$ file /boot/initramfs-XXX.img /boot/initramfs-XXX.img: ASCII cpio archive (SVR4 with no CRC)
It could indicate that there is a type of compression in place (gzip, xz or the like) in which case this initramfs has likely not been generated by a modern version of Dracut. Let’s extract the contents into a new temporary directory:
$ pwd /tmp $ mkdir init_tmp && cd init_tmp $ cpio -idmv < /boot/initramfs-XXX.img kernel kernel/x86 kernel/x86/microcode kernel/x86/microcode/GenuineIntel.bin 5784 blocks
You can see here, it just contains the microcode.
To get to the real initramfs we simply need to skip the first one using
Previously when we extracted the CPIO archive it told us how large it was (
5784 blocks at the end).
We simply need to skip those then we should be able to decode the inner archive.
$ dd if=/boot/initramfs-XXX.img bs=512 skip=5784 of=/tmp/init_tmp/inner-initramfs.img 128304+1 records in 128304+1 records out 65691829 bytes (66 MB, 63 MiB) copied, 0.488113 s, 135 MB/s
We can identify if compression is present:
$ file inner-initramfs.img inner-initramfs.img: gzip compressed data, last modified: Wed Jul 29 09:42:47 2020, from Unix, original size 218558976
Now we can decompress it and extract the inner archive
$ pwd /tmp/init_tmp $ zcat inner-initramfs.img | cpio -idmv . bin conf conf/arch.conf conf/conf.d ...<contents remove for brevity>... var var/lock var/run var/tmp 426873 blocks
NOW you get what you want.
dracut ships with a utility called
skipcpio which you can pipe one of these initramfs files throught to skip the extra
lsinitramfs will list all contents
本文采用 知识共享署名 4.0 国际许可协议（CC-BY 4.0）进行许可。转载请注明来源： https://snowfrs.com/2020/08/01/Extracting-initramfs.html 欢迎对文中引用进行考证，欢迎指出任何不准确和模糊之处。