-XXX: Invalid argument

you need to replace $(mktemp /tmp/vmlinux-XXX) by $(mktemp /tmp/vmlinux-XXXXXX) in the script). The command is /path/to/kernel/tree/scripts/extract-vmlinux <kernel image> >vmlinux.

If the extracted kernel binary contains symbol information, you should¹ be able to create the System.map file using the mksysmap script from the same subdirectory. The command here is NM=nm /path/to/kernel/tree/scripts/mksysmap vmlinux System.map.

¹ The kernel images shipped with my distribution seem to be stripped, so the script was not able to get the symbols.

5
  • thanks for your help!!I got the script from 3.5.2 and the result is [root@lwq2 test]# ./extract-vmlinux.sh vmlinuz extract-vmlinux.sh: Cannot find vmlinux.
    – hellolwq
    Commented Aug 17, 2012 at 10:40
  • Hm, I actually had the same problem first, the cause was that the script failed to create a needed temporary file /tmp/vmlinux-XXX (in my case, I needed to change that to /tmp/vmlinux-XXXXXX to get it working, the needed number of X'es should be mentioned in the manual page for mktemp). The extract-vmlinux script from version 3.5.2 also uses three X'es instead of six, so this could probably be the problem...
    – Abrixas2
    Commented Aug 17, 2012 at 10:48
  • For ARM it fails with "extract-vmlinux: Cannot find vmlinux": unix.stackexchange.com/questions/352215/… Commented Nov 19, 2018 at 17:51
  • The 'kernel tree" you mean the kernel source tree?
    – clearlight
    Commented Oct 31, 2019 at 15:00
  • Yes, the kernel tree that is available from kernel.org.
    – Abrixas2
    Commented Nov 1, 2019 at 10:35
2

As Abrixas2 wrote, you will need a kernel image with symbol information in order to create System.map files and a packed vmlinuz image is not likely to have symbols in it. I can, however, verify that the script in your original post works with '-e' replaced with '-P' and '$' dropped, i.e.,

$ dd if=vmlinuz-3.8.0-19-generic skip=`grep -a -b -o -m 1 -P '\x1f\x8b\x08\x00' vmlinuz-3.8.0-19-generic | cut -d: -f 1` bs=1 | zcat > /tmp/vmlinux
gzip: stdin: decompression OK, trailing garbage ignored
2
  • This does not appear to work with the latest version of grep. Commented Feb 26, 2015 at 16:14
  • It works for me. Excellent. Saved lot of my time. No need to download the source or manual steps to decompress.
    – user966588
    Commented May 28, 2015 at 18:30
1

try this :

dd if=vmlinuz bs=1 skip=24584 | zcat > vmlinux

with

24584 = 24576 + 8

when

od -A d -t x1 vmlinuz | grep '1f 8b 08 00'

gives

....... 0  1  2  3  .  .  .  .  8  
0024576 24 26 27 00 ae 21 16 00 1f 8b 08 00 7f 2f 6b 45

enjoy !

1
  • 1
    This is confusing because it's in reverse order. Most people reading this probably aren't going to have that exact "skip" value (right?) so it doesn't make sense to just give the command first. It'd be clearer if you explained it step-by-step.
    – wjandrea
    Commented Mar 17, 2022 at 23:59
0

I'm on ubuntu linux.
you can change $'\037\213\010\000' to "$(echo '\037\213\010\000')" in sh

bash$ N=$(grep -abo -m1  $'\037\213\010\000' vmlinuz-4.13.0-37-generic | awk -F: '{print $1+1}') && 
tail -c +$N vmlinuz-4.13.0-37-generic | gzip -d > /tmp/vmlinuz
1
  • Careful, $'\000' actually terminates the string in Bash, at least on 5.0.
    – wjandrea
    Commented Mar 17, 2022 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.