Plastikonf, dumping the flash
The last time, I analyzed the the hardware and figured out where the firmware is stored. So let's dump it. The datasheet tells us, that the flash IC has an SPI interface. Now we need something that adapts SPI to a more common interface like preferably USB. There are several devices to to this:
- Use some microcontroller and write firmware for it that reads the SPI flash and dumps its contents via UART/USB. Downside: have to write code for microcontroller, hard to debug
- Bus Pirate already supports SPI flashes. Unfortunately, Selfnet doesn't have one.
- FTDI also makes USB to SPI converters besides USB to UART. I didn't have one at hand either, but I've had existing code for using certain FTDI bridges as USB - SPI converts.
So I purchased the FT2232H Mini Module and built an adapter to connect the SPI flash to it.
The FT2232H contains a so called MPSSE (Multi-Protocol Synchronous Serial Engine) to do SPI. Side note: FTDI claims that the MPSSE also supports I²C, but since the FT2232H doesn't have open-drain outputs and has some glitching issues, it's really painful to implement. Since my existing code was developed on Windows™, it used the proprietary FTD2XX driver. After some fiddling, I got ftd2xx to work on python 3. Sorry, libftdi people :(
Implementing the protocol used by the SPI flash was rather straightforward since its datasheet is available. One particular nice aspect of the protocol is that you can read an arbitrary amount of data after sending the start address. So I hacked an IPython notebook to dump the flash. Magically, it worked the first time, therefore I didn't bother to clean it up to make it publishable.
That's inside the romdump:
$ binwalk romdump
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
94976 0x17300 U-Boot version string, "U-Boot 1.1.3 (Dec 4 2013 - 08:55:41)"
131584 0x20200 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3515396 bytes
1441792 0x160000 Squashfs filesystem, little endian, version 4.0, compression:lzma (non-standard type definition), size: 5051300 bytes, 627 inodes, blocksize: 131072 bytes, created: Fri Jun 20 05:19:24 2014
8126480 0x7C0010 XML document, version: "1.0"
In the next post, we'll dig into the romdump.