I'm trying to extract the ELF kernel image from Samsung S9 zImage.
All the information I could find is outdated and didn't work for me.
Here's what I tried:
$ binwalk ./zImage
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
109488 0x1ABB0 SHA256 hash constants, little endian
13107320 0xC80078 Linux kernel version "4.9.59 (fuzz@fuzzy) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Mon Dec 2 21:23:06 AEDT 2019"
13135872 0xC87000 ELF, 64-bit LSB shared object, version 1 (SYSV)
13155800 0xC8BDD8 gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
13468623 0xCD83CF Private key in DER format (PKCS header length: 4, sequence length: 2345
13522696 0xCE5708 LZO compressed data
13524096 0xCE5C80 CRC32 polynomial table, little endian
13956632 0xD4F618 CRC32 polynomial table, little endian
15232073 0xE86C49 eCos RTOS string reference: "ecos_booster_init"
15232097 0xE86C61 eCos RTOS string reference: "ecos_booster_request_pm_qos"
15232129 0xE86C81 eCos RTOS string reference: "ecos_booster_start"
15232153 0xE86C99 eCos RTOS string reference: "ecos_booster_stop"
16398151 0xFA3747 Boot section Start 0x43434342 End 0x72
16398155 0xFA374B Boot section Start 0x72 End 0x0
16564344 0xFCC078 YAFFS filesystem
16783528 0x10018A8 SHA256 hash constants, little endian
16921164 0x102324C Unix path: /home/euleyskiy/Perforce/SRK_EULEYSKIY_SEC_DEV3/DEV/Solution/SecurityDev3/SURC/FIVE/DEV/trusted_app/arch/tbase/stack_protector.c
16924308 0x1023E94 Unix path: /home/vm-user/Workspace/MCD_MSL_DEV_IMAKARCHUK_Ubuntu/DEV/Solution/SecurityDev/SubTG/Multibuild/DEV/libgpapi_crypto/src/storage.
16924740 0x1024044 Unix path: /home/vm-user/Workspace/MCD_MSL_DEV_IMAKARCHUK_Ubuntu/DEV/Solution/SecurityDev/SubTG/Multibuild/DEV/libgpapi_crypto/src/crypto_r
16926392 0x10246B8 Unix path: /home/euleyskiy/Perforce/SRK_EULEYSKIY_SEC_DEV3/DEV/Solution/SecurityDev/SubTG/Multibuild/DEV/multibuild/source/gp-api/prop/src/
16926828 0x102486C Unix path: /home/euleyskiy/Perforce/SRK_EULEYSKIY_SEC_DEV3/DEV/Solution/SecurityDev/SubTG/Multibuild/DEV/multibuild/source/gp-api/persisten
16969177 0x102EDD9 Unix path: /../../crypto/cipher/cipher.c
16970721 0x102F3E1 Unix path: /../../crypto/bn/add.c
16974228 0x1030194 Base64 standard index table
17937463 0x111B437 mcrypt 2.2 encrypted data, mode: CBC, keymode: 8bit
17944943 0x111D16F Unix path: /arch/arm64/include/asm/mmu_context.h
17955348 0x111FA14 Unix path: /arch/arm64/include/asm/pgtable.h
17959554 0x1120A82 Unix path: /include/trace/events/sched.h
18001357 0x112ADCD Unix path: /proc/sys/kernel/hung_task_timeout_secs" disables this message.
18013859 0x112DEA3 Unix path: /arch/arm64/include/asm/pgalloc.h
18167662 0x115376E xz compressed data
...
According to various sources the image is the LZOP part (LZO at offset 13522696):
$ dd if=./zImage of=out.lzop bs=13522696 skip=1
$ file out.lzop
out.lzop: lzop compressed data - version 0.000, os: MS-DOS
$ lzop -d out.lzop
lzop: out.lzop: header corrupted