Firmware Verification

How FirmHub verifies firmware integrity before flashing.

Checksum Validation

Before flashing, FirmHub calculates a SHA-256 hash of the firmware file and compares it against known-good values for firmware from the library.

Detects corrupted downloads
Prevents modified firmware
Ensures version matches

Verify firmware manually

shasum -a 256 firmware.bin

Flash Verification

After flashing, FirmHub can read back the flash contents and verify they match the source file.

Verify flash contents

esptool.py --chip esp32 --port /dev/ttyUSB0 verify_flash 0x10000 firmware.bin

Enable "Verify after flash" in FirmHub settings for automatic verification. This adds a few seconds to the flash process but confirms successful write.

ESP32 Secure Boot

ESP32 supports hardware-level secure boot to prevent unauthorized firmware:

• Secure Boot V1: RSA-3072 signature verification
• Secure Boot V2: ECDSA signature verification (ESP32-S2/S3/C3)
• Flash Encryption: AES-256 encryption of flash contents

Warning: Enabling secure boot is a one-way operation. Once enabled, only signed firmware can be flashed. This cannot be reversed.