River Rooks // Articles Directory
Field notes and technical write-ups covering embedded firmware reverse engineering, network forensics, low-level memory exploitation, and self-hosted infrastructure.
| PERMS | DATE | PRIMARY TAG | ARTICLE TITLE / FILE | EST. TIME | ACTION |
|---|---|---|---|---|---|
| -rw-r--r-- | [#firmware] | > Reverse Engineering IoT Firmware: SPI Flash Extraction | 8 mins | [INSPECT] | |
| -rw-r--r-- | [#homelab] | > Building a High-Availability Traefik Router with Docker Compose | 12 mins | [INSPECT] | |
| -rw-r--r-- | [#posix-sh] | > POSIX sh vs. Bash: Portability in Modern Scripts | 6 mins | [INSPECT] | |
| -rw-r--r-- | [#ctf] | > CTF Write-up: Heap Exploitation in glibc 2.35 | 15 mins | [INSPECT] | |
| -rw-r--r-- | [#networking] | > Zero-Trust Network Isolation with WireGuard & OPNsense VLANs | 10 mins | [INSPECT] |
~/notes/iot-firmware-spi-extraction.md
2026-07-20 • 8 mins read • [#firmware] [#hardware] [#security]
In security audits of embedded systems, retrieving the firmware is the critical first step. When over-the-air updates are encrypted and debug ports (UART, JTAG) are disabled in production silicon, dumping physical SPI Flash memory becomes necessary. This writeup covers extracting firmware from an 8-pin SOP SPI flash chip using a Bus Pirate and flashrom to bypass bootloader lockdowns.
# Query the SPI flash details using flashrom via Bus Pirate
flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump.bin
# Verify the integrity of the binary dump by comparing hashes
if [ $? -eq 0 ]; then
echo "Dump successful. Running md5sum..."
md5sum firmware_dump.bin
fi
Format: IEEE Std 1003.1 Markdown
READ COMPLETE WRITEUP →