Reconstructing Device Firmware from SPI Reads

If you wanted to extract the firmware from a mystery device, you might pull the flash chip out of it and toss it into a reader. Reconstructing Device Firmware from SPI Reads. But if you only had one chance to get it right and couldn’t risk damaging the device in the process, physically removing the chip may seem much less attractive.

Reading the chip in-circuit failed — because of course it did — so what does that leave. Well, if you follow the example of [Matthew “wrongbaud” Alt], the next tool you reach for might be a logic analyzer. In a recent write-up, [wrongbaud] explains the process of identifying, capturing, and ultimately decoding the SPI read operations used to load the firmware from a common W25Q-series flash chip at boot time.

He notes it’s not a perfect solution, as in the end you’ll only be able to sniff out what the CPU actually reads, not necessarily the entire contents of the chip, but it’s a big step in the right direction if you’re reverse engineering something in the dark. Before digging into the decoding of the captured data, [wrongbaud] does what he does best and breaks down the nuts and bolts of SPI communication. Armed with the output from his logic analyzer and the datasheet for the flash chip, he explains how to interpret the various signals at play.