Sample Header Ad - 728x90

Calculate byte offset for unquashfs

2 votes
1 answer
208 views
I'm trying to calculate the -o value for extracting an .AppImage file using unsquashfs on foreign architectures/OSs , but using objdump instead of readelf to make the solution more compatible with OSs such as macOS.
unsquashfs

Usage:

-o BYTES, -offset BYTES
              skip BYTES at start of FILESYSTEM.  Optionally a suffix of K, M or G can be given to specify Kbytes, Mbytes or Gbytes respectively (default 0
              bytes).
I'm following the guidance of [this solution](https://superuser.com/a/1690054?_gl=1*1ytjlvt*_ga*MTU2NzA5OTc3NS4xNzMzMzU0NzA4*_ga_S812YQPLT2*MTczNzA0OTY3Ny4xMS4xLjE3MzcwNTEwMzQuMC4wLjA.) , which uses readelf to calculate the -o offset value. This works great on Ubuntu, but does not work for macOS due to the generally unavailability of readelf. However, I'd like to use objdump if possible. I've found a few questions that explain how to find the entry point/offset of a binary executable, but no matter what values I try, I can't find a way to get the correct value for unsquashfs. I'm converting hex values to decimal, but nothing from objdump matches up to the readelf values below, even when using [Employed Russian's](https://stackoverflow.com/a/71367851) ehdr->e_entry - phdr->p_vaddr + phdr->p_offset. equation. * https://stackoverflow.com/a/71367851 * https://stackoverflow.com/a/57841768 * https://stackoverflow.com/a/16019798 For example, take Audacity's AppImage for example:
https://github.com/audacity/audacity/releases/download/Audacity-3.7.1/audacity-linux-3.7.1-x64-22.04.AppImage 
* Calling readelf -h audacity-linux-3.7.1-x64-22.04.AppImage gives me some helpful values, such as Start of section headers, Size of section headers, Number of section headers. * Next, using [Martin Vyskočil's](https://superuser.com/a/1690054?_gl=1*1sf6dim*_ga*MTU2NzA5OTc3NS4xNzMzMzU0NzA4*_ga_S812YQPLT2*MTczNzA0OTY3Ny4xMS4xLjE3MzcwNTExMDEuMC4wLjA.) $START_OF_SECTION + $SECTION_SIZE * $SECTION_NO logic , I can get a correct value of 191680 + 64 * 32, which is 193728. * The following command succeeds (on macOS and Ubuntu):
unsquashfs -o 193728 audacity-linux-3.7.1-x64-22.04.AppImage squashfs-root
... but how can I calculate this offset value with objdump instead of readelf?
Asked by tresf (355 rep)
Jan 16, 2025, 06:10 PM
Last activity: Mar 31, 2025, 10:19 PM