`memory-25x`¶

glasgow run memory-25x¶

Identify, read, erase, or program memories compatible with 25-series Flash memory, such as Microchip 25C320, Winbond 25Q64, Macronix MX25L1605, or hundreds of other memories that typically have “25X” where X is a letter in their part number.

When using this applet for erasing or programming, it is necessary to look up the page and sector sizes. These values are displayed by the identify command when the memory is self-describing, and can be found in the memory datasheet otherwise.

The pinout of a typical 25-series IC is as follows:

        16-pin                     8-pin
IO3/HOLD# @ * SCK               CS# @ * VCC
      VCC * * IO0/COPI     IO1/CIPO * * IO3/HOLD#
      N/C * * N/C           IO2/WP# * * SCK
      N/C * * N/C               GND * * IO0/COPI
      N/C * * N/C
      N/C * * N/C
      CS# * * GND
 IO1/CIPO * * IO2/WP#

The default pin assignment follows the pinouts above in the clockwise direction, making it easy to connect the memory with probes or, alternatively, crimp an IDC cable wired to a SOIC clip.

It is also possible to flash 25-series flash chips using the spi-flashrom applet, which requires a third-party tool flashrom. The advantage of using the spi-flashrom applet is that flashrom offers compatibility with a wider variety of devices, some of which may not be supported by the memory-25x applet.

usage: glasgow run memory-25x [-h] [-V SPEC] [--cs PIN] [--io PINS]
                              [--sck PIN] [-f FREQ]
                              OPERATION ...

-h, --help¶: show this help message and exit

-V <spec>, --voltage <spec>¶: configure I/O port voltage to SPEC (e.g.: ‘3.3’, ‘A=5.0,B=3.3’, ‘A=SA’)

--cs <pin>¶: bind the applet I/O line ‘cs’ to PIN (default: A5)

--io <pins>¶: bind the applet I/O lines ‘copi’, ‘cipo’, ‘wp’, ‘hold’ to PINS (default: A2,A4,A3,A0)

--sck <pin>¶: bind the applet I/O line ‘sck’ to PIN (default: A1)

-f <freq>, --frequency <freq>¶: set SCK frequency to FREQ kHz (default: 12000)

glasgow run memory-25x erase-block¶

usage: glasgow run memory-25x erase-block [-h] ADDRESS [ADDRESS ...]

address¶: erase block(s) starting at address ADDRESS

-h, --help¶: show this help message and exit

glasgow run memory-25x erase-chip¶

usage: glasgow run memory-25x erase-chip [-h]

-h, --help¶: show this help message and exit

glasgow run memory-25x erase-program¶

usage: glasgow run memory-25x erase-program [-h] -S SIZE -P SIZE (-d DATA |
                                            -f FILENAME)
                                            ADDRESS

address¶: program memory starting at address ADDRESS

-h, --help¶: show this help message and exit

-S <size>, --sector-size <size>¶: erase memory in SIZE byte sectors

-P <size>, --page-size <size>¶: program memory region using SIZE byte pages

-d <data>, --data <data>¶: program memory with DATA as hex bytes

-f <filename>, --file <filename>¶: program memory with contents of FILENAME

glasgow run memory-25x erase-sector¶

usage: glasgow run memory-25x erase-sector [-h] ADDRESS [ADDRESS ...]

address¶: erase sector(s) starting at address ADDRESS

-h, --help¶: show this help message and exit

glasgow run memory-25x fast-read¶

usage: glasgow run memory-25x fast-read [-h] [-f FILENAME] ADDRESS LENGTH

address¶: read memory starting at address ADDRESS, with wraparound

length¶: read LENGTH bytes from memory

-h, --help¶: show this help message and exit

-f <filename>, --file <filename>¶: write memory contents to FILENAME

glasgow run memory-25x identify¶

usage: glasgow run memory-25x identify [-h]

-h, --help¶: show this help message and exit

glasgow run memory-25x program¶

usage: glasgow run memory-25x program [-h] -P SIZE (-d DATA | -f FILENAME)
                                      ADDRESS

address¶: program memory starting at address ADDRESS

-h, --help¶: show this help message and exit

-P <size>, --page-size <size>¶: program memory region using SIZE byte pages

-d <data>, --data <data>¶: program memory with DATA as hex bytes

-f <filename>, --file <filename>¶: program memory with contents of FILENAME

glasgow run memory-25x program-page¶

usage: glasgow run memory-25x program-page [-h] (-d DATA | -f FILENAME)
                                           ADDRESS

address¶: program memory starting at address ADDRESS

-h, --help¶: show this help message and exit

-d <data>, --data <data>¶: program memory with DATA as hex bytes

-f <filename>, --file <filename>¶: program memory with contents of FILENAME

glasgow run memory-25x protect¶

usage: glasgow run memory-25x protect [-h] [BITS]

bits¶: set SR.BP[3:0] to BITS

-h, --help¶: show this help message and exit

glasgow run memory-25x read¶

usage: glasgow run memory-25x read [-h] [-f FILENAME] ADDRESS LENGTH

address¶: read memory starting at address ADDRESS, with wraparound

length¶: read LENGTH bytes from memory

-h, --help¶: show this help message and exit

-f <filename>, --file <filename>¶: write memory contents to FILENAME

glasgow run memory-25x verify¶

usage: glasgow run memory-25x verify [-h] (-d DATA | -f FILENAME) ADDRESS

address¶: program memory starting at address ADDRESS

-h, --help¶: show this help message and exit

-d <data>, --data <data>¶: program memory with DATA as hex bytes

-f <filename>, --file <filename>¶: program memory with contents of FILENAME

glasgow tool memory-25x¶

Dissect captured SPI/QSPI transactions and extract data into linear memory image files.

The expected capture file format is the same as ones used by spi-analyzer and qspi-analyzer applets. Specifically, one of the following Comma-Separated Value line formats is expected:

<COPI>,<CIPO>, where <COPI> and <CIPO> are hexadecimal byte sequences with each eight bits corresponding to samples of COPI and CIPO, respectively (from MSB to LSB).
<DATA>, where <DATA> is a hexadecimal nibble sequence with each four bits corresponding to samples of HOLD#, WP#, CIPO, COPI (from MSB to LSB).

The extracted data can be saved as pairs of data files and mask files, where the mask file contains a 1 bit for every bit in the data file that has been observed in a transaction, and a 0 bit otherwise.

The list below details every command that is recognized by this tool. If your capture includes commands not currently recognized, please open an issue with a capture file attached.

03h (Read Data)
04h (Write Disable)
05h (Read Status Register)
06h (Write Enable)
0Bh (Fast Read)
4Bh (Read Unique ID)
5Ah (Read SFDP)
9Fh (Read JEDEC ID)
B7h (Enter 4-Byte Address Mode)
E9h (Exit 4-Byte Address Mode)
3Bh (Dual Output Fast Read)
6Bh (Quad Output Fast Read)
BBh (Dual I/O Fast Read)
EBh (Quad I/O Fast Read)

usage: glasgow tool memory-25x [-h] [--data DATA-FILE] [--data-mask MASK-FILE]
                               [--sfdp DATA-FILE] [--sfdp-mask MASK-FILE]
                               [--uid DATA-FILE] [--uid-mask MASK-FILE]
                               CAPTURE-FILE

capture-file¶: read captured SPI transactions from CAPTURE-FILE

-h, --help¶: show this help message and exit

--data <data-file>¶: write extracted data to DATA-FILE

--data-mask <mask-file>¶: write data presence mask to MASK-FILE

--sfdp <data-file>¶: write extracted SFDP data to DATA-FILE

--sfdp-mask <mask-file>¶: write SFDP data presence mask to MASK-FILE

--uid <data-file>¶: write extracted UID data to DATA-FILE

--uid-mask <mask-file>¶: write UID data presence mask to MASK-FILE