查看小米路由vmlinuz.trx格式解析的源代码

本页参考了 carabob001 在这个 [http://www.iptvfans.cn/wiki/index.php/%E5%B0%8F%E7%B1%B3%E8%B7%AF%E7%94%B1%E5%99%A8%E5%86%85%E6%A0%B8 页面的分析] 节约了不少时间，在此严重感谢！


== 概述 ==

看一个 [0.5.56] 版本的固件，mkxqimage -x brcm4709_*.bin 解压后得到的 vmlinuz.trx:

<source lang=bash>
$ hexdump -C vmlinuz.trx | head -n 3
00000000  48 44 52 30 00 b0 2b 00  d6 3b 1d 6d 00 00 01 00  |HDR0..+..;.m....|
00000010  1c 00 00 00 00 00 00 00  00 00 00 00 5d 00 00 01  |............]...|
00000020  00 00 01 53 00 00 00 00  00 00 69 bc 00 2e 35 68  |...S......i...5h|
</source>

00 - 03: 0x30524448 TRX格式文件 Magic Number

04 - 07: 0x002bb000 整个TRX文件大小

08 - 11: CRC32

12 - 15:

16 - 19: 0x0000001C 第一分区文件内偏移


第一分区又是 LZMA 压缩格式，LZMA 压缩文件的头为 13 个字节：

  5D 00 00 01 00 00 01 53 00 00 00 00 00 00


前5个字节表示压缩率：

<pre>
   -1   5d 00 00 01 00
   -2   5d 00 00 10 00
   -3   5d 00 00 08 00
   -4   5d 00 00 10 00
   -5   5d 00 00 20 00
   -6   5d 00 00 40 00
   -7   5d 00 00 80 00
   -8   5d 00 00 00 01
   -9   5d 00 00 00 02
</pre>


后8个字节是解压后内容的大小：0x00530100 (5439744)


解压 vmlinuz.trx 文件的方法：

<source lang=bash>
$ dd if=vmlinuz.trx of=vmlinux.lzma bs=1 skip=28
$ unlzma vmlinux.lzma
</source>


解压得到的内核文件vmlinux 编译时带了 initramfs，通过搜索“5D 00 00 00”，找到：

<source lang=bash>
$ hexdump -C vmlinux | grep -i "5D 00 00 00"
0001e000  5d 00 00 00 02 ff ff ff  ff ff ff ff ff 00 18 0d  |]...............|
00402450  5d 00 00 00 08 d2 49 c0  00 00 00 00 e8 be 15 c0  |].....I.........|
00409890  00 00 00 00 5d 00 00 00  94 67 4a c0 74 96 01 c0  |....]....gJ.t...|
00414c70  01 5d 00 00 00 00 c0 00  48 3f 05 01 01 58 00 00  |.]......H?...X..|
004981e0  3c 25 70 3e 5d 00 00 00  20 28 25 73 29 00 00 00  |<%p>]... (%s)...|
00499900  5b 25 6c 78 2b 25 6c 78  5d 00 00 00 6d 6d 2f 6d  |[%lx+%lx]...mm/m|
0049c140  65 72 66 64 5d 00 00 00  5b 65 76 65 6e 74 66 64  |erfd]...[eventfd|
0049c150  5d 00 00 00 66 73 2f 6c  6f 63 6b 73 2e 63 00 00  |]...fs/locks.c..|
0049d7d0  5b 44 4d 5d 00 00 00 00  5b 45 5a 44 5d 00 00 00  |[DM]....[EZD]...|
00524490  5d 00 00 00 93 10 00 00  e7 70 00 00 ff ff ff ff  |]........p......|
005244a0  ff ff ff ff 00 00 00 00  00 00 00 00 5d 00 00 00  |............]...|
</source>


用下面的命令分离出 LZMA 压缩的initramfs：

<source lang=bash>
$ dd if=vmlinux of=initramfs.cpio.lzma bs=1 skip=$((0x1E000)) 
$ umlzma initramfs.cpio.lzma

#得到 initramfs.cpio 文件，用下面的命令解压：
$ cpio -idmc --no-absolute-filenames <initramfs.cpio
</source>

<br><br>

== 应用 ==

<source lang=bash>

</source>

<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br><br><br>
<br><br>
<br><br>
<br><br>
<br><br>