Dell Latitude 5440 - Help reading dual Winbond SPI flash in-circuit with CH341A on Linux

[portal7]

Hi everyone,

I’m working on a relatively new Dell Latitude 5440, Intel i5 model, and I’m trying to make clean backups of the onboard SPI flash chips without desoldering, if possible.

The motherboard has two Winbond SPI flash ICs close to each other:

- UC2: Winbond 25Q256JVEN, likely 32 MB
- UC6: Winbond 25R128JVSN, appears to be 16 MB



I’m using a CH341A programmer with a SOIC8 clip on Linux.

Tools tested:
- flashrom on Linux
- IMSProg GUI on Linux

With flashrom, UC6 is sometimes detected as:

Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on ch341a_spi.
JEDEC ID: EF 40 18

The problem is that detection is intermittent. Sometimes the chip is detected, then on the next run it is not detected anymore. If I disconnect/reconnect the clip, it may detect again.

When it does read, the resulting 16 MB dump is all 00 bytes:

hexdump -C uc6_1.bin | head
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
01000000

So I do not consider this a valid dump.

The laptop battery and charger are disconnected. I also held the power button for around 30 seconds before trying. I am only trying to READ at this point, no erase/write operations.

My questions:

1. Has anyone worked with a Dell Latitude 5440 or similar recent Dell board with this dual-SPI layout?
2. Which chip is usually the main BIOS/UEFI on this model: the 32 MB UC2 or the 16 MB UC6?
3. Is in-circuit reading usually possible on this board, or is desoldering required?
4. Could the all-00 dump be caused by HOLD/WP lines, board interference, bad SOIC clip contact, or CH341A voltage/current instability?
5. On Linux, is flashrom the best tool for this, or is there another recommended tool/programmer for newer Winbond chips?
6. Would a better programmer such as T48/T56/RT809H/CH347 make a difference here, or is the SOIC clip/in-circuit setup the real problem?

Commands used:

sudo flashrom -p ch341a_spi -V

sudo flashrom -p ch341a_spi -c "W25Q128.V" -r uc6_1.bin

hexdump -C uc6_1.bin | head

sha256sum uc6_*.bin

I can provide clear photos of the board, both IC markings, clip orientation, CH341A adapter, and flashrom logs.

I am not trying to write anything yet. I only want to obtain reliable backups first, ideally 2–3 identical reads with matching hashes.

P.S. For recovery/reset purposes, which dump would be the critical one on this model? Is the 32 MB UC2 chip the main BIOS/UEFI region, and the 16 MB UC6 chip EC/secondary firmware, or does Dell store important NVRAM/config data across both?


Any advice would be appreciated.

[stj]

i dont trust clips - one chip is WSON anyway.

interestingly both chips have 4 pads next to them - probably for programming.
i would try to read them with the laptop powered up and doing nothing - like in the bios screen for example.
that way power wont be the issue either.

[megaraider]

Manufactures have long drop the diode in series with power supply to power these chips!
Thus:

1. when you use a clip you are powering up not only these chips as well as the power bus line -> Leading to bad readings
2. if you connect the clip with the laptop powered on (even doing nothing) the control lines will misbehave (CLK, for example, will be a mess) -> Leading to bad readings

Therefore, the solutions are:

1. With everything disconnected (power, battery, coin cell), lift the power pin and then read it.
2. Desolder them and read them.

For backup purposes BOTH dumps are needed (While one holds the boot code the other holds certificates).