Kernel image extraction from RAM

TRINATH KARRI

Member
Joined
Mar 18, 2021
Messages
95
Reaction score
6
Credits
759
Hi all,

Is it possible to extract Kernel image from RAM if i know the kernel start address and size.
 


The kernel is not a stationary object in memory that can be extracted. It's working, which means it's changing all the time with values being modified in accordance with its numerous processes mediating the hardware and software. The nearest one can get, I imagine, is a kernel core dump which is not a bootable or usable kernel but rather something available for analysis.

On thinking further about it, if you wanted to have the kernel, but were unable to get the vmlinuz-... file of it in /boot, the next best thing might be getting the kernel config file so that it could be used to compile the kernel that became the system's /boot/vmlinuz-...
 
Last edited:
Hi @osprey ,
Thanks for the reply.

Got it! I just want to know kernel image crc calculation in runtime is possible or not. Now i think it is not possible. I have to calculate and validate crc before starting kernel.

Thanks.
 

Members online


Latest posts

Top