小米路由vmlinuz.trx格式解析
来自Jack's Lab
（版本间的差异）
| 第20行： | 第20行： | ||
16 - 19: 0x0000001C 第一分区文件内偏移 | 16 - 19: 0x0000001C 第一分区文件内偏移 | ||
| + | |||
| + | |||
| + | 第一分区又是 LZMA 压缩格式，LZMA 压缩文件的头为 13 个字节： | ||
| + | |||
| + | 5D 00 00 01 00 00 01 53 00 00 00 00 00 00 | ||
| + | |||
| + | |||
| + | 前5个字节表示压缩率： | ||
| + | |||
| + | <pre> | ||
| + | -1 5d 00 00 01 00 | ||
| + | -2 5d 00 00 10 00 | ||
| + | -3 5d 00 00 08 00 | ||
| + | -4 5d 00 00 10 00 | ||
| + | -5 5d 00 00 20 00 | ||
| + | -6 5d 00 00 40 00 | ||
| + | -7 5d 00 00 80 00 | ||
| + | -8 5d 00 00 00 01 | ||
| + | -9 5d 00 00 00 02 | ||
| + | </pre> | ||
| + | |||
| + | |||
| + | 后8个字节是解压后内容的大小：0x00530100 (5439744) | ||
| + | |||
| + | |||
| + | 解压 vmlinuz.trx 文件的方法： | ||
| + | |||
| + | <source lang=bash> | ||
| + | $ dd if=vmlinuz.trx of=vmlinux.lzma bs=1 skip=28 | ||
| + | $ unlzma vmlinux.lzma | ||
| + | </source> | ||
| + | |||
| + | |||
| + | 解压得到的内核文件vmlinux 编译时带了 initramfs，通过搜索“5D 00 00 00”，找到： | ||
| + | |||
| + | <source lang=bash> | ||
| + | $ hexdump -C vmlinux | grep -i "5D 00 00 00" | ||
| + | 0001e000 5d 00 00 00 02 ff ff ff ff ff ff ff ff 00 18 0d |]...............| | ||
| + | 00402450 5d 00 00 00 08 d2 49 c0 00 00 00 00 e8 be 15 c0 |].....I.........| | ||
| + | 00409890 00 00 00 00 5d 00 00 00 94 67 4a c0 74 96 01 c0 |....]....gJ.t...| | ||
| + | 00414c70 01 5d 00 00 00 00 c0 00 48 3f 05 01 01 58 00 00 |.]......H?...X..| | ||
| + | 004981e0 3c 25 70 3e 5d 00 00 00 20 28 25 73 29 00 00 00 |<%p>]... (%s)...| | ||
| + | 00499900 5b 25 6c 78 2b 25 6c 78 5d 00 00 00 6d 6d 2f 6d |[%lx+%lx]...mm/m| | ||
| + | 0049c140 65 72 66 64 5d 00 00 00 5b 65 76 65 6e 74 66 64 |erfd]...[eventfd| | ||
| + | 0049c150 5d 00 00 00 66 73 2f 6c 6f 63 6b 73 2e 63 00 00 |]...fs/locks.c..| | ||
| + | 0049d7d0 5b 44 4d 5d 00 00 00 00 5b 45 5a 44 5d 00 00 00 |[DM]....[EZD]...| | ||
| + | 00524490 5d 00 00 00 93 10 00 00 e7 70 00 00 ff ff ff ff |]........p......| | ||
| + | 005244a0 ff ff ff ff 00 00 00 00 00 00 00 00 5d 00 00 00 |............]...| | ||
| + | </source> | ||
| + | |||
| + | |||
| + | 用下面的命令分离出 LZMA 压缩的initramfs： | ||
| + | |||
| + | <source lang=bash> | ||
| + | $ dd if=vmlinux of=initramfs.cpio.lzma bs=1 skip=$((0x1E000)) | ||
| + | $ umlzma initramfs.cpio.lzma | ||
| + | |||
| + | #得到 initramfs.cpio 文件，用下面的命令解压： | ||
| + | $ cpio -idv <ramfs.cpio | ||
| + | </source> | ||
| + | |||
2014年6月4日 (三) 23:50的版本
本页参考了 carabob001 在这个 页面的分析 节约了不少时间，在此严重感谢！
看一个 [0.5.56] 版本的固件，解压后的 vmlinuz.trx:
$ hexdump -C vmlinuz.trx | head -n 3 00000000 48 44 52 30 00 b0 2b 00 d6 3b 1d 6d 00 00 01 00 |HDR0..+..;.m....| 00000010 1c 00 00 00 00 00 00 00 00 00 00 00 5d 00 00 01 |............]...| 00000020 00 00 01 53 00 00 00 00 00 00 69 bc 00 2e 35 68 |...S......i...5h|
00 - 03: 0x30524448 TRX格式文件 Magic Number
04 - 07: 0x002bb000 整个TRX文件大小
08 - 11: CRC32
12 - 15:
16 - 19: 0x0000001C 第一分区文件内偏移
第一分区又是 LZMA 压缩格式，LZMA 压缩文件的头为 13 个字节：
5D 00 00 01 00 00 01 53 00 00 00 00 00 00
前5个字节表示压缩率：
-1 5d 00 00 01 00 -2 5d 00 00 10 00 -3 5d 00 00 08 00 -4 5d 00 00 10 00 -5 5d 00 00 20 00 -6 5d 00 00 40 00 -7 5d 00 00 80 00 -8 5d 00 00 00 01 -9 5d 00 00 00 02
后8个字节是解压后内容的大小：0x00530100 (5439744)
解压 vmlinuz.trx 文件的方法：
$ dd if=vmlinuz.trx of=vmlinux.lzma bs=1 skip=28 $ unlzma vmlinux.lzma
解压得到的内核文件vmlinux 编译时带了 initramfs，通过搜索“5D 00 00 00”，找到：
$ hexdump -C vmlinux | grep -i "5D 00 00 00" 0001e000 5d 00 00 00 02 ff ff ff ff ff ff ff ff 00 18 0d |]...............| 00402450 5d 00 00 00 08 d2 49 c0 00 00 00 00 e8 be 15 c0 |].....I.........| 00409890 00 00 00 00 5d 00 00 00 94 67 4a c0 74 96 01 c0 |....]....gJ.t...| 00414c70 01 5d 00 00 00 00 c0 00 48 3f 05 01 01 58 00 00 |.]......H?...X..| 004981e0 3c 25 70 3e 5d 00 00 00 20 28 25 73 29 00 00 00 |<%p>]... (%s)...| 00499900 5b 25 6c 78 2b 25 6c 78 5d 00 00 00 6d 6d 2f 6d |[%lx+%lx]...mm/m| 0049c140 65 72 66 64 5d 00 00 00 5b 65 76 65 6e 74 66 64 |erfd]...[eventfd| 0049c150 5d 00 00 00 66 73 2f 6c 6f 63 6b 73 2e 63 00 00 |]...fs/locks.c..| 0049d7d0 5b 44 4d 5d 00 00 00 00 5b 45 5a 44 5d 00 00 00 |[DM]....[EZD]...| 00524490 5d 00 00 00 93 10 00 00 e7 70 00 00 ff ff ff ff |]........p......| 005244a0 ff ff ff ff 00 00 00 00 00 00 00 00 5d 00 00 00 |............]...|
用下面的命令分离出 LZMA 压缩的initramfs：
$ dd if=vmlinux of=initramfs.cpio.lzma bs=1 skip=$((0x1E000)) $ umlzma initramfs.cpio.lzma #得到 initramfs.cpio 文件，用下面的命令解压： $ cpio -idv <ramfs.cpio
