고정 헤더 영역
상세 컨텐츠
본문
CRC Values for KBOOTOutlineThis article explains how to calculate the CRC32 for KBOOT, both from binary and S-Record files and how to insert the values into the BCA (Bootloader Configuration Area). Additionally it gives tips about debugging the bootloaded application. Bootloader Configuration Area (BCA)The bootloader is configured with a BCA (Bootloader Configuration Area). As explained in ““, it configures the ROM bootloader. That ROM bootloader for the KL03Z does.not. implement the checksum feature:-(, so I would have to build a flash-flash resident bootloader as explained in ““.For the flash-resident bootloader, the BCA has part of the application to be loaded as well, and located at offset 0x3C0 right after the vector table located at offset 0x0000.So if the application gets loaded at 0xC000 (as used in this tutorial), the BCA is located at 0xC3C0. That BCA can be implemented as a struct in C as in “” or it could be part of the assembly code e.g.
In the startup file as in this tutorial. Bootloader Configuration AreaThe CRC start address, size in bytes and the expected CRC values are just behind the tag bytes:. 0x3c0 + 0x4: 04:07 crcStartAddress. 0x3c0 + 0x8: 08:0b crcByteCount.
0x3c0 + 0xC: 0c:0f crcExpectedValueThe question is: how to calculate that expected CRC value? CRC Value with KinetisFlashToolOn possibility to calculate the expected CRC values is to use the Kinetis Flash Tool. In the tool, browse for the binary (.bin) file (which is the only supported format 😦 ) and press the Config button. Inspecting values in binary fileTo calculate the CRC32 value from a Binary, I use the following command line: sreccat tinyK22KBOOTleddemo.bin -binary -fill 0xff 0x0000 0x1000 -crop 0x0400 0x1000 -BitReverse -CRC32LE 0x1000 -BitReverse -XOR 0xff -crop 0x1000 0x1004 -Output - -hexdump00001000: 52 04 06 B8 #.c^BIt first fills the memory from 0x0000 to 0x1000 with the 0xff filler, then cuts out the area between 0x400 to 0x1000, calculates the checksum and issues it on the console.Then add it to a binary. Below is the command line to insert that CRC32 value into the binary file at offset 0x3C4: sreccat -generate 0x3cc 0x3d0 -constant-b-e 0x52E406B8 4 tinyK22KBOOTleddemo.bin -binary -exclude 0x3cc 0x3d0 -output newWithCRC32.bin -Binary CRC Checks and Debugging with ‘Software’ BreakpointsThere is one potential problem with the CRC calculation done by the bootloader: If your debugger probe modifies the flash memory for setting breakpoints (e.g.
Segger J-Link can do this to get ‘unlimited’ breakpoints (see ““, then this is changing the code, and as such invalidates the CRC checksum/check. So if loading and CRC-checking application code, make sure you don’t have any breakpoints set in that area. AutomatingThis article describes the manual steps to determine the CRC value and than add it to the application. For automating things with a Python script, see the work of Robert Poor at.
SummaryAdding a CRC32 check in the bootloader makes the process more reliable, as it can detect bit in the loaded image. Knowing the correct polynomial and CRC calculation way is not always straight forward. Kudos to Robert Poor who has found out how to create the CRC32 for KBOOT. I’m now able to generate the checksum both from S19 and binary files. I’m doing things semi-automated (calculate the CRC and insert it into the file), and if I find time I plan to automate it further.
Crc32 Check Failed Nothing Patched
Until then, have a look how Robert is automating it (see previous section).The projects used in this tutorial are available on GitHub (see the links at the end of this article).Happy Checking 🙂 Links. Projects used in this Tutorial on GitHub:. Generating CRC-32 for KBOOT (by Robert Poor):. How to automate CRC generation (by Robert Poor):. Hi Erich,I have been following your articles on KBOOT and and the KL03.I am using the KL82, which supports CRC32 check in ROM bootloader. I have managed to get thecrcStartAddresscrcByteCountcrcExpectedValueof the application in the BCA (0x03C0).I am also using the ROM bootloader to reflash my application.Question:Is there a way to invoke a KBOOT CRC check other than by issuing a RESET to the microcontroller (via the reset pin; at this point the KL82 will enter KBOOT again) and querying via “get-property 8” command the status of the CRC32 integrity check.Thanks!RaduLike.
Crc32 Check Failed Nothing Patched 2
The KL03 (and I think as well the KL82) ROM bootloader is closed source (no sources available).I did not see a specific bootloader entry point for the CRC itself, but you can enter the bootloader anytime you want from the application (e.g. See how this is done for the ROM bootloader: ), see RunRomBootloader.The other way would be to read the CRC info from the image itself and run the same function as in the bootloader. The polynom should be the same I think.
You would have to copy that code.I hope this helps,ErichLike. Hi Erich,I think there is a misunderstanding. Let me explain what I am doing.
The KL82 comes with the flash erased and unsecured from factory. So upon power up it gets into KBOOT. Hi Erich,Thanks for the detailed explanation. 2 Questions:1. When writing:-crop 0xc400 0xD000How do you know what is the last index of data? (in this case: 0xD000)?I can’t seem to get the same CRC value as I get via the KinetisFlashTool, and I’m guessing the problem is in the crop data for the crc calculation.2.
Crc32 Check Failed Ghost
I’m working with bin file (using blhost). You did not mention it, but in such case, the byteCount and the startAddress should be hardcoded to the startupMK64F12.S file, right? Because the sreccat you showed only referes to the crc value.Thanks,RoyLike. I see Modbus is mentioned but it produce the wrong number for input data ‘0x03’. The most obvious command line for me is:sreccat -generate 0x0002 0x0003 -const-b-e 0x03 1 -o – sreccat – -crc16bigendian 0x1002 -poly ansi -ccittreturn 0xFCFF whereas Lammert’s site gives 0x41FFAnyhow, I can now reduce the number of combination to 3840: -CCITT, -XMODEM and -BROKEN are mutually exclusive:( -xor 0xff) ( -BitReverse) (-CRC16BigEndian -CRC16LittleEndian) (-poly ibm -poly ansi -poly cciit -poly t10-dif -poly dnp -poly dect 0x8005 0xA001 0x4003 0xC002) (-MostToLeast -LeastToMost) (-CCITT -XMODEM -BROKEN) (-AUGment -No-AUGment) ( -BitReverse) ( -xor 0xff)Like.
