Linux Boot Images

Introduction

A boot loader starts Linux by loading one file into memory and jumping to it. That file is a boot image, and what it looks like depends on the processor and on the loader. None of these files has an extension that tells you what it is: the ones on a Raspberry Pi boot partition are kernel8.img and kernel7.img, and elsewhere you find Image, zImage and uImage. What identifies each is a magic number at a fixed place in its header, so the explorer looks there, and a file with no extension, or with .img, is recognised by it.

The formats

A .gz kernel (Image.gz) is a gzip file: the explorer unpacks it and reads the result as one of the four. A kernel for another processor (an x86 bzImage) is not among them.

In the explorer

Each viewer shows the header field by field with its checks, and, for the processors it has a disassembler for, the first bytes of the code: the ARM64 Image with the AArch64 decoder, the zImage with the ARM decoder (ARMv7-A by default, with a choice of ARM or Thumb-2 and of architecture), the RISC-V Image with the RISC-V decoder (RV64GC by default, with a choice). The rest of a kernel is not explained: it is code and data mixed, and the viewers do not name its functions. A uImage opens its data as a file of its own, and checks both CRC-32 values.

Also used for

• GEM Image – GEM desktop bitmaps for PC and Atari ST: a word header and run-length planes.
• Raw disk image – A disk or memory card copied byte for byte, with no header.

Not described

Known, not yet covered

• Reference and viewer: the Android boot.img (magic ANDROID!), the x86 bzImage and vmlinuz and the Raspberry Pi boot partition files other than the kernels are not covered here.
• Viewer: the compressed kernel inside a zImage is not unpacked: the format does not say where it starts.

Unknown

• Reference: the Raspberry Pi firmware files bootcode.bin, start4.elf and fixup4.dat have no public format description that we have found; start4.elf is an ELF file and opens as one.

Links