Getting uname information from a compressed kernel image

Question

Is there a good way to extract the same information that uname does from a compressed kernel image? I want this to be able to check the dog tags of kernel sitting in dormant mtd's on an Embedded Linux system and compare it to the currently running kernel.

Pandit

Answer 1

For Linux image compressed with gzip, use this:

dd if=arch/arm/boot/zImage bs=1 skip=$(LC_ALL=C grep -a -b -o $'\x1f\x8b\x08\x00\x00\x00\x00\x00' arch/arm/boot/zImage | head -n 1 | cut -d ':' -f 1) | zcat | grep -a 'Linux version'

For Linux image compressed with xz, use this:

dd if=arch/arm/boot/zImage bs=1 skip=$(LC_ALL=C grep -a -b -o $'\xFD\x37\x7A\x58\x5A\x00' arch/arm/boot/zImage | head -n 1 | cut -d ':' -f 1) | xzcat | grep -a 'Linux version'

Because the image file contains data after the end of the compressed stream, you'll get an error you can ignore.

The string constant appears to be part of the frozen userspace visible kernel API:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=blob;f=init/version.c;hb=HEAD#l40

Lockard

Doesn't work for me. Also can't find the string constant in the referenced URL nor in the history of version.c. file shows: kernel/zImage: Linux kernel ARM boot executable zImage (little-endian) – Nogood

The string constant is there: git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/… – Lockard

@Daniel Alder what kind of compression does your image use? – Lockard

Thanks for this, super helpful. I'm curious what the skip=$(...) is meant to accomplish. I noticed on a build that I did the result of that clause is 0. So this also worked for me: dd if=arch/arm/boot/zImage | zcat | grep -a 'Linux version' And so this also worked for me: zcat arch/arm/boot/zImage | grep -a 'Linux version' – Asyut

Thank you for this. Useful for discovering the version of kernel7.img when creating Raspberry Pi firmware based on Raspbian. – Compline

Answer 2

$ mkimage -l uImage

Image Name:   Linux-2.6.39
Created:      Wed Jun  6 13:49:58 2012
Image Type:   ARM Linux Kernel Image (uncompressed)
Data Size:    3091036 Bytes = 3018.59 kB = 2.95 MB
Load Address: 80008000
Entry Point:  80008000

Arbitrament

comes inside u-boot-tools – Baptism

Answer 3

You can actually do this very easily using the file command

file /boot/vmlinuz-linux

Output:

/boot/vmlinuz-linux: Linux kernel x86 boot executable bzImage, version 6.10.3-arch1-2 (linux@archlinux) #1 SMP PREEMPT_DYNAMIC Tue, 06 Aug 2024 07:21:19 +0000, RO-rootFS, swap_dev 0XC, Normal VGA

If you'd like to get just the kernel version, use cut:

file /boot/vmlinuz-hridesh | cut -f 9 -d ' '

Ewens