小米路由vmlinuz.trx格式解析

本页参考了 carabob001 在这个 页面的分析 节约了不少时间，在此严重感谢！

看一个 [0.5.56] 版本的固件，mkxqimage -x brcm4709_*.bin 解压后得到的 vmlinuz.trx:

$ hexdump -C vmlinuz.trx | head -n 3
00000000  48 44 52 30 00 b0 2b 00  d6 3b 1d 6d 00 00 01 00  |HDR0..+..;.m....|
00000010  1c 00 00 00 00 00 00 00  00 00 00 00 5d 00 00 01  |............]...|
00000020  00 00 01 53 00 00 00 00  00 00 69 bc 00 2e 35 68  |...S......i...5h|

00 - 03: 0x30524448 TRX格式文件 Magic Number

04 - 07: 0x002bb000 整个TRX文件大小

08 - 11: CRC32

12 - 15:

16 - 19: 0x0000001C 第一分区文件内偏移

第一分区又是 LZMA 压缩格式，LZMA 压缩文件的头为 13 个字节：

 5D 00 00 01 00 00 01 53 00 00 00 00 00 00

前5个字节表示压缩率：

   -1   5d 00 00 01 00
   -2   5d 00 00 10 00
   -3   5d 00 00 08 00
   -4   5d 00 00 10 00
   -5   5d 00 00 20 00
   -6   5d 00 00 40 00
   -7   5d 00 00 80 00
   -8   5d 00 00 00 01
   -9   5d 00 00 00 02

后8个字节是解压后内容的大小：0x00530100 (5439744)

解压 vmlinuz.trx 文件的方法：

$ dd if=vmlinuz.trx of=vmlinux.lzma bs=1 skip=28
$ unlzma vmlinux.lzma

解压得到的内核文件vmlinux 编译时带了 initramfs，通过搜索“5D 00 00 00”，找到：

$ hexdump -C vmlinux | grep -i "5D 00 00 00"
0001e000  5d 00 00 00 02 ff ff ff  ff ff ff ff ff 00 18 0d  |]...............|
00402450  5d 00 00 00 08 d2 49 c0  00 00 00 00 e8 be 15 c0  |].....I.........|
00409890  00 00 00 00 5d 00 00 00  94 67 4a c0 74 96 01 c0  |....]....gJ.t...|
00414c70  01 5d 00 00 00 00 c0 00  48 3f 05 01 01 58 00 00  |.]......H?...X..|
004981e0  3c 25 70 3e 5d 00 00 00  20 28 25 73 29 00 00 00  |<%p>]... (%s)...|
00499900  5b 25 6c 78 2b 25 6c 78  5d 00 00 00 6d 6d 2f 6d  |[%lx+%lx]...mm/m|
0049c140  65 72 66 64 5d 00 00 00  5b 65 76 65 6e 74 66 64  |erfd]...[eventfd|
0049c150  5d 00 00 00 66 73 2f 6c  6f 63 6b 73 2e 63 00 00  |]...fs/locks.c..|
0049d7d0  5b 44 4d 5d 00 00 00 00  5b 45 5a 44 5d 00 00 00  |[DM]....[EZD]...|
00524490  5d 00 00 00 93 10 00 00  e7 70 00 00 ff ff ff ff  |]........p......|
005244a0  ff ff ff ff 00 00 00 00  00 00 00 00 5d 00 00 00  |............]...|

用下面的命令分离出 LZMA 压缩的initramfs：

$ dd if=vmlinux of=initramfs.cpio.lzma bs=1 skip=$((0x1E000)) 
$ umlzma initramfs.cpio.lzma

#得到 initramfs.cpio 文件，用下面的命令解压：
$ cpio -idmc --no-absolute-filenames <initramfs.cpio