Guide on how to extract a boot image from any Android phone without needing to root using Magisk, without stock firmware or a custom recovery

Boot image extraction guide.md

Boot Image Extraction Guide

Guide on how to extract a boot image from any Android phone without needing to root using Magisk, without stock firmware or a custom recovery.

Table of Contents

• Introduction
• Getting Started
• Checking Device Compatibility
• Understanding GSI Naming Conventions
• Flashing the GSI
  • Steps to Follow After Flashing/Installing a GSI
  • Manual Process
  • Automated Extraction
• Disclaimer

Introduction

Rooting an Android device often requires a boot image for patching, but obtaining this image can be challenging for users of newer devices. Custom recoveries may not be available due to limited development support, and official stock firmware images can be hard to find online. This guide offers a solution to extract the boot image from your Android device without needing to root it first, download firmware, or rely on a custom recovery.

We achieve this by temporarily flashing a Phh Based Generic System Image (GSI) that ships with phh's Superuser. Which is pre-rooted and has built-in superuser capabilities.

Why do GSIs ship with phh's Superuser?

Pierre-Hugues Husson Explained:

GSI are in constant development and debugging, and it's impossible to debug GSI issues without being rooted. Which is why a su is required. Magisk is unsuitable for several reasons:

• It breaks several expectations a ROM can make. One big instance is: The SELinux policy it compiles is the one that is going to be used. There has been many and many issues caused by magisk because of this. It also breaks other expectations, like the mounted environment when /init is executed.
• Magisk is "system-less", you can NOT put it in a system.img. The vast majority of devices don't have custom recoveries, or even available stock factory image, so you can't root them with magisk, unless you already have a root (sooo you do need a root)
• GSI are guaranteed to work by Google certification. If a device ships with Google apps, it is guaranteed that same-Android version unmodified AOSP GSI will work! Magisk being in system.img, there is absolutely no guarantee it will work, and it'll most of the time not work.

Guide Target Audience: Android users and developers with basic device modification knowledge.

Caution

Please note that these procedures may risk data loss, voided warranties, or device bricking. Proceed only if you understand these risks.

---

Getting Started

Before diving into the guide, please thoroughly review the Frequently Asked Questions (FAQ) to understand the basics of GSI and the various naming conventions used by GSI builders and maintainers.

---

Checking Device Compatibility

GSIs require Project Treble support. Verify compatibility:

1. Install Treble Info: Download Treble Info App from Here.
2. Check Support: Open the app and look for a green checkmark ✅, which indicates that the phone is Treble supported.
3. Note Specs: Look for architecture (e.g., arm64), partition style (A-only or A/B), and VNDKLite requirement in the "Required Image" section.

---

Understanding GSI Naming Conventions

GSI filenames encode compatibility details using the format: {arm|a64|arm64}_{a|b}{v|g|o}{N|S}-{signed|vndklite|personal}.

Component	Options	Description
Architecture	arm (32-bit, deprecated) a64 (32-bit with 64-bit binder) arm64 (64-bit)	Matches device CPU architecture. Most modern devices are arm64.
Partition	a (A-only, deprecated) b (A/B)	Indicates system partition style. A/B is common for newer devices.
Features	v (vanilla, no GApps) g (GApps) o (Go GApps) f (MicroG, rare) S (PHH Superuser) N (no superuser) Z (Dynamic Superuser, rare)	Specifies GApps inclusion and superuser status. S is required for root.
Build Type	signed (maintainer's keys) vndklite (VNDKLite or writable /system) personal (custom mods) secure (no superuser, spoofed props, rare)	Additional attributes. vndklite is for specific devices or writable needs.

Choosing a GSI

First, use the Treble Info app to identify your phone's architecture, partition style, and VNDKLite needs. Then, according to that information, choose a specific GSI from this PHH GSI List.

Note

1. You must select a GSI that comes pre-rooted. Meaning GSI variants marked with 'S' in the filename.
2. If Treble Info indicates VNDKLite, choose a vndklite GSI.
3. Choose v (vanilla) or g (GApps) based on preference; vanilla minimizes potential issues.

---

Flashing the GSI

If you're unfamiliar with flashing a GSI or unsure how to proceed, watch this YouTube video or search online for additional guides. You can also join the PHH GSI support group on Telegram for assistance: https://t.me/phhtreble.

Alternatively, the DSU sideloader can be used to install GSIs via Android's DSU feature with ease. For a detailed explanation, watch this YouTube video.

Steps to Follow After Flashing/Installing a GSI

Manual Process

1. Install Termux: Download and install Termux on your device.

2. Grant Storage Permissions: Open Termux and allow storage permissions using the command:

   termux-setup-storage

3. Check if the PHH Superuser app is already installed: Copy & paste the following command in terminal and check output.

   (pm list packages | grep me.phh.superuser) && echo "App installed" || echo "Not found"

Important

If "Not found" is displayed, install the app from here. This app is necessary to grant Termux requests to run as root.

4. Now type su, and approve the superuser request from the PHH app to gain root access.

5. With superuser permission, you can access any system file. Copy and enter the following command in Termux:

   for PARTITION in "boot" "boot_a" "boot_b"; do
     BLOCK=$(find /dev/block \( -type b -o -type c -o -type l \) -iname "$PARTITION" -print -quit 2>/dev/null)
     if [ -n "$BLOCK" ]; then
       echo "$PARTITION" = $(readlink -f "$BLOCK")
     fi
   done

   This command will display the boot partition paths for both A/B and A-only devices.

Tip

On A/B devices, the loop command will display the boot partition paths for both slots, something like this:

boot_a = /dev/block/sda40
boot_b = /dev/block/sda41

In this case, you can extract the image corresponding to your currently active slot. To determine the active slot, enter the command getprop ro.boot.slot_suffix. If the output is _a, use the path for boot_a; otherwise, use the path for boot_b.

6. Finally, use the following command to extract the image from the specified boot path:

   dd if=<boot_partition_path> of=<output_path>

   For example:

   dd if=/dev/block/mmcblk0p42 of=/sdcard/boot_a.img

Automated Extraction

If you find the manual process too complicated, you can use my Boot-image-Extractor script. This script automates the task, making the extraction process simpler and more efficient. You can find detailed instructions and usage guidelines within the repository.

---

Disclaimer

Warning

This guide and the script are intended for advanced users only. Improper use of this guide or script can lead to device bricking, data loss, or other serious issues. The author is not responsible for any damage or data loss resulting from the misuse of this script/guide. Proceed at your own risk, with caution, and follow the instructions carefully.

---

Keywords & Tags

Tags:

• GSI
• Rooting
• BootImage
• Android
• extract-android-boot-image
• dd-command-Android
• Magisk
• Phh-Gsi

Search Terms:

• how to extract boot image from Android
• how to extract boot img from android without root
• boot.img extraction without root
• Android boot image extraction guide

@NeverSm1le To Know which GSI image is right for your device, Download Treble Info app and check the "Required Image" section. ✨

Thank you @gitclone-url, I tried but sadly my device is not unlocked, thankfully it just reboot into recovery and reboot normally after that.

Yeah bootloader needs to be unlocked, else can't flash/install GSI image.

@Hot12345

Thanks for help but I can't find arm64 ab gsi with su in link you provided of Lineageos, my device has ab(android 14)partition, please bro can you find it for me please 🥺

@dipeshjatt2

You can find all the GSI image link in here : https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-%28GSI%29-list

Just choose any particular ROM then check if there is a su varient is available or not.

You can also try this build for your device : link

Her

no

Hermano hago todo bien pero nose como hacerle root ala rom de linage podrías ayudarme porfavor.

@wbeimar543 Please use English, and contact me on Telegram for further assistance: @Abhijeet ✨ Sorry for the delayed response, I've been quite busy lately and just saw your message.

Would it be possible to create a firmware backup or at least extract boot, system and recovery? I'm a bit afraid to do this since I can only do it once because there is no firmware online for my phone.

@T3ll3S-05 which phone? Contact me on telegram : @Abhijeet