
#-------------------------Kernels-------------------------------------

# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
# and Nicolas Lichtmaier <nick@debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
0       string      \xb8\xc0\x07\x8e\xd8\xb8\x00\x90\x8e\xc0\xb9\x00\x01\x29\xf6\x29    Linux kernel boot image
>514    string      !HdrS                                                               {invalid}

# Finds and prints Linux kernel strings in raw Linux kernels (output like uname -a).
# Commonly found in decompressed embedded kernel binaries.
0       string      Linux\x20version\x20    Linux kernel version
>14     byte        0                       {invalid}
>14     byte        !0
>>14    string      x                       "%s"

# Linux ARM compressed kernel image
# See arch/arm/boot/compressed/head.S and arch/arm/boot/compressed/vmlinux.lds.S
0	ulelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian),
>4	ulelong x		    load address: "0x%.8X",
>8	ulelong	x		    end address: "0x%.8X"
>12 ulelong !0x04030201 {invalid}

0	ubelong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian),
>4	ubelong x		    load address: "0x%.8X",
>8	ubelong	x		    end address: "0x%.8X"
>12 ubelong !0x04030201 {invalid}

