Firmware Extraction Workflow

TL;DR: Pull firmware from a vendor download or directly off the flash chip, then peel back the layers with binwalk, fmk, and ubireader until you reach a mountable rootfs.

What it is

Firmware extraction is the first step of embedded-device reverse engineering: turn a vendor .bin, .img, or a raw flash dump into a tree of files you can grep and decompile. The pipeline differs by storage medium (SPI NOR, parallel NOR, raw NAND, eMMC) and by bootloader (U-Boot is dominant on MIPS/ARM SoCs). Recursive extraction with binwalk gets you most of the way; the rest is identifying U-Boot headers, picking the right squashfs/UBI tooling, and handling ECC on NAND.

Preconditions / where it applies

Either a vendor firmware download or physical access to the PCB
For chip-off / in-circuit dumps: a SOIC-8 clip or test-clip, a programmer (Bus Pirate, CH341A, or a TIGARD), and flashrom
For NAND: a TSOP-48 socket adapter and a programmer that speaks ONFI (e.g., XGecu T56)
Linux host with binwalk, firmware-mod-kit, squashfs-tools, ubi_reader, jefferson

Technique

  
# 1. Recursive extract — finds nested archives, headers, and filesystems
binwalk -Me --depth=8 firmware.bin

# 2. Manual layer extraction for stubborn images
fmk/extract-firmware.sh router-fw.bin
unsquashfs -d rootfs squashfs-root.img

# 3. UBI / UBIFS volume from raw NAND
ubireader_extract_images -o ubi_out nand.dump
ubireader_extract_files  -o files    ubi_out/img-*.ubi

# 4. JFFS2 (older NOR layouts)
jefferson -d jffs_out fs.jffs2

# 5. Identify U-Boot — magic 0x27051956 at offset 0 of a legacy uImage
xxd firmware.bin | head -1
mkimage -l firmware.bin   # prints arch, OS, load addr, entry point

# 6. Live flash dump via SPI (3.3V — never apply 5V to a modern chip)
flashrom -p ch341a_spi -r dump.bin -c "MX25L6406E/MX25L6408E"
# Verify with a second read
flashrom -p ch341a_spi -r dump2.bin && cmp dump.bin dump2.bin

NAND requires care: bad-block markers in the OOB area and BCH/Hamming ECC mean a raw read is rarely flat. Dump with the OOB included, then strip ECC with nandtool or the vendor’s nanddump parameters before feeding the result into ubireader. NOR is contrast-simple — read it like a single contiguous file.

Detection and defence

Anti-tamper meshes and epoxy potting deter clip-on attacks; chip removal then becomes destructive
OTP fuses (e.g., NXP SRK hash, TI ROM-keys) lock the bootloader to signed images — read but cannot rewrite
Secure boot rooted in mask ROM verifies U-Boot SPL; a flash dump still leaks code but the device will not boot a modified image
Encrypted flash (Intel TME, NXP BEE) means the off-chip dump is ciphertext; you need a side-channel or fault attack to recover keys
Signed firmware update channels (RSA-2048 / Ed25519 over the .bin) prevent uploading modified images via the web UI

References

binwalk — recursive signature carving
ubi_reader — UBI/UBIFS parsing
flashrom — chip-supported programmer
U-Boot image format — uImage header layout