How is compressed and how can be decompressed real core.img?

In GPT/BIOS, GRUB2 "installs" on BIOS boot partition "core.img" consiting of "diskboot.img", lzma decompressor (lzma_decompress.img) and core.img (IIUC). I assumed that skipping 512 B of diskboot.img, then skipping lzma decompressor (2880 B on SLES), I would get compressed "real" core.img (ending where '00 00' follows). But how to decompress this part? Or, do I do anything wrong? BTW, I can't decompress even /boot/grub2/i386-pc/core.img (on SLES too) while skipping same parts... The goal is to see real "core.img" data to detect a modification...