Guide on how to extract a boot image from any Android phone without needing to root using Magisk, without stock firmware or a custom recovery.
- Introduction
- Getting Started
- Checking Device Compatibility
- Understanding GSI Naming Conventions
- Flashing the GSI
- Disclaimer
Rooting an Android device often requires a boot image for patching, but obtaining this image can be challenging for users of newer devices. Custom recoveries may not be available due to limited development support, and official stock firmware images can be hard to find online. This guide offers a solution to extract the boot image from your Android device without needing to root it first, download firmware, or rely on a custom recovery.
We achieve this by temporarily flashing a Phh Based Generic System Image (GSI) that ships with phh's Superuser. Which is pre-rooted and has built-in superuser capabilities.
Why do GSIs ship with phh's Superuser?
Pierre-Hugues Husson Explained:
GSI are in constant development and debugging, and it's impossible to debug GSI issues without being rooted. Which is why a su is required. Magisk is unsuitable for several reasons:
- It breaks several expectations a ROM can make. One big instance is: The SELinux policy it compiles is the one that is going to be used. There has been many and many issues caused by magisk because of this. It also breaks other expectations, like the mounted environment when /init is executed.
- Magisk is "system-less", you can NOT put it in a system.img. The vast majority of devices don't have custom recoveries, or even available stock factory image, so you can't root them with magisk, unless you already have a root (sooo you do need a root)
- GSI are guaranteed to work by Google certification. If a device ships with Google apps, it is guaranteed that same-Android version unmodified AOSP GSI will work! Magisk being in system.img, there is absolutely no guarantee it will work, and it'll most of the time not work.
Guide Target Audience: Android users and developers with basic device modification knowledge.
Caution
Please note that these procedures may risk data loss, voided warranties, or device bricking. Proceed only if you understand these risks.
Before diving into the guide, please thoroughly review the Frequently Asked Questions (FAQ) to understand the basics of GSI and the various naming conventions used by GSI builders and maintainers.
GSIs require Project Treble support. Verify compatibility:
- Install Treble Info: Download Treble Info App from Here.
- Check Support: Open the app and look for a green checkmark ✅, which indicates that the phone is Treble supported.
- Note Specs: Look for architecture (e.g., arm64), partition style (A-only or A/B), and VNDKLite requirement in the "Required Image" section.
GSI filenames encode compatibility details using the format: {arm|a64|arm64}_{a|b}{v|g|o}{N|S}-{signed|vndklite|personal}.
| Component | Options | Description |
|---|---|---|
| Architecture | arm (32-bit, deprecated)a64 (32-bit with 64-bit binder)arm64 (64-bit) |
Matches device CPU architecture. Most modern devices are arm64. |
| Partition | a (A-only, deprecated)b (A/B) |
Indicates system partition style. A/B is common for newer devices. |
| Features | v (vanilla, no GApps)g (GApps)o (Go GApps)f (MicroG, rare)S (PHH Superuser)N (no superuser)Z (Dynamic Superuser, rare) |
Specifies GApps inclusion and superuser status. S is required for root. |
| Build Type | signed (maintainer's keys)vndklite (VNDKLite or writable /system)personal (custom mods)secure (no superuser, spoofed props, rare) |
Additional attributes. vndklite is for specific devices or writable needs. |
First, use the Treble Info app to identify your phone's architecture, partition style, and VNDKLite needs. Then, according to that information, choose a specific GSI from this PHH GSI List.
Note
- You must select a GSI that comes pre-rooted. Meaning GSI variants marked with 'S' in the filename.
- If Treble Info indicates VNDKLite, choose a
vndkliteGSI. - Choose
v(vanilla) org(GApps) based on preference; vanilla minimizes potential issues.
If you're unfamiliar with flashing a GSI or unsure how to proceed, watch this YouTube video or search online for additional guides. You can also join the PHH GSI support group on Telegram for assistance: https://t.me/phhtreble.
Alternatively, the DSU sideloader can be used to install GSIs via Android's DSU feature with ease. For a detailed explanation, watch this YouTube video.
-
Install Termux: Download and install Termux on your device.
-
Grant Storage Permissions: Open Termux and allow storage permissions using the command:
termux-setup-storage
-
Check if the PHH Superuser app is already installed: Copy & paste the following command in terminal and check output.
(pm list packages | grep me.phh.superuser) && echo "App installed" || echo "Not found"
Important
If "Not found" is displayed, install the app from here. This app is necessary to grant Termux requests to run as root.
-
Now type
su, and approve the superuser request from the PHH app to gain root access. -
With superuser permission, you can access any system file. Copy and enter the following command in Termux:
for PARTITION in "boot" "boot_a" "boot_b"; do BLOCK=$(find /dev/block \( -type b -o -type c -o -type l \) -iname "$PARTITION" -print -quit 2>/dev/null) if [ -n "$BLOCK" ]; then echo "$PARTITION" = $(readlink -f "$BLOCK") fi done
This command will display the boot partition paths for both A/B and A-only devices.
Tip
On A/B devices, the loop command will display the boot partition paths for both slots, something like this:
boot_a = /dev/block/sda40
boot_b = /dev/block/sda41In this case, you can extract the image corresponding to your currently active slot. To determine the active slot, enter the command getprop ro.boot.slot_suffix. If the output is _a, use the path for boot_a; otherwise, use the path for boot_b.
-
Finally, use the following command to extract the image from the specified boot path:
dd if=<boot_partition_path> of=<output_path>
For example:
dd if=/dev/block/mmcblk0p42 of=/sdcard/boot_a.img
If you find the manual process too complicated, you can use my Boot-image-Extractor script. This script automates the task, making the extraction process simpler and more efficient. You can find detailed instructions and usage guidelines within the repository.
Warning
This guide and the script are intended for advanced users only. Improper use of this guide or script can lead to device bricking, data loss, or other serious issues. The author is not responsible for any damage or data loss resulting from the misuse of this script/guide. Proceed at your own risk, with caution, and follow the instructions carefully.
Tags:
- GSI
- Rooting
- BootImage
- Android
- extract-android-boot-image
- dd-command-Android
- Magisk
- Phh-Gsi
Search Terms:
- how to extract boot image from Android
- how to extract boot img from android without root
- boot.img extraction without root
- Android boot image extraction guide
First of all many thanks for @gitclone-url ❤️❤️❤️,
All the credits goes to him! By his help I make a small guide for myself!
I managed to extract the init_boot_a and _b.img file of my phone for root access::
Extracted the init_boot_image for acces to root::
Normal phone other then Xiaomi is it boot.img instead of init_boot_a/b.img::
Apps you need:
https://f-droid.org/packages/vegabobo.dsusideloader/
https://github.com/RikkaApps/Shizuku
Site: https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-%28GSI%29-list
a required info is:
Working image: Unofficial Android 14 - LineageOS "Light" - Download
https://sourceforge.net/projects/andyyan-gsi/files/lineage-21-light/
BIG S in the file name for Superuser root acces.
lineage-21.0-20240824-UNOFFICIAL-gsi_arm64_vS.img
Download Shizuku and setup this.
Pair with wireless debugging in devp mode.
3.Enable USB debugging and USB debugging security Settings
Disable Batteryoptimize - Settings - Apps - Shizuku - disable pauze app activity unused- Batterysaver - No restrication
Pair with Wireless debugging in devp mode
Press on Start in Shizuku, when its done Shizuke is running.
Authorized 0 applications, add DSU Sideloader
Close all and start it again Shizuku , you see 1 authorized applications
Go in DSU Sideloader -> Setting -> Operation Mode should Shizuku.
Select the Lineage image S.build from above and select it. It should extract the image. give it time. Not enable Userdata size, and Image size.
Allow one time acces from DSU Side loader
From the notification bar - Dynamic System updates -> Press on Restart.
Phone will boot into the Lineage OS with Superuser permission.
Skip the Wizard. of the OS.
Install from the Internet Termux
Open Termux
Type su
Prompt SuperUser grant it.
Use script below of Xiaomi.
It will give 2 lines:
init_boot_a = /dev/block/sde30
init_boot_b = /dev/block/sde59
Extract both of these images of the init_boot_a & b.
dd if=/dev/block/sde30 of=/sdcard/init_boot_a.img
dd if=/dev/block/sde59 of=/sdcard/init_boot_b.img
Extract the init_boot_a and b .img to the PC.
Reboot to the normal state of the phone from the notification bar
Install Magisk.apk.
Patch the one of the Init_boot file. One will be succeed.
Extract the pathed_magisk-image copy that to the adb directory of your pc.
Enable USB debugging from devp mode.
Open CMD -> type adb devices to see if its detect.
type adb reboot fastboot
Because its a init_boot image file, type the following:
type fastboot flash init_boot magisk_patched.img
Quickly go in to the Magisk app, Find Magisk app in your device, open it, click “install” and then check “direct install”, then press “let’s go”. Magisk will now install and make the root permanent. Now click “reboot” and the device will restart.