1](2 3)(4 5)(6 7)(8 9)(10 SPI1 CE1 11)(12 SPI1 CE0 13)(14 15)(16 17)(18 SPI0 MOSI 19)(20 SPI0 MISO 21)(22 SPI0 SCLK 23)(24 SPI0 CE0 25)(26 SPI0 CE1 27)(28 29)(30 31)(32 33)(34 SPI1 MISO 35)(36 SPI1 CE2 37)(38 SPI1 MOSI 39)(40 SPI1 SCLK SPI0 pins in BCM mode are: 9 (MISO), 10 (MOSI), 11 (SCLK) + 7 (CE1) /8 (CE0) SPI0 pins in WiringPi are: 12, 13, 14 + 10/11 SPI1 pins in BCM mode are: 20 (MOSI), 19 (MISO), 21 (SCLK) + 17 (CE1) / 18 (CE0) , 16 (CE2) SPI1 pins in WiringPi are: 28, 24, 29 + 0/1, 27 - SPI - Serial Peripheral Interface - Known as the four-wire serial bus, SPI lets you attach multiple compatible devices to a single set of pins by assigning them different chip-select pins. A useful example of an SPI peripheral is the MCP23S17 digital IO expander chip ( Note the S in place of the 0 found on the I2C version ). You can also use the SPI port to "Bit-Bang" an ATmega 328, loading Arduino sketches onto it with Gordon Hendersons' modified version of AVRDude. To talk to an SPI device, you assert its corresponding chip-select pin. By default the Pi has CE0 and CE1. import spidev spi = spidev.SpiDev() spi.open(0, CHIP_SELECT_0_OR_1) spi.max_speed_hz = 1000000 spi.xfer([value_8bit]) The SPI protocol is not enabled as standard on Raspbian, but it can be enabled with the raspi-config tool, along with I2C. - Dump flash memory - Most common test case in hardware testing is to extract the external flash memory of the target device which uses SPI communication interface. Most commonly used tool is flashrom which supports a wide variety of flash memory support. We are going to utilize the bcm2385 SPI interface /dev/spidev0.0 for reading and writing to it. Installation: sudo apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion libusb-1.0-0-dev svn co svn://flashrom.org/flashrom/trunk flashrom cd flashrom make Connection: CS – 24 MISO – 21 MOSI – 19 CLK – 23 3.3v – 17 To read data from the flash memory flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 -r spi_dump.bin Don’t forget the spispeed=512. Now you can use binwalk or fmk in the extracted firmware.