Locked Teensy "bricks"

Dogbone06

Well-known member
I have custom desgined boards using the PJRC bootloader and NXP chip, they work very nicely!

It was time to test the locking feature so I fired up Arduino and ran through the 4 steps. First creating a new certificate, I then ran the 3 steps to lock it. Every step was successful in the serial monitor.
Here is where the weird stuff happens. I try to flash it with a blink sketch and it wont do it. I click the boot button and the device restarts, but it takes almost a minute before I hear the windows sound. When it's connected again, it doesn't appear anywhere.

Basically it's bricked as it can't be flashed anymore. Looking at the serial terminal, the board is still running that 3rd (last) sketch.

I've tried this with a total of 3 boards, all the same!
Any ideas?
 
I try to flash it with a blink sketch and it wont do it
Isn't that the whole purpose of locking your Teensy? Such that no one can ever overwrite your code? Except ofcourse you, by programming EHEX files that are created using your key.
But perhaps I don't fully understand what you ask...

Paul
 
Isn't that the whole purpose of locking your Teensy? Such that no one can ever overwrite your code? Except ofcourse you, by programming EHEX files that are created using your key.
But perhaps I don't fully understand what you ask...

Paul

Locking the teensy isn't suppose to "brick it". I should be able to program it since I have the certificate in the correct Arduino folder. :)
 
Ah OK. I'm not familiar with the procedure and other settings that are required.
Hopefully someone with specific experience can chime in.

Paul
 
Check which version of Teensy Loader you are using. In the small Teensy Loader window, click Help > About.

Use version 1.58. Old versions won't know how to talk to lockable Teensy.


And yes, I can confirm you (or anyone you give the .ehex file) should be able to reproduce your lockable Teensy. Your key.pem file is only needed to create the encrypted .ehex file. It's not used by the uploading process.

Once locked, that Teensy can only be programmed with .ehex files created using your key.pem. It can't be programmed with normal plaintext .hex. It also won't allow programming with .ehex files created using any other key.

Make backup copies of your key.pem file!
 
Check which version of Teensy Loader you are using. In the small Teensy Loader window, click Help > About.

Use version 1.58. Old versions won't know how to talk to lockable Teensy.

I will try this, the version I have is 1.57.
Now that I already performed the 3 steps with 1.57, is that board dead forever or will it be fine to use 1.58 to flash the blink for example?

EDIT: The one on this link is 1.56.
https://www.pjrc.com/teensy/teensy.exe
 
Now that I already performed the 3 steps with 1.57, is that board dead forever or will it be fine to use 1.58 to flash the blink for example?

It is forever restricted to only running .ehex files created with your key.pem.

You could upload the LED blink example, but only in .ehex format, only created with your key.

Once locked, it is impossible to run unencrypted (typically speaking unsigned) programs. You can't upload any of the already made .hex files for LED blink.
 
It is forever restricted to only running .ehex files created with your key.pem.

You could upload the LED blink example, but only in .ehex format, only created with your key.

Once locked, it is impossible to run unencrypted (typically speaking unsigned) programs. You can't upload any of the already made .hex files for LED blink.

I'll try to explain as clearly as possible.
The 3 steps are already done and I know that's forever. The issue now is that even in boot mode, Teensyloader doesn't see the board, netiher does TyTools.
When entering the boot mode via the button, it should only take around 2 - 3 seconds to reboot into boot mode, but it takes almost a minute after clicking until I hear the windows sound.

Holding down the boot button should give me the orange blink after 13 seconds, it doesn't.
This board worked flawlessly before I performed the 3 steps.

The steps were performed on the "old" Arduino 1.8 platform with Teensyloader 1.57.
 
Holding down the boot button should give me the orange blink after 13 seconds, it doesn't.
This board worked flawlessly before I performed the 3 steps.

Once you have locked a T4.x (which it sounds like you have done successfully), the 15-second recovery procedure is no longer available, since the built-in BLINK sketch is not encrypted with your key. Once locked, you can *only* program your locked T4.x with an EHEX file that is signed with your personal key. Anything unencrypted (using a HEX file, including the 15-second restore) will not work, and anything encrypted (using an EHEX file) signed with a different key will not work (doesn't sound like this applies in your case).

Hope that helps . . .

Mark J Culross
KD5RXT
 
Once you have locked a T4.x (which it sounds like you have done successfully), the 15-second recovery procedure is no longer available, since the built-in BLINK sketch is not encrypted with your key. Once locked, you can *only* program your locked T4.x with an EHEX file that is signed with your personal key. Anything unencrypted (using a HEX file, including the 15-second restore) will not work, and anything encrypted (using an EHEX file) signed with a different key will not work (doesn't sound like this applies in your case).

Hope that helps . . .

Mark J Culross
KD5RXT

That was news to me, thanks for telling.
But that still doesn't change the fact the 3 boards I tried are bricked, they do not appear when they're in boot mode!
The 3 sketches to lock it, was flashed with Teensyduino 1.57. I've upgraded to 1.58 but these 3 boards still wont appear in Windows in boot mode.
They do however still run in ordinary mode. And ofc they're running the last sketch which locks them.
 
From where did you get that link ?? It is neither displayed nor referenced anywhere on the https://www.pjrc.com/teensy page (although it does seem to be downloadable from there !?!?!).

@PaulStoffregen: probably need to eliminate this file from being downloaded to avoid future conflicts and/or confusion.

Mark J Culross
KD5RXT

Actually, on the download page 1.56 is the one you get if you download, even older version. I had 1.57 because I haden't updated Arduino.
I did the test again with locking on a brand new board (lockable ofc), using 1.58, all good and it works!

So anyone trying to lock with 1.57 will basically brick it!
 
The 3 boards you previously locked should work with 1.58. The locking process doesn't depend on which version of Teensy Loader you use. It is the same even if you use very old versions (which then can't use the board after it's locked).
 
Actually, on the download page 1.56 is the one you get if you download, even older version.

Specifically, what "download page" (URL) ??? What is the specific URL of the "download page" containing this bad/old link ??

If, in fact, there is a link somewhere on some page providing this older version, that will need to be fixed. ***BUT***, without a specific reference to a specific page, no one would be expected to be able to go look at each & every page in hopes of finding the link that you seem to have used !!

All I could find were the current Teensyduino download links, which all point to the latest version at <this> URL ( https://www.pjrc.com/teensy/teensyduino.html ).

Mark J Culross
KD5RXT
 
The 3 boards you previously locked should work with 1.58. The locking process doesn't depend on which version of Teensy Loader you use. It is the same even if you use very old versions (which then can't use the board after it's locked).

Paul: Maybe a warning notification should be added to the <Code Security & Lockable Teensy> page specifying that TD1.58 or newer is required for full security functionality.

Mark J Culross
KD5RXT
 
Specifically, what "download page" (URL) ??? What is the specific URL of the "download page" containing this bad/old link ??
Mark (& Paul), it's on this page.

Untitled.jpg

Paul
 
Back
Top