vmlinux-to-elf is a tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)
Features:
- Take a raw binary blob or ELF kernel file as an input.
- Automatically detect and unpack the main compression formats used for the Linux kernel.
- Find and extract the embedded kernel symbols table (kallsyms) from the input file.
- Infer the instruction set architecture, endianness, bit size, relying upon other things on common function prologue signatures.
- Infer the entry point of the kernel from the symbols contained in the kallsyms table.
- Provide basic inference for the kernel base address.
- Unpack certain types of Android boot.img files, starting with an "ANDROID!" or "UNCOMPRESSED_IMG" magic.
- Produce an .ELF file fully analyzable with IDA Pro or Ghidra as an output.
Fix regression over recursively unpacking data
Correctly indicate whenever the kernel base address was found using kallsyms_relative_base
