Unpacking and Repacking the initramfs

# Unpack the rootfs to inspect / add your exploit:
mkdir fs && cd fs
cpio -idm < ../rootfs.cpio        # (gunzip first if compressed)

# ... cross-compile exploit.c -> place static binary in fs ...

# Repack for QEMU to boot:
find . | cpio -o -H newc > ../rootfs_new.cpio

• The initramfs is a cpio archive (sometimes gzip'd). You unpack it, read the init script, and see how the vulnerable module is loaded.
• Compile your exploit statically (the tiny rootfs has no libc), drop the binary in, and repack.
• Boot the new image, run your exploit, read the flag. Fast, safe, fully offline iteration.