Maybe you can have a look at the source code for a tool (in Archlinux), which can extract both CPIO files from a init boot file ❯ ls -al /usr/bin/lsinitcpio
.rwxr-xr-x 12k root 23 Dez 2025 /usr/bin/lsinitcpio
~
❯ file /usr/bin/lsinitcpio
/usr/bin/lsinitcpio: Bourne-Again shell script, ASCII text executable
~ ❯ sudo lsinitcpio -a /boot/initramfs-linux.img ==> Image: /boot/initramfs-linux.img
==> Created with mkinitcpio 40
==> Kernel: 6.18.3-arch1-1
==> Early CPIO: 9.99 MiB
==> Size: 11.99 MiB
==> Compressed with: zstd
-> Uncompressed size: 30.58 MiB (.392 ratio)
-> Estimated decompression time: 0,082s
==> Included modules (38):
cec drm_gpuvm hid-multitouch intel-gtt mmc_core rpmb-core spi-pxa2xx-platform virtio_scsi
drm_buddy drm_suballoc_helper hkdf intel-lpss nvme serio_raw ttm wmi
drm_display_helper drm_ttm_helper i2c-algo-bit intel-lpss-pci nvme-auth spi-intel uas xe
drm_exec dw_dmac i915 intel-vsec nvme-core spi-intel-pci usb-storage
drm_gpusvm_helper gpu-sched idma64 mmc_block nvme-keyring spi-pxa2xx-core video
==> Included binaries (14):
blkid e2fsck kmod mount plymouthd switch_root udevadm
busybox fsck loginctl plymouth setfont systemd-tmpfiles umount
==> Early hook run order:
udev
❯ lsinitcpio -h
lsinitcpio 40
usage: lsinitcpio [action] [options] <initramfs>
Actions:
-a, --analyze analyze contents of image
-c, --config show configuration file image was built with
-l, --list list contents of the image (default)
-x, --extract extract image to disk
Options:
-h, --help display this help
-n, --nocolor disable colorized output
-V, --version display version information
-v, --verbose more verbose output
--cpio list or extract only the main CPIO image
--early list or extract only the early CPIO image
❯ sudo lsinitcpio -l --early /boot/initramfs-linux-cachyos.img
bin
early_cpio
kernel/
kernel/x86/
kernel/x86/microcode/
kernel/x86/microcode/GenuineIntel.bin <--here stop first cpio for ucode intel firmware
lib
lib64
sbin
usr/
usr/lib/
usr/lib/firmware/