Contents
1️⃣ Approaches to Firmware Analysis
When analyzing IoT devices, the most crucial step is obtaining the firmware and setting up an environment for analysis. This allows us to examine the device's binaries and identify potential vulnerabilities in configurations that could be exploited.
There are three common methods for obtaining firmware:
Downloading update files and extracting the file system
Extraction through debug consoles like UART or JTAG
Firmware acquisition through Flash Memory Chip Off
Let's dive into method #3. While methods 1 and 2 are relatively straightforward, some devices come equipped with security measures like firmware encryption or removed debugging ports. When these security features are in place, conventional firmware extraction tools become ineffective at pulling out file systems or binaries, and the removal of debugging ports like UART and JTAG makes device access particularly challenging. While Command Injection attacks could force open a shell in such cases, you'd still need method 1 first for effective Command Injection Point analysis.
Flash Memory Chip Off is exactly what it sounds like - physically removing the Flash Memory from the IoT device's PCB and dumping its contents using specialized equipment or devices like Arduino or Raspberry Pi. This process requires additional tools such as a heat gun, soldering equipment, and solder paste.
2️⃣ Types of Flash Memory
Flash Memory can be broadly categorized into two types:
NOR Flash Memory
NAND Flash Memory
NOR Flash Memory, developed before NAND Flash Memory, processes data using NOT OR logic. It boasts extremely fast read speeds and can execute programs directly from memory thanks to its ability to read data in byte or word units. While it offers high reliability by storing each byte in separate cells, it has limitations. Scaling up capacity is challenging, and rewriting content requires a time-consuming process of erasing and writing cells individually since random access for writing isn't possible. This makes write speeds relatively slower compared to NAND Flash. NOR Flash is commonly used in BIOS chips.
NAND Flash Memory processes data using NOT AND logic. Unlike NOR Flash, it stores data in page units, making it well-suited for handling large volumes of data. While its read speeds are slower due to the impossibility of random access, it excels in write speeds. The USB drives we commonly use today are based on NAND Flash technology.
3️⃣ Equipment Used for Flash Memory Chip-Off
Let's look at the equipment needed for flash memory chip-off operations. Basic soldering equipment is essential for this work. Depending on your preferences and target device, you'll need a soldering iron, heat gun, as well as supplies like solder wick, solder paste, and lead-free solder.
After physically removing the Flash Memory from the PCB, you'll need additional equipment to read the data on a PC.
For devices with few memory blocks or those working through SPI, you can use a Raspberry Pi or Arduino. However, for components with multiple memory blocks like TSOP48 or TSOP56, specialized equipment becomes necessary. Using dedicated equipment makes voltage application, reading, and writing operations much more convenient. One such piece of equipment is the XGecu T48, which you can see in the images below.
4️⃣ Identifying the Target Flash Memory
For this analysis, we'll be examining a router. While this particular router has JTAG and UART ports, let's assume for the purpose of our chip-off analysis that these debugging ports aren't available.
The components visible in the above photo include:
Center component with heat sink: MCU
Component on the right with many pins: RAM
8-pin component on the left: Flash Memory
Now, let's identify the model number of this Flash Memory component.
The model number is MX25L3206EM2I-12G. Next, we need to verify if our XGecu T48 supports this particular component.
http://www.xgecu.com/MiniPro/T48_List.txt
We've confirmed that the XGecu T48 can both read and write data for this component through the link above.
5️⃣ Reading Data After Chip-Off
The component we're working with has an SOP 8-pin configuration. While it's possible to use a hook clip or SOP 8-pin clip without performing a chip-off, this method often leads to contact reliability issues. Since our focus is on the chip-off process, we'll proceed with direct desoldering.
Before beginning the operation, we'll use thermal tape to mask surrounding components. Then, we'll use a heat gun to separate the Flash Memory from the PCB. Set the heat gun temperature to 380-400 degrees Celsius, and apply solder paste to facilitate easier removal.
As shown in the image below, we can see the Flash Memory has been successfully removed.
After removal, connect the Flash Memory to the XGecu. Use the dedicated software to verify that the chip's information can be read correctly. During this process, you might encounter issues with reading data due to poor contact points or incorrect model selection. If you notice any abnormal information, check the contact points and verify that you've selected the correct model. The following image shows the component connected to the XGecu and the dedicated software testing the component's contact points and communication.
Next, read the data stored on the chip and save it as a binary file.
Below is an image showing the binary opened in the HxD tool.
As you can see in the image above, portions of the file system contents are visible.
6️⃣ Extracting the File System from Binary
Let's examine the results of analyzing our binary using the binwalk tool. We can confirm the presence of a CramFS file system.
<Binwalk Verification>
You can extract the file system using either binwalk's -e option or the Firmware-Mod-Kit (FMK). When working with CramFS, if the relevant tools aren't installed, the extraction might fail after the area is isolated. However, binwalk will still create a .cramfs file containing the isolated CramFS region. We can then use the FMK tool to proceed with file system separation.
<Binwalk Extraction Failure>
<FMK Extraction Results>
Checking the resulting directory, we can see the following contents:
<Extracted File System>
Through this article, we've explored a method that can be employed when software access or debug point access isn't possible.
This technique allows us to physically extract firmware stored in Flash Memory, and it can also be used to attempt recovery operations on Memory that has experienced issues during write operations.
