0

I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps here - I was wondering if this attack is applicable not only to NAND memory but also to the classic SPI Flash memory, like the one you can read in the aforementioned post.

In case it's possible, do you have any resource where I can study from? Also, what PINs need to be shortcircuited to try the attack?

Thanks!

1

As I know that specific glitch is specific to that device. I.e. it's firmware is written so that the device switches to the prompt in case it failed to access NAND. And if there was some other logic, like "reboot the device if NAND is not accessible", this NAND glitch won't be exploitable at all. Thus if it will work for EEPROM or not, depends on how the boot logic is organized in TG582N firmware.

Regarding the EEPROM pin, which you need to ground: https://www.exploitee.rs/index.php/Wink_Hub​​ they are grounding pin 29 of NAND chip, which is I/O1 pin. In case of EEPROM (which in your case is s25fl064l) I would try to ground SO/IO 1, SO/IO 0 pins, see the datasheet of s25fl064l.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.