Re:Reading Parallel nor Flash with JTAG
by Boardbricker35 on Wednesday March 27, 2024 @01:04PM
(#39841716)
Some questions I recvd (author) :
1) Is there a process by which you can do the same in-circuit, similar to the SOP8 footprints that most people are familiar with?
Answer:
1) YES! You totally can. In fact this is a preferred method because of its ease if there is ejtag or a jtag header and the flash is connected.Here are a few ways:
A) connecting to a target MCU/FPGA to dump over a preexisting bus.
B) using a large clip or soldering leads. Not recommended. May backfeed.
2) Are there any hidden gotchas (similar to NAND flash) that people should know about where reading or writing may not result in a 1:1 copy (which can be used later to revert to a known good working state, if the chip is not write protected)?
Answer:
2) Not really reliable with this method. Urjtag is software written in 2006 … so it is kinda dated. Topjtag is also quite dated and both are slightly unreliable. It is up to an engineer to really understand what they are doing and the dangers associated with dumping flash memory. Programmers are fairly inexpensive now so this method is more or less a last resort in most cases (wanted to share after trying this). However can be successful if the engineer does this correctly and takes their time. The first time I tried this i grounded the wrong pin. Power cut through the flash chip and destroyed it and took all the data with it.
3) How do you handle these chips when there are no markings, or the chips themselves have incomplete publicly available specifications? Some parallel memory chips I've run into seem to have fuses built-in to the silicon so if you pass voltage or hook up the wrong pin, the entire chip ceases functioning.
Answer:
3) A) Start with a logic analyzer
https://www.ebay.com/itm/225946293211?chn=ps&norover=1&mkevt...
and look at the package size. More than likely if I look at all 24 pins on one side of the chip with a logic analyzer I can collect enough data to start looking for the pins that are data and map them to a datasheet. For example I see data on pins 1-x and x+2-23 and x+1 is vcc and 24 is vss. Then map that so a package like tsop48 and narrow it down. Incomplete public… that is more difficult. Id use the logic analyzer and see how the MCU is taking to it and see if a protocol exists for it and mimic a read if a protocol exists with pins I find. If not… ill cross that hill when I get to it.
B) Oh I wish I had a FIB to edit silicon with. I have not had this issue … ever … so far. Im sure that will change. But ive heard of cracking the lid on a die with a laser and then using a fib to bridge the fuse. Very expensive. Ive also heard of only reading a byte or some small amount of data at a time on powerup, powering down and cycling until full flash is read. I guess it would really depend on the size of the fuse, gap size, and how you can get to it easiest or bypass it. Here is a link to a FIB:
https://www.thermofisher.com/us/en/home/electron-microscopy/...
Again, do be careful when doing this kind of stuff. Go to goodwill, get some really solid practice on some old netgear routers or other embedded systems before jumping into the high dollar stuff. It helps keep your cool and also understand the process more. Repetition is king in our field … if you can get it.
C) If the target is an FPGA, its a bitstream. And bitstreams are very, very painful to re. The sea of gates is very big. Id recommend looking at something with a tied architecture and older.
Thank you all so much for reading my article. I hope it helped and you got something out of it or will try this in your free time. Keep your eyes peeled for more articles.
1) Is there a process by which you can do the same in-circuit, similar to the SOP8 footprints that most people are familiar with? Answer: 1) YES! You totally can. In fact this is a preferred method because of its ease if there is ejtag or a jtag header and the flash is connected.Here are a few ways: A) connecting to a target MCU/FPGA to dump over a preexisting bus. B) using a large clip or soldering leads. Not recommended. May backfeed.
2) Are there any hidden gotchas (similar to NAND flash) that people should know about where reading or writing may not result in a 1:1 copy (which can be used later to revert to a known good working state, if the chip is not write protected)? Answer: 2) Not really reliable with this method. Urjtag is software written in 2006 … so it is kinda dated. Topjtag is also quite dated and both are slightly unreliable. It is up to an engineer to really understand what they are doing and the dangers associated with dumping flash memory. Programmers are fairly inexpensive now so this method is more or less a last resort in most cases (wanted to share after trying this). However can be successful if the engineer does this correctly and takes their time. The first time I tried this i grounded the wrong pin. Power cut through the flash chip and destroyed it and took all the data with it.
3) How do you handle these chips when there are no markings, or the chips themselves have incomplete publicly available specifications? Some parallel memory chips I've run into seem to have fuses built-in to the silicon so if you pass voltage or hook up the wrong pin, the entire chip ceases functioning. Answer: 3) A) Start with a logic analyzer https://www.ebay.com/itm/225946293211?chn=ps&norover=1&mkevt... and look at the package size. More than likely if I look at all 24 pins on one side of the chip with a logic analyzer I can collect enough data to start looking for the pins that are data and map them to a datasheet. For example I see data on pins 1-x and x+2-23 and x+1 is vcc and 24 is vss. Then map that so a package like tsop48 and narrow it down. Incomplete public… that is more difficult. Id use the logic analyzer and see how the MCU is taking to it and see if a protocol exists for it and mimic a read if a protocol exists with pins I find. If not… ill cross that hill when I get to it.
B) Oh I wish I had a FIB to edit silicon with. I have not had this issue … ever … so far. Im sure that will change. But ive heard of cracking the lid on a die with a laser and then using a fib to bridge the fuse. Very expensive. Ive also heard of only reading a byte or some small amount of data at a time on powerup, powering down and cycling until full flash is read. I guess it would really depend on the size of the fuse, gap size, and how you can get to it easiest or bypass it. Here is a link to a FIB: https://www.thermofisher.com/us/en/home/electron-microscopy/... Again, do be careful when doing this kind of stuff. Go to goodwill, get some really solid practice on some old netgear routers or other embedded systems before jumping into the high dollar stuff. It helps keep your cool and also understand the process more. Repetition is king in our field … if you can get it.
C) If the target is an FPGA, its a bitstream. And bitstreams are very, very painful to re. The sea of gates is very big. Id recommend looking at something with a tied architecture and older.
Thank you all so much for reading my article. I hope it helped and you got something out of it or will try this in your free time. Keep your eyes peeled for more articles.