从安卓系统USB升级包里提取system.img、boot.img和recovery.img在内的镜像文件

1.前言

如果你拿到一个USB升级包，你会发现升级包的结构基本相似。

但是里面并不是直接就有包括system.img、boot.img和recovery.img在内的镜像文件。

如果我们需要在Android手机上获取MaGISk。提取内核（boot.img）就至关重要。当然其他镜像根据你的需要也有其他用处。

这时，如果你需要这些镜像文件，怎么做呢？

关注 "升级包>update.zip>payload.bin"。我们这篇的博客的目的就是从payload.bin中提取出镜像文件。

2. 环境准备的提取步骤

2.1 下载payload_dumper

打开 

• GitHub - vm03/payload_dumper: Android OTA payload dumper

获取程序的压缩包解压放置合适的目录

2.2 安装库文件 

从压缩包里检查requirements.txt,里面有需要的python库的版本：

protobuf>=3.19.3, <=3.20.1six>=1.16.0bsdiff4>=1.1.5

安装指定版本的Python库：

D:\zyy\payload_dumper-master\payload_dumper-master>pip install bsdiff4Collecting bsdiff4  Downloading bsdiff4-1.2.3-cp39-cp39-win_amd64.whl (18 kB)Installing collected packages: bsdiff4Successfully installed bsdiff4-1.2.3D:\Users\zhangyy\AppData\Local\Programs\Python\Python39\Lib\site-packages\protobuf-python-3.20.1\protobuf-3.20.1>pip install protobuf==3.20.1Collecting protobuf==3.20.1  Downloading protobuf-3.20.1-cp39-cp39-win_amd64.whl (904 kB)     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 904.1/904.1 kB 202.8 kB/s eta 0:00:00Installing collected packages: protobufSuccessfully installed protobuf-3.20.1[notice] A new release of pip available: 22.3.1 -> 23.0.1[notice] To update, run: python.exe -m pip install --upgrade pip

检查是否都安装成功：

D:\Users\zhangyy\AppData\Local\Programs\Python\Python39\Lib\site-packages\protobuf-python-3.20.1\protobuf-3.20.1>pip listPackage      Version------------ -------asgiref      3.5.2bcrypt       4.0.1bsdiff4      1.2.3cffi         1.15.1cryptography 38.0.4Django       4.1.3paramiko     2.12.0pip          22.3.1protobuf     3.20.1pycparser    2.21PyNaCl       1.5.0setuptools   56.0.0six          1.16.0sqlparse     0.4.3tzdata       2022.6

OK，都安装成功而且版本合适。

2.3 执行镜像提取

将USB升级包的update.zip解压后拖到payload_dumper.py的同级目录执行

D:\zyy\payload_dumper-master\payload_dumper-master>python payload_dumper.py ota_package_update\payload.binProcessing abl partition.DoneProcessing bluetooth partition.DoneProcessing boot partition................................DoneProcessing cmnlib partition.DoneProcessing cmnlib64 partition.DoneProcessing devcfg partition.DoneProcessing dsp partition................DoneProcessing dtbo partition....DoneProcessing hyp partition.DoneProcessing imagefv partition.DoneProcessing keymaster partition.DoneProcessing modem partition....................................................DoneProcessing product partition........................................................................................................................DoneProcessing qupfw partition.DoneProcessing recovery partition................................................DoneProcessing rpm partition.DoneProcessing system partition............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................DoneProcessing tz partition.DoneProcessing uefisecapp partition.DoneProcessing vbmeta partition.DoneProcessing vbmeta_system partition.DoneProcessing vendor partition....................................................................................................................................................................................................................................................DoneProcessing xbl partition..DoneProcessing xbl_config partition.Done

执行完成后查看output目录

OK，这样就成功了，是不是很简单。

3. 利用脚本批量提取boot.img

将大量USB升级包放在 E:\store materials\all_firms_bak 目录下。

由于里面文件很多，经过分析，将“ "**" in nm and "ota" not in nm and len(nm) < 56” 作为筛选合适的USB升级包的判断条件。

payload_dumper-master脚本安装在 D:\zyy\payload_dumper-master\payload_dumper-master。

根据这些已知条件，编写python代码如下：

import osimport shutilimport zipfileimport timecount = 0def extract_img():    global count    zip_dir = r"E:\store materials\all_firms_bak"    for rt, dirs, fl in os.walk(zip_dir, topdown=True):        for nm in fl:            # if nm == "boot.img":            if "**" in nm and "ota" not in nm and len(nm) < 56:                file_path_name = str(rt) + "\\" + str(nm)                print("文件:", file_path_name)                unzip_and_extract_bootimg(file_path_name)                count = count + 1                print("bootimg count is:", count)                # 获取当前时间                current_time = int(time.time())                print(current_time)  # 1631186249                # 转换为localtime                localtime = time.localtime(current_time)                # 利用strftime()函数重新格式化时间                dt = time.strftime('%Y:%m:%d %H:%M:%S', localtime)                print(dt)  # 返回当前时间：2021:09:09 19:17:29        # for _dir in dirs:        # print("目录:", str(rt) + "\\" + str(_dir))# 解压缩def unzip_and_extract_bootimg(file_name):    payload_dumper_path = r"D:\zyy\payload_dumper-master\payload_dumper-master"    payload_dumper_ota_package_path = r"D:\zyy\payload_dumper-master\payload_dumper-master\ota_package_update/"    payload_dumper_putput_path = r"D:\zyy\payload_dumper-master\payload_dumper-master\output"    print("file_name is: ", file_name)    zip_file = zipfile.ZipFile(file_name)    if os.path.isdir(file_name + "_files"):        print("dir already exits! do not need unzip")    else:        # 从升级压缩包提取出update.zip子压缩包        os.mkdir(file_name + "_files")        filepath_package = file_name + "_files/"        print("destfilepath is: ", filepath_package)        zip_file.extractall(path=filepath_package, members=['update.zip'])        # 打印此时update.zip所在路径        file_path_updatezip = filepath_package + r"update.zip"        print("the path of update.zip is: ", file_path_updatezip)        # 从update.zip里提取payload.bin（payload.bin通过脚本制作出boot.img）        zip_file_bin = zipfile.ZipFile(file_path_updatezip)        zip_file_bin.extractall(path=filepath_package + "update/", members=["payload.bin"])        file_path_payloadbin = filepath_package + r"update/" + r"payload.bin"        print("file path payloadbin is ", file_path_payloadbin)        print("close zip_file")        zip_file.close()        mycopyfile(file_path_payloadbin, payload_dumper_ota_package_path)        print("move payload.bin sucess!")        os.chdir(payload_dumper_path)        print(os.getcwd())        ret = os.system(            "python payload_dumper.py ota_package_update\payload.bin")        store_bootimg_path = str(file_path_payloadbin).replace("all_firms_bak", "all_boot_test") + r"/"        if os.path.exists(payload_dumper_putput_path + r"\boot.img"):            mycopyfile(payload_dumper_putput_path + r"\boot.img", store_bootimg_path)            os.remove(r"D:\zyy\payload_dumper-master\payload_dumper-master\ota_package_update\payload.bin")            for f in os.listdir(r"D:\zyy\payload_dumper-master\payload_dumper-master\output"):                os.remove(os.path.join(r"D:\zyy\payload_dumper-master\payload_dumper-master\output", f))            time.sleep(3)            print("extract bootimg completed!")            return        else:            print("boot.img not exits!")def mycopyfile(srcfile, dstpath):  # 复制函数    if not os.path.isfile(srcfile):        print("%s not exist!" % (srcfile))    else:        fpath, fname = os.path.split(srcfile)  # 分离文件名和路径        if not os.path.exists(dstpath):            os.makedirs(dstpath)  # 创建路径        shutil.copy(srcfile, dstpath + fname)  # 复制文件        print("copy %s -> %s" % (srcfile, dstpath + fname))# Press the green button in the gutter to run the script.if __name__ == '__main__':    extract_img()# See PyCharm help at https://www.jetbrains.com/help/pycharm/

执行结果：

只需要半天的时间，脚本成功帮助我们提取了数百个boot.img。

4.总结

        安卓系统USB升级包里其实是有镜像信息的，需要你做一个提取。

来源地址：https://blog.csdn.net/qq_33163046/article/details/129293610