Secure DFU

RE: Secure DFU

soratks — Thu, 13 Feb 2020 07:21:35 GMT

Found what I was missing on. After step 11, we need to enter into DFU mode by pressing button 4 on startup.

Thanks Andreas for detailed steps!

RE: Secure DFU

soratks — Thu, 13 Feb 2020 07:09:56 GMT

Hi Andreas,

Thanks for the detailed steps. I followed the same for nRF52840 SDK15.3. I am not able to see the advertising on the nRFconnect mobile application. Below is the output for programming

D:\1_Projects\DFU_Exploring\hex_flash>nrfutil pkg generate --hw-version 52 --application-version 3 --application peripheral.hex --sd-req 0xB6 --key-file private.key app_dfu_package.zip
Zip created at app_dfu_package.zip

D:\1_Projects\DFU_Exploring\hex_flash>nrfjprog.exe -e
Erasing user available code and UICR flash areas.
Applying system reset.

D:\1_Projects\DFU_Exploring\hex_flash>nrfjprog.exe --program s140_nrf52_6.1.1_softdevice.hex --verify
Parsing hex file.
Reading flash area to program to guarantee it is erased.
Checking that the area to write is not protected.
Programming device.
Verifying programming.
Verified OK.

D:\1_Projects\DFU_Exploring\hex_flash>nrfjprog.exe --program my_bootloader.hex --verify -r
Parsing hex file.
Reading flash area to program to guarantee it is erased.
Checking that the area to write is not protected.
Programming device.
Verifying programming.
Verified OK.
Applying system reset.
Run.

Please find the output on RTT-Viewer below.

00> <info> app: Inside main
00>
00> <debug> app: In nrf_bootloader_init
00>
00> <debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
00>
00> <debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
00>
00> <debug> nrf_dfu_settings: Using settings page.
00>
00> <debug> nrf_dfu_settings: Copying forbidden parts from backup page.
00>
00> <info> nrf_dfu_settings: Old settings page detected. Upgrading info.
00>
00> <debug> nrf_dfu_settings: Writing settings...
00>
00> <debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 0
00>
00> <debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x20007D90, len=896 bytes), queue usage: 1
00>
00> <debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0
00>
00> <info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
00>
00> <debug> nrf_dfu_settings: Writing settings...
00>
00> <debug> nrf_dfu_settings: Erasing old settings at: 0x000FE000
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FE000, len=1 pages), queue usage: 1
00>
00> <debug> nrf_dfu_flash: Flash erase success: addr=0x000FE000, pending 0
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FE000, src=0x20008110, len=896 bytes), queue usage: 1
00>
00> <debug> nrf_dfu_flash: Flash write success: addr=0x000FE000, pending 0
00>
00> <debug> app: Enter nrf_bootloader_fw_activate
00>
00> <info> app: No firmware to activate.
00>
00> <debug> nrf_dfu_validation: CRC check of app failed. Return 1
00>
00> <debug> app: App is valid
00>
00> <info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
00>
00> <debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
00>
00> <debug> app: Running nrf_bootloader_app_start with address: 0x00001000
00>
00> <debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0
00>
00> <info> app: Inside main
00>
00> <debug> app: In nrf_bootloader_init
00>
00> <debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
00>
00> <debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
00>
00> <debug> nrf_dfu_settings: Using settings page.
00>
00> <debug> nrf_dfu_settings: Copying forbidden parts from backup page.
00>
00> <debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
00>
00> <info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
00>
00> <debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
00>
00> <debug> app: Enter nrf_bootloader_fw_activate
00>
00> <info> app: No firmware to activate.
00>
00> <debug> nrf_dfu_validation: CRC check of app failed. Return 1
00>
00> <debug> app: App is valid
00>
00> <info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
00>
00> <debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
00>
00> <debug> app: Running nrf_bootloader_app_start with address: 0x00001000
00>
00> <debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0
00>

Can you please help me find out what I am missing on.

Thanks,

Ramya

RE: Secure DFU

AndreasF — Tue, 29 Oct 2019 12:26:29 GMT

Hi.

Are you sure that you've programmed the device correctly?

Please follow all these steps, and paste the output of all you do.

Step 1.

Generate a private key by running this command in cmd in your SDK 15.3 folder:

nrfutil keys generate priv.pem

Step 2.

Generate a public key file from that private key by running this command in cmd in your SDK 15.3 folder:

nrfutil keys display --key pk --format code priv.pem --out_file dfu_public_key.c

You should now have a file named dfu_public_key.c in your SDK 15.3 folder.

Step 3.

Open the folder nRF5_SDK_15.3.0_59ac345\examples\dfu

You see that there is a file named dfu_public_key.c, delete this file.

Take the file you generated in step 2 and move it to this folder.

Step 4.

Open up the SES project in the folder nRF5_SDK_15.3.0_59ac345\examples\dfu\secure_bootloader\pca100: _ble_debug and build it in your preferred IDE.

After you have built it the folders: \Output\Release\Exe will appear in the folder structure. Open these folders and copy the file named secure_bootloader_ble_s132_pca10040.hex to your SDK 15.3 folder. This is the .hex file for the secure bootloader you have created. (If you for example use Segger Embedded Studio)

Step 5.

Open the folder nRF5_SDK_15.3.0_59ac345\components\softdevice\s132\hex, and copy the .hex file s132_nrf52_6.1.1_softdevice.hex to your SDK 15.3 folder.

Step 6.

Create an application, for example the ble_app_bms example, and copy the .hex file as you did for the bootloader to your SDK 15.3 folder (you find the .hex file in nRF5_SDK_15.3.0_59ac345\examples\ble_peripheral\ble_app_bms\pca10040\s132\ses\Output\Release\Exe, named ble_app_bms_pca10040_s132.hex, if you use Segger Embedded Studio)

Step 7.

Generate a bootloader settings page by running this command in cmd in your SDK 15.3 folder:

nrfutil settings generate --family NRF52840 --application ble_app_bms_pca10040_s132.hex --application-version 3 --bootloader-version 2 --bl-settings-version 1 settings.hex

The output looks like this:

Step 8.

Merge the settings.hex and secure_bootloader_ble_s132_pca10040.hex together by running this command in cmd in your SDK 15.3 folder:

mergehex.exe --merge settings.hex secure_bootloader_ble_s132_pca10040.hex --output my_bootloader.hex

The output looks like this:

Step 9.

Generate the DFU packet by running this command in cmd in your SDK 15.3 folder:

nrfutil pkg generate --hw-version 52 --application-version 3 --application ble_app_bms_pca10040_s132.hex --sd-req 0xB7 --key-file priv.pem app_dfu_package.zip

The output looks like this:

Step 10.

You should now have these files in the SDK 15.3 folder:

app_dfu_package.zip

ble_app_bms_pca10040_s132.hex

my_bootloader.hex

priv.pem

s132_nrf52_6.1.1_softdevice.hex

secure_bootloader_ble_s132_pca10040.hex

settings.hex

Step 11.

Open RTT-Viewer and select the board you're using.

Open the SDK 15.3 folder in cmd, and write the commands:

nrfjprog.exe -e

nrfjprog.exe --program s132_nrf52_6.1.1_softdevice.hex --verify

nrfjprog.exe --program my_bootloader.hex --verify -r

You have now programmed the SoftDevice and the Bootloader including the bootloader settings page.

Step 12.

Open nRF Connect on your mobile phone and scan:

When you find DfuTarg click on Connect.

And click on the DFU button and Select distribution packet (ZIP)

And select the file app_dfu_package.zip.

After you have finished the device will reset and start advertising as Nordic_BMS

Does this make things a bit clearer?

Could you also please post all the output from RTT-Viewer if this does not work?

Best regards,

Andreas