Reverse Engineering IoT Firmware: SPI Flash Extraction
- - -1.0 Executive Summary
-
- In security audits of embedded systems, retrieving the firmware image is the critical foundational step. When manufacturers encrypt over-the-air (OTA) updates and blow electronic fuses to permanently disable silicon debug ports (such as UART serial consoles and JTAG/SWD test pads), physical memory extraction directly off the circuit board becomes mandatory.
-
- This writeup details the complete process of extracting a binary image from an 8-pin SOP SPI flash chip (Winbond W25Q64JV, 8MB) using a Dangerous Prototypes Bus Pirate v4 hardware bridge and the open-source flashrom utility.
-
- Always de-solder the SPI flash chip or clamp using an SOP8 test clip with the host microcontroller's reset line (/RESET) driven low to prevent the main SoC from contending on the SPI bus.
-
2.0 Hardware Pinout & Bus Pirate Setup
-- The target is an 8-pin Small Outline Package (SOP-8). Pin 1 is easily identified by the circular depression in the epoxy mold. Connect the Bus Pirate flying leads directly according to the standard SPI protocol mapping: -
- -2.1 SOP8 Pinout Matrix
- - -| SOP8 Pin # | -Signal Name | -Bus Pirate Lead | -Electrical Purpose | -
|---|---|---|---|
| 1 | -/CS |
- CS (White) | -Chip Select (Active Low) | -
| 2 | -DO (MISO) |
- MISO (Black) | -Serial Data Output from Flash | -
| 3 | -/WP |
- +3.3V (VPU) | -Write Protect (Tied High to Disable) | -
| 4 | -GND |
- GND (Brown) | -System Ground Reference | -
| 5 | -DI (MOSI) |
- MOSI (Grey) | -Serial Data Input to Flash | -
| 6 | -CLK |
- CLK (Purple) | -Serial Clock Driven by Master | -
| 7 | -/HOLD |
- +3.3V (VPU) | -Hold / Suspend Input (Tied High) | -
| 8 | -VCC |
- +3.3V (Red) | -Supply Voltage (Nominal 3.3V DC) | -
- Verify whether your target chip is a 3.3V part (e.g., W25Q64FV) or a 1.8V part (e.g., W25Q64FW). Supplying 3.3V logic to a 1.8V chip will permanently destroy the silicon junction gates.
-
3.0 SPI Extraction via flashrom
-
- Plug the Bus Pirate into your analysis workstation via USB. It registers as /dev/ttyUSB0. Query the chip ID register using the 0x9F JEDEC Read ID command:
-
#!/bin/sh
-# Query the SPI flash details using flashrom via Bus Pirate
-flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump1.bin
-
-# Repeat extraction to create a secondary dump for comparison
-flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump2.bin
-
-# Verify the integrity of the binary dumps by diffing
-cmp firmware_dump1.bin firmware_dump2.bin
-if [ $? -eq 0 ]; then
- echo "[+] SPI Dumps match identically! Proceeding to hashing..."
- md5sum firmware_dump1.bin
- sha256sum firmware_dump1.bin
-else
- echo "[-] Bit flip or voltage sag detected! Re-run extraction." >&2
- exit 1
-fi
- Press Ctrl + C if the bus fails to synchronize. Once complete, inspect the initial bytes with xxd or hexdump:
-
0000000: 2705 1956 7062 8251 60a4 2130 0041 5262 '..Vpb.Q`.!0.ARb
-0000010: 6873 7173 0000 0004 0000 0000 0000 1000 hsqs............
-0000020: 0002 0001 0000 0000 636f 6e66 6967 2e64 ........config.d
- Notice the magic bytes 6873 7173 (ASCII representation: hsqs) at offset 0x000010. This confirms the presence of a SquashFS compressed root filesystem!
-
4.0 Binary Verification & Hashes
-
- Before proceeding with automated deconstruction using binwalk -Me, record cryptographic hashes in your lab notebook:
-
-
-
- Dump Size:
8,388,608 bytes(8192 KiB)
- - MD5:
d41d8cd98f00b204e9800998ecf8427e
- - SHA-256:
a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
-
5.0 Audit Checklist
-- Ensure all forensics hygiene steps have been recorded: -
- --
-
- - ✓ - Visual optical inspection and pinout diagram documented - -
-
- ✓
- Clean dual flashrom dumps matching via bitwise
cmp-
- -
- ✓
- SquashFS magic header identified at offset
0x10-
- - - • - Filesystem extraction and hardcoded credentials analysis (Part 2) - -