#-------------------------Kernels------------------------------------- # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> # and Nicolás Lichtmaier <nick@debian.org> # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90\x8e\xc0\xb9\x00\x01\x29\xf6\x29 Linux kernel boot image >514 string !HdrS (invalid) # Finds and prints Linux kernel strings in raw Linux kernels (output like uname -a). # Commonly found in decompressed embedded kernel binaries. 0 string Linux\ version\ Linux kernel version >14 byte 0 invalid >14 byte !0 >>14 string x "%s >>45 string x \b%s"