AwesomeREA.org

Tool

vmlinux-to-elf

Rebuild an analyzable ELF with function and variable symbols from a Linux kernel image, whether a raw or compressed vmlinux, vmlinuz, zImage or bzImage blob, certain Android boot.img files or a stripped kernel ELF, by locating and decoding the embedded kallsyms symbol table. It detects the compression format, instruction set, endianness, word size, entry point and an approximate base address and writes an ELF for IDA Pro or Ghidra; a kallsyms-finder listing, a standalone decompressor and a GTK GUI are included.

Requirements and limitations

  • Latest release at review: 1.3.6, published 2026-05-20 on GitHub and PyPI; its notes include provisional support for reserializing section-stripped ELF kernels and uImage LZMA decompression. The reviewed master commit is four commits ahead, with GUI and packaging updates, and carries a 1.3.6.1 tag that has no release. PyPI classifies the project as beta.
  • Requires Python 3.9+ with lz4, zstandard, minilzo and peewee. The README installs the CLI and GUI with snap on Ubuntu, from the AUR, or with uv plus GTK 4, libadwaita and PyGObject development packages; Flathub provides the GUI on distributions whose libadwaita is older than 1.6.
  • Input is a kernel image the analyst already has; kernels built without CONFIG_KALLSYMS are not supported. The README states support for Linux 2.6.10 through 6.4 as of August 2023, raw-kernel architecture detection for MIPS, ARM, ARM64, PowerPC, SPARC, x86, x86-64, SuperH and ARC, XZ, LZMA, GZip, BZ2, LZ4, LZO and Zstd decompression, and OpenWrt's uncompressed kallsyms variant. Instruction set, bit size, file offset and base address can be overridden when detection fails.
  • GPL-3.0-or-later. Recovered symbols carry only the name, address and nm-style type stored in kallsyms, and the base address is a heuristic: the first text symbol address with the low 12 bits cleared. No kernel image was converted.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · marin-m/vmlinux-to-elf · Revision 2d094bc
  2. README.md#L89-L98 GitHub · marin-m/vmlinux-to-elf · Revision 2d094bc
  3. README.md#L153-L192 GitHub · marin-m/vmlinux-to-elf · Revision 2d094bc
  4. pyproject.toml GitHub · marin-m/vmlinux-to-elf · Revision 2d094bc
  5. vmlinux_to_elf/core/kallsyms.py GitHub · marin-m/vmlinux-to-elf · Revision 2d094bc
  6. LICENSE GitHub · marin-m/vmlinux-to-elf · Revision 2d094bc
  7. https://github.com/marin-m/vmlinux-to-elf/releases/tag/1.3.6
  8. https://pypi.org/project/vmlinux-to-elf/1.3.6/