MTK Secure boot verify

  MTK 的bootload， lk， boot三阶段的验证和签名过程。

1.  签名主要python 脚本

       vendor/mediatek/proprietary/scripts/sign-image_v2/sign.py: 

       vendor/mediatek/proprietary/scripts/sign-image_v2/img_key_deploy.py

                                                                                               sign_flow.py

       img_key_deploy.py \
               cert1_key_path= \
              cert2_key_path= \
               root_key_padding="
      img_key_deploy.py mt6797 k97v1_64 \
                 cert1_key_path=privk1.pem \
                  cert2_key_path=privk2.pem"

2. 签名key，可以定制，生成证书

        cert1_key_path: ./hsm_test_keys/root_prvk.pem
        cert2_key_path: ./hsm_test_keys/img_prvk.pem

        sign-image_v2\x509_template

3.  Pub key，Priv Key

       vendor\mediatek\proprietary\custom\mt6xxx\security\cert_config

         lib.asn1_gen.asn1_gen(tbs_config_file_path, tbs_cert_file_path, False)
         lib.cert.sig_gen(tbs_cert_file_path, prvk_file_path, 'pss', sig_file_path)

4. Preload 

       vendor\mediatek\proprietary\bootable\bootloader\preloader\platform\mt6xxx\src\core\partition.c

       vendor\mediatek\proprietary\bootable\bootloader\preloader\platform\mt6xxx\src\core\partition.c

       vendor/mediatek/proprietary/bootable/bootloader/lk/target/k71v1_64_bsp/inc/oemkey.h

       seclib_set_pubk(g_oemkey, OEM_PUBK_SZ);

       vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6771/src/security/sec.c:  

         seclib_set_pubk(g_oemkey, OEM_PUBK_SZ);

 

static void lk_vb_vfy_dtbo(void)
{
#ifdef MTK_SECURITY_SW_SUPPORT
    PROFILING_START("dtbo vfy");
    if (0 != img_auth_stor(get_dtbo_part_name(), "dtbo", 0x0))
        assert(0);

 

5、下载 DA文件

       vendor/mediatek/proprietary/scripts/secure_chip_tools/resign_da.py

      可以对DA文件重签名，有你意想不到的效果！！

       #sign all load regions of the specified chip
     python resign_da.py prebuilt/resignda/MTK_AllInOne_DA.bin MT6755 settings/resignda/bbchips_pss.ini all               out/resignda/MTK_AllInOne_DA.bin-resign
      #sign only the specified load region of the specified chip, e.g. 0
     python resign_da.py prebuilt/resignda/MTK_AllInOne_DA.bin MT6755 settings/resignda/bbchips_pss.ini 0 out/resignda/MTK_AllInOne_DA.bin-resign