Firmware Extraction Series: Firmware Media
Firmware, sometimes referred to as a firmware image (or simply “ROM” in mobile communities), resides in Non-Volatile Memory (NVM) and can be both read and written. In embedded systems, the most common NVM types are ROM (Read-Only Memory) and Flash memory. While strictly speaking, “ROM” includes Mask ROM, PROM, EPROM, and EEPROM, modern “mainstream ROM” usually refers to EEPROM integrated within an MCU. Flash memory typically serves as the primary external storage.
In embedded devices, beyond standard NAND or NOR flash chips, you may also encounter eMMC. For expandable storage, devices might use SD cards, CF cards, USB drives, or HDDs. These storage solutions generally follow a controller + storage architecture: a controller bridges the host and the storage medium. As long as you can interact with the controller, you can read or write to the underlying storage.
Devices like eMMC, SD cards, and HDDs expose standard external interfaces, allowing them to be read using standard card readers or programming sockets. In contrast, raw flash chips are managed directly by the SoC (System on Chip) via specific drivers; they lack a generic external interface. However, because these chips are memory-mapped peripherals, you can interact with them if you can access their address space. This is the principle behind techniques like reading firmware via JTAG, IAP (In-Application Programming), or bootloaders (like U-Boot). Theoretically, even if the device’s main controller is non-functional, the firmware can still be recovered directly from the storage chip.
For the purpose of this series, I define “firmware” as the original files containing the operating system and data stored on these media. In embedded security research, firmware extraction is almost always the first—and most critical—step. Without the firmware, further research often hits a dead end. This series aims to systematically share the knowledge and techniques I’ve accumulated over years of performing firmware extraction.
EEPROM vs. NOR vs. NAND FlashEEPROM typically offers much higher endurance (erase/write cycles) than Flash memory. Combined with small package sizes and low write/erase power consumption, EEPROM is often the preferred choice for storing configuration data, particularly in automotive applications.
For high-performance storage, Flash memory is the standard. There are two main types:
- NOR Flash: Supports XIP (eXecute In Place) and offers fast read speeds, but provides slower write and erase operations. It supports random access, making it ideal for code execution.
- NAND Flash: Accessed in blocks rather than randomly. It offers significantly higher capacity, higher throughput, and lower cost per bit, but generally has lower reliability and requires complex management.
To communicate with these media, you must speak their protocols:
- EEPROM: Typically uses I2C or SPI (Serial Peripheral Interface).
- NOR Flash: Serial NOR usually uses SPI; Parallel NOR uses a parallel bus. Protocol standards include JEDEC SFDP (JESD216) for SPI and JEDEC CFI (JESD68) for parallel NOR.
- NAND Flash: Uses the Raw NAND protocol, with most modern devices adhering to the ONFI (Open NAND Flash Interface) standard.
Note: JEDEC (Joint Electron Device Engineering Council) defines standards that allow software to query a Flash chip’s manufacturer and device IDs to determine its size and capabilities. However, not all chips strictly adhere to these standards.
NOR Flash PackagesNOR flash is available in parallel and serial variants.
- Serial NOR: Commonly packaged as SOP (Small Outline Package) and uses SPI.
- Parallel NOR: Typically uses TSOP (Thin Small Outline Package) like TSOP-56, or BGA (Ball Grid Array) like TFBGA-56 and LFBGA-64.
Because NOR flash supports random access, it functions similarly to SRAM. Below is the pinout for a parallel NOR flash chip. Manually wiring these (using “flying leads”) can be tedious due to the high pin count.
Symbol Pin Name Function A[MAX:0] Address Address bits for read/write operations DQ[7:0] Data I/O Inputs/Outputs for commands and data DQ[14:8] Data I/O Inputs/Outputs for commands and data DQ15/A-1 Data I/O Data or address input (for x8/x16 mode switching) BYTE# Byte/Word Select Selects 8-bit or 16-bit data organization CE# Chip Enable Activates the device RE# Read Enable Data is valid on the falling edge of this pulse OE# Output Enable Drives data onto the bus when LOW; high-impedance when HIGH WE# Write Enable Triggers write operations WP# Write Protect Prevents unintended program/erase operations when LOW RST# Reset Resets the device RY/BY# Read/Busy Output LOW during operations; HIGH when ready. Requires a pull-up resistor (open-drain). Vcc Power Supply Voltage (typically 3.3V or 1.8V) Vss Ground Ground NC No Connection Unconnected pinTSOP-56 Pinout:
NAND FlashNAND flash is a type of non-volatile storage optimized for high density. Embedded devices commonly use SLC (Single Level Cell) NAND, which stores 1 bit per cell.
Flash memory uses a floating-gate transistor structure. Electrons are trapped in an insulated floating gate to store data. A key characteristic of Flash is that it cannot support in-place overwrites. Writing involves capturing electrons, but “erasing” involves releasing them. To erase, a high voltage is applied to pull electrons from the floating gate. Because the source connections are grouped, erasure must happen in large blocks, not individual bytes.
NAND PackagesThe ONFI standard defines several common packages for NAND flash, typically using SMT (Surface Mount Technology).
TSOP-48:
BGA-63:
NAND Flash Pin AssignmentNAND flash uses a multiplexed parallel I/O interface, typically 8-bit (x8). Pins marked with # are active-low and usually require pull-up resistors.
Symbol Pin Name Function I/O x Data I/O Used for command, address, and data input/output. High-impedance when disabled. CLE Command Latch Enable When HIGH, commands are latched on the rising edge of WE#. ALE Address Latch Enable When HIGH, addresses are latched on the rising edge of WE#. CE# Chip Enable Activates the device. When marked high, the device enters standby. RE# Read Enable Data is driven onto the bus on the falling edge of this pulse. WE# Write Enable Latches data/address/commands on the rising edge. WP# Write Protect Hardware write protection. R/B# Read/Busy Indicates device status. LOW = Busy; HIGH = Ready. Open-drain output (requires pull-up). Vcc Power Supply Voltage (3.3V / 1.8V) Vss Ground Ground NC No Connection Unconnected Array OrganizationNAND is organized hierarchically. Below is the organization of an 8-bit NAND chip from ESMT:
- Page: 2048 bytes (Data) + 64 bytes (Spare/OOB)
- Block: 64 Pages
- Device: 1024 Blocks
- Total Capacity: 1056 Mbits (128 MB Data + 4 MB Spare)
For non-expandable storage (soldered chips), reading methods fall into three categories:
- Chip-off (Offline): Desolder the chip and read it using a dedicated programmer and socket.
- Pros: Direct access, works if the device is dead.
- Cons: Higher cost (hardware), potential for damage, requires handling ECC/bad blocks manually.
- In-System / In-Circuit (Online): Connect external tools to the PCB to read the chip without desoldering.
- Methods: SoC debug interfaces (JTAG/SWD) or clamping directly to the storage chip pins (e.g., using a test clip).
- Tools: J-Link, USBDM, Bus Pirate, or custom harnesses.
- Internal Backup (Software): Gain shell access (e.g., via UART or partial exploit) and use system tools (dd, cat, nanddump) to dump the firmware partitions.
Tip: You don’t always need expensive programmers. For common protocols, a microcontroller (STM32, AVR) or a Raspberry Pi can often be repurposed as a dumper.
Architecture: How Embedded Devices Use FlashNOR Flash is similar to standard RAM: it supports random access. This enables XIP (eXecute In Place), allowing the CPU to fetch and execute instructions directly from the flash memory. This makes NOR ideal for storing the bootloader or BIOS, which must run immediately upon power-up.
NAND Flash, by contrast, does not support XIP. The CPU cannot execute code directly from NAND. Therefore, the very first stage of boot code cannot reside solely on NAND.
Historical Context (The “NOR-less” Shift): Early devices (like feature phones) used both NOR and NAND: NOR for the bootloader/kernel (XIP) and NAND for the filesystem (storage). Samsung later popularized the “NOR-less” concept. By embedding a small ROM inside the SoC capable of loading a bootloader from the first page of NAND into internal RAM, they eliminated the need for expensive NOR chips. This reduced cost and complexity, making NOR rare in modern high-volume consumer electronics like smartphones.
Managed Flash & FTL: NAND is susceptible to bit flips and bad blocks. It requires a complex software management layer called the FTL (Flash Translation Layer) to handle:
- Error Correction Codes (ECC)
- Bad Block Management
- Wear Leveling
- Garbage Collection
Depending on where this FTL resides, flash is categorized as:
- Raw Flash: The FTL is implemented in the OS driver (software).
- Managed Flash (eMMC, SD, UFS): The FTL is implemented in a hardware controller inside the storage package.
Implications for Extraction: When reading Raw NAND, you get the raw data including bit errors and OOB (Out-Of-Band) metadata. You must manually handle ECC algorithms (e.g., Hamming, BCH) and descrambling to reconstruct a valid binary. Since these algorithms are often vendor-specific and not standard, this is the most challenging part of raw firmware extraction.
Advanced topics on reconstructing firmware from raw dumps will be covered in future posts.
ReferencesNAND vs. NOR Flash Memory Technology Overview
Understanding Flash: Blocks, Pages and Program / Erases
UEFI Blog 杂谈闪存二：NOR和NAND Flash