Firmware Dumping
Flash Memory Types
- NOR Flash (SOIC8 package)
- SPI Flash
- Mostly error "Fault-free" memory
- Used for embedded device that need fast execution, but low storage capacity
- NAND Flash (TSOP48 package)
- eMMC Flash (BGA{153} package)
- UFS Universal Flash Storage
Flash a new firmware into the microcontroller
-
Using avrdudes/avrdude
# send raw data firmware $ avrdude -p m328p -c usbasp -P /dev/ttyUSB0 -b 9600 -U flash:w:flash_raw.bin # send ihex firmware $ avrdude -c arduino -p atmega328p -P /dev/ttyUSB* -b115200 -u -V -U flash:w:CHALLENGE.hex $ avrdude -c usbasp -p m328p -F -U flash:r:dump.hex:i # default $ avrdude -c usbasp -p m328p -C /etc/avrdude.conf -U flash:w:hardcodedPassword.ino.arduino_standard.hex
-
Using raspberrypi/picotool
Dump flash using debug port
-
Using avrdudes/avrdude
-
Using openocd-org/openocd
- Determine code space in the microcontroller (for example nRF51822 - Micro:bit), save as
dump_img.cfg
: - Dump with openocd
- Determine code space in the microcontroller (for example nRF51822 - Micro:bit), save as
-
Using raspberrypi/picotool
- Build PicoTool, you will need the pico-sdk
- Dump the program or the whole flash memory
Dump Flash via SPI
-
Using flashrom/flashroom
sudo apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion libusb-1.0-0-dev svn co svn://flashrom.org/flashrom/trunk flashrom cd flashrom make flashrom -p ft232_spi:type:232h -r spidump.bin flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r spi_dump.bin flashrom -p serprog:dev=/dev/ttyACM0,spispeed=160k -r dump_spi.bin -c "MX25L6406E/MX25L6408E"
-
Using HydraBus: hydrabus/hydrafw/hydra_spi_dump.py
Convert ihex to elf
The Intel HEX is a transitional file format for microcontrollers, (E)PROMs, and other devices. The documentation states that HEXs can be converted to binary files and programmed into a configuration device.
Each line in the ihex file starts with :
- a colon :
- followed by ONE BYTE = record length
- followed by TWO BYTES = offset to load
- followed by ONE BYTE = Record Type
- Last BYTE in the line = Checksum
Convert .hex(ihex format) to .elf file with avr-objcopy
or with an online tool http://matrixstorm.com
$ avr-objcopy -I ihex -O elf32-avr dump.hex dump.elf
# or
$ objcopy -I ihex chest.hex -O binary chest.bin ; xxd chest.bin
Alternative with Python bincopy
Quick strings on .hex
Inspect the assembly with avr-objdump -m avr -D chest.hex
.\
Emulate : qemu-system-avr -S -s -nographic -serial tcp::5678,server=on,wait=off -machine uno -bios chest.bin
Explore firmware
-
strings
$ strings file.bin $ strings -e l file.bin The strings -e flag specifies the encoding of the characters. -el specifies little-endian characters 16-bits wide (e.g. UTF-16) $ strings -tx file.bin The -t flag will return the offset of the string within the file. -tx will return it in hex format, T-to in octal and -td in decimal.
-
dd
-
binwalk
-
Unsquashfs
Write new firmware
-
Repack firmware
-
Flashrom write
Type of firmware
- SREC - Motorola S-Record : All S-record file lines start with a capital S.
- Intel HEX lines all start with a colon.
- TI-TXT is a Texas Instruments format, usually for the MSP430 series. Memory addresses are prepended with an @, and data is represented in hex.
- Raw NAND dumps
Check entropy
High entropy = probably encrypted (or compressed). Low entropy = probably not
Encrypted firmware
Over-the-air updates
TODO