Skip to main content

Questions tagged [flash]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
36 views

Buspirate_spi and flashrom opensource software

I have a question about buspirate_spi programmer and flashrom. I have a new Flash rom Boye BY25Q128AS similar to the winbond W25Q128.V in the flashrom list. How can I dump the data from this specific ...
Renin Roy's user avatar
1 vote
0 answers
74 views

Reading/writing flash ROM connected to OMAP L138 without JTAG

I have a product that uses an OMAP L138 with a flash rom. There are a couple different models of this product available, but they all share the same hardware with the only difference being the ...
Patrick's user avatar
  • 141
3 votes
0 answers
41 views

How to patch bootstrap in NAND flash?

I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC I read/write that flash. How can I analyze the bootstrap and change ...
Kokomelom's user avatar
  • 281
0 votes
1 answer
175 views

Contents of SPI NOR Flash appears scrambled

I'm working on reverse engineering a small household weather station, and I have successfully managed to extract the contents of a SPI NOR flash chip (using a modified version of this Python library ...
BarrowWight's user avatar
2 votes
0 answers
170 views

Edit Squashfs filesystem in flash memory

I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs . When I open this FS I want to add some file into this FS and edit some ...
yfr24493AzzrggAcom's user avatar
1 vote
0 answers
625 views

How can I flash unpacked firmware into Alcatel MiFi?

I bought Alcatel MW40V from Vodafone Shop some weeks ago and I can't access USSD Codes within Web UI. Bus 001 Device 008: ID 1bbb:0195 T & A Mobile Phones Alcatel OneTouch L850V / Telekom ...
AtomX's user avatar
  • 111
4 votes
0 answers
892 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
Capstone's user avatar
  • 143
1 vote
1 answer
149 views

What could a firmware image be, if not embedded linux?

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
Dan Scally's user avatar
1 vote
0 answers
325 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
silencedogood's user avatar
3 votes
1 answer
254 views

Dump Headunit Software

I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble. Note: I have no specialized tools just a DMM and ...
DaCoder's user avatar
  • 31
0 votes
1 answer
324 views

Detecting and reading embedded filesystems on desktop Linux

I have some data from a NAND chip, dumped using the built in nanddump utility on the embedded device. This is the device information: https://openwrt.org/toh/bt/homehub_v5a The NAND chip is 128MiB ...
moo's user avatar
  • 111
3 votes
2 answers
105 views

Reverse Engineering an ERP interface written in Flash

My college has its ERP platform in a Flash interface, accessible only via Internet Explorer. I am looking into ways I can interface with it via things like ruffle. So I can write my own frontend using ...
Blaine's user avatar
  • 131
2 votes
1 answer
398 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
cobz's user avatar
  • 121
1 vote
1 answer
445 views

Why doesn't binwalk see the filesystems in this Eufy Home Base 2 flash dump?

This teardown: https://electronics-teardowns.blogspot.com/2020/07/eufy-homebase2-teardown.html Gives a flash dump for the Eufy Home Base 2 here: https://anonymousfiles.io/Ve9y3cL4/ With this partition ...
winston_smith's user avatar
1 vote
1 answer
2k views

Unpacking, modifying, repacking and flashing a firmware

I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a ...
jvergeldedios's user avatar
0 votes
0 answers
175 views

How to dump firmware from an SD card?

I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
c00000fd's user avatar
  • 1,711
1 vote
1 answer
374 views

Memory map in AVR Harvard architecture

In this video https://youtu.be/D0VKuZuuvW8?t=259 . You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff . So in the video he ask ...
joif doi's user avatar
1 vote
1 answer
276 views

SD card microcontroller

I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory. Thank ...
user29875's user avatar
1 vote
2 answers
1k views

Using NAND flash dump with OOB data

I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
minto's user avatar
  • 215
2 votes
1 answer
2k views

Dumping a NAND Flash

I am currently trying to dump the content of a NAND Flash that is part of an embedded system. The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side....
Ramazuri's user avatar
  • 108
4 votes
1 answer
3k views

how to flash image.bin with uboot using serial or tftp

Hello I have a 4G LTE router which is blocked. and I have already dumped the partitions before via telnet from another device of the same model. U-Boot 2010.09 (Sep 06 2016 - 10:08:39)GCT GDM7243 ...
coolirc's user avatar
  • 111
1 vote
1 answer
68 views

SqashFS 3.0 file system has 40 "random" bytes of 0xFF in it

I'm looking at a firmware dump from a NAND flash chip and comparing it against another similar firmware dump I have. I am able to open one of them to see the root folder structure, however the other I ...
user29090's user avatar
1 vote
2 answers
4k views

How to read firmware from an STC microcontroller?

I have some printed circuit boards of a device that is no longer manufactured. I need to repair these boards but there is no replacement for them. I can make other boards, buy the components, but I ...
Daniel's user avatar
  • 215
2 votes
2 answers
3k views

dump flash memory with CAN BUS

I want to be able to read Flash memory from Microcontroller using CAN BUS, I was looking for the past few months for some resources to do that but didn't find any, i'm wondering how is that possible ...
Jwdsoft's user avatar
  • 191
1 vote
1 answer
149 views

Flash ROM has lower max voltage than read device?

I'm planning to read a MX25U1635E chip using the CH341a reader. The specs for that chip say it has a max voltage of 1.6-2.0 volts. The reader has an output of 3.3-5.0 volts. Most tutorials for the ...
gatzkerob's user avatar
  • 113
1 vote
0 answers
151 views

Motorola Freescale mpc564 microcontroller

Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
advancedsrs's user avatar
2 votes
0 answers
123 views

How can you use modprobe nandsim for two chips?

I have a board that uses two nand chips with data that appears to be interleaved byte-by-byte. I have manually desoldered the chips and dumped them with their respective spare areas to two files. I am ...
PaulS's user avatar
  • 91
2 votes
0 answers
764 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
78dtat78da's user avatar
2 votes
1 answer
800 views

SPI Flash, how to find the System memory addresses?

How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info: Flash Device Information: ...
minto's user avatar
  • 215
1 vote
1 answer
148 views

found easter egg (incl releasing trigger) in as code, but no clue how to fire it

I've been recently looking through decompiled AS3 code from Ubisoft's "The Settlers Online" and found an easter egg along with something that looked like trigger, but - as I have never read AS3 before,...
internety's user avatar
  • 148
0 votes
1 answer
197 views

Writing data flash of MPC5606B through JTAG interface using Nexus

I'm programming flash memory of MPC5606B through JTAG interface using Nexus. I'm imitating a tool that perform this task. However, in the middle of the process, the entire flash memory is erased. I ...
Daniel's user avatar
  • 215
0 votes
1 answer
572 views

Flash reading by JTAG in MPC5606B

I'm using MPC5606B and I would like to know what kind of issues I would have, concerning protection\encryption if I tried to read its flash content by JTAG using an external device. I was able to ...
Daniel's user avatar
  • 215
4 votes
0 answers
342 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
baltersice's user avatar
7 votes
1 answer
491 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
PaulS's user avatar
  • 91
2 votes
1 answer
953 views

SWF flash analysis

An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further ...
Heisenberg's user avatar
9 votes
3 answers
11k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote
3 answers
5k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
Lexx Luxx's user avatar
  • 203
0 votes
1 answer
671 views

Wiring Flash Chip to Raspberry Pi

I'm trying to wire a Winbond W25Q128FV to my Rasberry Pi Model 1B so that I can dump the firmware. I'll be using an SOIC8 clip and probe cables. Here is what I'm thinking: Flash ----- rPi CS ----- ...
Dylan Leggio's user avatar
0 votes
1 answer
3k views

Dumping Flash Memory Using Bus Pirate

I'm planning on dumping and reading the flash memory of a Winbond W25Q128FV chip. I've done some research and plan on buying the following tools to achieve this: Bus Pirate 3.6a Probe Cable SOIC8 ...
Dylan Leggio's user avatar
3 votes
4 answers
11k views

Determine NAND Flash chip type and dump contents

I have a USB stick with a NAND Flash chip that has only a few unhelpful markings on the chip. I desoldered the chip and I have a universal programmer, but I'm having trouble using it with my NAND ...
hft's user avatar
  • 191
2 votes
1 answer
544 views

Reversing Flash Files that use .loadBytes()

I've always been more knowledgeable about binary reversing -- x86/x64 type stuff -- so lately I decided I wanted to try reversing some flash. Used SoThink to get the .AS from a SWF, but the SWF is ...
Values's user avatar
  • 31
1 vote
3 answers
1k views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
fxgreen's user avatar
  • 113
2 votes
0 answers
902 views

Flash dump with encoded firmware

I downloaded firmware from 4MB spi flash in HDMI extender (more info here). It contains following sections: 0x00000000 – 0x00024e03 – SMEDIA02 …….456789ABCDEF (encoded – some strings suggesting ...
danman's user avatar
  • 129
1 vote
0 answers
2k views

Dump a MX25L12845E with a bus pirate and flashrom

I just received my buspirate, I now want to dump a flash (MX25L12845E). I tried the following command: flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c ...
VivienG's user avatar
  • 161
6 votes
1 answer
12k views

How does ECC work with nandwrite/nanddump in mtd-utils?

I am working on a device which has a NAND flash chip in TSOP48, a SK Hynix H27U1G8F2BTR (1Gbit/128Mbyte, 2048byte (+ 64byte spare) pages, 128K blocks). I have desoldered the chip and dumped the ...
Cybergibbons's user avatar
  • 1,762
8 votes
1 answer
137 views

No apparent effect after editing some JSON in the memory of a Flash process

I was trying to change the values of a Flash game which loads the SWF and some JSON over a HTTPS site. So changing the values of JSON was not possible using browser cache. I changed the values of ...
Novice User's user avatar