Often flash memory is connected via SPI (Serial Peripheral Interface Bus) to a processing unit like an ARM core or a micro controller.
- How can one dump the memory?
- Can there be protection mechanisms?
- Are there pitfalls to avoid?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Although I think the questions are too broad and I agree with @cb88 that the datasheet should give you all you need to know, I'll try to answer some.
First option is desoldering the chip from the board. After having done so you have 2 options
When you can't or don't want to remove the chip you have again 2 options.
You can also use a clip that is designed to attach the analyzer to the chip in-system.
In general I'd really recommend to desolder the chip. They're almost, if not always edge packaged (e.g. having clearly visible pins on the outside of the package) and not Ball Grid Array (BGA) packages. This makes them easy to remove and also easy to put back. It will save you the headaches you might encounter that I described in the pitfalls section below.
OTP memory Some of these chips can include One-Time Programmable (OTP) memory in which they store protection bits. I've only seen this being used for locking down area's against writing, not against reading. Otherwise what's the point of having the flash memory?
Encryption I have never seen nor could I quickly find any SPI flash chips that offer encryption. This is usually implemented in a memory controller on the System on a Chip (SoC) side that does it on the fly keeping it nice and transparent for the host CPU.
Some things to keep in mind;
In case you're writing your own sniffer make sure it can sample the signals fast enough. For example the bus pirate will fail in all cases because it can only sample at max ~32MHz where allot of SPI Flashes start at 40+MHz. So you'll need at least double the target speed (Sampling Theorem)
The flash devices can work at various speeds up to 100+MHz which relate to the various modes (normal read, fast read, dual read, quad read etc) they're in. Such a mode does not only change the speed, but also the way data is transferred. For example in Quad Read mode the flash clocks out 4 bits bits at a time using the SI/SO/WP/Hold signals instead of 'classic' mode where you read out 1 bit per clock cycle from SO (Serial Out).
When acting as the host just make sure you provide enough power and that the signals are high/low at the right times. All this information can be found in the datasheet of the flash chips.