[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Does core.img have a magic signature?

From: Mike Fleetwood
Subject: Re: Does core.img have a magic signature?
Date: Fri, 3 Jun 2016 13:29:52 +0100

On 1 June 2016 at 20:29, Andrei Borzenkov <address@hidden> wrote:
> 01.06.2016 20:12, Mike Fleetwood пишет:
>> Hi,
>> I would like to know if it is possible to recognise core.img when
>> written to a disk, especially written to a BIOS Boot partition (type
>> GUID 21686148-6449-6E6F-744E-656564454649)?  Is there a signature that
>> can be checked?
> Not really. You can look at bootinfoscript that contains some heuristic
> to detect and parse core.img. Having self-identifying core.img would
> actually be good.

Thank you Andrei,

If I understand correctly, bootinfoscript finds where core.img is
located from the boot sector, reads the first 4 bytes and compares them
to 4 known signatures.  (Just the first 4 bytes of the x86 CPU
instructions from core.img).

I can add matching of the same 4 signatures of 4 bytes to identify
core.img to GParted.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]