0

I'm working on reverse engineering a small household weather station, and I have successfully managed to extract the contents of a SPI NOR flash chip (using a modified version of this Python library to add the ID for the flash chip on the PCB) that I found on the circuit board, but the data appears to have some sort of shifting/jumbling.

For example:

00070f10  20 54 52 50 4a 4f 43 45  49 54 4e 4f 41 20 54 4c  | TRPJOCEITNOA TL|
00070f20  57 2f 54 49 20 48 41 46  52 48 4e 45 45 48 54 49  |W/TI HAFRHNEEHTI|
00070f30  20 20 45 43 53 4c 55 49  20 53 52 50 4a 4f 00 00  |  ECSLUI SRPJO..|
00070f40  00 00 20 20 55 43 52 52  4e 45 20 54 20 20 52 20  |..  UCRRNE T  R |

I can clearly tell the word FAHRENHEIT is on the second line, CELSIUS is on the third line, and CURRENT is on the fourth line, but the characters are all mixed up. Is this some sort of basic encryption, or is it a sign that I am reading the flash memory improperly?

Improve this question

1 Answer 1

Reset to default
0

Looks like 16bit Little endian for me. Bytes are swapped pairwise so instead of 12345678 you got 21436587. Not sure if its only on the strings or on all flash bytes. Best to test both variants out

Improve this answer
5
  • Interesting. I have never seen strings that use a pattern like that, though I am new to dumping flash memory. Is that layout normally related to the processor being used, or is a flash related thing?
    – BarrowWight
    Commented Mar 23, 2022 at 4:29
  • Processor-related. Had similarly scrambled bytes in a flashdump that i pulled from a CSR-based bluetooth module. Also: what chips are inside your device? (knowing that can give some useful pointers later)
    – masterX244
    Commented Mar 23, 2022 at 8:11
  • The main MCU (that the flash is connected to) is underneath an epoxy blob. There is an ESP8266 module that has the UART pins connected to the main MCU (and I found some AT Command strings) in the flash, so probably uses them. Lastly there is a 433MHz receiver module with castellated pads that is connected over I2C
    – BarrowWight
    Commented Mar 24, 2022 at 1:59
  • Dangit. Seems like you need to poke around blindly in the flashdump since there is no hint on the architecture. Possible to send me a copy of the dump?
    – masterX244
    Commented Mar 24, 2022 at 7:44
  • I'm not keen on doing that as I have previously had the device connection to my home network and some web accounts and I'm not sure if any of it might be encoded in the dump. Excluded a few bytes here and there, all of the bytes that are not 0xFF exist between 0x700080 and 0x7AE0B. Thanks to your help with the endianess, I now have a list of AT commands that likely communicate with the ESP83266, and this weekend I am going to desolder the RF shield from the ESP8266 module and read the SPI flash that is underneath it.
    – BarrowWight
    Commented Mar 25, 2022 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.