I'd like to ask your help to understand the algorithm used to encrypt these hex/bin firmware (for an ARM-Cortex M4 microcontroller).
In the tar file above you can find different firmware versions. In particular, the V16 version has been released encrypted, plain and also an encrypted TE version (I don't know what does TE mean).
It has been a while since I started to analyze these files (I also asked another question here in the past) but, so far, I didn't find the solution. I tried to invert the bytes, swap the nibbles, xor but no luck.
As you can see, the encrypted version is 276 bytes longer than the plain. I expect that in those bytes are defined the header/footer and the key sections used by the bootloader to decrypt the binary before flashing.
Personally I think that a simple algorithm has been used (something like Salsa20 or ChaCha), nothing complicated (SHA, etc.). Thank you.