11 votes
Accepted

Extracting a NAND flash dump with OOB data

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
Igor Skochinsky's user avatar
  • 36.6k
6 votes

Extracting a NAND flash dump with OOB data

I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip). upgtool can extract ...
Amaury Pouly's user avatar
6 votes

How does ECC work with nandwrite/nanddump in mtd-utils?

First of all the ECC scheme used does not necessaryly have to be the for all the flash erase blocks. There are ususally 3 different types of flash partitions used and for every type the method to ...
bshm's user avatar
  • 61
4 votes
Accepted

found easter egg (incl releasing trigger) in as code, but no clue how to fire it

This combination (up, up, down, down, left, right, left, right, A, B) is a well known Konami code so just pressing those keys should trigger it. The real question here is when, or if at all this ...
Paweł Łukasik's user avatar
4 votes
Accepted

Is it possible copy and save bootloader using CLI telnet commands?

The bootloader is in the flash, so you have to dump it first by using: dd if=/dev/mtd0 of=/tmp/mtd0 or nandump -of /tmp/mtd0 /dev/mtd0 After it you have to copy to an SD card, USB device or send ...
ebux's user avatar
  • 1,759
4 votes
Accepted

Dumping a NAND Flash

It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
Igor Skochinsky's user avatar
  • 36.6k
4 votes
Accepted

how to flash image.bin with uboot using serial or tftp

kernel_load_addr=0xd0600000 filesize=400000 then reset the device . it should be working. Starting kernel ... Uncompressing Linux... done, booting the kernel. gipc-protocol address: d4880010 ipc ...
coolirc's user avatar
  • 111
4 votes
Accepted

What could a firmware image be, if not embedded linux?

There are plenty of non-Linux solutions for embedded systems, ranging from an RTOS such as eCos, FreeRTOS, ThreadX, Nucleus and many others to a completely monolithic, custom made firmware without any ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes

dump flash memory with CAN BUS

In the automotive domain take a close look at the Unified Diagnostic Services (UDS) protocol. Most modern cars implement at least some of the services provided by UDS, typically over the OBD-II CAN ...
oh.dae.su's user avatar
  • 131
3 votes

Reverse Engineering an ERP interface written in Flash

Intercept the traffic between the browser / plugins and the server. I would start with Wireshark. The traffic between the client and the server will be some form of network requests which you can ...
pythonpython's user avatar
3 votes

Reverse Engineering an ERP interface written in Flash

My college has its erp platform in a flash interface, accesible only via Internet Explorer. Thing is, accessing the erp from amything other internet explorer results in the browser download a flash ...
user882813's user avatar
2 votes

Determine NAND Flash chip type and dump contents

If it's really a NAND flash chip conforming to ONFI standard and if you have an universal programmer, it should be possible to read its ID. www.onfi.org/~/media/onfi/specs/onfi_2_1_gold.pdf — refer ...
Vladislav Ivanov's user avatar
2 votes

Extracting a NAND flash dump with OOB data

Just a fast answer as future tip for NAND issues. When make reading of NAND flashes (doesn't care if bga, tsop..), not all programmers make clear dump, normally it includes dummy blocks as you ...
numind's user avatar
  • 153
2 votes
Accepted

Flash ROM has lower max voltage than read device?

The MX25U1635E is designed for 1.8 volt logic, whereas your programmer is designed for 3.3 or 5.0 volt logic. You're going to need a 1.8 volt adapter for the programmer or you will damage the ...
Zman37's user avatar
  • 126
2 votes

SPI Flash, how to find the System memory addresses?

I'm not too familiar with eCos, but my guess is that device address is not a memory address but the address of the hardware device used to access the SPI chip by the OS and bootloader, i.e. something ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

How to read firmware from an STC microcontroller?

I was doing a similar research and apparently there's no way to read it. STC says that it's a "feature" of their microcontrollers, the bootloader protects the code. Links related to this ...
Nicolae Mogoreanu's user avatar
2 votes
Accepted

How to read firmware from an STC microcontroller?

To program this MCU try using the programmer software at this site: http://www.stcmicro.com/rjxz.html Use USB to serial TTL to flash the code. Hope this helps
necki2's user avatar
  • 36
2 votes

Memory map in AVR Harvard architecture

So in the video he ask how that can be passable? and he answer that AVR used Harvard architecture , and data and code in diffrent address (not like x86) Different means are used to access each. In ...
Chris Stratton's user avatar
2 votes
Accepted

Unpacking, modifying, repacking and flashing a firmware

Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to ...
multithr3at3d's user avatar
1 vote

SD card microcontroller

The SD card controllers are usually embedded deeply into the card and do not offer easy access to their firmware (SPI or otherwise). However, they may have undocumented backdoor commands over the SD ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Using NAND flash dump with OOB data

It depends. For example Samsung XSR stores information about the blocks in spare area, thus you need to have to dump both data and spare.
Anton Kukoba's user avatar
  • 1,840
1 vote

Using NAND flash dump with OOB data

This depends very much on how exactly you plan to write the data back; some options would accept only "payload", others may need OOB too. If you use U-Boot's nand write, it seems it accepts data ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

SqashFS 3.0 file system has 40 "random" bytes of 0xFF in it

Do these extra bytes appear at regular intervals? If so, they could be the spare or OOB(out of band) bytes which are present in most NAND chips for error checking or housekeeping (bad block management ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

dump flash memory with CAN BUS

If the specific ECU you have implements flash reading CAN commands and if you know the command format (and possibly some password necessary to unlock them) then it may be possible. Unfortunately to ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Writing data flash of MPC5606B through JTAG interface using Nexus

At a guess, it is using NAND flash. This type of flash has good density and is reasonably cheap but it has one limitation: individual bits can be only toggled from 1 to 0 but not the other way around. ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Flash reading by JTAG in MPC5606B

After to study Chapter five of MPC5606's reference manual, I expected that the tool would send a 64-bits password, but I didn't found it in communication yet ( the time of communication is too big,...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

How can I determine if NAND blocks are good blocks?

I don't know if it applies exactly but the following document from QNX suggests that: spare is made up of "sequence #", "file ID", "offset", "CRC" and "ECC" there are special blocks that contains ...
Amaury Pouly's user avatar
1 vote

SWF flash analysis

According to https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3aJS%2fMeadgive this malware will download packages based on existing vulnerabilities. One way to ...
T. Edison's user avatar
1 vote

How to extract content of NVRAM file?

According to this page, you can try this command : dd if=/dev/mtdblock/0 bs=1 skip=4116 count=2048 | strings > /tmp/cfe.txt
SebMa's user avatar
  • 111
1 vote

How to extract content of NVRAM file?

Since there is no standard NVRAM format, you will need to find whatever code reads and/or writes it and analyze how it works. If the maker provides GPL source code, maybe some details can be gleaned ...
Igor Skochinsky's user avatar
  • 36.6k

Only top scored, non community-wiki answers of a minimum length are eligible