FMFU segments SHA

RE: FMFU segments SHA

Øyvind — Thu, 26 Jun 2025 08:55:05 GMT

Hello,

yes, that is correct, the CBOR file only contains information about the encrypted image, and the modem only reports digests of plaintext.

RE: FMFU segments SHA

Norbert H. — Wed, 25 Jun 2025 18:38:48 GMT

Thanks for the response!

To come back to my question. So it is not possible to generate the hashes for a verification from the cbor-file. This is because the image in the cbor-file is encrypted, and the hashes that can be read from the modem are generated from the decrypted image. So i have to use the hashes from the firmware.update.image.digest.txt to verify a successful update.

Is this correct?

RE: FMFU segments SHA

Øyvind — Wed, 25 Jun 2025 08:52:37 GMT

Hello again,

the modem team informs me that the file firmware.update.image.digest.txt refers to digests of plaintext modem firmware FLASH contents, whereas the transfer image contains encrypted firmware.

Kind regards,
Øyvind

RE: FMFU segments SHA

Øyvind — Tue, 24 Jun 2025 08:22:57 GMT

Hello, sorry the late answers on your inquiry. Our team working on this have a high workload and are not able to provide answers at quick as they want. There might not be any answers until end of July/beginning of August, but I hope to get answer within this week.

Sorry for any inconvenience this may cause.

Kind regards,
Øyvind

RE: FMFU segments SHA

Øyvind — Fri, 20 Jun 2025 14:38:58 GMT

HI, I have not received any updates on this, but we are still working with an answer. I hope to have an answer by end of Tuesday.

Kind regards,
Øyvind

RE: FMFU segments SHA

Norbert H. — Wed, 18 Jun 2025 10:11:49 GMT

My calculated sha of the segments at mfw-nr+_nrf91x1_1.0.2.cbor are:

Segment 3/5: 0x6000 - 0xFFFF
Expected SHA256: ddc883e1ef382344fba5601684ecbe7fcd7a57a313afa9a0f828c15915a5621c

Segment 4/5: 0x38000 - 0xB3FFF
Expected SHA256: d7fbe7d35810491d4e834a3cf885f7c65a9ce193c26b1ad1151eba79773bb0af

Segment 5/5: 0x27C000 - 0x27FFFF
Expected SHA256: 83932f5f9a35cce7ae2990cc48402b4d011233d0cfe54b89c45d2c8951b69d1c

and here is a small simplified snippet of how I implemented the whole thing in python

bootloader_size = 0x000018B0 + 0x0000039C
segment_length = 0x0000A000
segment_data = blob_data[bootloader_size : bootloader_size + segment_length]
expected_sha = sha256(segment_data).digest()

RE: FMFU segments SHA

Norbert H. — Tue, 17 Jun 2025 14:06:17 GMT

Yes we are targeting with the DECT NR+ modem FW. But the SHA calculation of the modem segments should be the same for LTE or DECT. The big question is can we calculate the sha's from the binary blob (cbor-file) or do we need the pre-calculated sha's from the firmware.update.image.digest.txt.

I think the binary bob (in the cbor-file) is encrypted and if the SHA is returned from the modem via the unencrypted content, it would not be possible to calculate from the cbor file.

RE: FMFU segments SHA

Øyvind — Tue, 17 Jun 2025 13:53:08 GMT

And just to clarify, you are targeting DECT NR+ modem FW?

RE: FMFU segments SHA

Øyvind — Tue, 17 Jun 2025 13:43:32 GMT

Hello, and thanks for the elaborate answer. I don't have a good answer for you right now, but let me forward this internally and discuss with out modem experts. I hope to have an answer by end of tomorrow or Thursday.

Kind regards,
Øyvind

RE: FMFU segments SHA

Norbert H. — Tue, 17 Jun 2025 13:03:44 GMT

We adapted your FMFU over SMP (UART) to work with SPI.
docs.nordicsemi.com/.../README.html

In your example, you provide the mfw_xxxx.zip file to the non-public library at pynrfjprog. To have full control, we reimplemented the functionality in Python by parsing and processing the cbor-file. The update is working. Now, we want to verify the FW update. To do this, we want to compare the SHAs from the segments. This is similar to what you do under the hood in pynrfjprog. To do this, we calculate the SHA of a segment from the cbor-file and read the SHA of the segments from the modem (via SMP). The SHA that we read over SMP is the same as that in the firmware.update.image.digest.txt file. However, the calculated SHA of the segment from the cbor-file/binary does not correlate to it. Therefore, the version of the nRF Connect SDK is not necessary for resolving this issue. You provided a documentation for the cbor-file. The COSE_Sign1_Manifest with the binary blob of the segments. The blob_hash is the SHA for the whole binary-blob, but how can we calculate the SHA for the segments? So that we can get the same result as in your firmware.update.image.digest.txt file?

docs.nordicsemi.com/.../fmfu_fdev.html

RE: FMFU segments SHA

Øyvind — Tue, 17 Jun 2025 12:07:34 GMT

Hello, could you please provide more details to your problem. What exactly are you trying to achieve? What are you basing this "custom modem fw update" on? What version of the nRF Connect SDK are you using?

Thanks.

Kind regards,
Øyvind