Tamper-proof firmware and lock parameters on CubePilot CubeOrange

Install necessary tools:

sudo apt-get update

sudo apt-get install git python3 python3-pip

pip3 install empy

sudo apt install git

sudo apt install python3-pip

sudo apt install cmake

sudo apt install libgstreamer1.0-dev

sudo apt install libgstreamer-plugins-base1.0-dev

sudo apt install python3-wxgtk4.0

sudo apt install python3-matplotlib

sudo apt install python3-opencv

sudo apt install python3-yaml

sudo apt install libgeographic-dev

sudo apt install libtinyxml2-dev

sudo apt install libeigen3-dev

sudo apt install libxml2-dev

sudo apt install libsqlite3-dev

sudo apt install libboost-all-dev

sudo apt install gcovr

sudo apt install lcov

pip3 install --user future

pip3 install --user lxml

pip3 install --user pymavlink

pip3 install --user mavproxy

Clone the ArduPilot repository to your local machine:

Install some required packages

  • Tools/environment_install/install-prereqs-ubuntu.sh -y
  • . ~/.profile

LOCK PARAMETERS IN THE CUBE ORANGE

Add the @READONLY flag to the parameters you want to lock in VS Code.

For example:

PARAM_DEFINE_FLOAT(PARAM_NAME, default_value, @READONLY);

Or

Set parameter lock password In the MAVProxy console, type:

param set LOCK_PARAM 1

param set LOCK_PASS your_secret_password

Replace “yoursecretpassword” with a strong password of your choice.

Lock specific parameters To lock a parameter (replace PARAM_NAME with the actual parameter name):

param lock PARAM_NAME

Save parameters

param save

Reboot the Cube Orange

Reboot

Flash the updated firmware that contains the locked parameters

Generate your public-private key pairs using the following command if private key already ready then skip the following steps

python3 -m pip install pymonocypher

Tools/scripts/signing/generate_keys.py NAME

this will generate pair of security keys, public and private

Tools/scripts/build_bootloaders.py CubeOrange --signing-key=NAME_public_key.dat

./waf configure --board CubeOrange --signed-fw

./waf copter

./Tools/scripts/signing/make_secure_fw.py build/CubeOrange/bin/arducopter.apj NAME_private_key.dat

OR

./waf configure --board CubeOrange --signed-fw --private-key NAME_private_key.dat

Upload firmware to connected CubeOrange

./waf copter –upload

Use MAVProxy to flash the signed bootloader:

mavproxy.py --master=/dev/ttyUSB0 --baud=115200

In the MAVProxy console, enter:

flashbootloader

OR

firmware load <path_to_signed_bootloader>

After flashing, verify that the new secure bootloader is installed:

mavproxy.py --master=/dev/ttyUSB0 --baud=115200

Check the bootloader version by entering:

status

Open the parameter definitions in the ArduPilot source code.

Connect to the Cube Orange and check the parameters:

param show PARAM_NAME

CAUTION

Follow these steps carefully; incorrect procedures can render the autopilot inoperative.

Attempt to modify the locked parameters to ensure they are indeed read-only.

Always keep backups of your original firmware and bootloader.

hello,

not bad… except step2 and step3 that are wrong. Please just install git and use install-prereqs-ubuntu.sh to get the right dependency.
specially sudo apt install gcc-arm-none-eabi is tottally wrong, untested and most of the time broken

i suggest you to use Ubuntu 18.04

where do this comes from ? ubuntu 18.04 is deprecated since long time. Please use ubuntu 22.04