Reading NAND/Flash directly from an MCU

[crackz0r]

Hey all.
Had a thought pop in my head recently and figured I'd ask around.

Most MCUs these days have flash (NAND/NOR) embedded in the IC for loading into RAM so the MCU can boot.

Has anyone thought about how it might be possible to access this NAND directly (say in an instance where the MCU fails and you can't debug via JTAG/SWD/etc.)

I am sure there is an embedded controller in most cases that links directly from the embedded CPU to the NAND structure itself.

What do you all think?

[pepe]

such controllers usually use NOR flash as internal nonvolatile storage. This peripheral is attached to an internal bus through which the MCU accesses it. I highly doubt there's any other way to access these than these buses. So if the device is unable to work on its own, accessing the flash is extremely difficult.
Not completely impossible but there must be a very good reason for someone to chose this way...

pepe

[DRUG]

Hey all.
Had a thought pop in my head recently and figured I'd ask around.

Most MCUs these days have flash (NAND/NOR) embedded in the IC for loading into RAM so the MCU can boot.

Has anyone thought about how it might be possible to access this NAND directly (say in an instance where the MCU fails and you can't debug via JTAG/SWD/etc.)

I am sure there is an embedded controller in most cases that links directly from the embedded CPU to the NAND structure itself.

What do you all think?

It is completely possible. However you need to decap the processor, and then probe it very precisely. Not all labs have the hardware or knowledge to do it.

[sourcerer]

It might also be (and my personal guess is that it's quite likely), that the internal SPI bus is also brought outside, so that it can be flashed during production. But the pins might not be further connected on the PCB, so just desoldering the chip might give you access to the SPI bus. I guess the difficult thing is to actually find those SPI bus pins...

[pepe]

I haven't seen internal flash with SPI interface, it is usually directly connected to the internal buses with paralel interfaces. Not telling it can't exist just haven't seen so far.

pepe