elftosb does not produce encrypted image

[tonythurood2]

Hi,

We are using the MIMXRT1060-EVKB and a dev board with the i.MXRT1062.

I am trying to produce an encrypted image using the CST tools, srktool and elftosb.exe.

The keys and certs are generated successfully and the /keys /crts folders included in the elftosb build area.

I run a bat file which processes the elftosb in 2 steps and produces the following...

Step 1 - create iMX format image files
Section: 0x14
Section: 0x15
Section: 0x16
Section: 0x18
Section: 0x19
Section: 0x1a
Section: 0x1b
Section: 0x1c
Section: 0x1f
Section: 0x21
CSF Processed successfully and signed data available in csf.bin
iMX bootable image generated successfully
Step 2 - create Kinetis format program files
Boot Section 0x00000000:
FILL | adr=0x00002000 | len=0x00000004 | ptn=0xc0000007
ENA | adr=0x00002000 | cnt=0x00000004 | flg=0x0900
ERAS | adr=0x60000000 | cnt=0x00010000 | flg=0x0000
FILL | adr=0x00004000 | len=0x00000004 | ptn=0xe0120000
FILL | adr=0x00004004 | len=0x00000004 | ptn=0x60001000
FILL | adr=0x00004008 | len=0x00000004 | ptn=0x00001000
FILL | adr=0x0000400c | len=0x00000004 | ptn=0x60002000
FILL | adr=0x00004010 | len=0x00000004 | ptn=0x0000e000
ENA | adr=0x00004000 | cnt=0x00000004 | flg=0x0900
FILL | adr=0x00003000 | len=0x00000004 | ptn=0xf000000f
ENA | adr=0x00003000 | cnt=0x00000004 | flg=0x0900
LOAD | adr=0x60001000 | len=0x00076c00 | crc=0x395beee2 | flg=0x0000
Done

The .sb code image is not encrypted. I have attached all the files used in this process.

Some issues.

1. The imx-flexspinor-normal-signed.bd does not work with ivtOffset = 0x1000. If this is set to 0x400 it runs. Why?

2. If the flags are set to "flags = 0x04; // encrypted image" it does not run. With "0x08; // signed image" it does run. Why?

3. I have looked at various documents, AN12079, MBOOTELFTOSBUG (rev 2 and rev 7), IMXMCUMFUUG (rev 2) and they refer to a 128bit dek key file (16 bytes), but the CST and srktool do not produce this file. Why? 

Please answer my questions and advise on the correct procedure.

Is there a document that defines the procedure to produce an encrypted image for a iMXRT1062 NOR flash image?

Attached... the files are txt files because your forum rejects bd and bat.

[mastupristi]

I have looked at various documents, AN12079, MBOOTELFTOSBUG (rev 2 and rev 7), IMXMCUMFUUG (rev 2) and they refer to a 128bit dek key file (16 bytes), but the CST and srktool do not produce this file. Why?

Where did you find the rev2 of IMXMCUMFUUG? Would you give me the link to the download page?

regards

Max

[jay_heng]

You can try this one-stop GUI tool https://github.com/JayHeng/NXP-MCUBootUtility

and note that you should install cst, image_enc tool before using it.

开启NXP-MCUBootUtility工具的HAB加密功能 - CST（中英双语）
开启NXP-MCUBootUtility工具的BEE加密功能 - image_enc

[tonythurood2]

Hi Jay,

That does not meet our requirements.

We need to command line tools that will convert our plain text image to encrypted image so that it can then be used as a firmware update using OTA or lan connection.

There are lots of tools that connect, download flashloader and then write image to qspi flash, but these are of no use in the firmware upgrade of customer products.