MCUboot image inspector

Drop zephyr.signed.bin, or any image signed with imgtool, to see what MCUboot will see: the version, the size, every TLV, whether the hash matches and which key signed it, with a warning when that key is one of the development keys published with MCUboot.

What it checks

• The header: magic, header size, image size, flags (encrypted, compressed, RAM load) and the version as major.minor.revision+build.
• The hash: recomputed over the header, the code and the protected TLVs, and compared with the SHA-256 (or 384, 512) TLV, as MCUboot does before booting.
• The signature: its type (ECDSA P-256, P-384, Ed25519, RSA) and the key hash, compared with MCUboot's root-*.pem development keys.
• The slot: whether the image fits, with room for the swap trailer.

The same as imgtool dumpinfo, plus the checks. The image stays in your browser. Why the development key matters.

Sending it to devices

Pinscope takes zephyr.signed.bin from the dashboard to devices anywhere, checks it is an MCUboot image first, and confirms it only when the new firmware is back online.

Try it

Three devices are free, and no card is needed. Create an account, or read the guide for your platform: ESP32, Zephyr, Raspberry Pi Pico, Linux, ESP8266.

More

• Remote access to an ESP32 without TLS: what it measured and what it costs
• Serial monitor in the browser for ESP32 and Zephyr, with crash decoding
• Pinscope now runs on Zephyr, Raspberry Pi Pico, Linux and ESP8266
• Zephyr devices in the field: logs, crashes and OTA over the internet
• Reading a Zephyr fatal error: fault, reason, CFSR and call trace
• MCUboot: are your images signed with the public development key?
• Zephyr fatal error decoder
• Cortex-M HardFault decoder
• UF2 converter and inspector
• Zephyr flash partition checker
• Memfault vs Pinscope: which one fits
• Golioth vs Pinscope: which one fits
• nRF Cloud vs Pinscope: which one fits
• Memfault, Golioth, nRF Cloud and Pinscope compared