[TOC]

0x00 镜像内容查看

lsinitramfs 命令
lsinitrd 命令

描述:列出给定一个initramfs镜像的内容列表,它允许快速检查一个(或多个)指定initramfs文件的内容;

命令语法参数:

1
2
3
4
5
6
Usage: lsinitrd [options] [<initramfs file> [<filename> [<filename> [...] ]]]
Usage: lsinitrd [options] -k <kernel version>
-s, --size sort the contents of the initramfs by size.
-m, --mod list modules.
-f, --file <filename> print the contents of <filename>.
-k, --kver <kernel version> inspect the initramfs of <kernel version>.

基础示例:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# 1.映像相关信息报考其大小/模块/文件列表
$lsinitrd /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img
# Image: /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img: 18M
# ========================================================================
# Early CPIO image
# ========================================================================
# drwxr-xr-x 3 root root 0 Feb 27 22:14 .
# -rw-r--r-- 1 root root 2 Feb 27 22:14 early_cpio
# drwxr-xr-x 3 root root 0 Feb 27 22:14 kernel
# drwxr-xr-x 3 root root 0 Feb 27 22:14 kernel/x86
# drwxr-xr-x 2 root root 0 Feb 27 22:14 kernel/x86/microcode
# -rw-r--r-- 1 root root 33792 Feb 27 22:14 kernel/x86/microcode/GenuineIntel.bin


# 2.列举出映像模块信息
$lsinitrd -m /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img
Image: /boot/initramfs-3.10.0-1062.12.1.el7.x86_64.img: 18M
========================================================================
Version: dracut-033-564.el7
dracut modules:
bash
nss-softokn
i18n
network
ifcfg
drm
plymouth
kernel-modules
qemu
rootfs-block
terminfo
udev-rules
biosdevname
systemd
usrmount
base
fs-lib
microcode_ctl-fw_dir_override
shutdown
========================================================================