Re: Does core.img have a magic signature?

[Mike Fleetwood]

On 1 June 2016 at 20:29, Andrei Borzenkov <address@hidden> wrote:
> 01.06.2016 20:12, Mike Fleetwood пишет:
>> Hi,
>>
>> I would like to know if it is possible to recognise core.img when
>> written to a disk, especially written to a BIOS Boot partition (type
>> GUID 21686148-6449-6E6F-744E-656564454649)?  Is there a signature that
>> can be checked?
>>
>
> Not really. You can look at bootinfoscript that contains some heuristic
> to detect and parse core.img. Having self-identifying core.img would
> actually be good.
>
> https://github.com/arvidjaar/bootinfoscript
>

Thank you Andrei,

If I understand correctly, bootinfoscript finds where core.img is
located from the boot sector, reads the first 4 bytes and compares them
to 4 known signatures.  (Just the first 4 bytes of the x86 CPU
instructions from core.img).

I can add matching of the same 4 signatures of 4 bytes to identify
core.img to GParted.

Mike