Questions tagged [flash]
The flash tag has no usage guidance.
49 questions
0
votes
0
answers
51
views
Which BHC error correction code produces non-zero code for all-zero data input
I am reversing a raw flash image (Micron MT29F16G08ABACA), and I am currently stuck trying to find the correct ECC algorithm.
What I know thus far:
1 page = 4096 bytes data + 224 bytes OOB (out of ...
- 33
1
vote
0
answers
90
views
Firmware analysis output
I have a ZTE router "ZTE_ZXHN_H168N" and want to learn more about firmware reverse engineering. I managed to do the following so far:
Dump the firmware from the SPI flash.
Running strings ...
- 11
0
votes
0
answers
26
views
Going from NAND dump to firmware update package
I.... Have no idea what I'm doing.
So, I did a full NAND dump of an Actions ATJ2257 based MP4 player (url: https://archive.org/details/eclipse-t-2810-c.-7z) and I want to recreate the ".fw" ...
- 183
0
votes
1
answer
44
views
Buspirate_spi and flashrom opensource software
I have a question about buspirate_spi programmer and flashrom. I have a new Flash rom Boye BY25Q128AS similar to the winbond W25Q128.V in the flashrom list. How can I dump the data from this specific ...
1
vote
0
answers
75
views
Reading/writing flash ROM connected to OMAP L138 without JTAG
I have a product that uses an OMAP L138 with a flash rom. There are a couple different models of this product available, but they all share the same hardware with the only difference being the ...
- 141
3
votes
0
answers
42
views
How to patch bootstrap in NAND flash?
I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC
I read/write that flash.
How can I analyze the bootstrap and change ...
- 281
0
votes
1
answer
176
views
Contents of SPI NOR Flash appears scrambled
I'm working on reverse engineering a small household weather station, and I have successfully managed to extract the contents of a SPI NOR flash chip (using a modified version of this Python library ...
- 103
2
votes
0
answers
170
views
Edit Squashfs filesystem in flash memory
I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs .
When I open this FS I want to add some file into this FS and edit some ...
1
vote
0
answers
660
views
How can I flash unpacked firmware into Alcatel MiFi?
I bought Alcatel MW40V from Vodafone Shop some weeks ago and I can't access USSD Codes within Web UI.
Bus 001 Device 008: ID 1bbb:0195 T & A Mobile Phones Alcatel OneTouch L850V / Telekom ...
- 111
4
votes
0
answers
909
views
How to extract sound file from a small 1MB binary
I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
- 143
1
vote
1
answer
154
views
What could a firmware image be, if not embedded linux?
I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
- 113
1
vote
0
answers
347
views
Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset
I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP.
The device has a custom android repo ...
3
votes
1
answer
258
views
Dump Headunit Software
I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble.
Note: I have no specialized tools just a DMM and ...
- 31
0
votes
1
answer
337
views
Detecting and reading embedded filesystems on desktop Linux
I have some data from a NAND chip, dumped using the built in nanddump utility on the embedded device.
This is the device information: https://openwrt.org/toh/bt/homehub_v5a The NAND chip is 128MiB ...
- 111
3
votes
2
answers
105
views
Reverse Engineering an ERP interface written in Flash
My college has its ERP platform in a Flash interface, accessible only via Internet Explorer. I am looking into ways I can interface with it via things like ruffle. So I can write my own frontend using ...
- 131
2
votes
1
answer
398
views
How to dump firmware from ATWINC1510
I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file.
I know that the IC offers an SPI interface through the pins described in the ...
- 121
1
vote
1
answer
455
views
Why doesn't binwalk see the filesystems in this Eufy Home Base 2 flash dump?
This teardown:
https://electronics-teardowns.blogspot.com/2020/07/eufy-homebase2-teardown.html
Gives a flash dump for the Eufy Home Base 2 here: https://anonymousfiles.io/Ve9y3cL4/
With this partition ...
1
vote
1
answer
2k
views
Unpacking, modifying, repacking and flashing a firmware
I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a ...
- 113
0
votes
0
answers
177
views
How to dump firmware from an SD card?
I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
- 1,761
1
vote
1
answer
385
views
Memory map in AVR Harvard architecture
In this video https://youtu.be/D0VKuZuuvW8?t=259 .
You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff .
So in the video he ask ...
- 41
1
vote
1
answer
279
views
SD card microcontroller
I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory.
Thank ...
- 11
1
vote
2
answers
1k
views
Using NAND flash dump with OOB data
I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
- 235
2
votes
1
answer
2k
views
Dumping a NAND Flash
I am currently trying to dump the content of a NAND Flash that is part of an embedded system.
The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side....
- 108
4
votes
1
answer
3k
views
how to flash image.bin with uboot using serial or tftp
Hello I have a 4G LTE router which is blocked. and I have already dumped the partitions before via telnet from another device of the same model.
U-Boot 2010.09 (Sep 06 2016 - 10:08:39)GCT GDM7243
...
- 111
1
vote
1
answer
71
views
SqashFS 3.0 file system has 40 "random" bytes of 0xFF in it
I'm looking at a firmware dump from a NAND flash chip and comparing it against another similar firmware dump I have. I am able to open one of them to see the root folder structure, however the other I ...
- 11
1
vote
2
answers
4k
views
How to read firmware from an STC microcontroller?
I have some printed circuit boards of a device that is no longer manufactured. I need to repair these boards but there is no replacement for them. I can make other boards, buy the components, but I ...
- 215
2
votes
2
answers
3k
views
dump flash memory with CAN BUS
I want to be able to read Flash memory from Microcontroller using CAN BUS, I was looking for the past few months for some resources to do that but didn't find any, i'm wondering how is that possible ...
- 191
1
vote
1
answer
150
views
Flash ROM has lower max voltage than read device?
I'm planning to read a MX25U1635E chip using the CH341a reader.
The specs for that chip say it has a max voltage of 1.6-2.0 volts. The reader has an output of 3.3-5.0 volts.
Most tutorials for the ...
- 113
1
vote
0
answers
152
views
Motorola Freescale mpc564 microcontroller
Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
- 11
2
votes
0
answers
124
views
How can you use modprobe nandsim for two chips?
I have a board that uses two nand chips with data that appears to be interleaved byte-by-byte. I have manually desoldered the chips and dumped them with their respective spare areas to two files. I am ...
- 91
2
votes
0
answers
767
views
Obscure router refuses to flash OpenWrt
This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications.
I found GND/Tx/Rx/...
- 154
2
votes
1
answer
807
views
SPI Flash, how to find the System memory addresses?
How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info:
Flash Device Information:
...
- 235
1
vote
1
answer
151
views
found easter egg (incl releasing trigger) in as code, but no clue how to fire it
I've been recently looking through decompiled AS3 code from Ubisoft's "The Settlers Online" and found an easter egg along with something that looked like trigger, but - as I have never read AS3 before,...
- 148
0
votes
1
answer
202
views
Writing data flash of MPC5606B through JTAG interface using Nexus
I'm programming flash memory of MPC5606B through JTAG interface using Nexus. I'm imitating a tool that perform this task. However, in the middle of the process, the entire flash memory is erased. I ...
- 215
0
votes
1
answer
577
views
Flash reading by JTAG in MPC5606B
I'm using MPC5606B and I would like to know what kind of issues I would have, concerning protection\encryption if I tried to read its flash content by JTAG using an external device.
I was able to ...
- 215
4
votes
0
answers
343
views
How to perform manual flashing of a bricked device?
I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
- 51
7
votes
1
answer
496
views
How can I determine if NAND blocks are good blocks?
I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
- 91
2
votes
1
answer
957
views
SWF flash analysis
An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further ...
- 21
9
votes
3
answers
11k
views
Extracting a NAND flash dump with OOB data
I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed.
The dump was supposed to be just user ...
- 36.9k
1
vote
3
answers
5k
views
How to extract content of NVRAM file?
How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash.
NVRAM has been copied as mtdblock partition.
An embedded device that run Linux v2.6.18_pro500.
Linux version 2.6.18_pro500 ...
- 203
0
votes
1
answer
680
views
Wiring Flash Chip to Raspberry Pi
I'm trying to wire a Winbond W25Q128FV to my Rasberry Pi Model 1B so that I can dump the firmware. I'll be using an SOIC8 clip and probe cables.
Here is what I'm thinking:
Flash ----- rPi
CS ----- ...
- 45
0
votes
1
answer
3k
views
Dumping Flash Memory Using Bus Pirate
I'm planning on dumping and reading the flash memory of a Winbond W25Q128FV chip. I've done some research and plan on buying the following tools to achieve this:
Bus Pirate 3.6a
Probe Cable
SOIC8 ...
- 45
3
votes
4
answers
11k
views
Determine NAND Flash chip type and dump contents
I have a USB stick with a NAND Flash chip that has only a few unhelpful markings on the chip. I desoldered the chip and I have a universal programmer, but I'm having trouble using it with my NAND ...
- 191
2
votes
1
answer
545
views
Reversing Flash Files that use .loadBytes()
I've always been more knowledgeable about binary reversing -- x86/x64 type stuff -- so lately I decided I wanted to try reversing some flash.
Used SoThink to get the .AS from a SWF, but the SWF is ...
- 31
1
vote
3
answers
1k
views
Is it possible copy and save bootloader using CLI telnet commands?
I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
- 113
2
votes
0
answers
902
views
Flash dump with encoded firmware
I downloaded firmware from 4MB spi flash in HDMI extender (more info here). It contains following sections:
0x00000000 – 0x00024e03 – SMEDIA02 …….456789ABCDEF (encoded – some strings suggesting ...
- 129
1
vote
0
answers
2k
views
Dump a MX25L12845E with a bus pirate and flashrom
I just received my buspirate, I now want to dump a flash (MX25L12845E).
I tried the following command:
flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c ...
- 161
6
votes
1
answer
12k
views
How does ECC work with nandwrite/nanddump in mtd-utils?
I am working on a device which has a NAND flash chip in TSOP48, a SK Hynix H27U1G8F2BTR (1Gbit/128Mbyte, 2048byte (+ 64byte spare) pages, 128K blocks).
I have desoldered the chip and dumped the ...
- 1,762
8
votes
1
answer
137
views
No apparent effect after editing some JSON in the memory of a Flash process
I was trying to change the values of a Flash game which loads the SWF and some JSON over a HTTPS site. So changing the values of JSON was not possible using browser cache.
I changed the values of ...
- 223