here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to extract the zImage from the boot.img.
i found an article here to extract a gzip from the zImage but the output from arm-linux-gnueabi-objdump
is kinda weird with the <UNDEFINED> instruction: 0xf1008b1f
:
arm-linux-gnueabi-objdump -EL -b binary -D -m armv5t boot.img-zImage | grep 8b1f
2f14: f1008b1f ; <UNDEFINED> instruction: 0xf1008b1f
3290: f1008b1f ; <UNDEFINED> instruction: 0xf1008b1f
3384: f1008b1f ; <UNDEFINED> instruction: 0xf1008b1f
8a224: 2a0003f4 bcs 0x8b1fc
8b1f0: f9000518 ; <UNDEFINED> instruction: 0xf9000518
8b1f4: f9000308 ; <UNDEFINED> instruction: 0xf9000308
8b1f8: f9405fe8 ; <UNDEFINED> instruction: 0xf9405fe8
8b1fc: f9000708 ; <UNDEFINED> instruction: 0xf9000708
8fd54: b98b1f28 stmiblt fp, {r3, r5, r8, r9, sl, fp, ip}
cffbc: 9a9f87e9 bls 0xfe8b1f68
d0008: 9a9f87ea bls 0xfe8b1fb8
18a220: aa0003f3 bge 0x18b1f4
18b1f0: f81a83a8 ; <UNDEFINED> instruction: 0xf81a83a8
18b1f4: b40001a2 strlt r0, [r0], #-418 ; 0xfffffe5e
18b1f8: d0010268 andle r0, r1, r8, ror #4
18b1fc: b94e5108 stmdblt lr, {r3, r8, ip, lr}^
^C
Also i noticed that the file type was not recognized:
user@ubuntu:~/Desktop/bootImg$ file zImage
zImage: data
But anyway i converted the 2f14
to decimal and tried to extract a gzip archive:
dd if=zImage of=piggy.gz bs=1 skip=12052
and then tried to extract:
user@ubuntu:~/Desktop/bootImg$ gunzip piggy.gz
gzip: piggy.gz: unknown method 0 -- not supported
also, the archive seems to be encrypted:
user@ubuntu:~/Desktop/bootImg$ file piggy.gz
piggy.gz: gzip compressed data, reserved method, ASCII, has comment, encrypted, last modified: Fri Aug 29 04:43:12 2014, from Unix, original size modulo 2^32 0
note: i know that the oneplus kernels are opensource but i really want to practice my reverse engineering skills.