Reverse Engineering Flash Memory for Fun and Benefit
summary
Desolder NAND with hot air, attach a cheap SOIC socket and FTDI breakout to talk the NAND bus, and use a Python tool to dump raw pages including OOB, ECC and bad‑block markers. Practical results include 50 KB/s page reads versus 240 KB/s block read with a Samsung mode, extracted U-Boot and JFFS2 images mountable on Linux, and a one‑byte patch that defeats tamper detection. Hardware reflow and resoldering prove reliable for recovery. FTDI MCU-host bus emulation
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:38The targeted device
- 4:19Equipment & Supplies
- 5:24Too much heat?
- 7:53FTDI FT2232H breakout board
- 8:40MCU Host Bus Emulation Mode
- 10:17Data control lines
- 11:04Read operation example
- 11:52Basic command sets for usual NAND Flash memory (small blocks)
- 14:17Reading a small block page
- 21:01Write operation pin states
- 21:48ECC (Error Correction Code)
- 23:20Example - P8 calculation
- 23:53Example - P2 calculation
- 24:08ECC calculation code
- 25:13Example bad block check routine
- 27:41An example of Flash memory layout
- 29:01U-boot boot code
- 29:14Custom boot code
- 30:20Kernel image disassembly
- 34:27Mounting JFFS2 file system using a MTD
- 36:22Bridge & damaged pins
- 38:35Tamper detection
- 43:07Conclusion
related talks
47mHow To Dump, Parse, And Analyze i.MX Flash Memory Chips
33mBreaking Into Chips By Reading The Datasheet
01h 46mTutorial: Introduction to Reverse Engineering
48mFatal Fury on ESP32: Time to Release Hardware Exploits
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
14mFlash [Re]Loaded: Body Bias Injection on Flash Memory
19mBe Write Back: An in-depth Study of Fault Injection Effects on FRAM Technology
40mIntroduction to IoT Reverse Engineering