0

I have a big-endian zImage file that I dumped from a flash chip.

I dug through the hex dump of zImage and found an xz header (FD 37 7A 58 5A 00), leading me to believe it was compressed with xz.

01c2010 4d00 8c5d 0000 0000 4d00 4a60 0000 0000
01c2020 7a58 fd37 0001 5a00 de36 6922 edc2 03c0

How can I use dd to grab the file starting from the header, and how can I decompress the file? I'm working on a little-endian ThinkPad.

Dylan Leggio
  • 51
  • 1
  • 2

1 Answers1

2

Yes, it is rather unlikely that that byte sequence showed up by chance. That is an xz header.

There is no such thing as a "big-endian xz file". It is just an xz stream in that file. Simply extract the stream from the header to the end of the file. The xz format is self-terminating, so decompressing with xz will ignore the junk at the end.

Mark Adler
  • 101,978
  • 13
  • 118
  • 158