4

I am using a Raspberry Pi.

There seem to be all kinds of linux distributions, all in .img Format that I use Win32DiskImager for to burn to SD-card.

How do I find out, which files were changed(some people say, this image was made off distribution X, so I could use dist. X as one file and his as the other and compare) and how to figure out whether a custom distribution is malicious or not?

I would like to figure differences out under windows 7. The Distros are always Linux, though.

0

1 Answer 1

2

A .img file is an image file of a complete disk. So it may contain more than 1 partition. Given it's a disk image you can use disk management tools such as fdisk to see what type of partitions it contains.

Contents of archlinux-hf-2013-06-06.img

$ fdisk -l archlinux-hf-2013-06-06.img

Disk archlinux-hf-2013-06-06.img: 1960 MB, 1960837120 bytes
64 heads, 32 sectors/track, 1870 cylinders, total 3829760 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0004f23a

                      Device Boot      Start         End      Blocks   Id  System
archlinux-hf-2013-06-06.img1   *        2048      186367       92160    c  W95 FAT32 (LBA)
archlinux-hf-2013-06-06.img2          186368     3667967     1740800   83  Linux

So looking at the output we can see that there are 2 partitions inside the .img file. The first, rchlinux-hf-2013-06-06.img1, is a FAT32 type of partition. The second partition, archlinux-hf-2013-06-06.img2, is a Linux partition.

Make note of the starting sectors for the 2 partitions (2048 & 186368). You'll need those later. Also note how many bytes a given sector contains (512 bytes).

Mounting the partitions

To mount the Linux partition, you'd first need to calculate its starting position in terms of bytes. So do the following math:

part1:   2048 sectors * 512 bytes/sector =  1048576 bytes
part2: 186368 sectors * 512 bytes/sector = 95420416 bytes

So in order to mount the Linux partitions (2nd one):

$ sudo mount -o loop,offset=95420416 archlinux-hf-2013-06-06.img /mnt/

NOTE: To mount the FAT32 partition you can use this command:

$ sudo mount -t vfat -o loop,offset=1048576 archlinux-hf-2013-06-06.img /mnt/

And we can now see the contents:

$ ls /mnt|columns -c 4
bin                   boot                  dev                   etc
home                  lib                   lost+found            media
mnt                   opt                   proc                  root
run                   sbin                  srv                   sys
tmp                   usr                   var

Unmounting

To unmount a partition when you're done with it just do the following command:

$ sudo umount /mnt

Comparing content of .img files

So here's an idea. You could mount 2 .img files on say /mnt1 and /mnt2 and then perform a recursive comparison of the 2 directory trees contained in each .img file.

With the 2 .img files mounted you could run a command like this which would do a comparison:

$ diff -qr /mnt1 /mnt2

This would result in output that showed a file and whether it was different and/or missing in the 2 directory trees.

kpartx - alternate way to mount partitions

If you're too lazy to perform the math above using fdisk you can use kpartx and map the partitions to loopback devices which you can easily mount/unmount. The commands would go something like this:

mount .img file #1

$ sudo kpartx -av your-image1.img 
add map loop0p1 (252:5): 0 117187 linear /dev/loop0 1
add map loop0p2 (252:6): 0 3493888 linear /dev/loop0 118784
$ sudo mount /dev/mapper/loop0p2 /mnt1

mount .img file #2

$ sudo kpartx -av your-image2.img 
add map loop1p1 (252:5): 0 117187 linear /dev/loop1 1
add map loop1p2 (252:6): 0 3493888 linear /dev/loop1 118784
$ sudo mount /dev/mapper/loop1p2 /mnt2

References

5
  • How to do that under windows? Commented Jun 15, 2013 at 16:34
  • @Zurechtweiser - you should add that you need that to your question. Also you asked your question on a Unix & Linux site so chances are everyone here is going to give you answers on how to do this under Unix & Linux 8-). Update your question!
    – slm
    Commented Jun 15, 2013 at 17:43
  • BTW, this tool will at least mount the .img files: osforensics.com/tools/mount-disk-images.html
    – slm
    Commented Jun 15, 2013 at 17:45
  • I asked that because it was about finding the difference between linux distros which are on the raspberry pi. I expected the os to be found on the images to be important to find out the differences in a meaningful way. In plain text, not binary code. But I edited my answer. Commented Jun 15, 2013 at 19:53
  • Yeah, the main reason it would've been nice to know is I wouldn't have provided you a method for doing it in Unix, if you wanted it for Windows. But given the nature of this site if you don't specify it's kind of assumed that solutions to problems would be in terms of Unix. Not to worry, the answer above provides a method, I'll see what I can dig up for doing something similar on Windows.
    – slm
    Commented Jun 15, 2013 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .