Iran Badge: Dumping SPI Flash memory via external test points without booting ESP32

Question

Hi all,

For our local hardware reverse engineering workshop, we want to extract the full 16MB SPI flash dump of the Iran Badge using a Glasgow or CH341A SPI flasher.

Are the SPI flash lines (MOSI, MISO, CLK, CS) broken out to test points on the back silkscreen, or do we need to hold ESP_EN (Reset) tied to Ground to keep the ESP32-S3 pins in high-impedance (Hi-Z) mode while reading?

Any recommendations on safe VDD voltage (3.3V vs 1.8V flash)?

ASIS CTF Team · Accepted Answer

Yes, the Iran Badge supports in-circuit SPI flash dumping:

Test Points: On the back side of the PCB, test pads TP1 (CS), TP2 (CLK), TP3 (DO/MISO), and TP4 (DI/MOSI) are located right next to the ESP32-S3 module shield.
Holding Reset: You must hold ESP_EN pulled low (connect TP_EN to GND) before attaching external power or logic leads. This puts all ESP32-S3 internal SPI multiplexer pins in high-Z state and prevents bus contention.
Voltage Level: The flash is a standard 3.3V part (Winbond 25Q128JVSQ). Do not apply 5V! If using a CH341A, verify your flasher has the 3.3V LDO mod enabled, otherwise it may output 5V on data lines and damage the S3 internal ESD diodes.

Iran Badge: Dumping SPI Flash memory via external test points without booting ESP32

1 Answers