TL;DR
This blog post explains how to extract and disassemble a Linux kernel image. It will cover the extract-vmlinux
script, how to use objdump
, and how to use /boot/System.map
to locate functions and other symbols.
Extracting the Linux kernel image (vmlinuz)
First, you’ll need to get the extract-vmlinux
script so that you can decompress and extract the Linux kernel image.
You can download the latest version from GitHub:
$ wget -O extract-vmlinux https://raw.githubusercontent.com/torvalds/linux/master/scripts/extract-vmlinux
It’s unlikely that the script will change, but to be safe you should use the extract-vmlinux
script that is from the same source tree as your kernel.
If you are extracting a kernel installed from your operating system, you can install the extract-linux
script with your package manager.
On Ubuntu, install linux-headers-$(uname -r)
:
$ sudo apt-get install linux-headers-$(uname -r)
You will be able to find the extract-linux
script at /usr/src/linux-headers-$(uname -r)/scripts/extract-vmlinux
.
On CentOS, install kernel-devel
:
$ sudo yum install kernel-devel
You will be able to find the extract-linux
script at /usr/src/kernels/$(uname -r)/scripts/extract-vmlinux
.
Using extract-vmlinux
You can now use extract-vmlinux
to decompress and extract the kernel image.
A good first step is to create a temporary directory and copy the kernel image to it:
$ mkdir /tmp/kernel-extract
$ sudo cp /boot/vmlinuz-$(uname -r) /tmp/kernel-extract/
Now, run the extract-vmlinux
script to extract the image.
On Ubuntu:
$ cd /tmp/kernel-extract/
$ sudo /usr/src/linux-headers-$(uname -r)/scripts/extract-vmlinux vmlinuz-$(uname -r) > vmlinux
On CentOS:
$ cd /tmp/kernel-extract/
$ sudo /usr/src/kernels/$(uname -r)/scripts/extract-vmlinux vmlinuz-$(uname -r) > vmlinux
Disassmble the Linux kernel with objdump
Now that you have decompressed and extracted the kernel image, you can use objdump
to disassemble it. There’s quite a bit of code, so piping the output to less
is probably a good idea.
Using the same directory structure as before:
$ cd /tmp/kernel-extract/
$ objdump -D vmlinux | less
Finding symbols in /boot/System.map
So, you’ve extracted the kernel and are now looking at the disassembled kernel. You’ll notice that there are no symbol names, so you can’t easily find the starting point for functions you want to examine.
Luckily, all the symbols and their starting address can be found in the file /boot/System.map-$(uname -r)
.
For example, let’s lookup the address of tcp_v4_do_rcv
:
$ sudo grep " tcp_v4_do_rcv" /boot/System.map-3.2.0-29-virtual
ffffffff81590df0 T tcp_v4_do_rcv
You can now search the objdump
output for the address ffffffff81590df0
to find the disassmbled net_ipv4_path
function:
ffffffff81590df0: 55 push %rbp
ffffffff81590df1: 48 89 e5 mov %rsp,%rbp
ffffffff81590df4: 48 83 ec 20 sub $0x20,%rsp
ffffffff81590df8: 48 89 5d e8 mov %rbx,-0x18(%rbp)
ffffffff81590dfc: 4c 89 65 f0 mov %r12,-0x10(%rbp)
ffffffff81590e00: 4c 89 6d f8 mov %r13,-0x8(%rbp)
ffffffff81590e04: e8 77 9c 0c 00 callq 0xffffffff8165aa80
...
Conclusion
Extracting the Linux kernel is relatively straightforward once you know what extract-vmlinux
is and where to find it. Extracting the kernel can be useful when you want to verify comments left by kernel code authors or are just curious to see how a particular function was compiled.