{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/README.md#L11-L25",
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/README.md#L64-L102",
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/CHANGELOG.md",
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/go.mod",
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/Dockerfile",
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/payload/payload_test.go",
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/payload/e2e_real_test.go",
    "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/LICENSE",
    "https://github.com/ssut/payload-dumper-go/releases/tag/2.1.0"
  ],
  "category": "firmware",
  "description_en": "Go command-line tool and library that extracts partition images from Android A/B OTA payloads, reading either a raw payload.bin or the OTA zip that contains it in place. It decompresses operations in parallel, can list partitions or dump only selected ones, and verifies operation data, source images and final images with SHA-256, exiting non-zero on any mismatch. Incremental (delta) payloads are applied onto previously extracted base images, and it regenerates the dm-verity hash tree and FEC parity that delta payloads omit, so the README reports bit-exact output.",
  "description_zh": "用 Go 编写的命令行工具和库，可从 Android A/B OTA 载荷中提取分区镜像，既可读取原始 payload.bin，也可直接就地读取包含它的 OTA zip 包。它并行解压各项操作，可列出分区或只导出选定分区，并用 SHA-256 校验操作数据、源镜像和最终镜像，任何不一致都会以非零退出码结束。增量（差分）载荷会应用在先前提取的基础镜像之上，并重新生成差分载荷省略的 dm-verity 哈希树和 FEC 校验数据，因此 README 称输出可做到逐位一致。",
  "entry_url": "https://awesomerea.org/resources/payload-dumper-go/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/payload-dumper-go/",
  "evidence_url": "https://github.com/ssut/payload-dumper-go/blob/c3a50ba8d784764c06143c1f82971cd81a77f9d6/README.md",
  "group": "tools",
  "id": "payload-dumper-go",
  "json_url": "https://awesomerea.org/resources/payload-dumper-go/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/payload-dumper-go/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/payload-dumper-go/index.md",
  "name": "payload-dumper-go",
  "name_zh": "payload-dumper-go Android OTA 载荷提取工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: 2.1.0, published 2026-09-23 and identical to the reviewed main commit, with prebuilt binaries for Linux (amd64, amd64 AVX2, arm64, armv7), macOS (amd64, amd64 AVX2, arm64) and Windows (amd64, amd64 AVX2, arm64) and a checksum file; the README also lists a Homebrew package. The changelog says macOS builds need macOS 13 or later since 2.0.2 moved to Go 1.27. The README requires xz on the system because decompression uses the C xz library through cgo; the Dockerfile builds with CGO and liblzma-dev.",
    "Input is an OTA zip or payload.bin the analyst supplies; an incremental OTA also needs the base images extracted from the matching earlier full OTA, passed with -old. The README says PUFFDIFF, ZUCCHINI and LZ4DIFF delta operations are not supported yet, so affected partitions, usually system, product or system_ext, fail with an error while the rest can be extracted with -p; images written with -no-fec skip FEC and final verification and must not be flashed.",
    "The repository commits no OTA images: its tests build synthetic payloads, and two opt-in tests read a real payload path from environment variables (E2E_PAYLOAD, DBG_PAYLOAD). The payload format follows AOSP's update_metadata.proto. Apache-2.0."
  ],
  "requirements_zh": [
    "审阅时最新版本为 2.1.0，发布于 2026-09-23，与所审阅的 main 提交相同，提供 Linux（amd64、amd64 AVX2、arm64、armv7）、macOS（amd64、amd64 AVX2、arm64）和 Windows（amd64、amd64 AVX2、arm64）预构建二进制及校验和文件；README 还列出了 Homebrew 软件包。更新日志称自 2.0.2 改用 Go 1.27 起，macOS 版本需要 macOS 13 或更高版本。README 要求系统安装 xz，因为解压通过 cgo 调用 C 版 xz 库；Dockerfile 启用 CGO 并安装 liblzma-dev 进行构建。",
    "输入为分析者自行提供的 OTA zip 包或 payload.bin；增量 OTA 还需要从对应的前一版完整 OTA 中提取出的基础镜像，通过 -old 传入。README 称目前尚不支持 PUFFDIFF、ZUCCHINI 和 LZ4DIFF 差分操作，受影响的分区（通常是 system、product 或 system_ext）会报错失败，其余分区可用 -p 提取；使用 -no-fec 生成的镜像跳过了 FEC 和最终校验，不得刷入设备。",
    "仓库不含任何 OTA 镜像：测试使用合成的载荷，另有两个需手动启用的测试通过环境变量（E2E_PAYLOAD、DBG_PAYLOAD）读取真实载荷路径。载荷格式依据 AOSP 的 update_metadata.proto。采用 Apache-2.0 许可。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/ssut/payload-dumper-go",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}