Encrypt mpy files

[JessicaMBG]

Can I encrypt the file system and keep running my code as my flash is encrypted?
I am willing to encrypt the firmware of a ESP32 WROVER for security purposes but I am not using the ESP IDF. I built my codes, compiled into mpy, and embedded them using ampy. The main.py should keep the routine running, but once I turn on the encryption It does not
From what I've seen, the files to access the built-in libs should also be encrypted or It won't be able to access data, correct me if I'm wrong, please
So the whole problem is: I need the scripts to keep running after I encrypt the flash memory, How do I do that?

Would appreciate any help :)

[sam0910]

I am not sure it might help, #8706
IWhat about freezing the code you need a security into firmware and encrypt?
instead of compiling mpy and using ampy .

[JessicaMBG]

Hi! I'm actually doing that with a few codes, but how do I make it run?
It might be a dumb question but anything that I put on my main.py does not seem to run once I turn on the encryption :/

[peterhinch]

@JessicaMBG If you do a search of the old forum you will find multiple discussions of protecting source code.

[JessicaMBG]

I've taken a look on the forum before but didn't find something like what I'm looking for. Maybe I just couldn't search correctly (╥﹏╥)

[shariltumin]

I assume you have an encrypted mpy file in your Flash VFS, say 'xx.mpz'. What you are asking is how to import xx from the `xx.mpz' file.

What we need to do is:

1. decrypt 'xx.mpz' to 'xx.mpy'
2. save 'xx.mpy' to "something"
3. from "something" do import xx

Now this "something" must be a VFS. There was a post in stackoverflow that told us how to do this, where this "something" is a RAM-based VFS.

https://stackoverflow.com/questions/69153584/in-micropython-how-do-i-load-a-module-from-a-string

This may be a solution to your problem without the need to encrypt the entire flash drive.

[JessicaMBG]

I actually encrypted my flash memory, my codes are not encrypted except for those I've built in the firmware. The problem is that when I turn on the flash encryption my code stops running, I've seen something about saying that my codes should be encrypted as well in order to have access to the memory, but I don't know exactly how to do that
I guess my text was not that self-explaining, I'm sorry

[shariltumin]

You said you were encrypting the flash file system and not using the ESP IDF to do the encryption. How did you do the encryption?

The MicroPython 'main.c' boot process needs to be able to find 'main.py' from the flash file system in order to run it.

    // run boot-up scripts
    pyexec_frozen_module("_boot.py", false);
    pyexec_file_if_exists("boot.py");
    if (pyexec_mode_kind == PYEXEC_MODE_FRIENDLY_REPL) {
        int ret = pyexec_file_if_exists("main.py");
        if (ret & PYEXEC_FORCED_EXIT) {
            goto soft_reset_exit;
        }
    }

If the boot process does not find main.py, you will get REPL. Do you get REPL after booting?

If you have the REPL, can you do os.listdir() and see that 'main.py' is listed?

[JessicaMBG]

I definitely made my text confusing.
My main goal is to encrypt the flash memory and I am doing that using espefuse.py, when I say I'm not using the IDF is that I'm not building a project, all my code are compiled Into mpy and uploaded using ampy.
When I run my embedded code without turning on the flash encryption, the code runs perfectly, and the main.py is there
When I turn the flash encryption, the code stops and I don't have access to the REPL then
I looked for It and found that It may be because my codes also have to be encrypted with the same key to access the data from flash, and since I don't want to use a pre-generated key, I tried enabling the encryption of the file system as well
None of that worked

I tried to be brief and made myself incomprehensible, sorry.

[littlegreenbean33]

have you found a solution ? I am trying to encrypt my flash, via project using idf and the micropython tree.

I am unable to get encryption activated via menuconfig. somehow the sdkconfig parameters do not get into my custom build of micropython ? bootloader ?

Any hints appreciated

Thanks

JC