Firmware extraction

• To get the firmware

  • Download it from internet

  • TFTP transfert the root file system (not all the firmware but at least the files)

  • Get from bootloader

    

  • Read directly from ROM with the right tools

Serial Peripheral Interface

• SPI Protocol

• Master-Slave : one give order the other listen and answer

• MISO : Master in Slave out

• MOSI : Master out Slave in

• CLK : Sync clock given by the master chip

• CS : Chip select - Value given by the master

• Vss = ground

• Find read instruction in the datasheet

• EEPROM / FlashROM clip to read the ROM

  • Test clips can be easier to use

  

• Double check the connections, the ROM is easy to burn

  • No need to connect Vcc

• SPI is higher freq than UART, use high sampling like 16MHz and over

  • Sometimes errors are due to bad USB adapter

SPI_BOOT_CAPTURE.zip

• Then using PulseView we can deduce the signals
  • The chip selected is the one that goes down at the beginning of the action
  • The Clock start pulsing as soon as the CS is enabled
  • The MISO is inactive until the MOSI vary
  • Here we already knows the pins, but sometimes, the logic analyser is the only way to find out the pinout of the chip

• But rather than deducing it by hand lets just use a decoder provided by pulsview

Extracting the firmware from ROM