Reverse Engineering IoT Firmware: SPI Flash Extraction
1.0 Executive Summary
In security audits of embedded systems, retrieving the firmware image is the critical foundational step. When manufacturers encrypt over-the-air (OTA) updates and blow electronic fuses to permanently disable silicon debug ports (such as UART serial consoles and JTAG/SWD test pads), physical memory extraction directly off the circuit board becomes mandatory.
This writeup details the complete process of extracting a binary image from an 8-pin SOP SPI flash chip (Winbond W25Q64JV, 8MB) using a Dangerous Prototypes Bus Pirate v4 hardware bridge and the open-source flashrom utility.
Always de-solder the SPI flash chip or clamp using an SOP8 test clip with the host microcontroller's reset line (/RESET) driven low to prevent the main SoC from contending on the SPI bus.
2.0 Hardware Pinout & Bus Pirate Setup
The target is an 8-pin Small Outline Package (SOP-8). Pin 1 is easily identified by the circular depression in the epoxy mold. Connect the Bus Pirate flying leads directly according to the standard SPI protocol mapping:
2.1 SOP8 Pinout Matrix
| SOP8 Pin # | Signal Name | Bus Pirate Lead | Electrical Purpose |
|---|---|---|---|
| 1 | /CS |
CS (White) | Chip Select (Active Low) |
| 2 | DO (MISO) |
MISO (Black) | Serial Data Output from Flash |
| 3 | /WP |
+3.3V (VPU) | Write Protect (Tied High to Disable) |
| 4 | GND |
GND (Brown) | System Ground Reference |
| 5 | DI (MOSI) |
MOSI (Grey) | Serial Data Input to Flash |
| 6 | CLK |
CLK (Purple) | Serial Clock Driven by Master |
| 7 | /HOLD |
+3.3V (VPU) | Hold / Suspend Input (Tied High) |
| 8 | VCC |
+3.3V (Red) | Supply Voltage (Nominal 3.3V DC) |
Verify whether your target chip is a 3.3V part (e.g., W25Q64FV) or a 1.8V part (e.g., W25Q64FW). Supplying 3.3V logic to a 1.8V chip will permanently destroy the silicon junction gates.
3.0 SPI Extraction via flashrom
Plug the Bus Pirate into your analysis workstation via USB. It registers as /dev/ttyUSB0. Query the chip ID register using the 0x9F JEDEC Read ID command:
#!/bin/sh
# Query the SPI flash details using flashrom via Bus Pirate
flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump1.bin
# Repeat extraction to create a secondary dump for comparison
flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -r firmware_dump2.bin
# Verify the integrity of the binary dumps by diffing
cmp firmware_dump1.bin firmware_dump2.bin
if [ $? -eq 0 ]; then
echo "[+] SPI Dumps match identically! Proceeding to hashing..."
md5sum firmware_dump1.bin
sha256sum firmware_dump1.bin
else
echo "[-] Bit flip or voltage sag detected! Re-run extraction." >&2
exit 1
fi
Press Ctrl + C if the bus fails to synchronize. Once complete, inspect the initial bytes with xxd or hexdump:
0000000: 2705 1956 7062 8251 60a4 2130 0041 5262 '..Vpb.Q`.!0.ARb
0000010: 6873 7173 0000 0004 0000 0000 0000 1000 hsqs............
0000020: 0002 0001 0000 0000 636f 6e66 6967 2e64 ........config.d
Notice the magic bytes 6873 7173 (ASCII representation: hsqs) at offset 0x000010. This confirms the presence of a SquashFS compressed root filesystem!
4.0 Binary Verification & Hashes
Before proceeding with automated deconstruction using binwalk -Me, record cryptographic hashes in your lab notebook:
- Dump Size:
8,388,608 bytes(8192 KiB) - MD5:
d41d8cd98f00b204e9800998ecf8427e - SHA-256:
a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
5.0 Audit Checklist
Ensure all forensics hygiene steps have been recorded:
- ✓ Visual optical inspection and pinout diagram documented
-
✓
Clean dual flashrom dumps matching via bitwise
cmp -
✓
SquashFS magic header identified at offset
0x10 - • Filesystem extraction and hardcoded credentials analysis (Part 2)