Decompressing zImage

Question

I have a firmware that I've dumped from a phone. I found a uImage header and a zImage after running binwalk. The header says that the image is uncompressed, however I've read that zImages are usually compressed with lzma, xz, gzip, etc. Does this mean the zImage is uncompressed and I can work with it directly, without decompressing it?

352768        0x56200         uImage header, header size: 64 bytes, header CRC: 0xFAAD7908, created: 2015-09-01 19:12:03, image size: 1283768 bytes, Data Address: 0xC8008000, Entry Point: 0xC8008000, data CRC: 0xB0AF08F8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.4.20-rt31-dvf-v1.2.6.1-r"
352832        0x56240         Linux kernel ARM boot executable zImage (little-endian)

Answer 1

the zImage kernel is "uncompressed" in the meaning that it can be just copied to some place in RAM and run from there as-is, without additional decompression step. The bulk of the kernel is still compressed (most often with gzip), however there is a small uncompressed stub prepended to it which does the decompression in-place. So, depending on your goals, you can either just disassemble the start of the file to look at the decompressor code, or find the compressed data (searching for 1F 8B is a good starting point), decompress it and then disassemble that.

https://acassis.wordpress.com/2015/06/04/how-to-recover-and-decompress-a-linux-kernel-dumped-mtd-partition/

You can also try the extract-vmlinux script which tries to automate these steps: https://github.com/torvalds/linux/blob/master/scripts/extract-vmlinux