Encrypt mpy files

[JessicaMBG]

Can I encrypt the file system and keep running my code as my flash is encrypted?
I am willing to encrypt the firmware of a ESP32 WROVER for security purposes but I am not using the ESP IDF. I built my codes, compiled into mpy, and embedded them using ampy. The main.py should keep the routine running, but once I turn on the encryption It does not
From what I've seen, the files to access the built-in libs should also be encrypted or It won't be able to access data, correct me if I'm wrong, please
So the whole problem is: I need the scripts to keep running after I encrypt the flash memory, How do I do that?

Would appreciate any help :)

[sam0910]

I am not sure it might help, #8706
IWhat about freezing the code you need a security into firmware and encrypt?
instead of compiling mpy and using ampy .

[JessicaMBG]

Hi! I'm actually doing that with a few codes, but how do I make it run?
It might be a dumb question but anything that I put on my main.py does not seem to run once I turn on the encryption :/

[peterhinch]

@JessicaMBG If you do a search of the old forum you will find multiple discussions of protecting source code.

[JessicaMBG]

I've taken a look on the forum before but didn't find something like what I'm looking for. Maybe I just couldn't search correctly (╥﹏╥)

[shariltumin]

I assume you have an encrypted mpy file in your Flash VFS, say 'xx.mpz'. What you are asking is how to import xx from the `xx.mpz' file.

What we need to do is:

1. decrypt 'xx.mpz' to 'xx.mpy'
2. save 'xx.mpy' to "something"
3. from "something" do import xx

Now this "something" must be a VFS. There was a post in stackoverflow that told us how to do this, where this "something" is a RAM-based VFS.

https://stackoverflow.com/questions/69153584/in-micropython-how-do-i-load-a-module-from-a-string

This may be a solution to your problem without the need to encrypt the entire flash drive.

[JessicaMBG]

I definitely made my text confusing.
My main goal is to encrypt the flash memory and I am doing that using espefuse.py, when I say I'm not using the IDF is that I'm not building a project, all my code are compiled Into mpy and uploaded using ampy.
When I run my embedded code without turning on the flash encryption, the code runs perfectly, and the main.py is there
When I turn the flash encryption, the code stops and I don't have access to the REPL then
I looked for It and found that It may be because my codes also have to be encrypted with the same key to access the data from flash, and since I don't want to use a pre-generated key, I tried enabling the encryption of the file system as well
None of that worked

I tried to be brief and made myself incomprehensible, sorry.

[littlegreenbean33]

have you found a solution ? I am trying to encrypt my flash, via project using idf and the micropython tree.

I am unable to get encryption activated via menuconfig. somehow the sdkconfig parameters do not get into my custom build of micropython ? bootloader ?

Any hints appreciated

Thanks

JC

[littlegreenbean33]

MY issues was eventually resolved using idf.py -B build to pint to the right build tree. A few fuse burns and bootloader is encrypted and signed, micropython is encrypted and signed and flash content is encrypted. Let me know if you have any issues with this. However, little protection if you can't disable REPL.

[RoboSergey]

@littlegreenbean33 when you say flash content you mean vfs partition? if yes how _boot.py mounted this encrypted file system I am confused. Can you share little more how you did it?

[littlegreenbean33]

Please see the thread in discord / micropython /esp32. I have provided the full command sequence.

I encrypt bootloader, partition table and micropython. Then I encrypt the partitions ( which I have a specific set of partitions).
You can then upload your encrypted partitions (including VFS) with your files.

I do disable REPL as well. So the only way to exchange data with the flash is via downloading encrypted partitions, decrypt, mount ,locally, do changes, unmount, encrypt, upload again via esptool.

https://discord.com/channels/574275045187125269/952412628926472273