How to extract the kernel assembly code from a zImage?

Question

here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to extract the zImage from the boot.img.

i found an article here to extract a gzip from the zImage but the output from arm-linux-gnueabi-objdump is kinda weird with the <UNDEFINED> instruction: 0xf1008b1f:

arm-linux-gnueabi-objdump -EL -b binary -D -m armv5t boot.img-zImage | grep 8b1f
    2f14:   f1008b1f            ; <UNDEFINED> instruction: 0xf1008b1f
    3290:   f1008b1f            ; <UNDEFINED> instruction: 0xf1008b1f
    3384:   f1008b1f            ; <UNDEFINED> instruction: 0xf1008b1f
   8a224:   2a0003f4    bcs 0x8b1fc
   8b1f0:   f9000518            ; <UNDEFINED> instruction: 0xf9000518
   8b1f4:   f9000308            ; <UNDEFINED> instruction: 0xf9000308
   8b1f8:   f9405fe8            ; <UNDEFINED> instruction: 0xf9405fe8
   8b1fc:   f9000708            ; <UNDEFINED> instruction: 0xf9000708
   8fd54:   b98b1f28    stmiblt fp, {r3, r5, r8, r9, sl, fp, ip}
   cffbc:   9a9f87e9    bls 0xfe8b1f68
   d0008:   9a9f87ea    bls 0xfe8b1fb8
  18a220:   aa0003f3    bge 0x18b1f4
  18b1f0:   f81a83a8            ; <UNDEFINED> instruction: 0xf81a83a8
  18b1f4:   b40001a2    strlt   r0, [r0], #-418 ; 0xfffffe5e
  18b1f8:   d0010268    andle   r0, r1, r8, ror #4
  18b1fc:   b94e5108    stmdblt lr, {r3, r8, ip, lr}^
^C

Also i noticed that the file type was not recognized:

user@ubuntu:~/Desktop/bootImg$ file zImage 
zImage: data

But anyway i converted the 2f14 to decimal and tried to extract a gzip archive:

dd if=zImage of=piggy.gz bs=1 skip=12052

and then tried to extract:

user@ubuntu:~/Desktop/bootImg$ gunzip piggy.gz 
gzip: piggy.gz: unknown method 0 -- not supported

also, the archive seems to be encrypted:

user@ubuntu:~/Desktop/bootImg$ file piggy.gz 
piggy.gz: gzip compressed data, reserved method, ASCII, has comment, encrypted, last modified: Fri Aug 29 04:43:12 2014, from Unix, original size modulo 2^32 0

note: i know that the oneplus kernels are opensource but i really want to practice my reverse engineering skills.

Answer 1

It's possible that the kernel is not actually gzip compressed but uses another algorithm. I would recommend using vmlinux-to-elf which can not only automatically detect the compressed stream, uncompress, and convert to an ELF but also parse the kallsyms tables and symbolize the image.