How to extract files from uImage?

Question

Buildroot is generating images for an embedded device where they should run. This is working very well. In those images, the rootfs is included.

Due to some research, I'd like to look into that generated file (e.g. different compression modes set by the Buildroot were applied and now shall be checked if they were correctly done), but I can't find something useful in the Net.

As far as I know, the difference between a uImage and zImage is just a small header, so u-boot is able to read that binary file. But I can open neither uImage nor the zImage.

Can anyone give me a hint of how to decompress those (u/z)Images on the host?

Solution 1

mkimage -l uImage

Will dump the information in the header.

tail -c+65 < uImage > out

Will get the content.

tail -c+65  < uImage | gunzip > out

will get it uncompressed if it was gzip-compressed.

If that was an initramfs, you can do cpio -t < out or pax < out to list the content.

If it's a ramdisk image, you can try and mount it with:

mount -ro loop out /mnt

file out could tell you more about what it is.

Solution 2

U-Boot brings its own dumpimage tool (find it in the tools directory of your U-Boot tree)

Of course it works with simple images, but it also supports the old-style multi images

$ ~2/tools/dumpimage -l uMulti 
Image Name:   
Created:      Thu Aug 31 19:54:29 2017
Image Type:   ARM Linux Multi-File Image (uncompressed)
Data Size:    5678650 Bytes = 5545.56 kB = 5.42 MB
Load Address: 10008000
Entry Point:  10008000
Contents:
   Image 0: 5028760 Bytes = 4910.90 kB = 4.80 MB
   Image 1: 602111 Bytes = 588.00 kB = 0.57 MB
   Image 2: 47762 Bytes = 46.64 kB = 0.05 MB
$ ~2/tools/dumpimage -i uMulti kernel.extracted
$ ~2/tools/dumpimage -i uMulti -p 1 initramfs.extracted
$ ~2/tools/dumpimage -i uMulti -p 2 device-tree.extracted

Have not tried it with new style FIT images yet, but I guess it should just work.

Solution 3

In case there are several images inside here is a quick bash script to extract them all into the files image_0, image_1, …:

#!/bin/bash

src_file=uImage

declare -ia sizes=( $(mkimage -l "$src_file" |
  awk '/^ +Image [0-9]+/ { print $3 }') )
declare -i offset="68+4*${#sizes[@]}"
declare -i size

for i in "${!sizes[@]}"; do

  size=${sizes[$i]}

  echo "Unpacking image_$i"
  dd if="$src_file" of="image_$i" bs=1 skip="$offset" count="$size"

  # going to offset of next file while rounding to 4 byte multiple
  offset+=$(( size + (4 - size % 4) % 4 ))

done

You then need to check then what is what (could be a packed Linux kernel, archive with files, device tree, …). file and binwalk (http://binwalk.org/) might be helpful.

Comments

[K.Denn]

Header tells me that it's an: ARM Linux Kernel Image (uncompressed). i can't open it neither with gunzip nor cpio the way that you explained it. Mounting the image wasn't possible too

[K.Denn]

but the rootfs is included. I use the 3 different compression modes and for one of them it's not working, therefore my plan was to open the image and check what has bin compressed

[Stéphane Chazelas]

@user3085931, if the rootfs has been appended to the kernel image, then somehow the offset must be specified somewhere either as parameters passed to the kernel or embeded in the kernel itself. Do you have an example of such an image somewhere?

[K.Denn]

very nice addition

[socketpair]

It works with FIT images.

[AnthonyD973]

If you want to extract the rootfs to the current directory, run tail -c+65 < rootfs.image.gz | cpio -i. If the archive is compressed with gzip, run tail -c+65 < rootfs.image.gz | gunzip | cpio -i.