The vmlinuz file contains other things besides the gzipped content, so you need to find out where the gzipped content starts. To do that, use:

od -A d -t x1 vmlinuz | grep '1f 8b 08 00'

What this does is to show you where in that file you can find the gzip header. The output looks like:

0024576 24 26 27 00 ae 21 16 00 1f 8b 08 00 7f 2f 6b 45

This means that at 0024576 in the vmlinuz file, you will find the binary values “24 26 27 00 ae 21 16 00 1f 8b 08 00 7f 2f 6b 45”. You’re looking for 1f 8b 08 00, which can be found from character 9 onwards, or, at 0024576 + 8 (start counting from 0) = 24584.

Now that you know where the gzipped content starts (at position 24584) you can use dd to extract that gzipped content and ungzip it. To do that, use:

dd if=vmlinuz bs=1 skip=24584 | zcat > vmlinux

The first command will seek to that position and copy everything to stdout. zcat then will uncompress everything it gets from stdin and will output the uncompressed string to stdout. Then the > will redirect zcat’s output to a new file named vmlinux.