Removing the flash chip to extract the firmware of a mysterious device risks damaging the device, while reading the chip in-circuit may also fail. [Matthew “wrongbaud” Alt] instead explains how to identify, record, and analyze the SPI read operations performed by the common W25Q series of flash chips during boot using a logic analyzer. Since the method is limited to the data actually read by the processor, it may not provide the contents of the entire chip.
Alt first explains the basics of SPI communication and how to interpret the signals using the flash chip’s datasheet. He then processes logic analyzer captures with Scapy, converting them into an image file that can be passed to binwalk. The Python tool Scapy can also be used with this type of data, beyond network packets.
Although the firmware image contains a bootloader and the Linux kernel, the filesystem partition is missing. This is because the processor switches to the faster Quad-SPI mode, which uses two additional data lines, before reading the filesystem. After additional recording and processing, the two images are combined with a single-line dd command. Alt’s work also includes a hardware hacking guide and studies of fault injection.
Why it matters
This approach both reduces the risk of damaging the device by making it possible to work without removing the chip during firmware analysis and gives researchers the opportunity to monitor the actual communication on the board. However, since the result reflects the sections accessed by the processor during startup rather than all the content stored in memory, the scope of the resulting image is limited from the outset. In particular, the transition from SPI to Quad-SPI shows why recording only standard signals can produce an incomplete output and requires similar studies to take the data lines used into account. This demonstrates to hardware researchers and those conducting reverse engineering that the method is not sufficient on its own and that additional recording and processing steps may be needed to complete the missing sections.