1

I am trying to reverse engineer a router's firmware. The device has a NAND chip, and has a cripled version of BusyBox v1.14.1. nanddump command exists but with intresting parameters, as I wasn't able to find any info on Google. Also nandwrite command doesn't exist, instead they wrote a different tool called psi to write to the chip. Here are the outputs of their usage with compare to the original counterparts.

$ nanddump
Usage: nanddump mtdX [noswap || swap] [nospare || spare] sector_count
        sector_count can be provided as "0" which means the whole partition

So, what are these swap and spare options for? When I try to dump with swapor noswap I got the same file when I use the command cat /dev/mtd* > mtd*.bin. However using spare parameter gives a slightly bigger file. Here is what I got from full fledged busybox

$ nanddump
BusyBox v1.21.1 (2013-07-08 10:56:01 CDT) multi-call binary.

Usage: nanddump [-o] [-b] [-s ADDR] [-f FILE] MTD_DEVICE

Dump the specified MTD device

        -o      Dump oob data
        -b      Omit bad block from the dump
        -s ADDR Start address
        -l LEN  Length
        -f FILE Dump to file ('-' for stdout)

And for the other tool, psi

$ psi
usage: psi -o <command> -t <configtype> -f <filename|env.var.name> -s <flashsize> -r <rebootflag>
supported commands: <read> <write> <erase>
supported config types: <asd> <cfg> <env> <flash> <firmware>
supported reboot flags: <yes> <no>
Note: -s parameter is for flash dump/undump only

It seems like this tool reads and writes at the same time. Well this is hard to figure out as I wasn't able to use it to read mtd partitions, and it doesn't let firmware partition to be read. It only writes to that partition. Here is the nandwrite command from busybox.

$ nandwrite
BusyBox v1.21.1 (2013-07-08 10:56:01 CDT) multi-call binary.

Usage: nandwrite [-p] [-s ADDR] MTD_DEVICE [FILE]

Write to the specified MTD device

        -p      Pad to page size
        -s ADDR Start address

So I believe flashsize from psicommand has something to do with these two parameters. Also here is the list of mtd

$ cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00004000 "RootFS"
mtd1: 08000000 00020000 "FlashAll"
mtd2: 00020000 00020000 "Bootloader"
mtd3: 00220000 00020000 "BootloaderConfig"
mtd4: 00220000 00020000 "Config"
mtd5: 00220000 00020000 "ASD"
mtd6: 02200000 00020000 "Kernel"
mtd7: 02200000 00020000 "KernelBackup"
mtd8: 02e60000 00020000 "disk"
mtd9: 00220000 00020000 "edr"
mtd10: 00500000 00020000 "bbt"

Custom nanddump throws an error while reading RootFS. These are all I got for now.

0

Don’t know what swap is about, but spare area, or OOB area is an additional area at the end of each page storing metadata such as:

  • bad block markers
  • ECC (error checking and correcting) code
  • custom data which may be used by the system

It seems the spare option enables dumping it which is why the dump is slightly bigger.

For more info about NAND flash organization see this nice document from Lauterbach

| improve this answer | |
  • thank you for your response. i checked that document it is indeed a nice one. as you said i confirmed that spare option is for extra data from the chips datasheet. Also i have realized that swap changes endiannes of the dumps. I have bootloader dump which has "cfe" written in normal one and when swapped it becomes "efc". I also was able to dump using psi command. It's dumping as multiples of 64KB data. I believe that is page size, but I am not sure. psi command has no ecc option – ekardon May 20 at 2:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.