encryption of application code

[lee]

Hi,

I wish to encrypt my application to protect my code. I've tried running my hex file through openssl

openssl enc -aes-128-ofb -nopad -nosalt -e -K XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX -iv XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX -in app_release.hex -out app_release_enc.hex

I then try to generate a package as follows :

rfutil dfu genpkg --application app_release_enc.hex --application-version 14 --bootloader bootloader_release.hex --sd-req 0x81,0x00 --softdevice s132_nrf52_2.0.0_softdevice.hex --dev-revision 1 dfu_release_enc.zip

But I then receive the following :

Traceback (most recent call last): File "/usr/local/bin/nrfutil", line 9, in load_entry_point('nrfutil==0.3.0', 'console_scripts', 'nrfutil')() File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 716, in call return self.main(*args, **kwargs) File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 696, in main rv = self.invoke(ctx) File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 1060, in invoke return _process_result(sub_ctx.command.invoke(sub_ctx)) File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 1060, in invoke return _process_result(sub_ctx.command.invoke(sub_ctx)) File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 889, in invoke return ctx.invoke(self.callback, **ctx.params) File "/usr/local/lib/python2.7/dist-packages/click/core.py", line 534, in invoke return callback(*args, **kwargs) File "/usr/local/lib/python2.7/dist-packages/nrfutil-0.3.0-py2.7.egg/nordicsemi/main.py", line 236, in genpkg package.generate_package(zipfile_path) File "/usr/local/lib/python2.7/dist-packages/nrfutil-0.3.0-py2.7.egg/nordicsemi/dfu/package.py", line 189, in generate_package Package.normalize_firmware_to_bin(work_directory, firmware[FirmwareKeys.FIRMWARE_FILENAME]) File "/usr/local/lib/python2.7/dist-packages/nrfutil-0.3.0-py2.7.egg/nordicsemi/dfu/package.py", line 329, in normalize_firmware_to_bin temp = nRFHex(firmware_path) File "/usr/local/lib/python2.7/dist-packages/nrfutil-0.3.0-py2.7.egg/nordicsemi/dfu/nrfhex.py", line 63, in init self.loadfile(source, self.file_format) File "/usr/local/lib/python2.7/dist-packages/nrfutil-0.3.0-py2.7.egg/nordicsemi/dfu/intelhex/init.py", line 241, in loadfile self.loadhex(fobj) File "/usr/local/lib/python2.7/dist-packages/nrfutil-0.3.0-py2.7.egg/nordicsemi/dfu/intelhex/init.py", line 204, in loadhex decode(s, line) File "/usr/local/lib/python2.7/dist-packages/nrfutil-0.3.0-py2.7.egg/nordicsemi/dfu/intelhex/init.py", line 115, in _decode_record raise HexRecordError(line=line) nordicsemi.dfu.intelhex.HexRecordError: Hex file contains invalid record at line 1

Can anyone help?

Thanks Lee

[John]

It is hardly surprising that scrambling your hex file results in a corrupted hex file. If you are looking to protect your application from being reverse engineered I'd look at the read back protection features of the nRF52 instead.

[lee]

I wish to protect the algorithms in the application hex file on their way to the nrf52 during over the air updates. Not so worried about people reading our code back using a debugger as we'll be using read back protection.

[John]

Then you should look at the BLE pairing and security options. The latest bootloader is set up to be able to share pairing information with your application firmware so you can preserve an encrypted connection between your devices when in bootloader mode. Scrambling the hex file is not going to work.

[mstrouse]

Consider "scrambling" the binary before you generate your hex file. In doing what you are currently doing, you are scrambling the hex file header(s) and trailer(s). And after that, nothing can make sense of it.

I agree with John tho ... look into BLE security options before you spend a lot more time on this.

[babaly]

It seems you forget about a trivial option on Android systems, a hacker can sniff his own Bluetooth traffic easily by enabling Bluetooth HCI Snoop Log and if your firmware is not encrypted it can be stolen during a firmware upgrade process. I think BLE security options don't help in this case but please correct me if I'm wrong.