Parsing Android firmware: from extraction to analysis of system files

Parsing firmware Android is a task that is required by custom ROM developers, security specialists or enthusiasts who want to modify system software. Unlike a standard update via OTA, here we are talking about a deep analysis of the firmware structure, extraction of individual components (for example, boot.img or system.img) and their decompilation. This process opens up access to hidden settings, allows you to remove firmware (bloatware) or even restore data after a failure.

However, working with firmware is fraught with risks: incorrect actions can turn a smartphone into a “brick,” and violation of license agreements can lead to legal consequences. In this article we will look at legal ways to extract and analyze firmware, current tools (Android Image Kitchen, Ghidra, JADX) and key stages of the process - from obtaining a dump to editing build.prop. We will pay special attention to precautions and alternative methods for devices with a locked bootloader.

1. Preparation: what you will need to work with the firmware

Before you start analyzing the firmware, make sure that you have everything you need. Without the right tools and knowledge, the process may end in failure or damage to the device.

Basic requirements:

• 📱 Device with an unlocked bootloader (for most methods). On some models (Samsung, Xiaomi), additional permission is required through OEM Unlock in the developer settings.
• 💻 Computer running Linux/Windows (recommended Ubuntu or WSL2 for stability). Virtual machines may not support fastboot and adb correctly.
• 🔧 Tools for work:
  • Platform Tools (from Google) — for commands fastboot and adb.
  • Android Image Kitchen — for unpacking .imgfiles.
  • 7-Zip or PeaZip — for extracting archives with firmware.
  • HxD or xxd — hexadecimal editors for analyzing binaries.
• 📁 Data backup. Even if you plan to work from a firmware dump rather than a live device, the error may result in the loss of user files.

For devices with a locked bootloader (for example Huawei or some models Sonyalternative methods are available, but they are limited by reading partitions through ADB backup or using exploits. Firmware for such devices is often encrypted using unique manufacturer keys, which makes their modification extremely difficult without an official unlocker.

2. Obtaining firmware: official and unofficial sources

There are several ways to obtain a firmware file for analysis. The choice depends on the device model and your goals.

Official sources (the safest, but not always available):

• 🌐 Manufacturers' websites. Companies like Samsung (samfw.com), Xiaomi (miui.com), Google (developers.google.com/android/images) provide stock firmware for their devices. They are usually distributed in the format .zip or .tgz.
• 📦 OTA updates. You can intercept the update file through ADB or specialized applications like OTA Capture (requires root).
• 🔄 apps for firmware (Odin for Samsung, FlashTool for Sony). They often contain built-in firmware databases.

Unofficial sources (use with caution!):

• 🏴 Forums and communities (XDA Developers, 4PDA). Firmware dumps, custom ROMs and tools for modifying them are posted here. Risk: Files can be modified by third parties or contain malicious code.
• 🔍 Dumps via dd. If you have rootyou can create a complete dump of the device partitions with the command:

  su
  dd if=/dev/block/mmcblk0 of=/sdcard/full_dump.img

  Warning: this method creates an exact copy of all partitions, including user data. Make sure that there is enough space on the memory card (the dump size can exceed 30 GB).

⚠️ Attention: Firmware for devices with Qualcomm often contain proprietary binaries (vendor.img, modem.img), the unpacking of which may violate the license agreements. Use them only for personal purposes and do not distribute modified versions.

3. Android firmware structure: which files are important

Firmware Android consists of several key sections, each of which is responsible for certain system functions. Understanding their structure will help you specifically extract the necessary components.

Section	File in the firmware	Purpose	Can it be modified?
Boot	boot.img	Contains the Linux kernel and ramdisk (initial system boot).	Yes, but requires rebuilding with the correct parameters (mkbootimg).
System	system.img	Main system files, including /system/app and /system/priv-app.	Yes, but changes can lead to bootloop.
Vendor	vendor.img	Drivers and proprietary binaries for hardware.	Limited (risk of loss of functionality of the camera, modem, etc.).
Recovery	recovery.img	Recovery mode (used to install updates).	Yes, often replaced on TWRP.
DTBO	dtbo.img	Device tree (configuration of hardware components).	Only for experienced users (errors will lead to the device not working).

The most interesting for modification are system.img (where applications and settings are stored) and boot.img (to change the kernel or add Magisk for root access). The section vendor.img usually contains closed binaries, and editing it may disrupt the operation of the camera, GPS or mobile communications.

To extract the contents of .imgfiles use Android Image Kitchen:

unpackimg.sh boot.img

This command will create a folder with unpacked files, including kernel and ramdisk.cpio.

4. Decompiling and analyzing system files

After extracting the firmware, the next step is to analyze its contents. Depending on your goals, you may need different tools.

Working with APK files (applications and services):

• 🔄 Decompilation: Use JADX or Apktool to convert .apk to readable code. For example:

  apktool d framework-res.apk

  This will allow you to edit resources (strings, images) or simulate the behavior of the application.

• 🔍 Analysis of manifests: The file AndroidManifest.xml inside the APK contains information about permissions, activities and services. It can be viewed in any text editor after decompilation.

Working with binary files (kernel, drivers):

• 🖥️ Disassembling: Tools like Ghidra or IDA Pro allows you to analyze machine code. For example, you can examine the camera driver (/vendor/lib/libcamera*.so) for vulnerabilities.
• 📜 Editing configurations: Files like build.prop (in system.img) or fstab (in vendor.img) can be modified in a text editor to change system parameters (for example, enable USB debugging by default).

Editing example build.prop to overclock the processor (not recommended for beginners!):

ro.config.cpu_boost_enable=1
ro.config.cpu_boost_freq=1700000

Warning: incorrect values can lead to overheating or unstable operation of the device.

What is bootloop and how to avoid it?

Bootloop is a condition when the device constantly reboots before the system boots. Main reasons:

- Incorrectly assembled boot.img (errors in ramdisk or kernel).

- Conflict of modified files in system.img (for example, deleting critical libraries).

- Incompatible version vendor.img (for example, firmware MIUI 13 with a kernel from MIUI 12).

To avoid bootloop, always check the boot logs via adb logcat or fastboot boot with test boot.img before flashing the firmware.

5. Modifying the firmware: what can be changed

After analyzing the firmware, you can start modifying it. Here are the most common tasks:

• 🧹 Removing the firmware (debloating). section system/priv-app or system/app you can remove unnecessary applications (for example, GooglePlayServices.apkif you use alternative services). Important: do not remove system components like Settings.apk or TelephonyProvider.apk —this will lead to the crash of the system.
• 🔧 Adding root access. To do this, you need to modify boot.img, adding to it Magisk. data-i="193">Unpack
  1. Unpack boot.img via Android Image Kitchen.
  2. Download the latest version Magisk and run:

     magiskboot unpack boot.img

  3. Add magisk_init to ramdisk and rebuild the image:

     magiskboot repack boot.img

🎨 Themes and interface. The files framework-res.apk and SystemUI.apk store interface resources (icons, colors, fonts). They can be edited via Apktool, but you need to know the structure Android Resource Binary (.arsc).

📡 Changing network settings. In the file /vendor/build.prop or /vendor/rfs/msm/mpss/dsds.gen you can modify the modem parameters (for example, enable support for new 4G/5G bands). Risk: incorrect settings will lead to loss network.

A backup copy of the original firmware has been created

Version compatibility checked (boot/system/vendor)

Signature verification in the bootloader is disabled (if required)

The device is charged at least 50%

A USB debugger is connected and OEM is allowed Unlock-->

⚠️ Attention: On devices with Samsung Knox or Huawei firmware modification may trigger hardware security flags (KNOX 0x1), which will lead to loss of warranty and refusal of service. Check the status of the flags via adb shell getprop ro.boot.warranty_bit or fastboot oem get_warranty_bit.

6. Firmware for a modified image

When the modified firmware is ready, it needs to be installed on the device. The method depends on the type of changes and the smartphone model.

Flashing methods:

• 📲 Via fastboot (for boot.img, recovery.img):

  fastboot flash boot patched_boot.img
  fastboot reboot

  Suitable for most devices with an unlocked bootloader.

• 🔄 Via TWRP (for system.img, vendor.img):
  1. Boot into TWRP (fastboot boot twrp.img).
  2. Transfer the modified files to the device.
  3. Select Install → Install Image and specify the path to system.img.

🌐 Via ODIN (for Samsung). This method requires files in the format .tar.md5. Use 7-Zip to pack the modified partitions into an archive.

After flashing, reset the settings (Wipe Data v TWRP), if modifications affected system applications or build.prop. This will help avoid conflicts with the cache.

Checking the result:

• Load the device into the system and check the operation of basic functions: calls, Internet, camera.
• For diagnostics, use the commands:

  adb logcat | grep -i error
  adb shell dmesg | grep -i panic

  They will show critical errors in the logs.

• If the device does not boot, try booting into fastboot and flashing the original one boot.img.

💡

Always test the modified firmware on a second device or in an emulator (for example, Android-x86), if possible. This will save time on restoring the main gadget.

7. Error recovery

If something goes wrong and the device stops booting, don’t panic. In most cases, it can be restored.

Recovery methods:

• 🔄 Stock version firmware. Download the official firmware for your model and flash it via fastboot or ODIN. For Qualcommdevices you can use QFil or EDL Mode (requires an authorized account for some brands).
• 🛠️ Use Rescue Party (on Pixel). Some devices Google have a built-in recovery mechanism that is activated after several unsuccessful boots.
• 📡 JTAG or ISP. If the bootloader is damaged, low-level programming through special adapters may be required. This method is complex and requires soldering work.

For devices with a locked bootloader (for example, Huawei after 2018), restoration is often only possible through an official service center. Before contacting them, remove all traces of modifications, otherwise the warranty will be void.

⚠️ Attention: On some devices (OnePlus, Xiaomi), after unsuccessful firmware, protection may be triggered anti-rollback, blocking rollback to an older version of the software. Check the current version of the bootloader through fastboot getvar anti before flashing.

8. Legal aspects and ethics

Modifying firmware is in a gray area from a legal point of view: Here's what you need to consider:

What is allowed:

• ✅ Changing the firmware on your device for personal use (for example, deleting bloatware or installing LineageOS).
• ✅ Creating custom Open source ROMs (AOSP) and their distribution without proprietary components.
• ✅ Reverse engineering (reverse engineering) for security research (protected by fair use laws in some countries).

What is prohibited:

• ❌ Distribution of modified firmware with proprietary binaries (vendor.img, modem.img) without the permission of the manufacturer.
• ❌ Bypassing DRM protections (for example, deleting Widevine L1 for viewing Netflix in HD) may violate licensing agreements.
• ❌ Using modified firmware to bypass paid features (for example, unlocking premium features in games).

In European Union and some states USA there are laws allowing bypassing protections to repair or modify user-owned devices (Right to Repair). However, manufacturers often challenge these rights in court. Before distributing modified files, check your local laws.

If you plan to share your work (for example, uploading it) custom firmware for XDA), make sure that:

• You do not include closed binaries (use placeholderfiles).
• You have indicated all sources and licenses (for example, GPL for kernel Linux).
• You warned users about possible risks (loss of warranty, bootloop).
💡

Even if you modify the firmware exclusively for yourself, avoid publishing instructions on how to bypass protections (for example, unlocking the bootloader on Huawei no official code). This may lead to blocked accounts on forums or legal problems.

FAQ: Frequently asked questions about disassembling Android firmware

Is it possible to disassemble the firmware without unlocking the bootloader?

Partially. You can extract some files via ADB backup (for example, /system/app), but access to sections like boot or vendor will be limited. For a complete dump you need root or an unlocked bootloader. On some devices (for example Samsung Exynosthere are exploits for obtaining root access without unlocking, but they are often closed by security updates.

How to find out which section of the firmware is responsible for a specific function (for example, a camera)?

Use the command adb shell mount or cat /proc/mountsto see the linking of partitions to folders in the system. For example, a camera usually depends on files in /vendor/lib (library libcamera*) and /vendor/etc (configuration camera@*.xml). It is also useful to study the logs:

adb logcat | grep -i camera

They will show which modules are loaded when the camera starts.

What to do if, after modifying the firmware, the mobile network stops working?

The most likely reasons:

1. Damaged partition modem.img or vendor.img (incompatible version).
2. Missing critical files in /vendor/rfs/msm/mpss (for Qualcomm).
3. Incorrect settings in build.prop (for example, ro.telephony.default_network).

Solution: flash the original vendor.img i modem.img, then check the modem logs via adb logcat -b radio.

Is it possible to return the device to its original state after modifications?

Yes, if you have the original firmware Flash it. via fastboot or ODIN, then perform a factory reset (Wipe Data). However, on some devices (for example, Samsung c Knox), the modification flag (KNOX 0x1) will remain forever, which may affect the operation of Samsung Pay or Secure Folder.

Which devices are the most difficult to modify?

Top 5 devices difficult to modify (as of 2026):

1. Huawei (after 2019) - locked bootloader without an official unlocking method.
2. Apple iPhone (despite checkm8, modifications are limited due to Secure Enclave).
3. Samsung Exynos (new models) - protection Defex and RMM blocks the firmware of unofficial images.
4. Google Pixel (c Titan M2) - hardware protection against rollback to old firmware versions.
5. MediaTek s HyperEngine —proprietary drivers are highly integrated into the system.

These devices often require unique exploits or specialized equipment (for example, JTAG).