Search code examples
linux-kernelcoredump

Is it possible to figure Linux kernel version from a snapshot of system physical memory?

I was wondering if given a snapshot of the physical memory os system running Linux OS it is possible the figure out what is the Kernel version it was running? I don't have access to the image or anything.

Solution

  • The kernel version is into the physical memory dump of the kernel as returned by /proc/version from the struct new_utsname defined into include/uapi/linux/utsname.h. I suggest to first try the 'strings' command on your kernel dump and try to identify part of the pattern usually returned by /proc/version.

    The Linux source init/version.c define this:

    const char linux_banner[] =
"Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n"

    So a search of the string "Linux version" into the dump should give you the location of the linux_banner string that contain the information returned by /proc/version.