As part of my work for Continental/Bertrandt, I developed and maintained a specialized toolchain for securing firmware images for automotive control units. The focus was on the integrity and authenticity of the delivered software components.
The Challenge
In modern vehicles, firmware updates must be safely installed via various interfaces (OTA, workshop tester). It must be ensured that:
- The firmware comes from an authorized source (Authenticity).
- The firmware was not modified on the way to the control unit (Integrity).
- Sensitive code areas are protected against reverse engineering (Confidentiality).
The Solution: adas_rbin_tools
The core of the work was the development and maintenance of adas_rbin_tools, a Python-based suite for transforming and signing binary data.
1. elf2rbin: Structured Security
The tool transforms ELF files (Executable and Linkable Format) into the proprietary RBIN format.
- Section-based Encryption: Using a JSON configuration, individual sections (e.g.,
.text,.rodata) could be selectively encrypted. - Cryptographic Standards: Support for AES (128, 192, 256 Bit) in various modes such as CBC, CTR and OFB.
- Key Management: Integration of Profile-IDs for assigning the correct cryptographic keys in the target system (HSM).
2. rbins2muco: Multi-Component Images
For complex systems with multiple processor cores (Multi-Core), the MUCO format (Multi-Component) was used. rbins2muco allows aggregating multiple RBIN files into a consistent overall image including a global header and checksums.
3. Diversity of Input Formats
In addition to ELF files, other industry standards were also supported:
- xpar2rbin: Conversion of MOT files (Motorola S-Record).
- rprc2rbin: Support for Texas Instruments RPRC format.
Result
The toolchain was firmly integrated into the CI/CD process (Jenkins). Automated validation scripts (validate.py) ensured that every generated image met the specifications before entering the release pipeline. This minimizes the risk of “bricks” (unusable hardware due to faulty firmware) and increases the security of the entire vehicle fleet.