RE: Disabling bootloader security without customization

ruotoy — Thu, 07 Apr 2022 23:41:45 GMT

[quote userid="7571" url="~/f/nordic-q-a/50296/disabling-bootloader-security-without-customization/200992#200992"]Bjørn[/quote]

Hi Bjorn,

I am confused about how nrf_dfu_validation_prevalidate() verify signature. According to my understanding, the signature from init packet is generated based on the firmware to be updated. The nrf_dfu_validation_signature_check() function will compare if the hash calculated from firmware is the same with the hash from signature. However, the firmware is not available during the prevalidation. To this end, I do not know how the signature is verified.

From source code, nrf_dfu_validation_prevalidate() call nrf_dfu_validation_signature_check() function with m_init_packet_data_ptr as one of the input. m_init_packet_data_ptr will then be used to calculate the hash, which is obviously the hash from init packet instead of firmware to be updated.

I might misunderstand some part of the code. Really appreciate if you can explain this to me. Thanks for your time.

RE: Disabling bootloader security without customization

bjorn-spockeli — Mon, 29 Jul 2019 13:43:37 GMT

HI Douglas,

when creating a DFU firmware image using the --debug-mode option of nrfutil, you're only skipping the version check for hardware and firmware, see https://github.com/NordicSemiconductor/pc-nrfutil#generate.

This can be seen in nrf_dfu_ver_validation_check() from nrf_dfu_validation.c

nrf_dfu_result_t nrf_dfu_ver_validation_check(dfu_init_command_t const * p_init)
{
    nrf_dfu_result_t ret_val = NRF_DFU_RES_CODE_SUCCESS;
    if (!fw_type_ok(p_init))
    {
        NRF_LOG_ERROR("Invalid firmware type.");
        ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_INIT_COMMAND_INVALID);
    }
    else if (!fw_hash_type_ok(p_init))
    {
        NRF_LOG_ERROR("Invalid hash type.");
        ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_WRONG_HASH_TYPE);
    }
    else if (!NRF_DFU_DEBUG ||
            (NRF_DFU_DEBUG && ((p_init->has_is_debug == false) || (p_init->is_debug == false))))
    {
        if (p_init->has_hw_version == false)
        {
            NRF_LOG_ERROR("No HW version.");
            ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_INIT_COMMAND_INVALID);
        }
        else if (p_init->hw_version != NRF_DFU_HW_VERSION)
        {
            NRF_LOG_WARNING("Faulty HW version.");
            ret_val = EXT_ERR( NRF_DFU_EXT_ERROR_HW_VERSION_FAILURE);
        }

        else if (!sd_req_ok(p_init))
        {
            NRF_LOG_WARNING("SD req not met.");
            ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_SD_VERSION_FAILURE);
        }
        else if (p_init->has_fw_version)
        {
            if (!fw_version_ok(p_init))
            {
                NRF_LOG_WARNING("FW version too low.");
                ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_FW_VERSION_FAILURE);
            }
        }
        else
        {
            if (fw_version_required(p_init->type))
            {
                NRF_LOG_ERROR("FW version missing.");
                ret_val = EXT_ERR(NRF_DFU_EXT_ERROR_INIT_COMMAND_INVALID);
            }
        }
    }
    return ret_val;
}

which in turn is called by nrf_dfu_validation_prevalidate(), which checks the signature _before_ calling nrf_dfu_ver_validation_check().

nrf_dfu_result_t nrf_dfu_validation_prevalidate(void)
{
    nrf_dfu_result_t                 ret_val        = NRF_DFU_RES_CODE_SUCCESS;
    dfu_command_t            const * p_command      = &m_packet.command;
    dfu_signature_type_t             signature_type = DFU_SIGNATURE_TYPE_MIN;
    uint8_t                  const * p_signature    = NULL;
    uint32_t                         signature_len  = 0;

    if (m_packet.has_signed_command)
    {
        p_command      = &m_packet.signed_command.command;
        signature_type =  m_packet.signed_command.signature_type;
        p_signature    =  m_packet.signed_command.signature.bytes;
        signature_len  =  m_packet.signed_command.signature.size;
    }

    // Validate signature.
    if (signature_required(p_command->init.type))
    {
        ret_val = nrf_dfu_validation_signature_check(signature_type,
                                                     p_signature,
                                                     signature_len,
                                                     m_init_packet_data_ptr,
                                                     m_init_packet_data_len);
    }

    // Validate versions.
    if (ret_val == NRF_DFU_RES_CODE_SUCCESS)
    {
        ret_val = nrf_dfu_ver_validation_check(&p_command->init);
    }

    if (ret_val != NRF_DFU_RES_CODE_SUCCESS)
    {
        NRF_LOG_WARNING("Prevalidation failed.");
        NRF_LOG_DEBUG("Init command:");
        NRF_LOG_HEXDUMP_DEBUG(m_init_packet_data_ptr, m_init_packet_data_len);
    }

    return ret_val;
}

If you want to disable the signature check and version requirement for the bootloader you will have to modify the source.

Best regards

Bjørn