The custom structure offset is 0x120 = (sizeof(esp_image_header_t) + sizeof(esp_image_segment_header_t) + sizeof(esp_app_desc_t)).
I double-checked it; it is exactly at 0x120 from the start of the app binary. I do not see an issue with it. If you use `const char *my_custom_text`, then yes, the text ...

Hi!

At the first boot the bootloader revokes unused digest slots when unused (when the bootloader is signed only by one key). This action can be skipped if CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS is set. According to your log other digest slots, the SECURE_BOOT_KEY1 and SECURE_BOOT_KEY2, were ...

Hi @eitell!

There might be some solutions:
- an efuse block is already read-protected - Software can not read it anyway, so it is safe to keep it. If you still want to destroy data see below.
- an efuse block is write-protected - The data in this block can not be changed.
- an efuse block is not ...

Hi!
Sorry for the inconvenience. The name in the doc is DIS_PAD_JTAG, but in the IDF and espefuse.py it is HARD_DIS_JTAG (they point to the same efuse bit). Please use HARD_DIS_JTAG for now. We will fix it soon, so after that, both names will be available.

Hi!
Please take a look the github thread - https://github.com/espressif/esp-idf/issues/8810
You need to change the names in your custom_efuse_table.csv

USER_DATA.MODULE_VERSION, EFUSE_BLK3, 56, 8

Final efuse name - USER_DATA_MODULE_VERSION

Hi regiskiwi!
I have checked the branch that you used ESP-IDF v4.3-274-g75940e9364 in the first msg and I successfully run the Secure Boot V2 on esp32 eco3 (the first and the next boots are ok).

As I understand last your msg with the ESP-IDF v4.2 (you did not provide what exact version). I think ...

Hi regiskiwi!

It is hard to say what it is. I think.. it looks like the bootloader was corrupted. Th size of bootloader = 13124+20616+4104 = 0x93D4 + 0x1000 (offset) = 0xA93D4 => round up 0xB000 => + signature block => 0xC000. Your partition offet is 0xE000 (looks good).


verifying bootloader:
D ...

Hi sripad!

I am able to see the same log as here ` secure_boot_v1: image has invalid signature version field 0xffffffff`. This happens when you try to provide not a signed app to OTA server.
- disable "Sign binaries during build"
- provide `Secure boot public signature verification key ...

Hi NotMyRealName!

NOTE: I have it configured to launch the test app from a GPIO pin boot, but as the default behavior is to run the test app if no other partitions are found this is a bit of a security hole. You could very easily force running insecure code by corrupting or loading invalid code ...

Hi @halilarkl07!
I tried your code and can not get the same result as you reported (it works as expected). I used the hello_world example as a base and put your code. I suggest you try my way, apply the hello_world_patch.txt patch for hello_world. The log like this:

tv_now.tv_sec 0
PRId64 tv_now.tv ...