Locked Teensy "bricks"

D

Dogbone06

Well-known member
I have custom desgined boards using the PJRC bootloader and NXP chip, they work very nicely!

It was time to test the locking feature so I fired up Arduino and ran through the 4 steps. First creating a new certificate, I then ran the 3 steps to lock it. Every step was successful in the serial monitor.
Here is where the weird stuff happens. I try to flash it with a blink sketch and it wont do it. I click the boot button and the device restarts, but it takes almost a minute before I hear the windows sound. When it's connected again, it doesn't appear anywhere.

Basically it's bricked as it can't be flashed anymore. Looking at the serial terminal, the board is still running that 3rd (last) sketch.

I've tried this with a total of 3 boards, all the same!
Any ideas?
 
Dogbone06 said:
I try to flash it with a blink sketch and it wont do it
Click to expand...
Isn't that the whole purpose of locking your Teensy? Such that no one can ever overwrite your code? Except ofcourse you, by programming EHEX files that are created using your key.
But perhaps I don't fully understand what you ask...

Paul
 
PaulS said:
Isn't that the whole purpose of locking your Teensy? Such that no one can ever overwrite your code? Except ofcourse you, by programming EHEX files that are created using your key.
But perhaps I don't fully understand what you ask...

Paul
Click to expand...

Locking the teensy isn't suppose to "brick it". I should be able to program it since I have the certificate in the correct Arduino folder. :)
 
Ah OK. I'm not familiar with the procedure and other settings that are required.
Hopefully someone with specific experience can chime in.

Paul
 
Check which version of Teensy Loader you are using. In the small Teensy Loader window, click Help > About.

Use version 1.58. Old versions won't know how to talk to lockable Teensy.


And yes, I can confirm you (or anyone you give the .ehex file) should be able to reproduce your lockable Teensy. Your key.pem file is only needed to create the encrypted .ehex file. It's not used by the uploading process.

Once locked, that Teensy can only be programmed with .ehex files created using your key.pem. It can't be programmed with normal plaintext .hex. It also won't allow programming with .ehex files created using any other key.

Make backup copies of your key.pem file!
 
PaulStoffregen said:
Check which version of Teensy Loader you are using. In the small Teensy Loader window, click Help > About.

Use version 1.58. Old versions won't know how to talk to lockable Teensy.
Click to expand...

I will try this, the version I have is 1.57.
Now that I already performed the 3 steps with 1.57, is that board dead forever or will it be fine to use 1.58 to flash the blink for example?

EDIT: The one on this link is 1.56.
https://www.pjrc.com/teensy/teensy.exe
 
Dogbone06 said:
Now that I already performed the 3 steps with 1.57, is that board dead forever or will it be fine to use 1.58 to flash the blink for example?
Click to expand...

It is forever restricted to only running .ehex files created with your key.pem.

You could upload the LED blink example, but only in .ehex format, only created with your key.

Once locked, it is impossible to run unencrypted (typically speaking unsigned) programs. You can't upload any of the already made .hex files for LED blink.
 
PaulStoffregen said:
It is forever restricted to only running .ehex files created with your key.pem.

You could upload the LED blink example, but only in .ehex format, only created with your key.

Once locked, it is impossible to run unencrypted (typically speaking unsigned) programs. You can't upload any of the already made .hex files for LED blink.
Click to expand...

I'll try to explain as clearly as possible.
The 3 steps are already done and I know that's forever. The issue now is that even in boot mode, Teensyloader doesn't see the board, netiher does TyTools.
When entering the boot mode via the button, it should only take around 2 - 3 seconds to reboot into boot mode, but it takes almost a minute after clicking until I hear the windows sound.

Holding down the boot button should give me the orange blink after 13 seconds, it doesn't.
This board worked flawlessly before I performed the 3 steps.

The steps were performed on the "old" Arduino 1.8 platform with Teensyloader 1.57.
 
Dogbone06 said:
Holding down the boot button should give me the orange blink after 13 seconds, it doesn't.
This board worked flawlessly before I performed the 3 steps.
Click to expand...

Once you have locked a T4.x (which it sounds like you have done successfully), the 15-second recovery procedure is no longer available, since the built-in BLINK sketch is not encrypted with your key. Once locked, you can *only* program your locked T4.x with an EHEX file that is signed with your personal key. Anything unencrypted (using a HEX file, including the 15-second restore) will not work, and anything encrypted (using an EHEX file) signed with a different key will not work (doesn't sound like this applies in your case).

Hope that helps . . .

Mark J Culross
KD5RXT
 
kd5rxt-mark said:
Once you have locked a T4.x (which it sounds like you have done successfully), the 15-second recovery procedure is no longer available, since the built-in BLINK sketch is not encrypted with your key. Once locked, you can *only* program your locked T4.x with an EHEX file that is signed with your personal key. Anything unencrypted (using a HEX file, including the 15-second restore) will not work, and anything encrypted (using an EHEX file) signed with a different key will not work (doesn't sound like this applies in your case).

Hope that helps . . .

Mark J Culross
KD5RXT
Click to expand...

That was news to me, thanks for telling.
But that still doesn't change the fact the 3 boards I tried are bricked, they do not appear when they're in boot mode!
The 3 sketches to lock it, was flashed with Teensyduino 1.57. I've upgraded to 1.58 but these 3 boards still wont appear in Windows in boot mode.
They do however still run in ordinary mode. And ofc they're running the last sketch which locks them.
 
kd5rxt-mark said:
From where did you get that link ?? It is neither displayed nor referenced anywhere on the https://www.pjrc.com/teensy page (although it does seem to be downloadable from there !?!?!).

@PaulStoffregen: probably need to eliminate this file from being downloaded to avoid future conflicts and/or confusion.

Mark J Culross
KD5RXT
Click to expand...

Actually, on the download page 1.56 is the one you get if you download, even older version. I had 1.57 because I haden't updated Arduino.
I did the test again with locking on a brand new board (lockable ofc), using 1.58, all good and it works!

So anyone trying to lock with 1.57 will basically brick it!
 
The 3 boards you previously locked should work with 1.58. The locking process doesn't depend on which version of Teensy Loader you use. It is the same even if you use very old versions (which then can't use the board after it's locked).
 
Dogbone06 said:
Actually, on the download page 1.56 is the one you get if you download, even older version.
Click to expand...

Specifically, what "download page" (URL) ??? What is the specific URL of the "download page" containing this bad/old link ??

If, in fact, there is a link somewhere on some page providing this older version, that will need to be fixed. ***BUT***, without a specific reference to a specific page, no one would be expected to be able to go look at each & every page in hopes of finding the link that you seem to have used !!

All I could find were the current Teensyduino download links, which all point to the latest version at <this> URL ( https://www.pjrc.com/teensy/teensyduino.html ).

Mark J Culross
KD5RXT
 
PaulStoffregen said:
The 3 boards you previously locked should work with 1.58. The locking process doesn't depend on which version of Teensy Loader you use. It is the same even if you use very old versions (which then can't use the board after it's locked).
Click to expand...

Paul: Maybe a warning notification should be added to the <Code Security & Lockable Teensy> page specifying that TD1.58 or newer is required for full security functionality.

Mark J Culross
KD5RXT
 
kd5rxt-mark said:
Specifically, what "download page" (URL) ??? What is the specific URL of the "download page" containing this bad/old link ??
Click to expand...
Mark (& Paul), it's on this page.

Untitled.jpg

Paul
 
You must log in or register to reply here.
Back
Top