nRF9160 custom modem updater: calculated SHA256 of modem firmware differs from digest.txt file

Question

Hi, 
 I'm working on implementing a modem upload feature (using probe-rs) to be integrated into our production programming line. 
 Following the procedure described here ( docs.nordicsemi.com/.../device_setup.html) all seems to go well, but when calculating the SHA256's something's off. 
 I do find the correct segments in the firmware.update.image.segments.[n].hex files. But when calculating SHA256 my result is different from the ones in the firmware.update.image.digest.txt 
 I have calculated the SHA256 over the binary portion of each segment. Also exported the segment data to a .bin file and found an external tool generating the same SHA256 as my own tool did. I also tried swapping endianness (swap each four bytes i.e. 32bit word), different digest obviously, still not the same as the digest.txt file. What am I missing.. ? 
 Pasted below the output from my tool and also the contents of the digest.txt. I'm using files from mfw_nrf9160_1.3.5.zip 
 Got segment file: firmware.update.image.segments.0.hex: 1 segments Got segment file: firmware.update.image.segments.1.hex: 3 segments file0, segment0: 59602000 - 59602937 (2360 bytes) SHA256 digest: 58ffb9f4852329c707699021419e35418d25dd166439e80ae82653ee8a92b2db 
 file1, segment0: 6000 - FFFF (40960 bytes) SHA256 digest: b6002d91b2e1702324456f81ee8db56a36a81188bfe80d4e9ab2c5e9a4e38a0a 
 file1, segment1: 50000 - 237FFF (1998848 bytes) SHA256 digest: 9f2f4d2017546fd425dd1037dac399d6e914c5053ede290657f1d7a9d5d75afc 
 file1, segment2: 27C000 - 27FFFF (16384 bytes) SHA256 digest: 9aef5d403ccfee44f4fda028c947ed48ef28da3426e53fcf4367d3ce95b3e60c 
 Contents from firmware.update.image.digest.txt 
 SHA256 of all ranges in ascending address order: CD1B24523FE8C6D0B994DDE4F04695E178009D8181755828AC95B1CBC46E2008 Range: 0x00006000--0x0000FFFF SHA256: 2324F27B5BEB779BC9080C660650225F86B62B8D078D0F6B618EB5ACE51172DA Range: 0x00050000--0x00237FFF SHA256: 317C3A6B22B7B1D740EFA1F8D9510D96335C86A194EF46C67128E7D743CC0151 Range: 0x0027C000--0x0027FFFF SHA256: 9811C05B95FE6AFC46572E260E8A6228BC2439F7E101011BE1419A3B8A1136C4

rogierl · Answer

Ok.. comment to self: 
 What I suspect is going on is that the input hex files (from the zip archive) are encrypted and the given SHA256 hashes (in the digest.txt) are the digests of the non-encrypted data.. In other words, only the modem firmware itself can calculate the correct digest over the decoded/decrypted firmware image segments. Doh. 
 Does this make sense..? 
 In essence this comes down to just RTFM..