Skip to content

Commit b4b5c3e

Browse files
will-v-piwill-v-pi
committed
Add hello_encrypted example
1 parent e20303e commit b4b5c3e

File tree

8 files changed

+260
-0
lines changed

8 files changed

+260
-0
lines changed

‎CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ add_subdirectory(cmake)
6666
add_subdirectory(dcp)
6767
add_subdirectory(divider)
6868
add_subdirectory(dma)
69+
add_subdirectory(encrypted)
6970
add_subdirectory(flash)
7071
add_subdirectory(gpio)
7172
add_subdirectory(hstx)

‎encrypted/CMakeLists.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
if (TARGET pico_mbedtls)
2+
add_subdirectory_exclude_platforms(hello_encrypted host rp2040 rp2350-riscv)
3+
else()
4+
# Assume picotool has no signing support, if no pico_mbedtls available
5+
message("Skipping encrypted example as pico_mbedtls unavailable")
6+
endif ()

‎encrypted/hello_encrypted/CMakeLists.txt

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Example encrypted binard
2+
add_executable(hello_encrypted
3+
hello_encrypted.c
4+
)
5+
6+
# pull in common dependencies
7+
target_link_libraries(hello_encrypted pico_stdlib)
8+
9+
# enable stdio_usb and stdio_uart
10+
pico_enable_stdio_uart(hello_encrypted 1)
11+
pico_enable_stdio_usb(hello_encrypted 1)
12+
13+
# set as no_flash binary
14+
pico_set_binary_type(hello_encrypted no_flash)
15+
16+
# set version (optional)
17+
pico_set_binary_version(hello_encrypted MAJOR 7 MINOR 3)
18+
19+
# set tbyb (optional)
20+
# target_compile_definitions(hello_encrypted PRIVATE PICO_CRT0_IMAGE_TYPE_TBYB=1)
21+
22+
# Add command to update otp.json if privateaes.bin changes
23+
add_custom_command(OUTPUT ${CMAKE_CURRENT_LIST_DIR}/otp.json
24+
COMMAND ${CMAKE_COMMAND} -P "${CMAKE_CURRENT_LIST_DIR}/update-key.cmake"
25+
DEPENDS ${CMAKE_CURRENT_LIST_DIR}/privateaes.bin)
26+
# Copy that otp.json file to build directory
27+
add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/otp.json
28+
COMMAND ${CMAKE_COMMAND} -E copy "${CMAKE_CURRENT_LIST_DIR}/otp.json" "${CMAKE_CURRENT_BINARY_DIR}/otp.json"
29+
DEPENDS ${CMAKE_CURRENT_LIST_DIR}/otp.json)
30+
add_custom_target(hello_encrypted_otp_json DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/otp.json)
31+
add_dependencies(hello_encrypted hello_encrypted_otp_json)
32+
33+
# configure otp output
34+
pico_set_otp_key_output_file(hello_encrypted ${CMAKE_CURRENT_BINARY_DIR}/otp.json)
35+
36+
# sign, hash, and encrypt
37+
pico_sign_binary(hello_encrypted ${CMAKE_CURRENT_LIST_DIR}/private.pem)
38+
pico_hash_binary(hello_encrypted)
39+
pico_encrypt_binary(hello_encrypted
40+
${CMAKE_CURRENT_LIST_DIR}/privateaes.bin
41+
EMBED
42+
OTP_KEY_PAGE 29)
43+
44+
# package uf2 in flash
45+
pico_package_uf2_output(hello_encrypted 0x10000000)
46+
47+
# create map/bin/hex/uf2 file etc.
48+
pico_add_extra_outputs(hello_encrypted)
49+
50+
# add url via pico_set_program_url
51+
example_auto_set_url(hello_encrypted)

‎encrypted/hello_encrypted/hello_encrypted.c

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* Copyright (c) 2020 Raspberry Pi (Trading) Ltd.
3+
*
4+
* SPDX-License-Identifier: BSD-3-Clause
5+
*/
6+
7+
#include <stdio.h>
8+
#include <stdlib.h>
9+
#include "pico/stdlib.h"
10+
#include "pico/bootrom.h"
11+
#include "hardware/sync.h"
12+
13+
int main() {
14+
restore_interrupts_from_disabled(0);
15+
stdio_init_all();
16+
17+
#if PICO_CRT0_IMAGE_TYPE_TBYB
18+
// If TBYB image, then buy it
19+
uint8_t* buffer = malloc(4096);
20+
rom_explicit_buy(buffer, 4096);
21+
free(buffer);
22+
#endif
23+
24+
while (true) {
25+
printf("Hello, world!\n");
26+
printf("I'm a self-decrypting binary\n");
27+
printf("My secret is...\n");
28+
sleep_ms(1000);
29+
}
30+
}

‎encrypted/hello_encrypted/otp.json

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"29:0" :
3+
{
4+
"ecc" : true,
5+
"value" :
6+
[
7+
"0x31",
8+
"0xb6",
9+
"0xd8",
10+
"0x18",
11+
"0x23",
12+
"0x2e",
13+
"0x7b",
14+
"0x7c",
15+
"0xa3",
16+
"0xb1",
17+
"0xb7",
18+
"0x90",
19+
"0x7b",
20+
"0x2f",
21+
"0x41",
22+
"0xd2",
23+
"0x51",
24+
"0xb5",
25+
"0x03",
26+
"0x62",
27+
"0xd6",
28+
"0x21",
29+
"0x0c",
30+
"0xb5",
31+
"0x8d",
32+
"0x17",
33+
"0xe6",
34+
"0xd5",
35+
"0x6b",
36+
"0x0d",
37+
"0x87",
38+
"0x8d",
39+
"0x2b",
40+
"0x74",
41+
"0xa4",
42+
"0xba",
43+
"0xb9",
44+
"0x14",
45+
"0x75",
46+
"0x88",
47+
"0x9b",
48+
"0x05",
49+
"0x2d",
50+
"0x32",
51+
"0x51",
52+
"0xc1",
53+
"0x35",
54+
"0x09",
55+
"0x78",
56+
"0xbb",
57+
"0x6d",
58+
"0xc2",
59+
"0xbb",
60+
"0xa6",
61+
"0x5e",
62+
"0x95",
63+
"0xa2",
64+
"0x29",
65+
"0x32",
66+
"0x34",
67+
"0x5b",
68+
"0x2c",
69+
"0xd3",
70+
"0xf8",
71+
"0x5d",
72+
"0xe2",
73+
"0x5f",
74+
"0x23",
75+
"0xeb",
76+
"0x27",
77+
"0xa4",
78+
"0xcd",
79+
"0xb0",
80+
"0x8e",
81+
"0xf4",
82+
"0x6e",
83+
"0x94",
84+
"0x86",
85+
"0x19",
86+
"0x93",
87+
"0x3a",
88+
"0xd8",
89+
"0x97",
90+
"0x65",
91+
"0x29",
92+
"0x25",
93+
"0x57",
94+
"0x65",
95+
"0x49",
96+
"0x03",
97+
"0xfe",
98+
"0xc6",
99+
"0xe9",
100+
"0x8b",
101+
"0xa3",
102+
"0x7e",
103+
"0x2b",
104+
"0x53",
105+
"0x80",
106+
"0x68",
107+
"0xdd",
108+
"0x05",
109+
"0x10",
110+
"0x17",
111+
"0xca",
112+
"0xc3",
113+
"0xa8",
114+
"0x04",
115+
"0x8d",
116+
"0x12",
117+
"0xaf",
118+
"0xd9",
119+
"0x49",
120+
"0xa9",
121+
"0x6d",
122+
"0x90",
123+
"0x7c",
124+
"0xb3",
125+
"0x63",
126+
"0x4f",
127+
"0x36",
128+
"0xc5",
129+
"0x00",
130+
"0xb5",
131+
"0x71",
132+
"0x74",
133+
"0xe6",
134+
"0x9a"
135+
]
136+
},
137+
"OTP_DATA_KEY1" : [ 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7 ],
138+
"OTP_DATA_KEY1_VALID" : "0x010101",
139+
"PAGE29_LOCK0" : "0x494949",
140+
"PAGE29_LOCK1" : "0x3d3d3d"
141+
}

‎encrypted/hello_encrypted/private.pem

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-----BEGIN EC PARAMETERS-----
2+
BgUrgQQACg==
3+
-----END EC PARAMETERS-----
4+
-----BEGIN EC PRIVATE KEY-----
5+
MHQCAQEEIAXAdiilH8wT07TESUzWPt+BY9+NcchvYU3xbnpK+CBNoAcGBSuBBAAK
6+
oUQDQgAEYYJtMQFGW4AB94tU3u/Qir5sRcYjBYMqCa+8gxsYd9OwMS3dqWKsnVBz
7+
dyy7bFWdJzXDMb9o20xRRd57Q9xSYw==
8+
-----END EC PRIVATE KEY-----

‎encrypted/hello_encrypted/privateaes.bin

128 Bytes
Binary file not shown.

‎encrypted/hello_encrypted/update-key.cmake

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
if (CMAKE_VERSION VERSION_LESS 3.19)
2+
# Check if keyfile is not the default, and print warning
3+
file(READ ${CMAKE_CURRENT_LIST_DIR}/privateaes.bin key_file HEX)
4+
if (NOT ${key_file} STREQUAL "31b6d818232e7b7ca3b1b7907b2f41d251b50362d6210cb58d17e6d56b0d878d2b74a4bab91475889b052d3251c1350978bb6dc2bba65e95a22932345b2cd3f85de25f23eb27a4cdb08ef46e948619933ad89765292557654903fec6e98ba37e2b538068dd051017cac3a8048d12afd949a96d907cb3634f36c500b57174e69a")
5+
message(WARNING
6+
"AES key not updated in otp.json file, as CMake version is < 3.19"
7+
" - you will need to change the key in otp.json manually and re-run the build"
8+
)
9+
endif()
10+
else()
11+
# Read the JSON file.
12+
file(READ ${CMAKE_CURRENT_LIST_DIR}/otp.json json_string)
13+
# Read the key file
14+
file(READ ${CMAKE_CURRENT_LIST_DIR}/privateaes.bin key_file HEX)
15+
16+
# adds '0x' prefix, comma suffix, and quotes for every byte
17+
string(REGEX REPLACE "([0-9a-f][0-9a-f])" "\"0x\\1\", " key_file ${key_file})
18+
set(key_file_json "[${key_file}]")
19+
20+
string(JSON json_string SET ${json_string} "29:0" "value" ${key_file_json})
21+
22+
file(WRITE ${CMAKE_CURRENT_LIST_DIR}/otp.json ${json_string})
23+
endif()

0 commit comments

Comments
 (0)