A way to validate the hex file burned into device against the result (hex) of original source code

[Sansei]

Engineerings, We are looking around to find a way to prove that the hex file burned into the device is really the result of the original source code. Is there any idea/way to validate?

How Nrfgo verify the program code burned into the device? I'm asking on program code hex structure.

[endnode]

What?:) You can only validate binary against binary so you can dump the flash (assuming it isn't protected against read-back) and compare to some external binary (typical HEX file). If you want to reverse HEX file into source code and then get glimps if the source code reminds some other existing C/ASM project then good luck, this is very unlikely. Even if you are magician with tools like IDA Pro and disassemble the binary into some pseudo source code it will be so different from any human readable/written C source code that it will be almost impossible to guess if it matches some specific source files. Every compiler and linker produces different binary, very usually different versions of compilers like GCC or Keil or IAR produce different binary, there are countless options to set different behavior of compiler so from one source code you can produce many different binaries (and many of them might even work quite the same way!).

The only conditions where I've seen such exercise completed are:

• You have some HEX file (either you have it archived or you can dump it from some device).
• You have source code or several versions of source code project but not more then few.
• Finally you have some limited options of what compilation chain and settings might be used.

Then you simply compile all the options and compare results with HEX binary one by one. It's almost trial and error one by one, sometimes you can see that certain parts start to match which might hint that e.g. your compilation chain is correct just source code project version is different or vice versa.

[endnode]

Then you need to do it in two steps: firstly verify that flash content is equal to sequence of HEX files you applied during programming. As I said every normal person would use "verify" option in the flashing tool so this is done automatically without any effort needed. Second part is to validate that once you have certain source code base and compilation chain that it produces the HEX files which you loaded in previous step. But this is off-line procedure done on your PC (or other build system) and it has basically nothing to do with the HW. So simply show to whom ever you need that by compiling certain source code in certain way you have arrived to HEX binaries which are equal to these you flashed to the device. All done.