Download CycloneBOOT

Secure Bootloader source code by version

Both Open Source and Evaluation packages of CycloneBOOT can be obtained from this page.

Note: These packages also include CycloneTCP (TCP/IP stack), CycloneSSL (TLS library), CycloneSSH (SSH library with SFTP protocol) and various third-party software (BSP drivers, HAL layers, RTOS, etc.) for demonstration purpose.


CycloneBOOT Release History

This section provides version history and main changes.

VersionDateLinksChanges
2.6.0Feb. 09, 2026Open | Eval
New
  • Added application firmware verification performed on every boot by the second-stage bootloader, using digital signatures (ECDSA or RSA) or integrity checks (SHA-1/SHA-2)
  • Added signature key generation support to the ImageBuilder tool
  • Added demo projects for STM32H573I-DK showcasing new Secure Boot features and the use of UART/Y-Modem, USB-CDC, or HTTPS client protocols
Improvements
  • Added support for the HMAC-DRBG algorithm for random number generation, in addition to Yarrow
Bug Fixes
  • Fixed bugs in the Mailbox API related to encryption key retrieval
2.5.4Sept. 26, 2025Open | Eval
New
  • Added support for multi-stage bootloader architecture, including an optional immutable first-stage bootloader to enable updatability of the second stage
  • Added support for standalone bootloader mode, enabling the bootloader to manage the entire firmware update process including reception, validation, and installation
  • Added support for "last operation" flag so that the application can detect a fallback operation or a successful firmware update
  • Added demo projects to showcase new update scenarios:
    • Multi-stage bootloader demo on NUCLEO-L476RG using UART/Y-Modem protocol
    • Standalone bootloader demo on STM32H750B-DK using UART/Y-Modem protocol
Improvements
  • Added support for complex firmware versions
  • Fixed an edge case in fallback operation (fallback with both the current app and its backup corrupted)
  • Fixed an incorrect loop termination bug in STM32H5 internal flash driver
  • Extended user callback code and hook functions to intercept various second stage bootloader operations
  • Introduced C++ guards in header files for mixed-language projects
  • Refined demo project structure and naming (hybrid_app_bl, iap_dual_bank, standalone_bl) for clearer representation of various firmware update scenarios
2.5.2June 6, 2025Open | Eval
New
  • Added support for automatic firmware fallback to the last known working version if the firmware update image is unstable or corrupted, or if the current firmware is corrupted
  • Added user-definable callback functions in bootloader operations to allow custom code execution, such as implementing a failsafe mode in case of issues with the update or current firmware image
  • Added CMake as a supported build system for the following boards: Nucleo-H563ZI, Nucleo-H743ZI, Nucleo-H7A3ZI-Q, and STM32H753I-EVAL. In future releases, CMake support will be expanded and standardized.
  • Added new demo projects for Nucleo-H563ZI (Single Bank, demo with HTTP server) and STM32F769I-EVAL (Single Bank + External Memory, demo with MQTT client)
Improvements
  • As part of the multi-stage bootloader feature on our roadmap, the following changes have been made to the bootloader implementation:
    • `static_bootloader` is renamed to `second_stage_bootloader` (note: the next release will include a `first_stage_bootloader`, which will enable updates to the `second_stage_bootloader`)
    • Improvements to the bootloader's finite state machine
  • Fixed memory related issue in ImageBuilder utility
2.5.0Feb. 10, 2025Open | Eval
Version Change Notice
  • In this release, we are aligning the version numbering of CycloneBOOT with the versioning scheme used for all our other software products, ensuring a consistent versioning structure across all our software.
  • The version change is driven by our shared dependency on the 2.5.0 version of the cryptographic library (CycloneCRYPTO), now consistent across all of our security products.
  • As part of this alignment, the version of this new CycloneBOOT release is 2.5.0, succeeding the previous legacy version L.3.0.6. All future releases will follow the new versioning system (2.5.0+).
What this means for you:
  • The version number change does not affect the functionality or features of the product. The underlying product remains the same, with updates and improvements applied as usual.
  • Any major changes will be highlighted as usual
Improvements
  • CycloneCRYPTO library has been updated to version 2.5.0
L.3.0.6
Legacy version
Dec. 13, 2024Open | Eval
New
  • Add support for STM32H5 family
  • New evaluation board supported (Nucleo-H563ZI)
  • Add SFTP Server demonstration project for Nucleo-STM32H563ZI board
Improvements
  • CycloneCRYPTO library has been updated to version 2.4.4
L.3.0.4
Legacy version
May 31, 2024Open | Eval
New
  • New evaluation boards supported (Nucleo-H743ZI2 from STMicroelectronics and SAM E54 XPlained Pro from Microchip)
  • Update Library:
    • Added safe-guards against mismatching AES keys on the update server and on the embedded device
  • ImageBuilder utility:
    • Added HASH-based encryption key verification logic to update image
    • Added support for encryption and authentication keys in both ASCII and HEX formats
Improvements
  • Improved memory slot management with an abstraction layer to safeguard against any overflows and run-time errors related to bad memory slot configuration
  • Added support for dual-bank fallback mode on STM32U5 family
  • CycloneCRYPTO library has been updated to version 2.4.2
L.3.0.2
Legacy version
Feb. 5, 2024Open | Eval
New
  • Added support for In-Application Programming (IAP) using Single Bank MCU without necessitating an external memory (demo project available for STM32F769I-EVAL evaluation board)
  • New evaluation boards supported (Nucleo-L496ZG, Nucleo-F429ZI, Nucleo-F767ZI, Nucleo-H7A3ZI-Q, STM32F769I-DISCOVERY)
Improvements
  • Clearly distinguished IAP Single Bank demos: those requiring external flash (iap-single-bank-ext-mem/) and those using only MCU internal flash (iap-single-bank/)
L.3.0.0
Legacy version
Dec. 18, 2023Open | Eval
New
  • Various demonstration projects for Nucleo-U575ZI-Q, Nucleo-H743ZI2, STM32429I-EVAL, STM32F769I-EVAL and STM32H753I-EVAL2 evaluation boards
  • Revamped READMEs for our demonstration projects, making them much more user-friendly and easy to understand
Improvements
  • Internal re-structuring of modules for better code reuse
  • Reorganization of memory related functions for more flexibility and portability across different use cases
  • Improvements to ImageBuilder PC utility (formerly AppImageBuilder) to better manage boot offset required by different MCU families
  • CycloneCRYPTO library has been updated to version 2.3.4
L.2.1.0
Legacy version
Dec. 23, 2022Open | Eval
New
  • Introduction of new error codes for specific firmware update related error scenarios. The list of error codes will be expanded gradually in upcoming releases.
  • AppImageBuilder CLI utility has been completely overhauled. The source code for the utility is also now available. Multiplatform support (Windows/Linux) alongside POSIX compatible CLI parameters/flags have been added. CMake based toolchain is now used to build the project and to facilitate compilation on a number of different OS’s.
Improvements
  • CycloneCRYPTO library has been updated to version 2.2.0
  • Reorganization of security related (authentication, signature, and integrity verification) modules into a separate package to better code reuse
  • All HTTP server demo projects will now display a message in the HTML UI, if an error occurs during firmware update process
  • Added new demonstration projects for Nucleo-H743ZI2 (HTTP Server Dual Bank Demo, HTTPS Client Dual Bank Demo)
Bug Fixes
  • Reworked ECDSA verification process
  • Correct some edge-cases related to Single Bank update image processing (with the static bootloader)
L.2.0.2
Legacy version
Jul. 29, 2022Open | Eval
New
  • Added new demo boards (Nucleo-STM32H7A3-ZIQ, Nucleo-STM32L496-ZG, SAME54-Xplained-Pro)
  • Added new demo projects on STM32 evaluation boards (IAP Demo through USB/RNDIS with HTTP Server protocol, IAP Demo through UART with Y-Modem protocol)
Improvements
  • Improved parsing process for the image update
L.2.0.0
Legacy version
Mar. 25, 2022Open | Eval
New
  • Added support for Single Bank MCUs
  • Added support for external flash memory devices through an abstraction layer
  • Included a static bootloader to perform advanced firmware update scenarios
  • Added support for Fallback & Anti-rollback features during firmware update
  • Added demo projects for STM32 targets (Nucleo-F429ZI, Nucleo-F767ZI, STM32F769I-DISCO evaluation boards)
Improvements
  • CycloneBOOT architecture has been revamped to incorporate Single Bank MCU support (with external memory)
  • Expanded Cryptographic algorithms support for firmware security
  • Added a Linux binary of ApplicationImageBuilder utility, used to create firmware update images
L.1.0.1
Legacy version
Apr. 09, 2021Open
  • Legacy CycloneBOOT demonstration package (IAP library) for STM32F4 and STM32F7 MCUs with Dual Bank internal MCU Flash
Back to Top
in Music!