Meraki Z3 - Flash Dump

[nv1t]

Hey hey,

I am trying to understand the Flash Dump of a Meraki Z3. It uses the same Chip as the MR33 (s34ml01g2). I think i got all the chip data, but the Page Layout looks weird. Usually, the Chip should have a 2048kB + 64 Bytes Page separated into 512 Bytes Data and 16 Bytes Spare.

I seem to get 517 Bytes and 11 Bytes. At least for the uboot part. The rest adds up as well, but that does not make sense, and i am still missing 20 bytes spare per page.

Documentation:

Code: Select all

Page Size: 2kb
Block Size (without Spare): 128kB
Spare Area: 8 Byte/512 byte
OOB Size: 64 Bytes
BCH ECC: 4 Bit

If anybody has a MR33 dump or Z3 dump lying around, it would be highly appreciated. I am nearly going mad at the moment not being able to extract the ubifs and want to check against other reads.

There is a second Z3 in my possession, but i don't have a clip and had to desolder the chip, due to time constraints

[nv1t]

Apparently it is something from everything.

my setup of the reader introduces errors (the tsop adapter didn't have the right pinout). i get better and more clear results with more dumps and taking a quorum of the dumps.

the 11 bytes actually make sense, if you think about 7 bytes of ECC.

Trying to get more reads to get a better result on each sector and maybe producing one good read through quorums.