winget install --id=syedinsaf.otaripper -e otaripper is a high-performance, multi-threaded partition extractor for Android OTA packages (payload.bin and full OTA .zip files). Built in Rust, it features SIMD-accelerated memory operations and robust fail-safe behavior.
Extract partitions from Android OTA files with cryptographic verification, strong reliability guarantees, and high-performance execution.
For in-depth architecture and performance details, see TECHNICAL.md
otaripper extracts partitions from Android OTA packages (payload.bin or full OTA .zip files).
The tool is written in Rust and prioritizes:
Unlike many extraction tools, otaripper verifies output images by default and refuses to leave behind partially valid or corrupted files.
⚠️ Incremental OTA packages are intentionally not supported.
| Feature | otaripper v3.4 | payload-dumper-go | payload_dumper (Python) |
|---|---|---|---|
| Output verification | ✅ SHA-256 | ❌ | ❌ |
| Remote HTTP Streaming | ✅ (Parallel) | ❌ | ❌ |
| Network Error Recovery | ✅ (Auto-resume) | ❌ | ❌ |
| Zstd Compressed Payloads | ✅ (v10 / Vivo) | ❌ | ❌ |
| SIMD optimization | ✅ AVX-512/AVX2 | ❌ | ❌ |
| Qualcomm ARB Analysis | ✅ | ❌ | ❌ |
| Firmware Metadata parsing | ✅ | ❌ | ❌ |
| Corrupt Image Detection | ✅ (Sanity checks) | ❌ | ❌ |
| Cache-aware large writes | ✅ | ❌ | ❌ |
| Zero-Copy Decompression | ✅ | ❌ | ❌ |
| Direct ZIP Memory Mapping | ✅ | ❌ (Extracts temp) | ❌ |
| Graceful interruption | ✅ | ❌ | ❌ |
| Auto-cleanup on failure | ✅ | ❌ | ❌ |
| Performance statistics | ✅ | ❌ | ❌ |
| Selective extraction | ✅ | ✅ | ✅ |
| Multi-threaded | ✅ | ✅ | ❌ (1 thread) |
| Cross-platform | ✅ | ✅ | ⚠️ Python |
| Standalone binary | ✅ | ✅ | ❌ |
> otaripper is designed to fail early and cleanly rather than produce questionable output.
otaripper automatically detects CPU capabilities and selects the optimal execution path.
Version 3.4.0 introduces Zstandard (zstd) compressed payload support (minor version 10 update engine format used in Vivo, iQOO, and modern OTAs), local/remote EDL firmware & directory scanning, smart metadata parsing, parallel chunked Remote HTTP Streaming, and massive I/O savings:
zstd) Decompression: Full support for Android update engine minor version 10 operations (REPLACE_ZSTD), enabling fast, streamable extraction of modern zstd-compressed OTAs (e.g. Vivo, iQOO) directly into single-extent zero-copy memory maps or SIMD worker pools.STORED OTA zips, mapping the internal payload.bin straight from the disk using a zero-copy offset.liblzma backend safely handles modern Android payloads utilizing the ARM64 BCJ filter (e.g., Xiaomi HyperOS).extractor and simd modules.AVX-512, AVX2, SSE2) through non-temporal cache-bypassing mechanisms.
Throughput Example (3GB system partition)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
otaripper (AVX-512) ████████████ 2.8 GB/s
otaripper (AVX2) ████████ 1.9 GB/s
payload-dumper-go ████ 1.0 GB/s
payload_dumper ██ 0.4 GB/s
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Performance scales with:
For architectural details, see TECHNICAL.md
Prebuilt packaged archives are available on the Releases page. Download the archive matching your platform:
otaripper-vX.Y.Z-windows-msvc-x86_64.zipotaripper-vX.Y.Z-windows-gnu-x86_64.zipotaripper-vX.Y.Z-linux-x86_64.tar.gzotaripper-vX.Y.Z-linux-static-x86_64.tar.gzotaripper-vX.Y.Z-linux-arm64.tar.gzotaripper-vX.Y.Z-macos-x86_64.tar.gzotaripper-vX.Y.Z-macos-arm64.tar.gzotaripper-vX.Y.Z-android-arm64.zipOnce extracted, you will find the main executable cleanly named otaripper (or otaripper.exe on Windows).
> Note: Each release also includes an ultra-minimalist otaripper-lite executable alongside the main binary. The lite version is compiled without remote HTTP streaming capabilities (--no-default-features), resulting in an exceptionally compact footprint for users only performing local extractions.
otaripper releases follow a "Gold Standard" two-layer checksum architecture:
checksums.txt file containing hashes for all .tar.gz and .zip archives.otaripper-vX.Y.Z.sha256 file enclosed alongside the executables. Run sha256sum -c *.sha256 in your terminal to instantly verify the integrity of the extracted binaries.otaripper is available via the Windows Package Manager:
winget install syedinsaf.otaripper
To update to the latest version:
winget update syedinsaf.otaripper
# or
winget upgrade syedinsaf.otaripper
otaripper is available on the AUR:
paru -S otaripper # build from source (recommended)
paru -S otaripper-bin # prebuilt glibc binary
yay -S otaripper
yay -S otaripper-bin
If otaripper-bin fails to run due to libc/runtime issues, use the
fully static musl build from GitHub Releases:
https://github.com/syedinsaf/otaripper/releases
Extract everything:
otaripper ota.zip
List partitions:
otaripper -l ota.zip
Extract selected partitions:
otaripper ota.zip -p boot,vendor_boot,init_boot
🌐 Remote HTTP Streaming (Zero-Download Extraction):
Extract specific partitions directly from a web URL without downloading the full OTA package!
otaripper https://android.googleapis.com/packages/ota-api/package.zip -p boot,init_boot
Print hashes:
otaripper ota.zip --print-hash
Strict verification:
otaripper ota.zip --strict
Disable automatic folder opening:
otaripper ota.zip -n
Analyze Qualcomm bootloader Anti-Rollback (ARB) metadata (accepts .img, .bin, .zip archives, or directories):
otaripper arb update.zip
# or directories
otaripper arb CPH2583_EDL_Folder/
🌐 Remote ARB Inspection (Zero-Download) & Interactive Export:
Instantly check the ARB index of an OTA or EDL firmware update without downloading the massive 3GB+ zip file! otaripper will intelligently stream and extract only the tiny bootloader candidate image (e.g. xbl_config.img or xbl_config.elf) directly from the URL over the internet. You can optionally export the metadata into a beautifully formatted, platform-sanitized JSON file named dynamically after your device model, software build, and ARB index:
$ otaripper arb https://example.com/firmware.zip
[arbscan] Connecting to remote server...
[arbscan] EDL firmware zip detected. Scanning for bootloader image...
[arbscan] Found candidate: RADIO/xbl_config.img. Extracting temporarily...
[arbscan] Analyzing: extracted_bootloader.img
OEM Metadata
────────────
Major Version : 3
Minor Version : 0
ARB Index : 1
Write JSON output? [y/N]: y
Device model : PJZ110
Update / build : PJZ110_16.0.5.701(CN01)_260303
✔ JSON written: PJZ110_PJZ110_16.0.5.701(CN01)_260303_ARB(1).json
Remove previously extracted folders:
otaripper clean
Clean a specific directory:
otaripper clean -o /path/to/output
The cleanup command only removes directories matching extracted_*
and refuses to operate on filesystem roots for safety.
| Option | Description |
|---|---|
-l, --list | List partitions only |
-p, --partitions | Extract specific partitions |
-o, --output-dir | Custom output directory |
--strict | Enforce manifest hashes |
--no-verify | Disable verification (unsafe) |
--print-hash | Print SHA-256 hashes |
--sanity | Detect obviously invalid output |
--stats | Show performance statistics |
-t, --threads | Thread control (1–256, 0 = auto) |
-n, --no-open | Disable folder auto-open |
clean | Remove extracted_* folders safely |
arbscan, arb | Extract ARB metadata from bootloader images or payloads |
We provide two built-in Cargo aliases for easy compilation:
git clone https://github.com/syedinsaf/otaripper.git
cd otaripper
# Build the standard CLI (with Remote HTTP Streaming support)
cargo full
# Build the 'lite' CLI (Network-free, local extraction only)
cargo lite
Binary output:
target/release/otarippertarget/lite/release/otaripper> Note: The cargo lite alias automatically isolates its output into a separate target/lite/ directory. This ensures you can compile and test both versions side-by-side locally without them overwriting each other!
otaripper can be built locally with CPU-specific optimizations for maximum performance. This enables all instruction sets supported by your CPU (AVX2 / AVX-512 / ARMv8, etc.).
⚠️ Important: Binaries built this way are NOT portable and must NOT be redistributed.
A helper script is provided to:
curlunzipchmod +x build.sh
./build.sh
Output binary:
After running build.sh, a new folder named otaripper-native
will be created in the same directory where build.sh is located.
~/otaripper-native/otaripper
On Windows, a native PowerShell script is provided. It uses the official Windows rustup installer and defaults to the MSVC toolchain.
Before running the script, allow execution for the current session only:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
Then run:
.\build.ps1
Output binary:
After running build.ps1, a new folder named otaripper-native
will be created in the same directory where build.ps1 is located.
otaripper-native\otaripper.exe
-C target-cpu=nativeTesting, bug reports, and performance feedback are welcome.
Please include:
Pull requests should:
otaripper benefits greatly from real-world testing and feedback.
Special thanks to Jean Rivera for extensive validation, edge-case testing, and correctness feedback.
Thanks also to:
If otaripper helped you:
otaripper is licensed under the Apache License 2.0. See LICENSE for details.
Use at your own risk.
The author and contributors are not responsible for data loss, bricked devices, or damage resulting from misuse.