[Sony Cross-Device General] munjeni:
This is probably what you need to know?

int extract_elf(char *dest, char *in)
{
char fname[256];
char fnameoff[256];
FILE *fo = NULL;
FILE *fooff = NULL;
FILE *fi = NULL;
char *buff;
int tmp = 1;
int i;

unsigned long last_address = 0;
unsigned short hdrphnum = 0;

struct Elf32_Ehdr header32;
struct Elf32_Phdr *phdr32 = NULL;
struct Elf64_Ehdr header64;
struct Elf64_Phdr *phdr64 = NULL;

unsigned char head[6];
int determined = 0;

fi = fopen64(in, "rb");
if (fi == NULL) {
printf("unable to open %s\n", in);
return 1;
}

printf("Extracting file %s\n", in);

fseeko64(fi, 0, SEEK_SET);
fread_unus_res(head, 1, 6, fi);
determined = *(unsigned char *)&head[4];
fseeko64(fi, 0, SEEK_SET);

if (determined == 2)
{
fread_unus_res(&header64, 1, sizeof(header64), fi);

if (header64.e_ident[0] != ELFMAG0 || header64.e_ident[1] != ELFMAG1
|| header64.e_ident[2] != ELFMAG2 || header64.e_ident[3] != ELFMAG3)
{
printf("ELF magic not found, exiting\n");
if (fi) fclose(fi);
return 1;
}
printf("ELF magic found\n");
printf("Entry point : 0x%08llX\n", header64.e_entry);
printf("Class : 64-bit objects\n");
printf("Program Header start : 0x%llx\n", header64.e_phoff);
printf("Program Header size : 0x%x\n", header64.e_phentsize);
printf("Program Header count : %d\n" , header64.e_phnum);

phdr64 = malloc(sizeof(struct Elf64_Phdr) * header64.e_phnum);
fseeko64(fi, header64.e_phoff, SEEK_SET);
for(i = 0; i < header64.e_phnum ; i++) {
fread_unus_res(&phdr64[i], 1, sizeof(struct Elf64_Phdr), fi);
printf(" PH[%d], type=%d, offset=0x%08llX, virtual=0x%08llX, phy=0x%08llX, size=0x%08llX\n",
i,
phdr64[i].p_type,
phdr64[i].p_offset,
phdr64[i].p_vaddr,
phdr64[i].p_paddr,
phdr64[i].p_filesz
);
}

hdrphnum = header64.e_phnum;
if (hdrphnum) {
snprintf(fnameoff, sizeof(fnameoff), "%s/boot.img-base", dest);
if ((fooff = fopen64(fnameoff, "wb")) != NULL) {
fprintf(fooff, "%08llx\n", header64.e_entry & 0xf0000000);
fclose(fooff);
}
}
}
else
{
fread_unus_res(&header32, 1, sizeof(header32), fi);

if (header32.e_ident[0] != ELFMAG0 || header32.e_ident[1] != ELFMAG1 ||
header32.e_ident[2] != ELFMAG2 || header32.e_ident[3] != ELFMAG3) {
printf("ELF magic not found, exiting\n");
if (fi) fclose(fi);
return 1;
}

printf("ELF magic found\n");
printf("Entry point : 0x%08X\n", header32.e_entry);
printf("Class : 32-bit objects\n");
printf("Program Header start : 0x%x\n", header32.e_phoff);
printf("Program Header size : 0x%x\n", header32.e_phentsize);
printf("Program Header count : %d\n" , header32.e_phnum);

phdr32 = malloc(sizeof(struct Elf32_Phdr) * header32.e_phnum);
fseeko64(fi, header32.e_phoff, SEEK_SET);

for(i = 0; i < header32.e_phnum ; i++) {
fread_unus_res(&phdr32[i], 1, sizeof(struct Elf32_Phdr), fi);
printf(" PH[%d], type=%d, offset=0x%08X, virtual=0x%08X, phy=0x%08X, size=0x%08X\n",
i,
phdr32[i].p_type,
phdr32[i].p_offset,
phdr32[i].p_vaddr,
phdr32[i].p_paddr,
phdr32[i].p_filesz
);
}

hdrphnum = header32.e_phnum;
if (hdrphnum) {
snprintf(fnameoff, sizeof(fnameoff), "%s/boot.img-base", dest);
if ((fooff = fopen64(fnameoff, "wb")) != NULL) {
fprintf(fooff, "%08x\n", header32.e_entry & 0xf0000000);
fclose(fooff);
}
}
}

for(i = 0; i < hdrphnum; i++) {
if (determined == 2)
buff = malloc(phdr64[i].p_filesz);
else
buff = malloc(phdr32[i].p_filesz);

snprintf(fname, sizeof(fname), "%d", i);
switch (i)
{
case 0:
snprintf(fname, sizeof(fname), "%s/boot.img-zImage", dest);
snprintf(fnameoff, sizeof(fnameoff), "%s/boot.img-kerneloff", dest);
break;
case 1:
snprintf(fname, sizeof(fname), "%s/boot.img-ramdisk.gz", dest);
snprintf(fnameoff, sizeof(fnameoff), "%s/boot.img-ramdiskoff", dest);
break;
case 2:
snprintf(fname, sizeof(fname), "%s/boot.img-dt", dest);
snprintf(fnameoff, sizeof(fnameoff), "%s/boot.img-tagsoff", dest);
break;
case 3:
snprintf(fname, sizeof(fname), "%s/certificate", dest);
snprintf(fnameoff, sizeof(fnameoff), "%s/certificateoff", dest);
break;
default:
snprintf(fname, sizeof(fname), "%s/unknown.%d.bin", dest, i);
snprintf(fnameoff, sizeof(fnameoff), "%s/unknown.%d.off", dest, i);
break;
}
printf("%d. Dumping %s\n", i, fname);
fo = fopen64(fname, "wb");
fooff = fopen64(fnameoff, "wb");

if (fo == NULL || fooff == NULL) {
printf("unable to open fo or foof for writting!\n");
if (fi) fclose(fi);
if (fo) fclose(fo);
if (fooff) fclose(fooff);
free(buff);
return 1;
}

if (determined == 2)
{
fseeko64(fi, phdr64[i].p_offset, SEEK_SET);
fread_unus_res(buff, 1, phdr64[i].p_filesz, fi);
fwrite(buff, 1, phdr64[i].p_filesz, fo);
/* cmdline position */
last_address = phdr64[i].p_offset + phdr64[i].p_filesz + 0x8;
/* write fileoff */
fprintf(fooff, "%08llx\n", phdr64[i].p_paddr);
}
else
{
fseeko64(fi, phdr32[i].p_offset, SEEK_SET);
fread_unus_res(buff, 1, phdr32[i].p_filesz, fi);
fwrite(buff, 1, phdr32[i].p_filesz, fo);
/* cmdline position */
last_address = phdr32[i].p_offset + phdr32[i].p_filesz + 0x8;
/* write fileoff */
fprintf(fooff, "%08x\n", phdr32[i].p_paddr);
}

if (fo) fclose(fo);
if (fooff) fclose(fooff);
free(buff);
}

printf(" Seeking to cmdline address = 0x%08lX\n", last_address);
snprintf(fname, sizeof(fname), "%s/boot.img-cmdline", dest);
fo = fopen64(fname, "wb");
if (fo == NULL) {
printf("unable to open %s\n", fname);
if (fi) fclose(fi);
return 1;
}
printf("%d. Dumping cmdline to %s\n", i, fname);

do {
buff = malloc(1);
fseeko64(fi, last_address, SEEK_SET);
fread_unus_res(buff, 1, 1, fi);
tmp = getc(fi);
fwrite(buff, 1, 1, fo);
last_address += 1;
fseeko64(fi, last_address, SEEK_SET);
free(buff);
} while (tmp != 0);

if (fo)
fclose(fo);
if (fi)
fclose(fi);

fflushall();

return 0;
}