Error trying to extract ubi files.

[markyy1991]

Hello everyone, I am trying to extract the contents of 2 ubi files, and I am getting an error with the software presented here.

Any idea how to fix it and extract the content from these?

It should be noted that these files have the OOB removed. But it still doesn't work.

I leave the link to the files here in case someone can shed some light.

Thanks to all :)

https://fromsmash.com/ubi-files

[qkaiser]

It should be better handled by ubireader, but it looks like your memory dump is corrupted. Removing OOB is one step but ideally you would fix the content according to ECC data contained in these OOB chunks.

How did you dump the memory ? Do you know the flash model ?

[markyy1991]

Yed the model is MT29F2G16ABBEAHC I have the full dump if u need i can send here Enviado desde Outlook para Android<https://aka.ms/AAb9ysg>

…

________________________________ From: Quentin Kaiser ***@***.***> Sent: Tuesday, February 6, 2024 12:16:20 PM To: onekey-sec/ubi_reader ***@***.***> Cc: markyy1991 ***@***.***>; Author ***@***.***> Subject: Re: [onekey-sec/ubi_reader] Error trying to extract ubi files. (Issue #91) It should be better handled by ubireader, but it looks like your memory dump is corrupted. Removing OOB is one step but ideally you would fix the content according to ECC data contained in these OOB chunks. How did you dump the memory ? Do you know the flash model ? — Reply to this email directly, view it on GitHub<#91 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AIRJDDC43UAKMKQIWMJGTUTYSIGIJAVCNFSM6AAAAABC3SCXTWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMRZGMYDGNJWGY>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[qkaiser]

You need to read the datasheet of your memory chip to get the information you need like page size, block size, OOB size, and ECC algorithm.

Depending on the tools you use to dump the memory, ECC fixing will be there (http://www.flash-extractor.com/manual/ecc/) or you'll need to find another approach like https://github.com/hwiosec/DumpFlash (untested, a bit outdated).

[qkaiser]

Moved to discussions section since it's more about memory dumping than ubireader in itself.

[markyy1991]

Ok, but in this case i remove the OOB , its correct or no?

[qkaiser]

Answered at #92 (reply in thread)

[markyy1991]

The steps I took were

1. unblob in the .bin with the original image.
2. I tried ubi_reader , but it gave error, so I did OOB removed
3. I still have errors.

Solutions? I can upload the image here if necessary.

[qkaiser]

It would have worked if your memory dump was not corrupt. The OOB section of the memory holds error correcting code (ECC) information. Since NAND is not super reliable, the ECC is there to detect if there was one or more bit flips in the memory before, and use an ECC algorithm to recover the original content if memory got flipped.

In your case, the memory most likely got flipped at a few random locations, leading to offset and size values being wrong and getting ubireader to fail. Simply removing the OOB sections will not solve the problem. You need to fix the memory according to the ECC data stored in OOB. That's why I mentioned flash-extractor and DumpFlash.

Another way to do this, especially if your memory dumping tools are flaky or the flash does not like it, is to take different memory dumps and compare them using something like vbindiff to make sure they're the same, and fix them manually otherwise.

Good luck !

[markyy1991]

Thanks for responding, I just did 3 readings on the same chip, there are indeed differences between the different readings, although they are minimal, they do exist.

Can I send the dumps here to fix it?

[qkaiser]

Why would it be my job to fix your memory dumps ? I gave you all the information you need and pointers to tools you can use in #92 (reply in thread)

[markyy1991]

Because i dont know how to fix the dumps, i tryed DumpFlash but dont like my dumps (or im doing it bad)

[markyy1991]

I tried the dumpflash with the dump.

$ '/home/kali/dumpflash/dumpflash/dumpflash.py' -b '/home/kali/dumpflash/dumpflash/MT29F2G16ABBEAHC(NQ453)@BGA63_728.BIN'
/home/kali/dumpflash/dumpflash/dumpflash.py: 4: from: not found
import: Unable to grab mouse.
import: Unable to read X window image ().
import: abort due to signal 11 (SIGSEGV) "Segmentation Fault"...
Aborted
import: Unable to grab mouse.
import: Unable to read X window image ().
import: abort due to signal 11 (SIGSEGV) "Segmentation Fault"...
Aborted
import: Unable to grab mouse.
import: Unable to read X window image ().
import: abort due to signal 11 (SIGSEGV) "Segmentation Fault"...
Aborted
/home/kali/dumpflash/dumpflash/dumpflash.py: 9: Syntax error: "(" unexpected

[qkaiser]

The script is interpreted as a bash script and leads to all kinds of problems. Run it explicitly with python2.7 dumpflash.py. All the instructions are available on their repo (https://github.com/ohjeongwook/dumpflash), including talks.

[qkaiser]

Closing this discussion since the ubi_reader discussions space is not a support forum for unrelated subjects.

[markyy1991]

I have tried that file as you indicate and I cannot fix the problem.