extract the cia? you mean decrypt it?
just like any other proper/encrypted cia, you need to get the title key, decrypt that, run the content through through aescbc, then i think ncch decrypt that output - it has been a while since i had to do it. something like that
it is all public information, nothing secret etc
it's nothing specific to the python tool i made called 'UpdateCDN'...
- but if you are using UpdateCDN just decrypt the raw files then build a cia when you are done