DFU Update: "Upload Failed: Unknown Command" & Signature-less Bootloader

RE: DFU Update: "Upload Failed: Unknown Command" & Signature-less Bootloader

tkstreet — Thu, 09 Aug 2018 17:48:02 GMT

I have a number of nRF52832 devices in the field where the bootloader was created with SDK 11. They were created in the most liberal format, using the 0xFFFF codes in all fields (using the old nrfutil version) and no key signing. I would like to flash an entirely new set to these devices - new bootloader, S132, and new application - but I cannot find any way to do this using either packaging format with the old nrfutil (v0.3.0, I believe) nor the new nrfutil (v3.5.0). I have tried just about every combination and permutation I could think of to no avail.

RE: DFU Update: "Upload Failed: Unknown Command" & Signature-less Bootloader

Einar Thorsrud — Thu, 09 Aug 2018 07:20:38 GMT

You are right, signing is needed even in debug mode. However, in that case the default configuration of the example is to use a example public key that can only be used with the prebuild .zip distributions in the SDK, as we do not provide the private key. You need to replace the public key with your own public key in order to test the bootloader with your own DFU .zip files, even with the debug bootloader.

SDK 15 introduced a bootloader which does not use signing (called "open bootloader"). This is intended specifically for the nRF52840 dongle, so the only example we provide uses USB transport. However, it should be possible to replace the transport layer with BLE (though I have not tested).

I am a bit unsure about what you mean when you say:

I would like to not have to sign it with a private key. I need to do this in order to maintain backward compatibility with firmware that was compiled and packaged without key signing.

I assume this older firmware packages were made for the legacy bootloader (no signature verification)? If so, there are also many other differences, so you cannot use these packages with the new bootloader. You anyway need to re-pack it for use with the new bootloader, therefore I do not see a significant issue with using signed images for the new bootloader and non-signed images for the old. Or am I missing something? I would also like to emphasize the risk of having an open bootloader, as this makes it very easy for an attacker to change the firmware of a device in the field, modifying its behavior or bricking it.

RE: DFU Update: "Upload Failed: Unknown Command"

tkstreet — Wed, 08 Aug 2018 18:58:43 GMT

Yes, I get the same response from nRF Connect. I'm using whatever the latest version is for Android nRF Toolbox.

Am I required to use PGP key signing for DFU? I think this is where the problem lies. When I am compiling the bootloader, even though I am using the NRF_DFU_DEBUG_VERSION, it is still compiling the dfu_public_Key.c file and thus signing the bootloader with the public key. When I am generating the package, I would like to not have to sign it with a private key. I need to do this in order to maintain backward compatibility with firmware that was compiled and packaged without key signing. It seems that now, even in debug mode, I am required to do key signing. Is this correct? If so, why is it even possible to generate DFU packages that are unsigned? It seems that the BLE DFU depends on the dfu_req_handling driver (as well as crypto and crc32).

I can't find any documentation on non-signed bootloaders, nor are there any examples in the SDK. But what's strange is that the warning in nrfutil suggests it's possible:

|===============================================================|
|You are not providing a signature key, which means the DFU     |
|files will not be signed, and are vulnerable to tampering.     |
|This is only compatible with a signature-less bootloader and is|
|not suitable for production environments.                      |
|===============================================================|

Can you point me in the right direction to make a signature-less bootloader? Thank you.

RE: DFU Update: "Upload Failed: Unknown Command"

Einar Thorsrud — Mon, 06 Aug 2018 10:51:49 GMT

Hi,

From the log it seems that the nRF receives an unsigned command (log says "Handling unsigned command"). Referring to the implementation in dfu_req_handling.c in SDK 14.2.0, this always leads to a "Unknown command" response. I have a a few more questions:

Which version of nRF Toolbox are you using?
Do you get the same behaviour if you use nRF Connect (for mobile and/or desktop?

RE: DFU Update: "Upload Failed: Unknown Command"

tkstreet — Fri, 03 Aug 2018 18:05:35 GMT

I just flashed the same bootloader but unsecured and in debug mode. I tried using DFU to send one of the example .zip packages and it worked fine. So it doesn't seem like the problem is in the bootloader, but in my application package. I'm not sure what it is though. If I flash the firmware and bootloader directly, everything works fine. Then if I package the exact same application and try to flash over DFU, that's when I get this Unknown Command error. Do you see something wrong with the settings I am using with nrfutil to package my application?

RE: DFU Update: "Upload Failed: Unknown Command"

tkstreet — Fri, 03 Aug 2018 17:11:33 GMT

Here's the log from the RTT viewer:

 0> <info> app: Inside main
 0> <debug> app: In nrf_bootloader_init
 0> <debug> app: in weak nrf_dfu_init_user
 0> <debug> app: In real nrf_dfu_init
 0> <debug> nrf_dfu_settings: Running nrf_dfu_settings_init(sd_irq_initialized=false).
 0> <debug> nrf_dfu_flash: Calling nrf_dfu_flash_init(sd_irq_initialized=false)...
 0> <debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
 0> <debug> app: Initializing the clock.
 0> <debug> app: Enter nrf_dfu_continue
 0> <debug> app: Valid App
 0> <info> app: Bootloader Button read: Pressed
 0> <debug> app: Application sent bootloader request
 0> <debug> app: In nrf_dfu_transports_init
 0> <debug> app: num transports: 1
 0> <debug> app: Initializing BLE DFU transport
 0> <debug> app: vector table: 0x00073000
 0> <debug> app: vector table: 0x00073000
 0> <debug> app: Error code - sd_softdevice_vector_table_base_set: 0x00000000
 0> <debug> app: Enabling SoftDevice.
 0> <warning> nrf_sdh_ble: RAM starts at 0x20002830, can be adjusted to 0x20002180.
 0> <warning> nrf_sdh_ble: RAM size can be adjusted to 0xDE80.
 0> <debug> app: SoftDevice enabled.
 0> <debug> app: nrf_dfu_settings_adv_name_is_valid FALSE
 0> <debug> app: Regular adv name
 0> <debug> app: #### Advertising NO BONDING ####
 0> <debug> app: Finished initializing BLE DFU transport
 0> <debug> app: After nrf_dfu_transports_init
 0> <debug> nrf_dfu_flash: Calling nrf_dfu_flash_init(sd_irq_initialized=true)...
 0> <debug> nrf_dfu_flash: Initializing nrf_fstorage_sd backend.
 0> <debug> app: Waiting for events
 0> <debug> app: Received: BLE_GAP_EVT_CONN_PARAM_UPDATE
 0> <debug> app: conn_sup_timeout: 2000
 0> max_conn_interval: 6
 0> min_conn_interval: 6
 0> slave_latency 0
 0> <debug> app: Received: BLE_GAP_EVT_CONN_PARAM_UPDATE
 0> <debug> app: conn_sup_timeout: 2000
 0> max_conn_interval: 36
 0> min_conn_interval: 36
 0> slave_latency 0
 0> <debug> app: Received select object
 0> <info> dfu_req_handling: Valid Command: NRF_DFU_OBJECT_OP_SELECT
 0> <debug> app: Sending Object Info: [0x60, 0x06, 0x01 max: 0:x00000100 0:x00000000, CRC:0x00000000]
 0> <debug> app: Set receipt notif
 0> <debug> app: Sending Response: [0x2, 0x1]
 0> <debug> app: Received create object
 0> <info> dfu_req_handling: Before OP create command
 0> <info> dfu_req_handling: Valid Command Create
 0> <debug> app: Sending Response: [0x1, 0x1]
 0> <info> dfu_req_handling: Before OP write command
 0> <info> dfu_req_handling: Before OP write command
 0> <info> dfu_req_handling: Before OP write command
 0> <info> dfu_req_handling: Before OP write command
 0> <debug> app: Received calculate CRC
 0> <info> dfu_req_handling: Valid Command CRC
 0> <debug> app: Sending CRC: [0x60, 0x03, 0x01, 0:x00000042, CRC:0x13C9BA70]
 0> <debug> app: Received execute object
 0> <info> dfu_req_handling: Before OP execute command
 0> <info> dfu_req_handling: Valid command execute
 0> <info> dfu_req_handling: PB: Init packet data len: 60
 0> <info> dfu_req_handling: Handling unsigned command
 0> <debug> app: Sending Response: [0x4, 0xB]
 0> <debug> app: #### Advertising NO BONDING ####

And here's the log from nRF Connect:

nRF Connect, 2018-08-03
DfuTarg (DA:B9:73:AE:5B:2C)
V 10:00:43.841 Connecting to DA:B9:73:AE:5B:2C...
D 10:00:43.842 gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE)
D 10:00:44.106 [Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I 10:00:44.106 Connected to DA:B9:73:AE:5B:2C
D 10:00:44.124 [Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
V 10:00:44.126 Discovering services...
D 10:00:44.126 gatt.discoverServices()
D 10:00:44.619 [Callback] Services discovered with status: 0
I 10:00:44.619 Services discovered
V 10:00:44.640 Generic Access (0x1800)
- Device Name [R W] (0x2A00)
- Appearance [R] (0x2A01)
- Peripheral Preferred Connection Parameters [R] (0x2A04)
- Central Address Resolution [R] (0x2AA6)
Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
Secure DFU Service (0xFE59)
- DFU Packet [WNR] (8ec90002-f315-4f60-9fb8-838830daea50)
- DFU Control Point [N W] (8ec90001-f315-4f60-9fb8-838830daea50)
   Client Characteristic Configuration (0x2902)
D 10:00:44.640 gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
D 10:00:44.643 gatt.setCharacteristicNotification(8ec90001-f315-4f60-9fb8-838830daea50, true)
D 10:01:07.826 [Callback] Connection state changed with status: 34 and new state: DISCONNECTED (0)
E 10:01:07.827 Error 34 (0x22): GATT CONN LMP TIMEOUT
I 10:01:07.827 Disconnected
D 10:01:07.893 [Broadcast] Action received: android.bluetooth.device.action.ACL_DISCONNECTED
D 10:01:12.795 gatt.close()
D 10:01:12.797 wait(200)
V 10:01:13.001 Connecting to DA:B9:73:AE:5B:2C...
D 10:01:13.001 gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE)
D 10:01:13.271 [Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I 10:01:13.271 Connected to DA:B9:73:AE:5B:2C
D 10:01:13.280 [Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
V 10:01:13.282 Discovering services...
D 10:01:13.282 gatt.discoverServices()
D 10:01:13.769 [Callback] Services discovered with status: 0
I 10:01:13.769 Services discovered
V 10:01:13.784 Generic Access (0x1800)
- Device Name [R W] (0x2A00)
- Appearance [R] (0x2A01)
- Peripheral Preferred Connection Parameters [R] (0x2A04)
- Central Address Resolution [R] (0x2AA6)
Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
Secure DFU Service (0xFE59)
- DFU Packet [WNR] (8ec90002-f315-4f60-9fb8-838830daea50)
- DFU Control Point [N W] (8ec90001-f315-4f60-9fb8-838830daea50)
   Client Characteristic Configuration (0x2902)
D 10:01:13.784 gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
D 10:01:13.787 gatt.setCharacteristicNotification(8ec90001-f315-4f60-9fb8-838830daea50, true)
V 10:01:33.772 [DFU] DFU service started
V 10:01:33.772 [DFU] Opening file...
I 10:01:33.832 [DFU] Firmware file opened successfully
V 10:01:33.833 [DFU] Connecting to DFU target...
D 10:01:33.837 [DFU] gatt = device.connectGatt(autoConnect = false)
I 10:01:33.840 [DFU] Connected to DA:B9:73:AE:5B:2C
V 10:01:33.840 [DFU] Discovering services...
D 10:01:33.840 [DFU] gatt.discoverServices()
I 10:01:34.357 [DFU] Services discovered
D 10:01:34.385 [DFU] wait(1000)
V 10:01:35.385 [DFU] Requesting new MTU...
D 10:01:35.386 [DFU] gatt.requestMtu(517)
I 10:01:35.449 [DFU] MTU changed to: 23
V 10:01:35.449 [DFU] Enabling notifications for 8ec90001-f315-4f60-9fb8-838830daea50
D 10:01:35.449 [DFU] gatt.setCharacteristicNotification(8ec90001-f315-4f60-9fb8-838830daea50, true)
D 10:01:35.449 [DFU] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
I 10:01:35.585 [DFU] Data written to descr.8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 01-00
V 10:01:35.586 [DFU] Notifications enabled for 8ec90001-f315-4f60-9fb8-838830daea50
A 10:01:35.586 [DFU] Notifications enabled
D 10:01:35.586 [DFU] wait(1000)
V 10:01:36.592 [DFU] Writing to characteristic 8ec90001-f315-4f60-9fb8-838830daea50
D 10:01:36.592 [DFU] gatt.writeCharacteristic(8ec90001-f315-4f60-9fb8-838830daea50)
I 10:01:36.659 Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value: (0x) 60-06-01-00-01-00-00-00-00-00-00-00-00-00-00
A 10:01:36.660 "Response for: Read Object Info
Status: Success
Max object size: 256 bytes
Current offset: 0 bytes
CRC-32: 00000000" received
I 10:01:36.677 [DFU] Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-06-01-00-01-00-00-00-00-00-00-00-00-00-00
I 10:01:36.677 [DFU] Data written to 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-06-01-00-01-00-00-00-00-00-00-00-00-00-00
A 10:01:36.677 [DFU] Command object info received (Max size = 256, Offset = 0, CRC = 00000000)
V 10:01:36.677 [DFU] Writing to characteristic 8ec90001-f315-4f60-9fb8-838830daea50
D 10:01:36.677 [DFU] gatt.writeCharacteristic(8ec90001-f315-4f60-9fb8-838830daea50)
I 10:01:36.748 Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value: (0x) 60-02-01
A 10:01:36.748 "Response for: Set PRN value
Status: Success" received
I 10:01:36.760 [DFU] Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-02-01
I 10:01:36.760 [DFU] Data written to 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-02-01
A 10:01:36.760 [DFU] Packet Receipt Notif disabled (Op Code = 2, Value = 0)
V 10:01:36.760 [DFU] Writing to characteristic 8ec90001-f315-4f60-9fb8-838830daea50
D 10:01:36.760 [DFU] gatt.writeCharacteristic(8ec90001-f315-4f60-9fb8-838830daea50)
I 10:01:36.837 Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value: (0x) 60-01-01
A 10:01:36.837 "Response for: Create Object
Status: Success" received
I 10:01:36.848 [DFU] Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-01-01
I 10:01:36.848 [DFU] Data written to 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-01-01
A 10:01:36.848 [DFU] Command object created
V 10:01:36.848 [DFU] Writing to characteristic 8ec90002-f315-4f60-9fb8-838830daea50
D 10:01:36.848 [DFU] gatt.writeCharacteristic(8ec90002-f315-4f60-9fb8-838830daea50)
I 10:01:36.848 [DFU] Data written to 8ec90002-f315-4f60-9fb8-838830daea50, value (0x): 0A-40-08-01-12-3C-08-15-10-34-1A-04-9D-01-A5-01-20-00-28-00
V 10:01:36.848 [DFU] Writing to characteristic 8ec90002-f315-4f60-9fb8-838830daea50
D 10:01:36.848 [DFU] gatt.writeCharacteristic(8ec90002-f315-4f60-9fb8-838830daea50)
I 10:01:36.848 [DFU] Data written to 8ec90002-f315-4f60-9fb8-838830daea50, value (0x): 30-00-38-B0-DD-0F-42-24-08-03-12-20-4D-16-56-65-E7-52-56-36
V 10:01:36.848 [DFU] Writing to characteristic 8ec90002-f315-4f60-9fb8-838830daea50
D 10:01:36.848 [DFU] gatt.writeCharacteristic(8ec90002-f315-4f60-9fb8-838830daea50)
I 10:01:36.860 [DFU] Data written to 8ec90002-f315-4f60-9fb8-838830daea50, value (0x): 42-3A-91-F5-81-CA-C6-2E-A6-36-2B-4F-CD-B3-C4-56-4D-33-9B-C3
V 10:01:36.860 [DFU] Writing to characteristic 8ec90002-f315-4f60-9fb8-838830daea50
D 10:01:36.860 [DFU] gatt.writeCharacteristic(8ec90002-f315-4f60-9fb8-838830daea50)
I 10:01:36.860 [DFU] Data written to 8ec90002-f315-4f60-9fb8-838830daea50, value (0x): 3F-CA-4E-8C-48-00
A 10:01:36.860 [DFU] Command object sent (CRC = 13C9BA70)
V 10:01:36.860 [DFU] Writing to characteristic 8ec90001-f315-4f60-9fb8-838830daea50
D 10:01:36.860 [DFU] gatt.writeCharacteristic(8ec90001-f315-4f60-9fb8-838830daea50)
I 10:01:36.980 [DFU] Data written to 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 03
I 10:01:37.016 Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value: (0x) 60-03-01-42-00-00-00-70-BA-C9-13
A 10:01:37.016 "Response for: Calculate Checksum
Status: Success
Current offset: 66 bytes
CRC-32: 13C9BA70" received
I 10:01:37.028 [DFU] Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-03-01-42-00-00-00-70-BA-C9-13
A 10:01:37.028 [DFU] Checksum received (Offset = 66, CRC = 13C9BA70)
V 10:01:37.028 [DFU] Writing to characteristic 8ec90001-f315-4f60-9fb8-838830daea50
D 10:01:37.028 [DFU] gatt.writeCharacteristic(8ec90001-f315-4f60-9fb8-838830daea50)
I 10:01:37.108 Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value: (0x) 60-04-0B-03
A 10:01:37.108 "Response for: Execute
Status: Extended error
Details: Unknown command" received
I 10:01:37.114 [DFU] Data written to 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 04
I 10:01:37.114 [DFU] Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-04-0B-03
E 10:01:37.114 [DFU] Remote DFU error: EXTENDED ERROR
E 10:01:37.114 [DFU] Details: Unknown command (Code = 3)
V 10:01:37.114 [DFU] Disconnecting...
D 10:01:37.142 [DFU] gatt.disconnect()
I 10:01:37.142 [DFU] Disconnected
D 10:01:37.142 [DFU] gatt.refresh() (hidden)
D 10:01:37.142 [DFU] gatt.close()
D 10:01:37.142 [DFU] wait(600)

Thanks for your help.

RE: DFU Update: "Upload Failed: Unknown Command"

Einar Thorsrud — Fri, 03 Aug 2018 12:27:18 GMT

Hi,

Can you upload a log of the DFU upgrade process to give a bit more understanding of what is going on? You can also try upgrading using the nRF Connect app for mobile or desktop. It might also be useful to see the log from the nRF side, which you can get by using the debug version of the bootloader (with RTT logging).