How to decompress compressed kernel

Question

I have a kernel that the vendor hasn't provided the source for. It is the gziped kernel. Where does the data part of the sequence start? I tried to find the magic number (1f 8b) and copy that into a gzip file, but I can't decode it in 7zip.

Answer 1

You have the correct approach for a gzip-compressed binary. The decompression is different for burrows-wheeler (bzip2) or LZMA. If it doesn't decompress with 7zip, try using something like gzip/zcat.

An example of decompressing gzip-encoded kernels, based on Benjamin Coddington's post How to extract vmlinux from vmlinuz [archived from the original]:

$ mkdir -p /tmp/kernel-uncompressed/; cd /tmp/kernel-uncompressed/
$ f="vmlinuz-`uname -r`"  # e.g. "vmlinuz-2.6.18-128.el5.uvm6PAE"
$ cp /boot/$f .
$ od -t x1 -A d $f | grep "1f 8b 08"
0008320 1b 00 1f 8b 08 00 d5 c2 9a 49 02 03 ec 3b 7d 7c
$ offset=8322 # Where the gzip marker starts, based on the above output.
$ dd bs=1 skip=$offset if=$f | zcat > vmlinux