//THE ACADEMY IS GROWING DAILY. CHECK OUT THE FIELD NOTES FROM TECHS HERE AT THE ACADEMY
>_DAEMONCORE // ACADEMY
← FIELD NOTES

Firmware security: Extracting and modifying SPI flash ROMs with flashrom and binwalk

2026.10.06//12 MIN READhardware-securitylinuxpenetration-testingmethodology

// Understanding SPI Flash Memory

SPI flash memory is commonly used in embedded systems for firmware storage. Extracting and modifying firmware from SPI flash ROM can expose vulnerabilities and help in assessing device security. This process often involves tools like flashrom for extraction and binwalk for analysis.

// Prerequisites

Make sure your environment is set up correctly:

  • Linux OS (preferably Ubuntu or Debian)
  • Necessary packages: flashrom, binwalk, dd, and hexdump
  • Access to the target hardware

// Step 1: Identifying the Chip

Before extraction, identify the SPI flash chip using a command like:

ls /dev |
grep spi

This will show devices typically like /dev/spidev0.0. Make sure your user has permissions to access these devices.

// Step 2: Extracting Firmware with Flashrom

Use flashrom to read from the SPI flash chip. The command resembles the following:

flashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware_backup.bin

This command tells flashrom to use the SPI device at /dev/spidev0.0, and -r specifies to read and save the firmware into firmware_backup.bin. Ensure that the chip is properly connected. If flashrom fails, check your wiring and chip compatibility.

Common Issues

  • Device not found: double-check your connections and permissions.
  • Chip not supported: consult flashrom documentation to ensure your chip is recognized.

// Step 3: Analyzing the Firmware with Binwalk

Once you have the firmware image, use binwalk to analyze its contents:

binwalk firmware_backup.bin

The output will detail various binaries, compressed files, and file signatures within the firmware. This step will help identify the components present and areas for potential exploits or modifications.

Interpreting Binwalk Output

  • Look for files that may contain configuration data or sensitive information (like credentials).
  • Identify any embedded scripts or binaries that may be modified for testing.

// Step 4: Modifying Firmware

Assuming you’ve identified components of interest, you can extract them using:

binwalk -e firmware_backup.bin

This extracts the files into a directory, allowing you to modify them as needed. For example, if you find a web interface binary, you can disassemble it using tools like Ghidra or Radare2 for further analysis.

// Step 5: Repacking the Firmware

After modifications, you may need to repack the firmware. This can often be a tricky process depending on the original format. You can sometimes use binwalk's --repack option, but it may not always work.

Example of Repacking

  • Check the extracted files and ensure they maintain the original structure.
  • Use dd to create a new firmware image:
dd if=modified_files/firmware_file of=new_firmware.bin bs=1M

Ensure that your new firmware image matches the original size and format, or the device may reject it.

// Step 6: Flashing the Modified Firmware

With your modified firmware ready, you can flash it back using flashrom:

flashrom -p linux_spi:dev=/dev/spidev0.0 -w new_firmware.bin

Verification

After flashing, it's critical to verify that the firmware has been updated:

flashrom -p linux_spi:dev=/dev/spidev0.0 -r verification_backup.bin

Compare verification_backup.bin with new_firmware.bin to confirm the flash was successful. Use checksums for this verification:

sha256sum new_firmware.bin verification_backup.bin

// Trade-offs and Considerations

  • Backup: Always back up the original firmware before making changes.
  • Device Compatibility: Modifications might make the device unusable if not done carefully. Test in a controlled environment.
  • Legal Implications: Ensure you have permission to alter firmware on any device.

// Checklist for Firmware Security Assessment

  • [ ] Identify SPI flash device.
  • [ ] Extract firmware with flashrom.
  • [ ] Analyze with binwalk.
  • [ ] Modify necessary components carefully.
  • [ ] Repack firmware maintaining original structure.
  • [ ] Flash back and verify integrity.

Understanding firmware security through extraction and analysis is foundational for anyone in hardware security. Utilizing tools like flashrom and binwalk effectively can illuminate vulnerabilities that need addressing.

--- // FIELDOPS REPORT AUTHORIZED BY: Theodore O. //