http://linuxfromscratch.org/pipermail/lfs-chat/2004-July/023913.html
http://www.linuxfans.org/nuke/modules.php?name=Forums&file=viewtopic&p=3891233

Ok, here's a very, very, very slow bzImage->vmlinux:

 i=1
 until tail +${i}c /boot/vmlinuz |gzip -d>vmlinux 2>/dev/null;do
  i=`expr $i + 1`
 done

I don't know a way to find that offset. On my system it ended up
being 19,537, which took a while for the above loop to find:-). This
is on a 2.4.21, with patches applied to support a Vaio Picturebook's
1024x480 LCD.

Try to use

xxd -g0 -c4 /boot/vmlinuz | grep -m1 ' 1f8b0800' | cut -d: -f1 | \
  perl -ne 'print ((hex)+1)'

to get the offset. Interesting enough, the offset on 2.4.24,2.4.25 and 2.4.26
all are the same on my machine: 18533.

2004-07-15T23:30:24 Anderson Lizardo:
> xxd -g0 -c4 /boot/vmlinuz | grep -m1 ' 1f8b0800' | cut -d: -f1 | \
>   perl -ne 'print ((hex)+1)'

Very impressive! That reproduced the number I'd brute forced the
first time around.

So the final product is, bzImage => vmlinux:

tail +`xxd -g0 -c4 /boot/vmlinuz | grep -m1 ' 1f8b0800' | cut -d: -f1 | perl -ne 'print ((hex)+1)'`c /boot/vmlinuz | gzip -d>vmlinux