Recent content by dresden-fx

Thank you guys for the summary. Didn't follow the Teensyduiono 1.55 Beta thread for some time as for my purpose the security functions already worked well. All in all it's great to hear, that the lockable design stabilizes and the official release is right arround the corner. You all did a very...

Have there been any substantial changes to the security related functions or concept?

I believe there is a lock bit for the SRK hash also, that when burnt doesn't allow to change any single bit of the SRK hash. The reason I believe that is that all the IMX processors have the rather same layout of the fuse memory and within the iMX6's SRM this fuse is documented while in the...

I sucessfully run all 3 steps to secure the Teensy and it worked without issues so far. The steps are easy to follow quite self explantory and work very well. So from my point of view Paul did really great stuff.

Thank you for your support and encouragement. That helps a lot to increase my motivation. Actually, behind the scenes, I still keep going, albeit at half throttle. I'm in contact with Paul in order to discuss and tune technical solutions in accordance with his master plan. Unfortunately Paul...

Trying to reproduce the HAB log entry of yesterday I found out that it not had to do with the UART, but with how I configured the debug connection settings and how I used the debugger. Yesterday I configured the connection settings to use JTAG_nTRST for a reconnect and as after plugging in the...

Right few minutes ago I tried to check the HAB entry again but watching the memory with the debugger (target was halted) showed randomly changing RAM contents which was a bit misterious. After disconnectiing the debugger from both, the target and my PC and restarting the debug host application I...

As even with the modification previously described the IMXRT didn't boot successfully and because the reason is not obvious, I decided to make an attempt to completely dedolder the MKL02 in order to gain access to the IMXRT's JTAG interface. As I do not own special desolder station for chips, it...

Ok, I took the board, where all the JTAG is blocked now by fuses and as SNVS still reports SV1 I tried to physically block JTAG access. I soldered very thin wires to those pads of the MKL02 which are most probable stimulated for JTAG access (P13 - JTAG_MOD, P8 - JTAG_TCK, P7 - JTAG_TDI, P5 -...

Ok, I found a reasonable exlanation for the MKL02 still beeing able to access the IMXRT via JTAG when JTAG_SMODe is burnt to 0b01 or 0b11: AN12419 in chapter 2.3 says that additionally the KTE fuse hes to be burnt to have JTAG secure mode work, which I did not. Anyway tos doesn't change anything...

Hello everybody, here is the latest news about HAB... As I didn't get a response yet, I started experimenting with a fresh board. So tried to hardly pull up/down single wires of the JTAG interface by which I was able to prevent the MKL02 form accessing the IMXRT, but the SNVS security...

Probably just Paul can give substantated answers to those 3 questions... So please Paul, if your time allows, please let me know whether the Teensy 4.0 will boot and run also if JTAG between MKL02 and IMXRT is disabled. I don't want to brick a fresh non-locked Teensy for finding out that this...

The headline within your linked dicument says: "Modifying the Teensy 3.5 and 3.6 for ARM SWD Debugging" so I guess this will work for those teensies. For Teensy 4.x the JTAG-related pads of the IMXRT are not accessible from any board pins as they are connected to the boot chip. So you will not...

Hello everybody, I made an attempt to set one of the unlocked teensy boards to closed configuration after having burnt the SRK hash fuses and successful HAB authentication in open configuration. But rather undexpectedly the board didn't answer anymore after reset. After long second thought what...

In fact I've never been away. But it took me some of my spare time to get prepared for further investigations. BTW nice to see what Paul did in the meantime. As I understand the, update process, the bootloader is injected into the iMXRT via JTAG by the MKL02 chip. So as long as you do not...