BlackHat资料us-14-Oh-Reverse-Engineering-Flash-Memory-For-Fun-And-Benefit-WP.pdfVIP

Reverse Engineering Flash Memory for Fun and Benefit Jeong Wook (Matt) Oh oh@ oh.jeongwook@ HP NAND Flash technology Flash Technology was invented circa 1980 by a Japanese inventor, Dr. Fujio Masuoka, while he was working for Toshiba. (1) Intel was the first company to produce the chips en masse. (1) In the 1990s, the technology was adapted from the industry and is now used everywhere. There are two different types of technology in Flash memory. First, NOR-based Flash is typically used as a replacement for old ROM technology. It has a long erase and write time, but it has a random read access capability for any memory location. In contrast, NAND-based Flash has a shorter erase and write time, but has other limitations. One limitation with NAND-based Flash is that it needs level access to the data. When reading or writing, NAND can’t write by byte level, and the page size can vary from a few hundred bytes to a few thousand. (2) In this paper, I am going to present a methodology for reverse engineering NAND Flash memory. I am most interested in NAND Flash technology when it is used for storage on embedded systems. Even if you can’t perform random data access efficiently with NAND Flash, embedded devices can load up a whole NAND image to a DRAM and start up the operating system on the memory using an MTD (Memory Technology Device). I’ve found reverse engineering NAND Flash to be very beneficial when I was experimenting with many embedded devices. There are many different models of NAND Flash out there, and I’m using TSOP (Thin Small Outline Package) 48 type NAND Flash memory for my experiment here. This type of chip is very commonly used in many embedded devices on the market. NAND Flash specification The ONFI (Open NAND Flash Interface) is a joint working grou