User Guide - nxpimage#

This user guide describes how to use nxpimage application. nxpimage is a tool for generating TrustZone, Master Boot Image and Secure Binary images. This tool is used to create various kind of NXP images.

Refer to the Executable Images, Secure update, Bootable Image for more information.

Command line interface#

nxpimage#

NXP Image tool.

Manage various kinds of images for NXP parts. It’s successor of obsolete ELFTOSB tool.

nxpimage [OPTIONS] COMMAND [ARGS]...

Options

-v, --verbose#

Print more detailed information

-vv, --debug#

Display more debugging information.

--version#

Show the version and exit.

--help#

Show this message and exit.

ahab#

Group of sub-commands related to AHAB.

nxpimage ahab [OPTIONS] COMMAND [ARGS]...
certificate#

Group of sub-commands related to AHAB certificate blob.

nxpimage ahab certificate [OPTIONS] COMMAND [ARGS]...
export#

Generate AHAB Certificate Blob from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage ahab certificate export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

-o, --output <output>#

Required Path to a file, where to store the output.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

get-template#

Create template of configuration in YAML format.

nxpimage ahab certificate get-template [OPTIONS]

Options

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

parse#

Parse AHAB Certificate Blob.

nxpimage ahab certificate parse [OPTIONS]

Options

-b, --binary <binary>#

Required Path to binary AHAB Certificate blob image to parse.

-s, --srk_set <srk_set>#

SRK set that has been used for certificate.

Options:

oem | nxp

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

export#

Generate AHAB Image from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage ahab export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage ahab get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt118x

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

parse#

Parse AHAB Image into YAML configuration and binary images.

nxpimage ahab parse [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt118x

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

-b, --binary <binary>#

Required Path to binary AHAB image to parse.

-k, --dek <dek>#

Data encryption key, if it’s specified, the parse method tries decrypt all encrypted images. It could be specified as binary/HEX text file path or directly HEX string

re-sign#

Re-sign the container in AHAB image.

nxpimage ahab re-sign [OPTIONS]

Options

-f, --family <family>#

Required Select the chip family.

Options:

mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt118x

-b, --binary <binary>#

Required Path to binary AHAB image to update.

-k, --pkey <pkey>#

Path to private key or signature provider configuration used for signing.

-i, --container-id <container_id>#

Required ID of the container where the keyblob will be replaced.

-m, --mem-type <mem_type>#

Select memory type. Only applicable for bootable images (image containing FCB or XMCD segments). Do not use for raw AHAB image

Options:

serial_downloader | recovery_spi | semc_nor | recovery_spi_mbi | internal | recovery_spi_hab | semc_nand | flexspi_nor | recovery_spi_sb31 | mmc | flexspi_nand | recovery_spi_sb21 | emmc | sd

update-keyblob#

Update keyblob in AHAB image container.

nxpimage ahab update-keyblob [OPTIONS]

Options

-f, --family <family>#

Required Select the chip family.

Options:

mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt118x

-b, --binary <binary>#

Required Path to binary AHAB image to update.

-k, --keyblob <keyblob>#

Required Path to keyblob that will be inserted into AHAB Image

-i, --container-id <container_id>#

Required ID of the container where the keyblob will be replaced.

-m, --mem-type <mem_type>#

Select memory type. Only applicable for bootable images (image containing FCB or XMCD segments). Do not use for raw AHAB image

Options:

serial_downloader | recovery_spi | semc_nor | recovery_spi_mbi | internal | recovery_spi_hab | semc_nand | flexspi_nor | recovery_spi_sb31 | mmc | flexspi_nand | recovery_spi_sb21 | emmc | sd

verify#

Verify AHAB Image.

nxpimage ahab verify [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt118x

-b, --binary <binary>#

Required Path to binary AHAB image to parse.

-p, --problems#

Show just problems in image.

-k, --dek <dek>#

Data encryption key, if it’s specified, the parse method tries decrypt all encrypted images. It could be specified as binary/HEX text file path or directly HEX string

bee#

Group of sub-commands related to BEE.

nxpimage bee [OPTIONS] COMMAND [ARGS]...
export#

Generate BEE Images from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage bee export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage bee get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

rt1010 | rt1015 | rt102x | rt104x | rt105x | rt106x

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

bootable-image#

Group of bootable image utilities.

nxpimage bootable-image [OPTIONS] COMMAND [ARGS]...
fcb#

FCB (Flash Configuration Block) utilities.

nxpimage bootable-image fcb [OPTIONS] COMMAND [ARGS]...
export#

Export FCB Image from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-templates’.

nxpimage bootable-image fcb export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

-o, --output <output>#

Required Path to a file, where to store the output.

get-templates#

Create template of configurations in YAML format for all memory types.

The template files folder name is specified as argument of this command.

nxpimage bootable-image fcb get-templates [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

lpc553x | lpc55s3x | mcxn54x | mcxn94x | mcxn9xx | rt1010 | rt1015 | rt102x | rt104x | rt105x | rt106x | rt116x | rt117x | rt118x | rt5xx | rt6xx | rw61x

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

--force#

Force overwriting of existing files.

parse#

Parse FCB Image into YAML configuration.

nxpimage bootable-image fcb parse [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

lpc553x | lpc55s3x | mcxn54x | mcxn94x | mcxn9xx | rt1010 | rt1015 | rt102x | rt104x | rt105x | rt106x | rt116x | rt117x | rt118x | rt5xx | rt6xx | rw61x

-m, --mem-type <mem_type>#

Required Select the chip used memory type.

Options:

flexspi_nor | xspi_nor

-b, --binary <binary>#

Required Path to binary FCB image to parse.

-o, --output <output>#

Required Path to a file, where to store the output.

get-templates#

Create template of configurations in YAML format from all memory types.

The template files folder name is specified as argument of this command.

nxpimage bootable-image get-templates [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

lpc550x | lpc551x | lpc552x | lpc553x | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt1010 | rt1015 | rt102x | rt104x | rt105x | rt106x | rt116x | rt117x | rt118x | rt5xx | rt6xx | rw61x

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

--force#

Force overwriting of existing files.

merge#

Merge boot image blocks into one bootable image.

The configuration template files could be generated by subcommand ‘get-templates’.

nxpimage bootable-image merge [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

-o, --output <output>#

Required Path to a file, where to store the output.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

parse#

Parse Bootable Image into YAML configuration and binary images.

nxpimage bootable-image parse [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

lpc550x | lpc551x | lpc552x | lpc553x | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt1010 | rt1015 | rt102x | rt104x | rt105x | rt106x | rt116x | rt117x | rt118x | rt5xx | rt6xx | rw61x

-m, --mem-type <mem_type>#

Select the chip used memory type.

Options:

serial_downloader | recovery_spi | semc_nor | recovery_spi_mbi | internal | recovery_spi_hab | semc_nand | flexspi_nor | recovery_spi_sb31 | mmc | flexspi_nand | recovery_spi_sb21 | emmc | sd

-b, --binary <binary>#

Required Path to binary Bootable image to parse.

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

xmcd#

XMCD (External Memory Configuration Data) utilities.

nxpimage bootable-image xmcd [OPTIONS] COMMAND [ARGS]...
export#

Export XMCD Image from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-templates’.

nxpimage bootable-image xmcd export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

-o, --output <output>#

Required Path to a file, where to store the output.

get-templates#

Create template of configurations in YAML format for all memory types.

The template files folder name is specified as argument of this command.

nxpimage bootable-image xmcd get-templates [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

rt116x | rt117x | rt118x

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

--force#

Force overwriting of existing files.

parse#

Parse XMCD Image into YAML configuration.

nxpimage bootable-image xmcd parse [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

rt116x | rt117x | rt118x

-b, --binary <binary>#

Required Path to binary XMCD image to parse.

-o, --output <output>#

Required Path to a file, where to store the output.

cert-block#

Group of sub-commands related to certification block.

nxpimage cert-block [OPTIONS] COMMAND [ARGS]...
export#

Generate Certificate Block from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage cert-block export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

-f, --family <family>#

Select the chip family.

Options:

k32w1xx | kw45xx | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mc56f818xx | mc56f81xxx | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mcxw71xx | mwct2xd2 | nhs52sxx | rt5xx | rt6xx | rw61x

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

get-isk-tbs#

Generate To-Be-Signed data for ISK Certificate created by NXP’s EdgeLock2GO service.

nxpimage cert-block get-isk-tbs [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

mc56f818xx | mc56f81xxx | mwct2xd2

-p, --public-key <public_key>#

Required Path to file with the ISK public key

-o, --output <output>#

Required Path to a file, where to store the output.

get-template#

Create template of configuration in YAML format.

nxpimage cert-block get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

k32w1xx | kw45xx | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mc56f818xx | mc56f81xxx | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mcxw71xx | mwct2xd2 | nhs52sxx | rt5xx | rt6xx | rw61x

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

parse#

Parse Certificate Block.

RoTKTH is printed out in verbose mode.

nxpimage cert-block parse [OPTIONS]

Options

-b, --binary <binary>#

Required Path to binary Certificate Block image to parse.

-f, --family <family>#

Select the chip family.

Options:

k32w1xx | kw45xx | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mc56f818xx | mc56f81xxx | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mcxw71xx | mwct2xd2 | nhs52sxx | rt5xx | rt6xx | rw61x

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

hab#

Group of sub-commands related to HAB container.

nxpimage hab [OPTIONS] COMMAND [ARGS]...
convert#

Convert BD Configuration to YAML.

EXTERNAL is a space separated list of external binary files defined in BD file

nxpimage hab convert [OPTIONS] [EXTERNAL]...

Options

-c, --command <command>#

Required BD configuration file for conversion to YAML

-o, --output <output>#

Required Path to a file, where to store the output.

Arguments

EXTERNAL#

Optional argument(s)

export#

Generate HAB container from configuration.

EXTERNAL is a space separated list of external binary files defined in BD file

nxpimage hab export [OPTIONS] [EXTERNAL]...

Options

-c, --command <command>#

Required BD or YAML configuration file to produce HAB container

-o, --output <output>#

Required Path to a file, where to store the output.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

Arguments

EXTERNAL#

Optional argument(s)

get-template#

Create template of configuration in YAML format.

nxpimage hab get-template [OPTIONS]

Options

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

-f, --family <family>#

Select the chip family.

Options:

rt1010 | rt1015 | rt102x | rt104x | rt105x | rt106x | rt116x | rt117x

parse#

Parse HAB container into individual segments.

nxpimage hab parse [OPTIONS]

Options

-b, --binary <binary>#

Required Path to binary HAB image to parse.

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

iee#

Group of sub-commands related to IEE.

nxpimage iee [OPTIONS] COMMAND [ARGS]...
export#

Generate IEE Images from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage iee export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage iee get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

rt116x | rt117x | rt118x

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

mbi#

Group of sub-commands related to Master Boot Images.

nxpimage mbi [OPTIONS] COMMAND [ARGS]...
export#

Generate Master Boot Image from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-templates’.

nxpimage mbi export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

get-templates#

Create template of MBI configurations in YAML format.

nxpimage mbi get-templates [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

k32w1xx | kw45xx | lpc550x | lpc551x | lpc552x | lpc553x | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mc56f816xx | mc56f817xx | mc56f818xx | mc56f81xxx | mcxa142 | mcxa143 | mcxa144 | mcxa145 | mcxa146 | mcxa152 | mcxa153 | mcxa154 | mcxa155 | mcxa156 | mcxa1xx | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mcxw71xx | mwct2x12 | mwct2xd2 | nhs52sxx | rt5xx | rt6xx | rw61x

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

--force#

Force overwriting of existing files.

parse#

Parse MBI Image into YAML configuration and binary images.

nxpimage mbi parse [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

k32w1xx | kw45xx | lpc550x | lpc551x | lpc552x | lpc553x | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mc56f816xx | mc56f817xx | mc56f818xx | mc56f81xxx | mcxa142 | mcxa143 | mcxa144 | mcxa145 | mcxa146 | mcxa152 | mcxa153 | mcxa154 | mcxa155 | mcxa156 | mcxa1xx | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mcxw71xx | mwct2x12 | mwct2xd2 | nhs52sxx | rt5xx | rt6xx | rw61x

-b, --binary <binary>#

Required Path to binary MBI image to parse.

-k, --dek <dek>#

Data encryption key, if it’s specified, the parse method tries decrypt all encrypted images. It could be specified as binary/HEX text file path or directly HEX string

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

otfad#

Group of sub-commands related to OTFAD.

nxpimage otfad [OPTIONS] COMMAND [ARGS]...
export#

Generate OTFAD Images from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage otfad export [OPTIONS]

Options

-a, --alignment <alignment>#

Alignment of key blob data blocks. Default value is 512 B if not specified.

-i, --index <index>#

OTFAD peripheral index - This is needed to generate proper indexes of fuses in optional BLHOST script. If not specified, BLHOST fuse script won’t be generated

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

get-kek#

Compute OTFAD KEK value and optionally store it into folder in various formats.

The computed OTFAD KEK is shown in hexadecimal text, if the ‘output-folder’ is specified, it is stored in folder also in binary format.

nxpimage otfad get-kek [OPTIONS]

Options

-m, --otp-master-key <otp_master_key>#

OTP MASTER KEY in hexadecimal format or file name to binary or text file with key.

-k, --otfad-key <otfad_key>#

OTFAD KEY (OTFAD KEK seed) in hexadecimal format or file name to binary or text file with key.

-f, --family <family>#

Optional family, if specified, the tool generates the BLHOST scripts to load key fuses. To use this feature, the ‘-o’ options has to be also defined!

Options:

mx93 | rt1010 | rt116x | rt117x | rt118x | rt5xx | rt6xx

-o, --output <output>#

Optional result output folder (otfad_kek.bin/txt, optionally BLHOST scripts to load keys into Fuses)

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage otfad get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

mx93 | rt1010 | rt116x | rt117x | rt118x | rt5xx | rt6xx

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

sb21#

Group of sub-commands related to Secure Binary 2.1.

nxpimage sb21 [OPTIONS] COMMAND [ARGS]...
convert#

Convert SB 2.1 BD file to YAML.

nxpimage sb21 convert [OPTIONS] [EXTERNAL]...

Options

-f, --family <family>#

Select the chip family.

Options:

lpc55s0x | lpc55s1x | lpc55s2x | lpc55s6x | nhs52sxx | rt5xx | rt6xx

-o, --output <output>#

Required Path to converted YAML configuration

-c, --command <command>#

Required Path to BD file that will be converted to YAML

-k, --key <key>#

Required Add a key file and enable encryption.

-s, --pkey <pkey>#

Path to private key or signature provider configuration used for signing.

-S, --cert <cert>#

Path to certificate files for signing. The first certificate will be the self signed root key certificate.

-R, --root-key-cert <root_key_cert>#

Path to root key certificate file(s) for verifying other certificates. Only 4 root key certificates are allowed, others are ignored. One of the certificates must match the first certificate passed with -S/–cert arg.

-h, --hash-of-hashes <hash_of_hashes>#

Path to output hash of hashes of root keys. If argument is not provided, then by default the tool creates hash.bin in the working directory.

Arguments

EXTERNAL#

Optional argument(s)

export#

Generate Secure Binary v2.1 Image from configuration.

EXTERNAL is a space separated list of external binary files defined in BD file

nxpimage sb21 export [OPTIONS] [EXTERNAL]...

Options

-c, --command <command>#

Required BD or YAML configuration file to produce secure binary v2.x

-o, --output <output>#

Path to a file, where to store the output.

-k, --key <key>#

Add a key file and enable encryption.

-s, --pkey <pkey>#

Path to private key or signature provider configuration used for signing.

-S, --cert <cert>#

Path to certificate files for signing. The first certificate will be the self signed root key certificate.

-R, --root-key-cert <root_key_cert>#

Path to root key certificate file(s) for verifying other certificates. Only 4 root key certificates are allowed, others are ignored. One of the certificates must match the first certificate passed with -S/–cert arg.

-h, --hash-of-hashes <hash_of_hashes>#

Path to output hash of hashes of root keys. If argument is not provided, then by default the tool creates hash.bin in the working directory.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

Arguments

EXTERNAL#

Optional argument(s)

get-sbkek#

Compute SBKEK (AES-256) value and optionally store it as plain text and as binary.

SBKEK is AES-256 symmetric key used for encryption and decryption of SB. Plain text version is used for SB generation. Binary format is to be written to the keystore. The same format is also used for USER KEK.

For OTP, the SBKEK is derived from OTP master key: SB2_KEK = AES256(OTP_MASTER_KEY, 03000000_00000000_00000000_00000000_04000000_00000000_00000000_00000000)

Master key is not needed when using PUF as key storage

The computed SBKEK is shown as hexadecimal text on STDOUT, SBKEK is stored in plain text and in binary if the ‘output-folder’ is specified,

nxpimage sb21 get-sbkek [OPTIONS]

Options

-k, --master-key <master_key>#

AES-256 master key as hexadecimal string or path to file containing key in plain text or in binary

-o, --output <output>#

Output folder where the sbkek.txt and sbkek.bin will be stored

get-template#

Create template of configuration in YAML format.

nxpimage sb21 get-template [OPTIONS]

Options

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

-f, --family <family>#

Select the chip family.

Options:

lpc55s0x | lpc55s1x | lpc55s2x | lpc55s6x | nhs52sxx | rt5xx | rt6xx

parse#

Parse Secure Binary v2.1 Image.

nxpimage sb21 parse [OPTIONS]

Options

-b, --binary <binary>#

Required Path to the SB2 container that would be parsed.

-k, --key <key>#

Required Key file for SB2 decryption in plaintext

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

sb31#

Group of sub-commands related to Secure Binary 3.1.

nxpimage sb31 [OPTIONS] COMMAND [ARGS]...
export#

Generate Secure Binary v3.1 Image from YAML/JSON configuration.

SB3KDK is printed out in verbose mode.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage sb31 export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage sb31 get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

k32w1xx | kw45xx | lpc55s3x | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mcxw71xx | rw61x

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

signed-msg#

Group of sub-commands related to Signed messages.

nxpimage signed-msg [OPTIONS] COMMAND [ARGS]...
export#

Generate Signed message Image from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage signed-msg export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

--plugin <plugin>#

External python file/package containing a custom plugin implementation.

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage signed-msg get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

mx8mn | mx8mp | mx8ulp | mx91 | mx93 | mx95 | rt118x

-m, --message <message>#

Select only one signed message to generate specific template if needed

Options:

KEYSTORE_REPROVISIONING_ENABLE_REQ | KEY_EXCHANGE_REQ | RETURN_LIFECYCLE_UPDATE_REQ | WRITE_SEC_FUSE_REQ

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

parse#

Parse Signed message Image into YAML configuration and binary images.

nxpimage signed-msg parse [OPTIONS]

Options

-b, --binary <binary>#

Required Path to binary Signed message image to parse.

-o, --output <output>#

Required Path to a directory, where to store generated/parsed files.

tz#

Group of sub-commands related to Trust Zone.

nxpimage tz [OPTIONS] COMMAND [ARGS]...
export#

Generate TrustZone Image from YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘get-template’.

nxpimage tz export [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage tz get-template [OPTIONS]

Options

-f, --family <family>#

Select the chip family.

Options:

k32w1xx | kw45xx | lpc55s0x | lpc55s1x | lpc55s2x | lpc55s3x | lpc55s6x | mcxn23x | mcxn54x | mcxn94x | mcxn9xx | mcxw71xx | nhs52sxx | rt5xx | rt6xx | rw61x

-r, --revision <revision>#

Chip revision; if not specified, most recent one will be used

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

utils#

Group of utilities.

nxpimage utils [OPTIONS] COMMAND [ARGS]...
binary-image#

Binary Image utilities.

nxpimage utils binary-image [OPTIONS] COMMAND [ARGS]...
align#

Align binary file to provided alignment and padded with specified pattern.

nxpimage utils binary-image align [OPTIONS]

Options

-i, --input-file <input_file>#

Required Binary file name to be aligned.

-o, --output <output>#

Aligned file name. If not specified, input file will be updated.

-a, --alignment <alignment>#

Alignment size.

-p, --pattern <pattern>#

Pattern of used padding (‘zeros’, ‘ones’, ‘rand’, ‘inc’ or any number value).

convert#

Convert input data file into selected format.

nxpimage utils binary-image convert [OPTIONS]

Options

-i, --input-file <input_file>#

Required Path to BIN/HEX/S19/ELF file to be converted.

-f, --format <output_format>#

Required Output format.

Options:

BIN | HEX | S19

-o, --output <output>#

Required Path to a file, where to store the output.

create#

Create binary file with pattern.

The helper utility to create simple binary file with pattern.

nxpimage utils binary-image create [OPTIONS]

Options

-s, --size <size>#

Required Size of file to be created.

-p, --pattern <pattern>#

Pattern of created file (‘zeros’, ‘ones’, ‘rand’, ‘inc’ or any number value).

-o, --output <output>#

Required Path to a file, where to store the output.

extract#

Extract chunk from binary file.

nxpimage utils binary-image extract [OPTIONS]

Options

-b, --binary <binary>#

Required Path to binary file to be used to extract chunk from.

-a, --address <address>#

Required Address of extracted chunk.

-s, --size <size>#

Required Size of extracted chunk. For ‘0’ it extract rest of the file from given address.

-o, --output <output>#

Required Path to a file, where to store the output.

get-template#

Create template of configuration in YAML format.

The template file name is specified as argument of this command.

nxpimage utils binary-image get-template [OPTIONS]

Options

-o, --output <output>#

Required Path to a file, where to store the output.

--force#

Force overwriting of existing files.

merge#

Merge binary images together by description in YAML/JSON configuration.

The configuration template files could be generated by subcommand ‘utils binary-image get-template’.

nxpimage utils binary-image merge [OPTIONS]

Options

-c, --config <config>#

Required Path to the YAML/JSON configuration file.

-o, --output <output>#

Required Path to a file, where to store the output.

pad#

Pad binary file to provided final size with specified pattern.

nxpimage utils binary-image pad [OPTIONS]

Options

-i, --input-file <input_file>#

Required Binary file name to be padded.

-o, --output <output>#

Padded file name. If not specified, input file will be updated.

-s, --size <size>#

Required Result file size.

-p, --pattern <pattern>#

Pattern of used padding (‘zeros’, ‘ones’, ‘rand’, ‘inc’ or any number value).

convert#

Conversion utilities.

nxpimage utils convert [OPTIONS] COMMAND [ARGS]...
bin2carr#

Convert binary file into C array string.

Default output is byte representation, but it could be converted to 16/32 or 64 bit unsigned types with specified endianness.

nxpimage utils convert bin2carr [OPTIONS]

Options

-i, --input-file <input_file>#

Required Path to binary file to be converted to C array.

-n, --name <name>#

The output C array name, if not specified the name of input file will be used.

-t, --type <output_type>#

The output C array type.

Options:

uint8_t | uint16_t | uint32_t | uint64_t

-e, --endian <endian>#

The binary input file endian.

Options:

big | little

-p, --padding <padding>#

The padding value in case of non aligned binary image.

-c, --count-per-line <count_per_line>#

The array items count per line.

--tab <tab>#

The tabulator size for new line.

-o, --output <output>#

Path to output text file with created C array, if not specified the output will be printed into standard output.

bin2hex#

Convert binary file into hexadecimal text file with optional reverse order of stored bytes.

nxpimage utils convert bin2hex [OPTIONS]

Options

-i, --input-file <input_file>#

Required Path to binary file with to be converted to hexadecimal text file.

-r, --reverse#

The result binary bytes will be stored in reverse order (for example SBKEK in elftosb this required).

-o, --output <output>#

Required Path to a file, where to store the output.

hex2bin#

Convert file with hexadecimal string into binary file with optional reverse order of stored bytes.

nxpimage utils convert hex2bin [OPTIONS]

Options

-i, --input-file <input_file>#

Required Path to text file with hexadecimal string to be converted to binary.

-r, --reverse#

The resulting binary bytes will be stored in reverse order (for example SBKEK in elftosb requires that).

-o, --output <output>#

Required Path to a file, where to store the output.