Using strings to recreate a Linux kernel config

Using the Linux kernel Image file (aka “piggy”) that recovered from camera I started rebuilding the original kernel configuration of VStarCAM H6837WI camera.

All we need to do is it:

$ strings piggy > strings_kernel_orig.txt
$ strings Image > strings_kernel_new.txt

The “piggy” file is from camera and Image is the Linux kernel image that I compiled.

Basically we just need to compare strings_kernel_orig.txt and strings_kernel_new.txt using a file comparator as the meld program.

When you find a readable text in piggy that doesn’t exist in our Image then you need to search for this string in the Linux kernel source tree:

user@linux/$ grep -r somestring

You will find a C file with this string, then open the Makefile at this C file directory to discover which CONFIG_ symbol includes the compilation of this C file.

Now you need to open the kernel configuration menu (“make menuconfig”) and search (press “/”) for this CONFIG_ symbol. You need to enable the feature of this symbol and compile the kernel again.

Repeat the process from generating the string_kernel_new.txt and comparing until you get both kernel with same strings. Then you will have a very similar kernel firmware at end.

Note: You can also search for strange symbol like “nYgq,” etc

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s