Flash Extraction - Revision history

Polymorphic7: Remove Ezp2023+ and add XGECU T48 TL866 II Plus

2026-04-02T14:51:18Z

Remove Ezp2023+ and add XGECU T48 TL866 II Plus

Symbioquine: /* Internal ROM */ Added links related to STM32F0 Obermaier whitepaper - Shedding too much Light on a Microcontroller’s Firmware Protection

2025-09-03T00:28:31Z

Internal ROM: Added links related to STM32F0 Obermaier whitepaper - Shedding too much Light on a Microcontroller’s Firmware Protection

Polymorphic7: flashrom added

2025-06-30T21:02:30Z

flashrom added

Polymorphic7: typo

2025-05-29T15:33:02Z

typo

Polymorphic7: better clarification + sentence fixed.

2025-05-29T15:24:17Z

better clarification + sentence fixed.

Polymorphic7: href to software category.

2025-04-25T11:20:39Z

href to software category.

Polymorphic7: finishing "The final chapter".

2025-04-25T11:06:46Z

finishing "The final chapter".

Polymorphic7: fix + added logic analyzer nand hacking.

2025-04-23T18:16:15Z

fix + added logic analyzer nand hacking.

Polymorphic7: better clarification

2025-04-15T20:01:31Z

better clarification

Polymorphic7: typo fixed

2025-04-15T19:13:18Z

typo fixed

@@ Line 179: / Line 179: @@
 :: ➤ CH341A programmer
 :::;- [https://www.onetransistor.eu/2017/08/ch341a-mini-programmer-schematic.html CH341A Mini Programmer Schematic and Drivers blogpost.]
-:: ➤ Ezp2023+ programmer with appropriate SOP16 SOP8 adapter
+:: ➤ XGECU T48 TL866 II Plus
-:::;- '''Important note:''' limited NOR Flash and NAND Flash support! Might need 1.8v adapter, buggy software. [https://www.onetransistor.eu/2023/12/how-to-use-ezp2023-usb-programmer.html Read more here.]
+:::;- Budget friendly high speed 30mhz programmer supports a wide range of chips (EEPROM/Flash/MCU/BIOS/SPI/NOR/NAND/EMMC) including high-capacity nand (up to 256gb).<br> Adjustable VCC/VPP voltages (1.8-6.5v up to 25v), logic testing and pin diagnostics. Broad OS support from Win XP to Win11.
 =====Flash Utilities=====
 :: ➤ flashrom (Support: SPI/BIOS/EC)

@@ Line 99: / Line 99: @@
 ::::: [https://cardis.org/cardis2013/proceedings/CARDIS2013_16.pdf Example paper 3. Glitch it if you can: parameter search strategies for successful fault injection.]
 ::::: [https://www.researchgate.net/publication/353922465_The_Forgotten_Threat_of_Voltage_Glitching_A_Case_Study_on_Nvidia_Tegra_X2_SoCs Example paper 4. The Forgotten Threat of Voltage Glitching: A Case Study on Nvidia Tegra X2 SoCs]
 :::;- Clock glitching (Oscillator Circuits)
 ::::: [https://caslab.io/publications/durand2021ultra.pdf Example paper 1. Ultra Freezing Attacks and Clock Glitching of Clock Oscillator Circuits]

@@ Line 172: / Line 172: @@
 :::; <pre style="font-weight: normal;">Signing an OTA update package involves applying a digital signature using cryptographic methods. This process serves several critical purposes. 1. Authenticity. 2. Integrity.</pre>
-====Programmers & Nand Flash Controllers ====
+====Programmers / Flash Utilities & Nand Flash Controllers ====
 =====Programmers=====
 ======SOP16 / 8 / VSOP8 / WSON8 / PDIP8 / SO8 / TSSOP8 / UFDFPN8======
@@ Line 179: / Line 179: @@
 :: ➤ Ezp2023+ programmer with appropriate SOP16 SOP8 adapter
 :::;- '''Important note:''' limited NOR Flash and NAND Flash support! Might need 1.8v adapter, buggy software. [https://www.onetransistor.eu/2023/12/how-to-use-ezp2023-usb-programmer.html Read more here.]
 =====Nand Flash Controllers=====

@@ Line 70: / Line 70: @@
 ::- 1-Wire is a wired half-duplex serial bus designed by Dallas Semiconductor that provides low-speed (16.3 kbit/s) data communication and supply voltage over a single conductor.
 ::: '''[Example]''' Genuine Dell laptop power supplies use the 1-Wire protocol to transmit data over the third wire to the laptop's embedded controller, providing information about power, current, and voltage ratings.
-::: The embedded controller then verifies that a compatible power supply is connected, allowing all VMR phases to operate at maximum duty cycle.
+::: The embedded controller then verifies that a compatible power supply is connected, allowing all VRM phases to operate at maximum duty cycle.
 ::: Emulating the [https://github.com/orgua/OneWireHub/blob/main/examples/DS2502_DELLCHG/DS2502_DELLCHG.ino DS2502 TO-92-3 1-wire Dell charger ID EEPROM.]

@@ Line 69: / Line 69: @@
 :* [https://en.wikipedia.org/wiki/1-Wire One-Wire]
 ::- 1-Wire is a wired half-duplex serial bus designed by Dallas Semiconductor that provides low-speed (16.3 kbit/s) data communication and supply voltage over a single conductor.
-::: Genuine Dell laptop power supplies use the 1-Wire protocol to send data via the third wire to the laptop computer about power, current and voltage ratings.
+::: '''[Example]''' Genuine Dell laptop power supplies use the 1-Wire protocol to transmit data over the third wire to the laptop's embedded controller, providing information about power, current, and voltage ratings.
-::: The laptop will then refuse charging if the adapter does not meet requirements.
+::: The embedded controller then verifies that a compatible power supply is connected, allowing all VMR phases to operate at maximum duty cycle.
 ::: Emulating the [https://github.com/orgua/OneWireHub/blob/main/examples/DS2502_DELLCHG/DS2502_DELLCHG.ino DS2502 TO-92-3 1-wire Dell charger ID EEPROM.]

@@ Line 199: / Line 199: @@
 ====The final chapter ====
-Analyzing dumped data.
+Analyzing dumped data. You might also find the [[Software_Tools#|software category interesting.]]
 ::* Analyzing & unpacking firmware blobs
 :::;- [https://github.com/onekey-sec/unblob Unblob]

@@ Line 200: / Line 200: @@
 ====The final chapter ====
 Analyzing dumped data.
-::* Tools
+::* Analyzing & unpacking firmware blobs
 :::;- [https://github.com/onekey-sec/unblob Unblob]
 :::;- [https://github.com/ReFirmLabs/binwalk Binwalk]
@@ Line 207: / Line 207: @@
 :::;- [https://github.com/attify/firmware-analysis-toolkit Firmware Analysis Tools (FAT)]
 :::;- [https://github.com/fkie-cad/FACT_core FACT (Firmware Analysis and Comparison Tool)]

@@ Line 125: / Line 125: @@
 : Credits to [https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/ 0x01 Team] and [https://www.youtube.com/watch?v=IOD5voFTAz8 RECESSIM] for finding the reset low period being connected to the glitch timebase.
-====Debugging Tools====
+====Debugging====
 ::* Tools that are used to find debug ports, OCD interfaces, serial port I/O.
-:::;- [https://github.com/openocd-org/openocd OpenOCD (Open On-Chip Debugger)]
+::;- [https://github.com/openocd-org/openocd OpenOCD (Open On-Chip Debugger)]
-:::;- [https://www.picotech.com/products/oscilloscope PicoScope. The modern alternative to the traditional benchtop oscilloscope.]
+::;- [https://www.picotech.com/products/oscilloscope PicoScope. The modern alternative to the traditional benchtop oscilloscope.]
-:::;- [https://buspirate.com/ BusPirate - universal bus interface device for I2C and SPI.]
+::;- [https://buspirate.com/ BusPirate - universal bus interface device for I2C and SPI.]
-:::;- [https://github.com/travisgoodspeed/goodfet GoodFET JTAG adapter]
+::;- [https://github.com/travisgoodspeed/goodfet GoodFET JTAG adapter]
-:::;- [https://mouser.com/new/segger/seggerjlink/ J-Link In-Circuit Debugger]
+::;- [https://mouser.com/new/segger/seggerjlink/ J-Link In-Circuit Debugger]
-:::;- [https://github.com/grandideastudio/jtagulator JTAGulator is an open source hardware tool that assists in identifying OCD interfaces from test points, vias, component pads, or connectors on a target device.]
+::;- [https://github.com/grandideastudio/jtagulator JTAGulator is an open source hardware tool that assists in identifying OCD interfaces from test points, vias, component pads, or connectors on a target device.]
 ====Non-intrusive methods====

@@ Line 175: / Line 175: @@
 =====Nand Flash Controllers=====
 Listing of nand flash controller interface chips & off the shelf hardware (cheap stuff).<br>
-Since the search engine is broken @ the usual suspects. I use a search query like example '''“TSOP48  usb pcb controller flash disk site:aliexpress.com”''' in image search mode.
+Since the search engine is broken @ the usual suspects: DHgate, Gearbest, Banggood, Aliexpress or various other China stores. I use a search query for example '''“TSOP48  usb pcb controller flash disk site:aliexpress.com”''' in image search mode.
 ======BGA-153======
 :: ➤ ['''UFS'''] JMicron JMS901 USB 3 (single channel nand supported)

@@ Line 85: / Line 85: @@
 =====Internal ROM=====
-When your target chip has an built-in ROM and the chip is locked you are out of luck trying to easily read the firmware in most cases.<br>
+When your target chip has a built-in ROM and the chip is locked you are out of luck trying to easily read the firmware in most cases.<br>
 Here is where it comes handy to know of different methods widely used to attack these chips in order to retrieve the firmware for later static analysis or even live debugging.