# vmlinux-to-elf

> Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. It detects the compression format, instruction set, endianness, word size, entry point and an approximate base address and writes an ELF for IDA Pro or Ghidra; a kallsyms-finder listing, a standalone decompressor and a GTK GUI are included.

- Type: Tool
- Targets: Binary · Firmware
- Category: Firmware tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/marin-m/vmlinux-to-elf>
- Primary source: <https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md>
- Catalog page: <https://awesomerea.org/resources/vmlinux-to-elf/>
- Record JSON: <https://awesomerea.org/resources/vmlinux-to-elf/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/vmlinux-to-elf/index.md)

## Requirements & limits

- Latest release at review: 1.3.6, published 2026-05-20 on GitHub and PyPI; its notes include provisional support for reserializing section-stripped ELF kernels and uImage LZMA decompression. The reviewed master commit is four commits ahead, with GUI and packaging updates, and carries a 1.3.6.1 tag that has no release. PyPI classifies the project as beta.
- Requires Python 3.9+ with lz4, zstandard, minilzo and peewee. The README installs the CLI and GUI with snap on Ubuntu, from the AUR, or with uv plus GTK 4, libadwaita and PyGObject development packages; Flathub provides the GUI on distributions whose libadwaita is older than 1.6.
- Input is a kernel image the analyst already has; kernels built without CONFIG_KALLSYMS are not supported. The README states support for Linux 2.6.10 through 6.4 as of August 2023, raw-kernel architecture detection for MIPS, ARM, ARM64, PowerPC, SPARC, x86, x86-64, SuperH and ARC, XZ, LZMA, GZip, BZ2, LZ4, LZO and Zstd decompression, and OpenWrt's uncompressed kallsyms variant. Instruction set, bit size, file offset and base address can be overridden when detection fails.
- GPL-3.0-or-later. Recovered symbols carry only the name, address and nm-style type stored in kallsyms, and the base address is a heuristic: the first text symbol address with the low 12 bits cleared.

## Primary sources

1. <https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md>
2. <https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md#L89-L98>
3. <https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md#L153-L192>
4. <https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/pyproject.toml>
5. <https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/vmlinux_to_elf/core/kallsyms.py>
6. <https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/LICENSE>
7. <https://github.com/marin-m/vmlinux-to-elf/releases/tag/1.3.6>
8. <https://pypi.org/project/vmlinux-to-elf/1.3.6/>

## More in Firmware and hardware

- [Sony-PMCA-RE](https://awesomerea.org/resources/sony-pmca-re/index.md) · Tool
- [cpu_rec](https://awesomerea.org/resources/cpu-rec/index.md) · Tool
- [ME Analyzer](https://awesomerea.org/resources/me-analyzer/index.md) · Tool
- [CHIPSEC](https://awesomerea.org/resources/chipsec/index.md) · Tool
- [binbloom](https://awesomerea.org/resources/binbloom/index.md) · Tool
- [m1n1](https://awesomerea.org/resources/m1n1/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.