Dangerous Prototypes

Dangerous Prototypes => Bus Pirate Development => Topic started by: malware on February 27, 2015, 03:04:03 pm

Title: I wonder about the SPI memory access.
Post by: malware on February 27, 2015, 03:04:03 pm
Good evening.

 I have a question.

I have been using router has failed.

 I would like to proceed with the SPI memory dump.

And I have connected to the SPI memory in the router board using the Bus Pirate.

Do I have to connect power to the router board?

Bus Pirate do you only need to connect a power source?

Thanks
Title: Re: I wonder about the SPI memory access.
Post by: DangerByte on February 27, 2015, 08:47:50 pm
If you're going to flash while the device is powered on, make sure not to connect any wires to the Vcc pin, as the router board provides its own power. I've just recently dumped my laptop BIOS, and I found out that by running flashrom while the PC was powered up, Bus Pirate was unable to pull the /CS pin low enough for the flash chip to activate. I had to remove power completely and use Bus Pirate to provide the +3.3V directly to the chip. Since I had a Winbond SOIC8 SPI flash chip, I had to supply +3.3V to three different pins: Vcc, /HOLD and /WP.

The dump was successful, but for some reason it took an unusually long time to read the entire 4 megs of flash...
This was the command line I used: $ flashrom -p buspirate_spi:dev=/dev/ttyACM0 -c "W25Q32.V" -r ./flash_L.bin

NOTE: You may need to adjust the -c parameter or simply leave it out to use chip autodetection.
Title: Re: I wonder about the SPI memory access.
Post by: malware on February 28, 2015, 03:21:34 am
[quote author="DangerByte"]If you're going to flash while the device is powered on, make sure not to connect any wires to the Vcc pin, as the router board provides its own power. I've just recently dumped my laptop BIOS, and I found out that by running flashrom while the PC was powered up, Bus Pirate was unable to pull the /CS pin low enough for the flash chip to activate. I had to remove power completely and use Bus Pirate to provide the +3.3V directly to the chip. Since I had a Winbond SOIC8 SPI flash chip, I had to supply +3.3V to three different pins: Vcc, /HOLD and /WP.

The dump was successful, but for some reason it took an unusually long time to read the entire 4 megs of flash...
This was the command line I used: $ flashrom -p buspirate_spi:dev=/dev/ttyACM0 -c "W25Q32.V" -r ./flash_L.bin

NOTE: You may need to adjust the -c parameter or simply leave it out to use chip autodetection.[/quote]

Hi.

Thanks for the answer.

To connect the Bus Pirate cable to the SPI Flash memory

I do connect with the exception of WP# and HOLD#?

And CS, VCC, DO, CLK, GND, DI pin happens only when you connect the cable?

SPI memory are now using the W25P16VSIG.

Thanks
Title: Re: I wonder about the SPI memory access.
Post by: DangerByte on February 28, 2015, 12:12:13 pm
If you're not using the router power (the router is powered off and disconnected from power) then you need to supply the voltage from Bus Pirate. Luckily, Bus pirate provides a +3.3V output that you can connect to the flash chip. According to the datasheet, your component is meant for +3.3V, but be careful because some components are meant for lower voltages like 1.8V.

So the bottom line is:
- Connect the following pins: /CS, DO (MISO), GND, DI (MOSI) and CLK.
- If you're using the router to supply the power then you're all set to go. Do not connect any more pins.
- If you're not using the router power then use the Bus Pirate +3.3V power supply. Connect it to all three pins: VCC, /WP and /HOLD.
Title: Re: I wonder about the SPI memory access.
Post by: malware on February 28, 2015, 02:20:04 pm
[quote author="DangerByte"]If you're not using the router power (the router is powered off and disconnected from power) then you need to supply the voltage from Bus Pirate. Luckily, Bus pirate provides a +3.3V output that you can connect to the flash chip. According to the datasheet, your component is meant for +3.3V, but be careful because some components are meant for lower voltages like 1.8V.

So the bottom line is:
- Connect the following pins: /CS, DO (MISO), GND, DI (MOSI) and CLK.
- If you're using the router to supply the power then you're all set to go. Do not connect any more pins.
- If you're not using the router power then use the Bus Pirate +3.3V power supply. Connect it to all three pins: VCC, /WP and /HOLD.[/quote]

Hi.

Thank you for answers.

I'll try again.

I'd like to dump in the firmware (data) in the SPI memory.

Connect the WP# pin and the HOLD# pin also. Can I dump the firmware?

WP# pin is not that the write-protect pin?

And WP #, HOLD # pin, Do I connect the cable from the Bus Pirate?

Thanks
Title: Re: I wonder about the SPI memory access.
Post by: DangerByte on February 28, 2015, 03:39:56 pm
Sorry, I misspoke there.

The /WP pin is a write-protect pin. You don't really need this while dumping the flash memory (reading), but if you plan to write to it then you must definitely disable it. My setup was meant for a scenario where you have read/write access for the chip. If the /WP pin is set to low (GND) then write protection will be enabled. To disable write protection you should connect it to Vcc (+3.3V). Personally I have successfully read a winbond chip with /WP pin high, I haven't tried reading it with /WP low (low = write-protect enable).

The /HOLD pin is also active low, which (according to the datasheet) means that a low signal on it (while /CS is also low) will prevent any communication from taking place - hance its name HOLD. You should connect this pin to Vcc (+3.3V) for normal operation.
Title: Re: I wonder about the SPI memory access.
Post by: malware on March 01, 2015, 03:41:29 am
[quote author="DangerByte"]Sorry, I misspoke there.

The /WP pin is a write-protect pin. You don't really need this while dumping the flash memory (reading), but if you plan to write to it then you must definitely disable it. My setup was meant for a scenario where you have read/write access for the chip. If the /WP pin is set to low (GND) then write protection will be enabled. To disable write protection you should connect it to Vcc (+3.3V). Personally I have successfully read a winbond chip with /WP pin high, I haven't tried reading it with /WP low (low = write-protect enable).

The /HOLD pin is also active low, which (according to the datasheet) means that a low signal on it (while /CS is also low) will prevent any communication from taking place - hance its name HOLD. You should connect this pin to Vcc (+3.3V) for normal operation.[/quote]
Thank you for answers.

If I understand your answer correctly

So I do not need to connect the cable to the WP pin because it proceeds only dump

In order to dump , /HOLD pin, Do need unconditional VCC (3.3V) connection cable?

Finally, in order to the dump

Excluding the WP pin and do all the pins to be connected?

I have created a table, please confirm.

Bottom line is needed to pin the memory dump (reading) CS, VCC, DO, DI, GND, CLK ,/HOLD(3.3V),VCC(3.3V)?

Bottom line is needed to pin the memory dump (Writing) CS, VCC, DO, DI, GND, CLK, VCC, HOLD, WP(VCC 3.3) ?

Thank you very much to you.
Title: Re: I wonder about the SPI memory access.
Post by: DangerByte on March 02, 2015, 04:33:00 pm
It might depend on the board you have. Personally I connected all three to Vcc, and was able to dump the flash.
Title: Re: I wonder about the SPI memory access.
Post by: malware on March 03, 2015, 09:04:23 am
[quote author="DangerByte"]It might depend on the board you have. Personally I connected all three to Vcc, and was able to dump the flash.[/quote]


Thank you very much.

I solved the problem with your help.

( ! ) Fatal error: Uncaught exception 'Elk_Exception' with message 'Please try again. If you come back to this error screen, report the error to an administrator.' in /var/www/dangerousprototypes/forum/sources/database/Db-mysql.class.php on line 696
( ! ) Elk_Exception: Please try again. If you come back to this error screen, report the error to an administrator. in /var/www/dangerousprototypes/forum/sources/database/Db-mysql.class.php on line 696
Call Stack
#TimeMemoryFunctionLocation
10.01072092952session_write_close ( )...(null):0
20.01102224544ElkArte\sources\subs\SessionHandler\DatabaseHandler->write( )...(null):0
30.01102225320Database_MySQL->query( ).../DatabaseHandler.php:119
40.05542364056Database_MySQL->error( ).../Db-mysql.class.php:273