SPI
Fast four-wire synchronous bus. The standard way to clip onto an external flash chip and dump the firmware whole.
SPI (Serial Peripheral Interface) is a fast, full-duplex, synchronous bus built around a master-driven clock and a per-device chip-select line. The controller talks to flash chips, sensors, and displays over four wires. For an attacker it is the classic offline path to firmware: clip onto the external flash and read the whole image without ever getting a shell.
What it is
SPI is a controller/peripheral (historically master/slave) bus. One master drives the clock (SCLK) and, for each transfer, pulls exactly one peripheral's CS low. Data moves full-duplex on two separate lines: MOSI (master out) and MISO (master in), so a byte goes out while a byte comes back on every clock. There is no addressing and no acknowledgement in the protocol itself; selection is purely the physical CS line.
| Pin | Alias | Role |
|---|---|---|
| SCLK | SCK, CLK | clock, driven by the master |
| MOSI | DI, SDI | master to peripheral |
| MISO | DO, SDO | peripheral to master |
| CS | SS, /CS | chip select, active low |
Several peripherals can share SCLK/MOSI/MISO; each gets its own CS. Clock polarity and phase (the CPOL/CPHA "mode", 0 to 3) must match between both ends.
Why it matters
Most embedded Linux and RTOS firmware lives in an external SPI NOR flash, very often a SOIC-8 chip marked 25xxx (W25Q, MX25, GD25, and friends). Because the flash sits on accessible pins outside the SoC, you can read it directly with a cheap programmer. That single dump usually yields the bootloader, the kernel, the root filesystem, and any secrets baked into it, no authentication involved.
Chip pinout
On a standard 25-series SOIC-8 flash: pin 1 = /CS, pin 2 = DO (MISO), pin 3 = /WP, pin 4 = GND, pin 5 = DI (MOSI), pin 6 = CLK, pin 7 = /HOLD, pin 8 = VCC. Pin 1 is marked by a dot or a bevelled edge. WSON/USON packages carry the same order in a leadless footprint.
How to dump it
- Identify the flash: read the part number off the package and note the size.
- Attach a
soic8-clipto the chip and drop it into ach341aprogrammer (or abus-pirate) at 3.3V. - Read it twice and diff, to be sure the capture is stable:
# Detect the chip, then read the full image.
flashrom -p ch341a_spi
flashrom -p ch341a_spi -r dump1.bin
flashrom -p ch341a_spi -r dump2.bin
cmp dump1.bin dump2.bin && echo "stable read"
# Carve the filesystem out of the image.
binwalk -e dump1.bin
- Mount the extracted squashfs and hunt for keys, certificates, and hardcoded credentials.
Pitfalls
- In-circuit contention: the host SoC may drive the same bus while you read. Hold the SoC in reset, or desolder the flash if the read is noisy or inconsistent.
- Power: 25-series flash is 3.3V. A 5V programmer line (some CH341A boards ship at 5V by default) can damage the chip.
- Always read twice and compare. A single dump that looks fine can still be corrupt from a marginal clip contact.
- A blank or all-
0xFFread usually means bad clip alignment or pin-1 flipped, not an empty chip.