Hot answers tagged

24

Although I think the questions are too broad and I agree with @cb88 that the datasheet should give you all you need to know, I'll try to answer some. How to dump the memory Desoldering First option is desoldering the chip from the board. After having done so you have 2 options Read the chip out using a chip programmer like e.g. Dataman that supports your ...


7

There is no SPI specification that dictates things like read codes or address lengths, AFAIK; these are chip-specific and have been generally standardized by vendors of SPI EEPROMs and flash chips (though I"m not aware of any formal agreement among vendors). Most SPI EEPROMs use two bytes to specify the read address, because they are so small that they only ...


4

Is the board powered? Obviously the chip needs power to be able to read out. The problem with doing this while it's still on the board is that other logic might be trying to access your chip at the same time. All I can recommend is removing it from the board and powering the chip using your programmer (I don't know if the bus pirate is capable of doing ...


3

First off, I would suggest ensuring that the HOLD# pin is pulled high. If it is not, the chip is in a "paused" state and you won't be able to read from it. I've dumped several SPI chips while they were in circuit and the most common problem that I've run into is that the power rail that the chip is powered from on the PCB is probably powering other ...


2

Flashrom project has some advice on ISP (In-System Programming) of SPI chips. For example: Often parts of the chipset are powered on partially (by the voltage supplied via the Vcc pin of the flash chip). In that case disconnect Vcc from the programmer and power it with its normal PSU and try powering up the board normally and holding it in reset (...


2

If this Linux distribution does support LD_PRELOAD you can easily use this feature to override opening/closing/reading/writing/ioctl-ing functions to this specific device. See here for very basic tutorial: http://www.catonmat.net/blog/simple-ld-preload-tutorial/ This will not require writing driver and pretty usable approach. IN addition you can try to use ...


2

If the board is a functional unit and not just a board with a single SOC on it, your best bet is probably to find small pin-count devices such as serial EEPROMs or an SDCard connector that have a SPI interface and known pinout and trace back from there. Alternatively, you can proceed by process of elimination since there are 17 pins, and you can probably ...


2

I'm not too familiar with eCos, but my guess is that device address is not a memory address but the address of the hardware device used to access the SPI chip by the OS and bootloader, i.e. something similar to the PCI address like B0:D31:F0 (bus 0, device 31, function 0) on the PC. You should try to find where the flash is mapped into memory and read the ...


2

The legacy BIOS code is usually stored compressed in the UEFI filesystem. You can find it in UEFITool by looking for the magic string IFE$ (49 46 45 24) - signature of the EFI_COMPATIBILITY16_TABLE structure. In AMI based firmware it is usually a RAW subsection of a file names CSMCORE. The following script parses the AMI format raw stream and extracts the ...


1

The SD card controllers are usually embedded deeply into the card and do not offer easy access to their firmware (SPI or otherwise). However, they may have undocumented backdoor commands over the SD interface that are used for factory testing. You can find the details and investigation of one family of controllers in bunnie & xobs's 30C3 talk: slides, ...


1

After extracting the ROM image from the update, UEFITool parses it fine for me:


1

There are some items I do not understand in your code: In the initial "bind" routine, there are commands 0x3F, 0x3E, 0x39, corresponding to registers 1F, 1E, 19, if I understood this right. These are not documented in the NRF24l01 data sheet (btw your link to it does not work). You send the payload with the correct command 0xA0. However, you send a total of ...


1

This can be a little awkward from time to time. There are several ways this can pan out. In approximate order of lazyness: You allow the router to provide power and the Bus Pirate attempts to drive the CS, clock, MOSI and reads MISO. The problem here will be that you need the master CS and clock to be in a high-impedance state for this to work. Because ...


1

You could probably use erase with some arguments to erase only the nvram partition, but I'm not sure if U-Boot can then reinitialize nvram storage. And since nvram usually contains the boot commands, erasing everything could make your unit unbootable. Therefore I would recommend erasing only specific variables. You can use setenv for that: To modify the ...


1

It may be possible. Based on the data sheet you posted, you need to see if Pin 9 is tied directly to ground, or can be controlled by the CPU. If it can be controlled, the chip can be re-programmed. If Pin 9 is tied to the CPU, you may then be in the realm of trial-and-error to see how to control that pin.


Only top voted, non community-wiki answers of a minimum length are eligible