...
MCUXpresso Secure Provisioning Tool - version 3.1.Command Prompt (cmd.exe)4.0.
\uD83D\uDCD8 Instructions
MCUXpresso Secure Provisioning Tool
Open MCUXpresso Secure Provisioning Tool. You can download the latest software version from here: https://www.nxp.com/design/software/development-software/mcuxpresso-software-and-tools-/mcuxpresso-secure-provisioning-tool:MCUXPRESSO-SECURE-PROVISIONING
Create a New Workspace. The Workspace will contain the keys, certificates, source file, boot file and configuration settings.
...
Select the path for the New Workspace, Series and Processor. Choose “Create”.
...
Select the Boot Type. Only the "Signed", "Encrypted (PRINCE) with CRC", and "Encrypted (PRINCE) and Signed" options generate a Secure Binary file.
...
After selecting the boot image type, generate/add the necessary certificates/keys. Choose “Keys Management”“PKI managment”.
...
Select "Add keys", "Generate keys" or "Import keys" depending on your needs.
...
on the PKI managment page.
...
When the configuration is complete, click “Generate”.
...
Once the keys have been generated/added, return to page one. Choose “Bulid image”.
...
Generate randomly or enter your SBKEK. SBKEK is necessary to decrypt secure binary file.
...
...
If you want to enable an additional security option, you can select the “PFR Configuration”.
...
Additional configuration data and additional security can be set in the "CFPA" and "CMPA" windows. Confirm the changes by clicking the “OK” button.
...
Click "Bulid Image" button. Now there is a Secure Binary file in the bootable_images folder in the workspace.
...
2. Command Prompt (cmd.exe)
Open Command Prompt.
Point to the location of the pfr.exe file. By default, it is installed in the folder with the given path: "C:\NXP\MCUX_Provi_v3.1\bin\tools\spsdk\".
...
Run pfr.exe with the appropriate command (Use your own file path with workspace!):
pfr.exe generate-binary -c "C:\..\gen_sb\cmpa.json" -o "C:\..\gen_sb\cmpa_sealed.bin" -a -e "C:\..\gen_sb\mbi_config.json"
pfr.exe generate-binary -c "C:\..\gen_sb\cmpa.json" -o "C:\..\gen_sb\cmpa_non_sealed.bin" -e "C:\..\gen_sb\mbi_config.json"
pfr.exe generate-binary -c "C:\..\gen_sb\cfpa.json" -o "C:\..\gen_sb\cfpa.bin"
...
The necessary files can be found:
...