This is an old revision of the document!
these are my notes on how I dump SPI flash.
Since flash uses kind of another technology, it is often hard or expensive to add flash memory in integrated circuits (IC), mainly micro-controller (MCU). Thus MCU have either very limited flash size (< 1 MB), or you have to provide it externally. Externally dedicated flash is very common and inexpensive. Some system on a chip (SoC) even just add the flash die next to the MCU die (this is called package in/on package).
The most common package for flash is SOIC-8 (surface mount, 8 pins, 1.27 mm pin pitch, 200 mil wide body). More compact alternatives are WSON/LGA (without external lead) and BGA (allowing more pins underneath). Whenever you find such a chip with 25 on the top marking, it is very probably a flash chip.
The most common interface is Serial Peripheral Interface (SPI). It allows extremely fast transfer rates (clock frequency > 100 MHz) and is supported by most MCU. For even faster communication, high-end chips even provide quad output support (QSPI).
The pinout is (almost) always the same to provide interoperability. The difference between models is mainly the size (obviously), and features (i.e. speed).
By far the easiest method is to de-solder the chip and place it in a dedicated programmer. The only disadvantage is that you will have to de-solder and re-solder the chip every time you want to read or write it.
The cheapest, and crudest, way to read/write SPI flash is using a CH341A based programmer. You can find them for less than $3.
Solder the SPI flash to a DIP-8 adapter board, and place it in the ZIF socket (Zero-Insertion-Force). Insert it as depicted on the side for the 25xx (furthest away from the lever, with pin 1 notch facing the lever). To avoid soldering the chip on an adapter board, use sockets with spring contacts (the contacts need to be clean for it to work well). Be sure the jumper shorts pin 1 and 2 on the side (shorting pins 2 and 3 switched the CH341A to UART mode).
As software we will use ch341prog. Verify if the chip is detected correctly, then read the memory out:
ch341prog --info Device reported its revision [4.03] Manufacturer ID: ef Memory Type: 4016 No CFI structure found, trying to get capacity from device ID. Set manually if detection fails. Capacity: 16 Chip capacity is 4194304 bytes ch341prog --read spi.bin ... Read started!
Limitations:
The TL866A (aka. MiniPRO) is the next step up, and still cheap (< $30).
Advantages:
Disadvantages:
For more information about the device (including reversed schematic), see this wiki or this repo.