{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md#L89-L98",
    "https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md#L153-L192",
    "https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/pyproject.toml",
    "https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/vmlinux_to_elf/core/kallsyms.py",
    "https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/LICENSE",
    "https://github.com/marin-m/vmlinux-to-elf/releases/tag/1.3.6",
    "https://pypi.org/project/vmlinux-to-elf/1.3.6/"
  ],
  "category": "firmware",
  "description_en": "Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. It detects the compression format, instruction set, endianness, word size, entry point and an approximate base address and writes an ELF for IDA Pro or Ghidra; a kallsyms-finder listing, a standalone decompressor and a GTK GUI are included.",
  "description_zh": "通过定位并解码内嵌的 kallsyms 符号表，从 Linux 内核镜像重建带函数与变量符号、可供分析的 ELF 文件；输入可以是原始或压缩的 vmlinux、vmlinuz、zImage、bzImage 数据块，部分 Android boot.img 文件，或已去除符号的内核 ELF。工具会检测压缩格式、指令集、字节序、位宽、入口点和近似基址，并生成可在 IDA Pro 或 Ghidra 中分析的 ELF；另附列出符号的 kallsyms-finder、独立解压工具和 GTK 图形界面。",
  "entry_url": "https://awesomerea.org/resources/vmlinux-to-elf/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/vmlinux-to-elf/",
  "evidence_url": "https://github.com/marin-m/vmlinux-to-elf/blob/2d094bc9c220b6b50f8215cbc3c9e581210ce1a6/README.md",
  "group": "tools",
  "id": "vmlinux-to-elf",
  "json_url": "https://awesomerea.org/resources/vmlinux-to-elf/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/vmlinux-to-elf/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/vmlinux-to-elf/index.md",
  "name": "vmlinux-to-elf",
  "name_zh": "vmlinux-to-elf 内核符号恢复工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: 1.3.6, published 2026-05-20 on GitHub and PyPI; its notes include provisional support for reserializing section-stripped ELF kernels and uImage LZMA decompression. The reviewed master commit is four commits ahead, with GUI and packaging updates, and carries a 1.3.6.1 tag that has no release. PyPI classifies the project as beta.",
    "Requires Python 3.9+ with lz4, zstandard, minilzo and peewee. The README installs the CLI and GUI with snap on Ubuntu, from the AUR, or with uv plus GTK 4, libadwaita and PyGObject development packages; Flathub provides the GUI on distributions whose libadwaita is older than 1.6.",
    "Input is a kernel image the analyst already has; kernels built without CONFIG_KALLSYMS are not supported. The README states support for Linux 2.6.10 through 6.4 as of August 2023, raw-kernel architecture detection for MIPS, ARM, ARM64, PowerPC, SPARC, x86, x86-64, SuperH and ARC, XZ, LZMA, GZip, BZ2, LZ4, LZO and Zstd decompression, and OpenWrt's uncompressed kallsyms variant. Instruction set, bit size, file offset and base address can be overridden when detection fails.",
    "GPL-3.0-or-later. Recovered symbols carry only the name, address and nm-style type stored in kallsyms, and the base address is a heuristic: the first text symbol address with the low 12 bits cleared."
  ],
  "requirements_zh": [
    "审阅时最新版本为 1.3.6，于 2026-05-20 发布在 GitHub 和 PyPI；其发布说明包括对去除节区的 ELF 内核重新序列化的初步支持，以及 uImage LZMA 解压。所审阅的 master 提交比它多四个提交，内容为图形界面和打包更新，并带有一个没有对应发布的 1.3.6.1 标签。PyPI 将项目标为 beta 阶段。",
    "需要 Python 3.9+ 以及 lz4、zstandard、minilzo 和 peewee。README 介绍了几种安装命令行和图形界面的方式：Ubuntu 上用 snap，或从 AUR 安装，或用 uv 并配合 GTK 4、libadwaita 和 PyGObject 开发包；在 libadwaita 低于 1.6 的发行版上，可通过 Flathub 使用图形界面。",
    "输入为分析者已有的内核镜像；未启用 CONFIG_KALLSYMS 编译的内核不受支持。README 称截至 2023 年 8 月支持 Linux 2.6.10 至 6.4，可为原始内核检测 MIPS、ARM、ARM64、PowerPC、SPARC、x86、x86-64、SuperH 和 ARC 架构，支持 XZ、LZMA、GZip、BZ2、LZ4、LZO 和 Zstd 解压，并能处理 OpenWrt 的未压缩 kallsyms 变体。自动检测失败时，可手动指定指令集、位宽、文件偏移和基址。",
    "采用 GPL-3.0-or-later。恢复出的符号只包含 kallsyms 中存储的名称、地址和 nm 风格的类型；基址为启发式推断，即第一个代码段符号地址清除低 12 位后的值。"
  ],
  "targets": [
    "binary",
    "firmware"
  ],
  "url": "https://github.com/marin-m/vmlinux-to-elf",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}