3 ms·

SpaceX Starlink router firmware analysis

16 points by pjf 5y ago

Kiboneu 5y ago
If this is a raw NAND dump you're probably encountering errors and/or OOB (out-of-band) areas used for ECC interleaved with the data. Look up the datasheet for the NAND chip you dumped from and look up the block / area / page layouts, then write a script to strip out the OOB sections from the dump. If you're lucky the errors captured in the dump aren't significant enough to break UBI extraction. If the datasheet isn't available you can visually infer the main / spare layout with a hex editor and by fudging with the column numbers, often there is a regular pattern of padding surrounding the main (where the data associated with the OOB is) and spare (where OOB is) areas. If UBI still fails to extract, you might have to rewrite the ECC algo and ECC-correct the data yourself. ECC is performed either by software or by dedicated NAND controller on the CPU. Blocks containing bootloader code sometimes use a different ECC schema then blocks containing FS (i.e. u-boot might not have support for enabling ECC on the NAND controller or doesn't have the algo used by further stages of booting / runtime so it uses something else for ECC). Linux knows how to interact with these controllers, i.e. within Broadcom MCUs [0]. Common ECC could include BCH or hamming codes. You might be lucky and have root access to a computer / machine with the same / similar-enough CPU as your starlink target, so you may be able to dump it through the second computer (using its hardware NAND controller) while running linux on a separate memory and dump a clean copy of the target chip through Linux's MTD interface. I've done this before, but the opportunity to do it is not common. Right now I'm working on a different project which involves NAND containing UBI with an unknown (to me) ECC schema... (no twitter so hopefully the author reads hn) 0: https://elixir.bootlin.com/linux/latest/source/drivers/mtd/nand/raw/brcmnand/brcmnand.c#L1278 https://elixir.bootlin.com/linux/latest/source/drivers/mtd/n... see also for examples: https://www.micron.com/-/media/client/global/documents/products/technical-note/nand-flash/tn2971_software_bch_ecc_on_linux.pdf https://www.micron.com/-/media/client/global/documents/produ... https://www.micron.com/-/media/client/global/documents/products/technical-note/nand-flash/tn2963_ecc_in_slc_nand.pdf https://www.micron.com/-/media/client/global/documents/produ...

16 points by pjf 5y ago

If this is a raw NAND dump you're probably encountering errors and/or OOB (out-of-band) areas used for ECC interleaved with the data. Look up the datasheet for the NAND chip you dumped from and look up the block / area / page layouts, then write a script to strip out the OOB sections from the dump. If you're lucky the errors captured in the dump aren't significant enough to break UBI extraction. If the datasheet isn't available you can visually infer the main / spare layout with a hex editor and by fudging with the column numbers, often there is a regular pattern of padding surrounding the main (where the data associated with the OOB is) and spare (where OOB is) areas. If UBI still fails to extract, you might have to rewrite the ECC algo and ECC-correct the data yourself. ECC is performed either by software or by dedicated NAND controller on the CPU. Blocks containing bootloader code sometimes use a different ECC schema then blocks containing FS (i.e. u-boot might not have support for enabling ECC on the NAND controller or doesn't have the algo used by further stages of booting / runtime so it uses something else for ECC). Linux knows how to interact with these controllers, i.e. within Broadcom MCUs [0]. Common ECC could include BCH or hamming codes. You might be lucky and have root access to a computer / machine with the same / similar-enough CPU as your starlink target, so you may be able to dump it through the second computer (using its hardware NAND controller) while running linux on a separate memory and dump a clean copy of the target chip through Linux's MTD interface. I've done this before, but the opportunity to do it is not common. Right now I'm working on a different project which involves NAND containing UBI with an unknown (to me) ECC schema... (no twitter so hopefully the author reads hn) 0: https://elixir.bootlin.com/linux/latest/source/drivers/mtd/nand/raw/brcmnand/brcmnand.c#L1278 https://elixir.bootlin.com/linux/latest/source/drivers/mtd/n... see also for examples: https://www.micron.com/-/media/client/global/documents/products/technical-note/nand-flash/tn2971_software_bch_ecc_on_linux.pdf https://www.micron.com/-/media/client/global/documents/produ... https://www.micron.com/-/media/client/global/documents/products/technical-note/nand-flash/tn2963_ecc_in_slc_nand.pdf https://www.micron.com/-/media/client/global/documents/produ...