# marin-m/vmlinux-to-elf

A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

Repository: https://github.com/marin-m/vmlinux-to-elf
Canonical: https://ross.abutalabs.com/products/vmlinux-to-elf
Homepage: https://fossplant.re/wiki/Main_page
Language: Python
License: GPL-3.0
License Family: copyleft
Topics: reverse-engineering, linux-kernel, linux, vmlinux, elf, firmware-analysis
Last push: 2026-06-05T05:29:22+00:00

## Health v2 (maintenance only)
Score: 88/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 86, release rhythm 84, longevity 100
- inputs: {"age_days": 2442, "days_push": 89, "days_rel": 105, "gap_med": 2.0, "n_releases_24m": 15}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1805, forks 183 (observed 2026-08-28T04:05:38.968446+00:00)

## What it is
A Python CLI (with optional GUI) that recovers a fully analyzable ELF file from raw or stripped Linux kernel images (vmlinux, vmlinuz, bzImage, zImage) by extracting the embedded kallsyms symbol table. The output ELF can be loaded into reverse engineering tools like IDA Pro or Ghidra with recovered function and variable symbols.

## Use cases
- recover symbols from a stripped vmlinux kernel image
- convert a raw kernel blob to an ELF for Ghidra analysis
- analyze embedded device firmware kernels in IDA Pro
- decompress a vmlinuz or bzImage kernel
- find kallsyms symbol addresses in a kernel binary
- reverse engineer an Android or IoT Linux kernel

## When to choose
- you need symbol names for reverse engineering a Linux kernel image
- you only have a raw or stripped kernel binary and want an analyzable ELF
- you do embedded systems or firmware security research

## When to avoid
- you need to reverse engineer userspace binaries rather than kernel images
- you want a full disassembler or decompiler - use Ghidra or IDA Pro instead
- the kernel has been deliberately hardened to remove or corrupt kallsyms

## Facets
- artifact type: cli-tool
- maturity: stable
- function: reverse-engineering, parser, developer-tools, security
- domain: reverse-engineering, operating-systems, security, embedded-systems, developer-tools
- platform: python, cli, cross-platform
- tags: kallsyms, vmlinux, elf, firmware-analysis, linux-kernel, ghidra, ida-pro, linux

## Member repositories
- marin-m/vmlinux-to-elf (main) score 88

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:38.968446+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:21:34.112375+00:00, confidence not recorded.
  - readme: https://github.com/marin-m/vmlinux-to-elf (fetched 2026-08-28T04:05:38.968446+00:00, sha 309579c1fb79)
  - homepage: https://fossplant.re/wiki/Main_page (fetched 2026-08-29T11:00:43.271119+00:00, sha a0ed9079bc39)
  - registry_pypi: https://pypi.org/pypi/vmlinux-to-elf/json (fetched 2026-08-29T11:00:43.275606+00:00, sha f8a76ed9249b)
- Data as of 2026-08-30T08:39:29.467469+00:00.