从安卓系统USB升级包里提取system.img、boot.img和recovery.img在内的镜像文件

2024-02-17 05:36| 来源: 网络整理| 查看: 265

1.前言

如果你拿到一个USB升级包，你会发现升级包的结构基本相似。

但是里面并不是直接就有包括system.img、boot.img和recovery.img在内的镜像文件。

如果我们需要在Android手机上获取Magisk。提取内核（boot.img）就至关重要。当然其他镜像根据你的需要也有其他用处。

这时，如果你需要这些镜像文件，怎么做呢？

关注 "升级包>update.zip>payload.bin"。我们这篇的博客的目的就是从payload.bin中提取出镜像文件。

2. 环境准备的提取步骤 2.1 下载payload_dumper

打开

GitHub - vm03/payload_dumper: Android OTA payload dumper

获取程序的压缩包解压放置合适的目录

2.2 安装库文件

从压缩包里检查requirements.txt,里面有需要的python库的版本：

protobuf>=3.19.3, =1.16.0 bsdiff4>=1.1.5

安装指定版本的python库：

D:\zyy\payload_dumper-master\payload_dumper-master>pip install bsdiff4 Collecting bsdiff4 Downloading bsdiff4-1.2.3-cp39-cp39-win_amd64.whl (18 kB) Installing collected packages: bsdiff4 Successfully installed bsdiff4-1.2.3 D:\Users\zhangyy\AppData\Local\Programs\Python\Python39\Lib\site-packages\protobuf-python-3.20.1\protobuf-3.20.1>pip install protobuf==3.20.1 Collecting protobuf==3.20.1 Downloading protobuf-3.20.1-cp39-cp39-win_amd64.whl (904 kB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 904.1/904.1 kB 202.8 kB/s eta 0:00:00 Installing collected packages: protobuf Successfully installed protobuf-3.20.1 [notice] A new release of pip available: 22.3.1 -> 23.0.1 [notice] To update, run: python.exe -m pip install --upgrade pip

检查是否都安装成功：

D:\Users\zhangyy\AppData\Local\Programs\Python\Python39\Lib\site-packages\protobuf-python-3.20.1\protobuf-3.20.1>pip lis t Package Version ------------ ------- asgiref 3.5.2 bcrypt 4.0.1 bsdiff4 1.2.3 cffi 1.15.1 cryptography 38.0.4 Django 4.1.3 paramiko 2.12.0 pip 22.3.1 protobuf 3.20.1 pycparser 2.21 PyNaCl 1.5.0 setuptools 56.0.0 six 1.16.0 sqlparse 0.4.3 tzdata 2022.6

OK，都安装成功而且版本合适。

2.3 执行镜像提取

将USB升级包的update.zip解压后拖到payload_dumper.py的同级目录执行

D:\zyy\payload_dumper-master\payload_dumper-master>python payload_dumper.py ota_package_update\payload.bin Processing abl partition.Done Processing bluetooth partition.Done Processing boot partition................................Done Processing cmnlib partition.Done Processing cmnlib64 partition.Done Processing devcfg partition.Done Processing dsp partition................Done Processing dtbo partition....Done Processing hyp partition.Done Processing imagefv partition.Done Processing keymaster partition.Done Processing modem partition....................................................Done Processing product partition........................................................................................................................Done Processing qupfw partition.Done Processing recovery partition................................................Done Processing rpm partition.Done Processing system partition............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Done Processing tz partition.Done Processing uefisecapp partition.Done Processing vbmeta partition.Done Processing vbmeta_system partition.Done Processing vendor partition....................................................................................................................................................................................................................................................Done Processing xbl partition..Done Processing xbl_config partition.Done

执行完成后查看output目录

OK，这样就成功了，是不是很简单。

3. 利用脚本批量提取boot.img

将大量USB升级包放在 E:\store materials\all_firms_bak 目录下。

由于里面文件很多，经过分析，将“ "**" in nm and "ota" not in nm and len(nm) < 56” 作为筛选合适的USB升级包的判断条件。

payload_dumper-master脚本安装在 D:\zyy\payload_dumper-master\payload_dumper-master。

根据这些已知条件，编写python代码如下：

import os import shutil import zipfile import time count = 0 def extract_img(): global count zip_dir = r"E:\store materials\all_firms_bak" for rt, dirs, fl in os.walk(zip_dir, topdown=True): for nm in fl: # if nm == "boot.img": if "**" in nm and "ota" not in nm and len(nm) < 56: file_path_name = str(rt) + "\\" + str(nm) print("文件:", file_path_name) unzip_and_extract_bootimg(file_path_name) count = count + 1 print("bootimg count is:", count) # 获取当前时间 current_time = int(time.time()) print(current_time) # 1631186249 # 转换为localtime localtime = time.localtime(current_time) # 利用strftime()函数重新格式化时间 dt = time.strftime('%Y:%m:%d %H:%M:%S', localtime) print(dt) # 返回当前时间：2021:09:09 19:17:29 # for _dir in dirs: # print("目录:", str(rt) + "\\" + str(_dir)) # 解压缩 def unzip_and_extract_bootimg(file_name): payload_dumper_path = r"D:\zyy\payload_dumper-master\payload_dumper-master" payload_dumper_ota_package_path = r"D:\zyy\payload_dumper-master\payload_dumper-master\ota_package_update/" payload_dumper_putput_path = r"D:\zyy\payload_dumper-master\payload_dumper-master\output" print("file_name is: ", file_name) zip_file = zipfile.ZipFile(file_name) if os.path.isdir(file_name + "_files"): print("dir already exits! do not need unzip") else: # 从升级压缩包提取出update.zip子压缩包 os.mkdir(file_name + "_files") filepath_package = file_name + "_files/" print("destfilepath is: ", filepath_package) zip_file.extractall(path=filepath_package, members=['update.zip']) # 打印此时update.zip所在路径 file_path_updatezip = filepath_package + r"update.zip" print("the path of update.zip is: ", file_path_updatezip) # 从update.zip里提取payload.bin（payload.bin通过脚本制作出boot.img） zip_file_bin = zipfile.ZipFile(file_path_updatezip) zip_file_bin.extractall(path=filepath_package + "update/", members=["payload.bin"]) file_path_payloadbin = filepath_package + r"update/" + r"payload.bin" print("file path payloadbin is ", file_path_payloadbin) print("close zip_file") zip_file.close() mycopyfile(file_path_payloadbin, payload_dumper_ota_package_path) print("move payload.bin sucess!") os.chdir(payload_dumper_path) print(os.getcwd()) ret = os.system( "python payload_dumper.py ota_package_update\payload.bin") store_bootimg_path = str(file_path_payloadbin).replace("all_firms_bak", "all_boot_test") + r"/" if os.path.exists(payload_dumper_putput_path + r"\boot.img"): mycopyfile(payload_dumper_putput_path + r"\boot.img", store_bootimg_path) os.remove(r"D:\zyy\payload_dumper-master\payload_dumper-master\ota_package_update\payload.bin") for f in os.listdir(r"D:\zyy\payload_dumper-master\payload_dumper-master\output"): os.remove(os.path.join(r"D:\zyy\payload_dumper-master\payload_dumper-master\output", f)) time.sleep(3) print("extract bootimg completed!") return else: print("boot.img not exits!") def mycopyfile(srcfile, dstpath): # 复制函数 if not os.path.isfile(srcfile): print("%s not exist!" % (srcfile)) else: fpath, fname = os.path.split(srcfile) # 分离文件名和路径 if not os.path.exists(dstpath): os.makedirs(dstpath) # 创建路径 shutil.copy(srcfile, dstpath + fname) # 复制文件 print("copy %s -> %s" % (srcfile, dstpath + fname)) # Press the green button in the gutter to run the script. if __name__ == '__main__': extract_img() # See PyCharm help at https://www.jetbrains.com/help/pycharm/

执行结果：

只需要半天的时间，脚本成功帮助我们提取了数百个boot.img。

4.总结

安卓系统USB升级包里其实是有镜像信息的，需要你做一个提取。

【本文地址】

公司简介

联系我们