[File] [PATCH] Detect ZBOOT wrapped linux kernel's

[Christos Zoulas]

Committed, thanks!

christos

> On Jul 11, 2025, at 1:29 PM, Jeremy Linton <jeremy.linton at arm.com> wrote:
> 
> The linux kernel has an optional decompressor in its EFI stub. This
> decompressor basically wraps the normal PE images but is currently being
> detected as a generic PE image rather than as a linux kernel.
> 
> Detect these files and identify them as linux boot images.
> 
> Signed-off-by: Jeremy Linton <jeremy.linton at arm.com>
> ---
> magic/Magdir/linux | 11 +++++++++++
> 1 file changed, 11 insertions(+)
> 
> diff --git a/magic/Magdir/linux b/magic/Magdir/linux
> index 6bdc784d..84e15cb0 100644
> --- a/magic/Magdir/linux
> +++ b/magic/Magdir/linux
> @@ -529,6 +529,17 @@
>> 0x18   lelong  &4          \b, 16K pages
>> 0x18   lelong  &6          \b, 32K pages
> 
> +############################################################################
> +# Linux kernel (arm64/riscv/loongarch) EFI executable (zstd/gzip) compressed zboot Image
> +# from: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/firmware/efi/libstub/zboot-header.S
> ++0	string	MZ\0\0zimg
> +>0x40   string	PE\0\0		Linux kernel
> +>>&0	leshort	0xAA64		ARM64 EFI executable
> +>>&0	leshort	0x5032          RISC-V32 EFI executable
> +>>&0	leshort	0x5064          RISC-V64 EFI executable
> +>>&0	leshort	0x6264          LoongArch64 EFI executable
> +>>0x18 string	>0		%s compressed zboot Image
> +
> ############################################################################
> # Linux RISC-V kernel image
> 0x38	string	RSC\05		Linux kernel RISC-V boot executable Image
> -- 
> 2.50.1
> 
> -- 
> File mailing list
> File at astron.com
> https://mailman.astron.com/mailman/listinfo/file

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP
URL: <https://mailman.astron.com/pipermail/file/attachments/20250712/ff538dd8/attachment.asc>