payload-dumper-rust 🦀
A fast and efficient Android OTA payload dumper written in Rust.
What is this?
If you've ever downloaded an Android OTA update and wondered how to extract the actual system images from it, this tool is for you. Android OTA packages contain a payload.bin file that holds all the partition images (boot, system, vendor, etc.). This tool extracts those partitions so you can work with them directly.
Why use this?
- Fast: All decompression runs in parallel
- Flexible: Extract from payload.bin files, ROM ZIPs, or even direct URLs
- Smart: Only download what you need when extracting from URLs
- Reliable: Verifies extracted partitions to ensure integrity
- Cross-platform: Works on Linux, Windows, macOS, Android (via Termux), and more
Installation
Quick Install
Linux / Termux:
Windows:
powershell -NoExit -ExecutionPolicy Bypass -Command "Invoke-RestMethod -Uri 'https://raw.githubusercontent.com/rhythmcache/payload-dumper-rust/main/scripts/install.ps1' | Invoke-Expression"
Manual Download
Download pre-built binaries for your platform from the releases page.
Build from Source
If you have Rust installed:
Usage
Basic Examples
Extract all partitions from a payload file:
Extract directly from a ROM ZIP (no need to unzip first):
Extract from a URL (great for CI/CD or when you don't want to download the whole file):
Extract specific partitions only:
List available partitions without extracting:
Advanced Options
Usage: payload_dumper [OPTIONS] <PAYLOAD_PATH>
Arguments:
<PAYLOAD_PATH> Path to payload.bin, ROM ZIP, or URL
Options:
--out <OUT> Output directory [default: output]
--images <IMAGES> Comma-separated partition names to extract
--list List all available partitions
--threads <THREADS> Number of parallel threads to use
--no-parallel Disable parallel extraction
--no-verify Skip hash verification
--metadata Save complete metadata as JSON
--diff Enable differential OTA mode
--old <OLD> Directory with old partitions (for differential OTA)
--user-agent <AGENT> Custom User-Agent for HTTP requests
Practical Examples
Extract boot and vendor_boot from a URL:
Process with custom thread count:
Get metadata without extracting:
How It Works
- Reads the payload structure from the file/ZIP/URL
- Identifies all available partitions
- Decompresses each partition in parallel (unless disabled)
- Verifies the integrity of extracted files
- Saves partitions to your output directory
Technical Details
- Parallel Processing: By default, uses all available CPU cores for maximum speed
- Memory Efficient: Streams data instead of loading everything into memory
- Network Optimized: When extracting from URLs, only downloads required chunks
Dependencies
- Protocol buffer definitions from Android's update_engine
- See Cargo.toml for complete dependency list
Building from Source
Requirements:
- Rust toolchain (install from rustup.rs)
- Cargo (comes with Rust)
Build command:
The binary will be at target/release/payload_dumper
Credits
Inspired by vm03/payload_dumper