extract_kernel.py

import os
import sys

from construct import *

BOOT_IMG_HDR = Struct(
    "magic" / Const(b"ANDROID!"),
    "kernel_size" / Int32ul,
    "kernel_addr" / Int32ul,
    "ramdisk_size" / Int32ul,
    "ramdisk_addr" / Int32ul,
    "second_size" / Int32ul,
    "second_addr" / Int32ul,
    "tags_addr" / Int32ul,
    "page_size" / Int32ul,
    Padding(8),
    "name" / PaddedString(16, "utf8"),
    "cmdline" / PaddedString(512, "utf8"),
    "id" / Int32ul[8]
)

with open(sys.argv[1], "rb") as f:
    bs = f.read()

hdr = BOOT_IMG_HDR.parse(bs)
print("[*] Kernel Size: 0x%08x" % hdr.kernel_size)
print("[*] Kernel Addr: 0x%08x" % hdr.kernel_addr)

n = (hdr.kernel_size + hdr.page_size - 1) // hdr.page_size
if len(bs) < (n + 1) * hdr.page_size:
    print("[!] Not enough data: %d < %d" % (len(bs), (n + 1) * hdr.page_size))
    exit()
else:
    with open("kernel.bin.gz", "wb") as f:
        f.write(bs[1 * hdr.page_size:(1 + n) * hdr.page_size])
    os.system("gzip -dc kernel.bin.gz > kernel.bin")