Dumping firmware directly from the device

If we cannot obtain firmware via the vendor site or proxying its traffic, we can start dumping the device firmware via UART, SPI, or JTAG. Dumping firmware directly requires access to a device and disassembling the device to find its flash storage. Once the flash storage chip is located, you can either connect your UART pins directly or use an 8-pin SOIC chip-clip to dump the firmware using flashrom and an SPI-enabled hardware board such as a Shikra. The following is how an SOIC clip and a Shikra would be connected to a device:

>

Get IoT Penetration Testing Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.