VoidStar Security Wiki
- Clips / Jumpers / Probes
- Conclusion
- Fault Injection
- Flash Readers
- VSS: Beginners Guide to Building a Hardware Hacking Lab
- JTAG / Debug Adapters
- Logic Analyzers
- Microscopes/Magnification
- Multimeters
- Oscilloscopes
- Extending Ghidra Part 1: Setting up a Development Environment
- Introduction to Embedded Reverse Engineering
- Intro to Embedded RE: UART Discovery and Firmware Extraction via UBoot
- Replicant: Reproducing a Fault Injection Attack on the Trezor One
- On the Road: Our first onsite training of the year
Flash Readers
So, you have done your initial teardown and identified a non-volatile storage device from which you want to extract some data. Perhaps there is a SPI flash chip or a TSOP 48 parallel flash that you want to extract data from. Many flash readers are available; below is a list of what I have in my lab. The Xeltek is somewhat expensive (it is currently on sale for $995.00), and the individual sockets for different chip packages range from $400-$700, so the cost adds up quickly. However, with that cost comes support from Xeltek and fairly reliable tooling, assuming you are comfortable with BGA rework and re-balling ICs, this may be the right choice for you and your team.
| Item | Price | Link | Usage |
|---|---|---|---|
| Transcend SD Card Reader | $10.99 | Link | Good for in-circuit eMMC reads, device supports low speeds and 1-bit eMMC modes |
| CH341A USB Programmer | $13.99 | Link | Generic SPI flash programmer, compatible with flashrom |
| FT2232H Breakout Board | $26.99 | Link | Generic breakout board, can be used with flashrom, openocd, etc. |
| FlashCAT USB Programmer | $99.00 | Link | Parallel flash extraction, TSOP48/56 |
| XGecu T56 | $199.00 | Link | All-purpose flash extraction, SPI, eMMC, NAND, etc |
| Easy JTAG | $399.00 | Link | All-purpose flash extraction, one of the few readers on the market to support UFS extraction |
| Xeltek Superpro | $995.00 | Link | Enterprise flash programmer, high quality, sockets for different chips can be pretty expensive |
| Dataman 48Pro2 Super Fast Universal ISP Programmer | $1,195.00 | Link | Industrial programming tool, expensive, but does consistently work on the supported ICs |
In my experience, no flash readout tool works on everything. Some tools are better at certain flash types than others. Having a few options in your hardware hacking toolbox is always a good idea if your preferred tool does not support your target device. If I had to pick two devices from the list above, I would choose the FlashCAT and the XGecu T56; you will have a wide range of target chip coverage between those two.