Is it possible to get the kernel image (bzImage, vmlinuz, etc.) from a running system by reading through the system's memory?
10
-
2What do you need it for?– muruMay 22, 2019 at 17:44
-
Ok, but why do you need the kernel image from a running system?– muruMay 22, 2019 at 19:20
-
1Have you already tried talking to the administrator of the PXE server? It seems like the environment the running system is in is highly secured, and if you start sniffing, you might trip other security mechanisms. In secure environments, "hacking/sniffing without proper authorization" can be a very serious offense, up to possibly causing you to lose your job immediately. Make very sure you have appropriate management blessing to whatever you're doing.Your boss might be able to just tell the PXE server admin to give you the boot image files you need.– telcoMMay 24, 2019 at 6:00
-
1@mosvy I agree. There are plenty of legitimate reasons for wanting this question answered, like the disk failing and the system still running. The user may be able to recover it if he can get the kernel image from the system and put it on a new drive or something.– userMay 24, 2019 at 13:01
-
1Agreed. At the very least "Unclear what you're asking" is incorrect. What the OP is asking for is very clear indeed. I suspect people have fallen into the trap of knowing that this is impossible and believing such questions should be closed. I was going to write up an answer on why this is impossible but have been blocked from doing so.– Philip CoulingMay 24, 2019 at 13:05
|
Show 5 more comments
1 Answer
No this isn't possible.
The basic problem is that despite the fact the kernel image is loaded directly into memory, this image is changed the moment the kernel is booted. While the kernel isn't really a program, many of the rules about the way a program is compiled / loaded into memory still apply.
Take the following C code as an example:
char x=5
int some_function() {
x=100;
}
The first line x=5 tells the compiler put the number 5 in a byte somewhere in memory for use latter. When the program runs, this byte will be loaded directly into memory along with everything else.
The later line x=100 tells the compiler to write machine code which, when executed will overwrite the original value. So if you extracted the running program from memory and de-compiled it you might see something like this
char x=100
int some_function() {
x=100;
}
Effectivly, the running program has re-written itself.
Similarly to this, user-land programs are stored in ELF format. When you run a userland program, the program loader has to assemble the program image from many pieces. Now the rules for the Kernel are a little different but there is a parallel with modprobe which loads other files into the running Kernel's memory space.
So while you might find a way to dump the entire memory of your Kernel, the result won't actually look much like the original Kernel image and certainly not enough to boot from it.
Here I'm afraid your best option is to go to the sysadmins and ask them for a copy, or ask for access.
answered May 24, 2019 at 14:59
