提取连接的cpio档案

Question

Linux上的initramfs档案可以由一系列连接的、gzipped压缩的cpio文件组成。

给定这样的存档，如何提取所有嵌入的档案，而不是仅仅提取第一个？

以下是一种模式的示例，虽然它似乎具有工作潜力，但只提取第一个存档：

while gunzip -c | cpio -i; do :; done <input.cgz

我还尝试使用来自dracut的skipcpio助手将文件指针移过第一个cpio映像，但是以下结果导致将一个损坏的流(而不是输入中的正确点)发送到cpio：

# this isn't ideal -- presumably would need to rerun with an extra skipcpio in the pipeline
# ...until all files in the archive have been reached.
gunzip -c <input.cgz | skipcpio /dev/stdin | cpio -i

Answer 1

安装了包amd64-microcode / intel-microcode包的Debian似乎使用了某种混乱的未压缩cpio存档，其中包含CPU微码，后面是带有实际initrd内容的gzip压缩cpio存档。我唯一能够提取它的方法是使用binwalk (apt install binwalk)，它可以正确地列出结构：

binwalk /path/to/initrd

示例输出：

host ~ # binwalk /boot/initrd.img-5.10.0-15-amd64

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             ASCII cpio archive (SVR4 with no CRC), file name: "kernel", file name length: "0x00000007", file size: "0x00000000"
120           0x78            ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86", file name length: "0x0000000B", file size: "0x00000000"
244           0xF4            ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86/microcode", file name length: "0x00000015", file size: "0x00000000"
376           0x178           ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86/microcode/.enuineIntel.align.0123456789abc", file name length: "0x00000036", file size: "0x00000000"
540           0x21C           ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86/microcode/GenuineIntel.bin", file name length: "0x00000026", file size: "0x00455C00"
4546224       0x455EB0        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
4546560       0x456000        gzip compressed data, has original file name: "mkinitramfs-MAIN_dTZaRk", from Unix, last modified: 2022-06-14 14:02:57
37332712      0x239A6E8       MySQL ISAM compressed data file Version 9

并提取出单独的部分：

binwalk -e /path/to/initrd

示例输出：

host ~ # binwalk -e /boot/initrd.img-5.10.0-15-amd64 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             ASCII cpio archive (SVR4 with no CRC), file name: "kernel", file name length: "0x00000007", file size: "0x00000000"
120           0x78            ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86", file name length: "0x0000000B", file size: "0x00000000"
244           0xF4            ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86/microcode", file name length: "0x00000015", file size: "0x00000000"
376           0x178           ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86/microcode/.enuineIntel.align.0123456789abc", file name length: "0x00000036", file size: "0x00000000"
540           0x21C           ASCII cpio archive (SVR4 with no CRC), file name: "kernel/x86/microcode/GenuineIntel.bin", file name length: "0x00000026", file size: "0x00455C00"
4546224       0x455EB0        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
4546560       0x456000        gzip compressed data, has original file name: "mkinitramfs-MAIN_dTZaRk", from Unix, last modified: 2022-06-14 14:02:57
37332712      0x239A6E8       MySQL ISAM compressed data file Version 9

这将为您在单独的文件中提供单独的部分，现在您可以最终提取适当的cpio存档：

host ~ # ls -l _initrd.img-5.10.0-15-amd64.extracted 
insgesamt 187M
drwxr-xr-x 3 root root 4,0K 14. Jun 17:53 cpio-root/
-rw-r--r-- 1 root root 114M 14. Jun 17:53 mkinitramfs-MAIN_dTZaRk
-rw-r--r-- 1 root root  39M 14. Jun 17:53 0.cpio
-rw-r--r-- 1 root root  35M 14. Jun 17:53 mkinitramfs-MAIN_dTZaRk.gz

host ~/_initrd.img-5.10.0-15-amd64.extracted # mkdir extracted
host ~/_initrd.img-5.10.0-15-amd64.extracted # cd extracted 
host ~/_initrd.img-5.10.0-15-amd64.extracted/extracted # cat ../mkinitramfs-MAIN_dTZaRk | cpio -idmv --no-absolute-filenames
[...]

host ~/_initrd.img-5.10.0-15-amd64.extracted/extracted # ll
insgesamt 28K
lrwxrwxrwx 1 root root    7 14. Jun 17:55 bin -> usr/bin/
drwxr-xr-x 3 root root 4,0K 14. Jun 17:55 conf/
drwxr-xr-x 7 root root 4,0K 14. Jun 17:55 etc/
lrwxrwxrwx 1 root root    7 14. Jun 17:55 lib -> usr/lib/
lrwxrwxrwx 1 root root    9 14. Jun 17:55 lib32 -> usr/lib32/
lrwxrwxrwx 1 root root    9 14. Jun 17:55 lib64 -> usr/lib64/
lrwxrwxrwx 1 root root   10 14. Jun 17:55 libx32 -> usr/libx32/
drwxr-xr-x 2 root root 4,0K 14. Jun 16:02 run/
lrwxrwxrwx 1 root root    8 14. Jun 17:55 sbin -> usr/sbin/
drwxr-xr-x 8 root root 4,0K 14. Jun 17:55 scripts/
drwxr-xr-x 8 root root 4,0K 14. Jun 17:55 usr/
-rwxr-xr-x 1 root root 6,2K 14. Jan 2021  init*

Answer 2

gunzip只需要运行一次(消耗所有输入)，而cpio应该在每个嵌入式存档中运行一次，如下所示：

gunzip -c <input.cgz | while cpio -i; do :; done

Answer 3

您可以使用dd skip=手动完成此操作。在我的Ubuntu20.04中，我可以查看第一部分(偏移0块)

# dd if=/boot/initrd.img-5.4.0-45-generic skip=0 | file -
/dev/stdin: ASCII cpio archive (SVR4 with no CRC)

然后看看里面的内容

# dd if=/boot/initrd.img-5.4.0-45-generic skip=0 | cpio -it
.
kernel
kernel/x86
kernel/x86/microcode
kernel/x86/microcode/AuthenticAMD.bin
62 blocks

第二部分是62个街区。

# dd if=/boot/initrd.img-5.4.0-45-generic skip=62 | file -
/dev/stdin: ASCII cpio archive (SVR4 with no CRC)

还是一个简单的cpio存档，但这次更大

# dd if=/boot/initrd.img-5.4.0-45-generic skip=62 | cpio -it
kernel
kernel/x86
kernel/x86/microcode
kernel/x86/microcode/.enuineIntel.align.0123456789abc
kernel/x86/microcode/GenuineIntel.bin
5868 blocks

现在跳过5868 + 62块到initramfs中

# dd if=/boot/initrd.img-5.4.0-45-generic skip=5930 | file -
/dev/stdin: LZ4 compressed data (v0.1-v0.9)

这一次它是一个压缩流，所以

# dd if=/boot/initrd.img-5.4.0-45-generic skip=5930 | lz4cat | file -
/dev/stdin: ASCII cpio archive (SVR4 with no CRC)

我们再次找到了下一个(也是最后一个) cpio存档。

# dd if=/boot/initrd.img-5.4.0-45-generic skip=5930 | lz4cat | cpio -it
... lots of output
usr/share/plymouth/themes/spinner/watermark.png
usr/share/plymouth/ubuntu-logo.png
var
var/cache
var/cache/fontconfig
var/cache/fontconfig/383ee5b3-5437-4bdc-87f6-cf314658a7c0-le64.cache-7
var/cache/fontconfig/575cffd4-ae01-4067-914f-7545fe566c1b-le64.cache-7
var/cache/fontconfig/CACHEDIR.TAG
var/cache/fontconfig/c467a813-186f-476e-880a-3770402989a9-le64.cache-7
var/cache/fontconfig/d912fc4e-f5b6-456d-a86d-e4c3ccbbefe9-le64.cache-7
var/lib
var/lib/dhcp
450460 blocks

虽然，这只有当第一个流是未压缩的时候才能工作。否则，cpio不会向initramfs报告大小，而是向未压缩部分报告大小。