Using JTAG to dump parallel NOR flash
zetier.com
Using JTAG to dump parallel NOR flash
1–10 of 20 posts
Re: Using JTAG to dump parallel NOR flash
#2Seems requiring IO of debugged device is directly connected to scan registers, like a FPGA.
Re: Using JTAG to dump parallel NOR flash
#3Figure 33's hexdump and Figure 35's binwalk output look suspicious to me. The hexdump is too sparse - lots of zero bits but no long runs of 0x00, consistent 0x00, 0x01 or 0x10 in odd-numbered positions, etc. It might be valid, or it might point to some kind of clocking or pinout issue. The binwalk output is even more suspicious - the signatures are likely all spurious. One does not expect a Flash ROM to consist solely of MySQL databases, particularly not random versions; this is likely the result of random bytes happening to match the file signature. As such, there don't seem to be any recoverable files in the dump per binwalk.
Re: Using JTAG to dump parallel NOR flash
#4This is a rather convoluted way to do this. Once you have the socket, just connect with wires to a pi pico and dump it over serial.
Re: Using JTAG to dump parallel NOR flash
#5Figure 33's hexdump and Figure 35's binwalk output look suspicious to me. The hexdump is too sparse - lots of zero bits but no long runs of 0x00, consistent 0x00, 0x01 or 0x10 in odd-numbered positions, etc. It might be valid, or it might point to some kind of clocking or pinout issue. The binwalk output is even more suspicious - the signatures are likely all spurious. One does not expect a Flash ROM to consist solel…
Yeah, I'd suspect that binwalk output to be junk from the flash tripping heuristics: "MySQL database" is one of those heuristics that a lot of random binary files trip spuriously for who knows what reason.
Practically every other read word is `10 00 10 00` which is definitely strange, but also it's hard to judge if that's wrong without looking at the dump more IMO.
Re: Using JTAG to dump parallel NOR flash
#6This is a rather convoluted way to do this. Once you have the socket, just connect with wires to a pi pico and dump it over serial.
Yeah, about the only way this would make sense is if they used the boundary scan of the original board's SoC so they didn't have to desolder anything.
Re: Using JTAG to dump parallel NOR flash
#7Figure 33's hexdump and Figure 35's binwalk output look suspicious to me. The hexdump is too sparse - lots of zero bits but no long runs of 0x00, consistent 0x00, 0x01 or 0x10 in odd-numbered positions, etc. It might be valid, or it might point to some kind of clocking or pinout issue. The binwalk output is even more suspicious - the signatures are likely all spurious. One does not expect a Flash ROM to consist solel…
Yeah, I'd suspect that binwalk output to be junk from the flash tripping heuristics: "MySQL database" is one of those heuristics that a lot of random binary files trip spuriously for who knows what reason. Practically every other read word is `10 00 10 00` which is definitely strange, but also it's hard to judge if that's wrong without looking at the dump more IMO.
Yeah, there's no way it's running MySQl. I'd expect to see a CPIO archive, a UBoot copyright string, or something in that wheelhouse at the top of binwalk given that it's the NOR flash to a mediatek soc.
Re: Using JTAG to dump parallel NOR flash
#8Figure 33's hexdump and Figure 35's binwalk output look suspicious to me. The hexdump is too sparse - lots of zero bits but no long runs of 0x00, consistent 0x00, 0x01 or 0x10 in odd-numbered positions, etc. It might be valid, or it might point to some kind of clocking or pinout issue. The binwalk output is even more suspicious - the signatures are likely all spurious. One does not expect a Flash ROM to consist solel…
The binwalk is more than likely not aligned for the endianess that is used. This dump was made to just be an example that magic existed and there was data that came from the flash chip using this method. Not necessarily the binary enumeration of the dump. The magic binwalk found is more than likely junk. If one was looking to flip endianess on a dump, use the -swap and it will flip around strings.
Re: Using JTAG to dump parallel NOR flash
#9This is a rather convoluted way to do this. Once you have the socket, just connect with wires to a pi pico and dump it over serial.
Oh yes it is convoluted. This is for parallel nor flash though, not serial. I suppose a pi could work I am just confused how you would dump it over serial. You need to connect:
D0-D15
A0-A15
CE (STATIC)
OE (STATIC)
WE (STATIC)
WP (STATIC)
RST (STATIC)
GND (STATIC)
3.3 (STATIC)
The pi would have to request an address over the address bus to the flash chip using A0-A15 and then the data would come over on D0-D15 and you would have to collect it. A pi would work if external static pins were held or tied to their respective state in order to read. TSOP56/48/40 would not work for this as a pico only has 26 GPIO pins available.
Here are images of the busses for both serial and parallel nor flashes. The bus sizes are different. Serial: https://www.embedded.com/wp-content/uploads/contenteetimes-i...
Parallel: https://www.embedded.com/wp-content/uploads/contenteetimes-i...
Re: Using JTAG to dump parallel NOR flash
#10This is a rather convoluted way to do this. Once you have the socket, just connect with wires to a pi pico and dump it over serial.
Yeah, about the only way this would make sense is if they used the boundary scan of the original board's SoC so they didn't have to desolder anything.
This also does work. Some devices do not have the ability to connect to a part though (no bsdl, no jtag header)