USB Armory MkII Tutorial 3

How to Use USB Armory Mk II (Part 3: Bare-Metal Execution)

We don’t always need operating system support to run a program. For example, you can interface with USB Mass Storage directly.

Loading a Single Program to USB Armory Mk II

Without the SD card, here’s how the host identifies the USB Armory:

$  lsusb
Bus  001  Device  020:  ID  0403:6011  Future  Technology  Devices  International,  Ltd  FT4232H  Quad  HS  USB-UART/FIFO  IC
Bus  001  Device  044:  ID  15a2:0080  Freescale  Semiconductor,  Inc.  SE  Blank  6ULL

This message indicates that the Mk II is in Serial Download Protocol (SDP) mode. Let’s flash a program onto the USB Armory using armory-ums. This TamaGo-based unikernel enables USB Mass Storage interfacing for both the USB Armory Mk II’s internal eMMC card and any inserted external microSD card.

Before jumping into the loading process, let’s discuss the tool used to load the executable image.

armory-boot

This tool implements a minimal version of the Serial Download Protocol (SDP), used on NXP i.MX SoC application processors, to load an executable image over USB. It is aimed at USB Armory Mk II users but should work with all i.MX series SoCs that support USB HID-based SDP.

The mfgtools and imx_usb_loader projects also offer similar functionality.

To install armory-boot, follow the instructions on the official GitHub page: armory-boot-usb. If you download, compile, and install the utility under your GOPATH, you can run the following command:

go install github.com/usbarmory/armory-boot/cmd/armory-boot-usb@latest

On my machine, I invoke the tool like this:

sudo $HOME/go/bin/armory-boot-usb -i armory-ums.imx

Alternatively you can manually compile it from source:

git clone https://github.com/usbarmory/armory-boot
cd armory-boot && make armory-boot-usb

TamaGo compiler

We need the TamaGo compiler to build the armory-ums.imx application executable. To build the TamaGo compiler (or use the latest binary release), run the following:

wget https://github.com/usbarmory/tamago-go/archive/refs/tags/latest.zip
unzip latest.zip
cd tamago-go-latest/src && ./all.bash
cd ../bin && export TAMAGO=`pwd`/go

Now, build the armory-ums.imx application executable:

git clone https://github.com/usbarmory/armory-ums && cd armory-ums
make CROSS_COMPILE=arm-none-eabi- imx

The original Makefile had an issue with the TAMAGO_PATH. I modified it to use the absolute path. You can check the updated Makefile here.

Verify

When you run the following command:

sudo armory-boot-usb -i armory-ums.imx

You should see the following output, indicating that the program was flashed successfully:

found device 15a2:0080 Freescale Semiconductor Inc SE Blank 6ULL
parsing armory-ums.imx
loading DCD at 0x00910000 (952 bytes)
loading imx to 0x9000f400 (2182144 bytes)
jumping to 0x9000f400
serial download complete

On the host machine, verify the flash process by running _lsblk_. You should see a new block device, sda, with a size of approximately 14 GB.