11
votes
Accepted
Extracting a NAND flash dump with OOB data
So, I have figured it out myself in the end. I'll try to describe the process.
First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
- 36.4k
6
votes
Extracting a NAND flash dump with OOB data
I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip).
upgtool can extract ...
- 226
6
votes
How does ECC work with nandwrite/nanddump in mtd-utils?
First of all the ECC scheme used does not necessaryly have to be the for all the flash erase blocks. There are ususally 3 different types of flash partitions used and for every type the method to ...
- 61
4
votes
Accepted
found easter egg (incl releasing trigger) in as code, but no clue how to fire it
This combination (up, up, down, down, left, right, left, right, A, B) is a well known Konami code so just pressing those keys should trigger it.
The real question here is when, or if at all this ...
- 4,912
4
votes
Accepted
Is it possible copy and save bootloader using CLI telnet commands?
The bootloader is in the flash, so you have to dump it first by using:
dd if=/dev/mtd0 of=/tmp/mtd0
or
nandump -of /tmp/mtd0 /dev/mtd0
After it you have to copy to an SD card, USB device or send ...
- 1,759
4
votes
Accepted
Dumping a NAND Flash
It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
- 36.4k
4
votes
Accepted
how to flash image.bin with uboot using serial or tftp
kernel_load_addr=0xd0600000
filesize=400000
then reset the device . it should be working.
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
gipc-protocol address: d4880010
ipc ...
- 111
4
votes
Accepted
What could a firmware image be, if not embedded linux?
There are plenty of non-Linux solutions for embedded systems, ranging from an RTOS such as eCos, FreeRTOS, ThreadX, Nucleus and many others to a completely monolithic, custom made firmware without any ...
- 36.4k
3
votes
dump flash memory with CAN BUS
In the automotive domain take a close look at the Unified Diagnostic Services (UDS) protocol. Most modern cars implement at least some of the services provided by UDS, typically over the OBD-II CAN ...
- 131
3
votes
Reverse Engineering an ERP interface written in Flash
Intercept the traffic between the browser / plugins and the server. I would start with Wireshark.
The traffic between the client and the server will be some form of network requests which you can ...
- 878
3
votes
Reverse Engineering an ERP interface written in Flash
My college has its erp platform in a flash interface, accesible only via Internet Explorer.
Thing is, accessing the erp from amything other internet explorer results in the browser download a flash ...
- 131
2
votes
Determine NAND Flash chip type and dump contents
If it's really a NAND flash chip conforming to ONFI standard and if you have an universal programmer, it should be possible to read its ID.
www.onfi.org/~/media/onfi/specs/onfi_2_1_gold.pdf — refer ...
- 619
2
votes
Extracting a NAND flash dump with OOB data
Just a fast answer as future tip for NAND issues.
When make reading of NAND flashes (doesn't care if bga, tsop..), not all programmers make clear dump, normally it includes dummy blocks as you ...
- 153
2
votes
Accepted
Flash ROM has lower max voltage than read device?
The MX25U1635E is designed for 1.8 volt logic, whereas your programmer is designed for 3.3 or 5.0 volt logic. You're going to need a 1.8 volt adapter for the programmer or you will damage the ...
- 126
2
votes
SPI Flash, how to find the System memory addresses?
I'm not too familiar with eCos, but my guess is that device address is not a memory address but the address of the hardware device used to access the SPI chip by the OS and bootloader, i.e. something ...
- 36.4k
2
votes
How to read firmware from an STC microcontroller?
I was doing a similar research and apparently there's no way to read it. STC says that it's a "feature" of their microcontrollers, the bootloader protects the code.
Links related to this ...
2
votes
Accepted
How to read firmware from an STC microcontroller?
To program this MCU try using the programmer software at this site:
http://www.stcmicro.com/rjxz.html
Use USB to serial TTL to flash the code.
Hope this helps
- 36
2
votes
Memory map in AVR Harvard architecture
So in the video he ask how that can be passable? and he answer that AVR used Harvard architecture , and data and code in diffrent address (not like x86)
Different means are used to access each.
In ...
- 245
2
votes
Accepted
Unpacking, modifying, repacking and flashing a firmware
Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to ...
- 609
1
vote
SD card microcontroller
The SD card controllers are usually embedded deeply into the card and do not offer easy access to their firmware (SPI or otherwise). However, they may have undocumented backdoor commands over the SD ...
- 36.4k
1
vote
Using NAND flash dump with OOB data
It depends. For example Samsung XSR stores information about the blocks in spare area, thus you need to have to dump both data and spare.
- 1,840
1
vote
Using NAND flash dump with OOB data
This depends very much on how exactly you plan to write the data back; some options would accept only "payload", others may need OOB too.
If you use U-Boot's nand write, it seems it accepts data ...
- 36.4k
1
vote
SqashFS 3.0 file system has 40 "random" bytes of 0xFF in it
Do these extra bytes appear at regular intervals? If so, they could be the spare or OOB(out of band) bytes which are present in most NAND chips for error checking or housekeeping (bad block management ...
- 36.4k
1
vote
dump flash memory with CAN BUS
If the specific ECU you have implements flash reading CAN commands and if you know the command format (and possibly some password necessary to unlock them) then it may be possible.
Unfortunately to ...
- 36.4k
1
vote
Writing data flash of MPC5606B through JTAG interface using Nexus
At a guess, it is using NAND flash. This type of flash has good density and is reasonably cheap but it has one limitation: individual bits can be only toggled from 1 to 0 but not the other way around. ...
- 36.4k
1
vote
Flash reading by JTAG in MPC5606B
After to study Chapter five of MPC5606's reference manual, I expected
that the tool would send a 64-bits password, but I didn't found it in
communication yet ( the time of communication is too big,...
- 36.4k
1
vote
How can I determine if NAND blocks are good blocks?
I don't know if it applies exactly but the following document from QNX suggests that:
spare is made up of "sequence #", "file ID", "offset", "CRC" and "ECC"
there are special blocks that contains ...
- 226
1
vote
SWF flash analysis
According to
https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3aJS%2fMeadgive this malware will download packages based on existing vulnerabilities.
One way to ...
- 11
1
vote
How to extract content of NVRAM file?
According to this page, you can try this command :
dd if=/dev/mtdblock/0 bs=1 skip=4116 count=2048 | strings > /tmp/cfe.txt
- 111
1
vote
How to extract content of NVRAM file?
Since there is no standard NVRAM format, you will need to find whatever code reads and/or writes it and analyze how it works. If the maker provides GPL source code, maybe some details can be gleaned ...
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible