How to extract android boot.img ?

boot: The boot partition contains a kernel image and a RAM disk combined via mkbootimg. In order to flash the kernel directly without flashing a new boot partition, a virtual partition can be used:

• kernel: The virtual kernel partition overwrites only the kernel (zImage, zImage-dtb, Image.gz-dtb) by writing the new image over the old one. To do this, it determines the start location of the existing kernel image in eMMC and copies to that location, keeping in mind that the new kernel image may be larger than the existing one. The bootloader can either make space by moving any data following it or abandoning the operation with an error. If the development kernel supplied is incompatible, you may need to update the dtb partition if present, or vendor or system partition with associated kernel modules.
• ramdisk: The virtual ramdisk partition overwrites only the RAM disk by writing the new image over the old one. To do this, it determines the start location of the existing ramdisk.img in eMMC and copies to that location, keeping in mind that the new RAM disk maybe be larger than the existing one. The bootloader can either make space by moving any data following it or abandon the operation with an error.

For extracting boot.img, we need to install abootimg on ubuntu using below command,

$ sudo apt-get install abootimg

Now, lets copy boot.img which we want to extract into temporary directory and check its information as below,

$ mkdir extract_bootimg

$ cd extract_bootimg

$ cp dir_of_bootimage/boot.img .

$ abootimg -i boot.img

Android Boot Image Info:

* file name = boot.img 

* image size = 6301696 bytes (6.01 MB)
  page size  = 2048 bytes

* Boot Name = ""

* kernel size       = 5182480 bytes (4.94 MB)
  ramdisk size      = 1107054 bytes (1.06 MB)
  second stage size = 1107054 bytes (1.06 MB)

* load addresses:
  kernel:       0x10008000
  ramdisk:      0x11000000
  second stage: 0x10f00000
  tags:         0x10000100

* cmdline = pci=noearly vmalloc=256M ptrace.ptrace_can_access=1 earlyprintk=nologger loglevel=8 androidboot.hardware=hw_name androidboot.serialno=01234567890123456789 snd_pcm.maximum_substreams=8 intel_soc_pmu.enable_s3=0

As we can see above “abootimg -i boot.img” displays the boot image information such as kernel image size, ramdisk size and boot arguments of the kernel.

Now, lets extract the boot.img as,

$ abootimg -x boot.img 
writing boot image config in bootimg.cfg
extracting kernel in zImage
extracting ramdisk in initrd.img
extracting second stage image in stage2.img

$ tree
.
├── boot.img
├── bootimg.cfg
├── initrd.img
├── stage2.img
└── zImage

0 directories, 5 files

As we can see above extracting boot.img, we are able to separate kernel image zImage, initrd root file system image initrd.img

Extracting root file system from initrd.img

$ mv initrd.img initrd.gz

$ gunzip initrd.gz

$ mkdir initrd-rfs

$ cp initrd initrd-rfs/

$ cd initrd-rfs/

$ file initrd 
initrd: ASCII cpio archive (SVR4 with no CRC)

$ cpio -id < initrd

This will extract initrd into initrd-rfs/ directory as.

$ tree
.
├── charger -> /sbin/healthd
├── data
├── default.prop
├── dev
├── file_contexts
├── init
├── init.environ.rc
├── init.rc
├── initrd
├── init.trace.rc
├── init.usb.configfs.rc
├── init.usb.rc
├── init.zygote32.rc
├── oem
├── proc
├── property_contexts
├── sbin
│ ├── adbd
│ ├── healthd
│ ├── ueventd -> ../init
│ └── watchdogd -> ../init
├── seapp_contexts
├── selinux_version
├── sepolicy
├── service_contexts
├── sys
├── system
└── ueventd.rc

Reference – https://github.com/ggrandou/abootimg
https://source.android.com/devices/bootloader/partitions-images