[TOC]

0x00 镜像内容查看

lsinitramfs 命令

lsinitrd 命令

描述:列出给定一个initramfs镜像的内容列表,它允许快速检查一个(或多个)指定initramfs文件的内容;

命令语法参数:

Usage: lsinitrd [options] [<initramfs file> [<filename> [<filename> [...] ]]]
Usage: lsinitrd [options] -k <kernel version>
-s, --size                  sort the contents of the initramfs by size.
-m, --mod                   list modules.
-f, --file <filename>       print the contents of <filename>.
-k, --kver <kernel version> inspect the initramfs of <kernel version>.

基础示例:

# 1.映像相关信息报考其大小/模块/文件列表
$lsinitrd /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img
# Image: /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img: 18M
# ========================================================================
# Early CPIO image
# ========================================================================
# drwxr-xr-x   3 root     root            0 Feb 27 22:14 .
# -rw-r--r--   1 root     root            2 Feb 27 22:14 early_cpio
# drwxr-xr-x   3 root     root            0 Feb 27 22:14 kernel
# drwxr-xr-x   3 root     root            0 Feb 27 22:14 kernel/x86
# drwxr-xr-x   2 root     root            0 Feb 27 22:14 kernel/x86/microcode
# -rw-r--r--   1 root     root        33792 Feb 27 22:14 kernel/x86/microcode/GenuineIntel.bin


# 2.列举出映像模块信息 
$lsinitrd -m /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img
Image: /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img: 18M
========================================================================
Version: dracut-033-564.el7
dracut modules:
bash
nss-softokn
i18n
network
ifcfg
drm
plymouth
kernel-modules
qemu
rootfs-block
terminfo
udev-rules
biosdevname
systemd
usrmount
base
fs-lib
microcode_ctl-fw_dir_override
shutdown
========================================================================