USB Armory MkII Tutorial 3
Published:
How to Use USB Armory Mk II (Part 3: Bare-Metal Execution)
We don’t always need operating system support to run a program. For example, you can interface with USB Mass Storage directly.
Loading a Single Program to USB Armory Mk II
Without the SD card, here’s how the host identifies the USB Armory:
$ lsusb
Bus 001 Device 020: ID 0403:6011 Future Technology Devices International, Ltd FT4232H Quad HS USB-UART/FIFO IC
Bus 001 Device 044: ID 15a2:0080 Freescale Semiconductor, Inc. SE Blank 6ULL
This message indicates that the Mk II is in Serial Download Protocol (SDP) mode. Let’s flash a program onto the USB Armory using armory-ums. This TamaGo-based unikernel enables USB Mass Storage interfacing for both the USB Armory Mk II’s internal eMMC card and any inserted external microSD card.
Before jumping into the loading process, let’s discuss the tool used to load the executable image.
armory-boot
This tool implements a minimal version of the Serial Download Protocol (SDP), used on NXP i.MX SoC application processors, to load an executable image over USB. It is aimed at USB Armory Mk II users but should work with all i.MX series SoCs that support USB HID-based SDP.
The mfgtools and imx_usb_loader projects also offer similar functionality.
To install armory-boot, follow the instructions on the official GitHub page: armory-boot-usb. If you download, compile, and install the utility under your GOPATH, you can run the following command:
go install github.com/usbarmory/armory-boot/cmd/armory-boot-usb@latest
On my machine, I invoke the tool like this:
sudo $HOME/go/bin/armory-boot-usb -i armory-ums.imx
Alternatively you can manually compile it from source:
git clone https://github.com/usbarmory/armory-boot
cd armory-boot && make armory-boot-usb
TamaGo compiler
We need the TamaGo compiler to build the armory-ums.imx
application executable. To build the TamaGo compiler (or use the latest binary release), run the following:
wget https://github.com/usbarmory/tamago-go/archive/refs/tags/latest.zip
unzip latest.zip
cd tamago-go-latest/src && ./all.bash
cd ../bin && export TAMAGO=`pwd`/go
Now, build the armory-ums.imx
application executable:
git clone https://github.com/usbarmory/armory-ums && cd armory-ums
make CROSS_COMPILE=arm-none-eabi- imx
The original Makefile had an issue with the TAMAGO_PATH
. I modified it to use the absolute path. You can check the updated Makefile here.
Verify
When you run the following command:
sudo armory-boot-usb -i armory-ums.imx
You should see the following output, indicating that the program was flashed successfully:
found device 15a2:0080 Freescale Semiconductor Inc SE Blank 6ULL
parsing armory-ums.imx
loading DCD at 0x00910000 (952 bytes)
loading imx to 0x9000f400 (2182144 bytes)
jumping to 0x9000f400
serial download complete
On the host machine, verify the flash process by running _lsblk_
. You should see a new block device, sda
, with a size of approximately 14 GB.