# Command-line operations

The Secure Provisioning Tool also offers a command-line interface, enabling integration in automated environments or customization of the image building and burning procedure.
Operation requires a verb (command) identifying the top-level operation \(building, flashing, provisioning, generating keys or detecting the list of USB devices\) and additional operation-specific options.

```{note}
This chapter shows commands that are run in a terminal.
Each command line begins with a prompt character: `>` for Windows or `$` for Linux and macOS.
Do not type this leading character, it only marks the start of a command and is not part of the command itself.
```

To display the available commands, arguments, and examples, run the following command from the command prompt:

```doscon
> C:\NXP\SEC_Provi_26.09\bin\securep.exe --help
```

Or in Linux and macOS:

```console
$ /opt/nxp/SEC_Provi_26.09/bin/securep --help
```

To display the available arguments for a specific command, run the following command from the command prompt:

```doscon
> C:\NXP\SEC_Provi_26.09\bin\securep.exe <command> --help
```

Or in Linux and macOS:

```console
$ /opt/nxp/SEC_Provi_26.09/bin/securep <command> --help
```

To avoid repetition, the remainder of this section uses Windows examples only, since usage is nearly identical on all platforms.

**Note:** The location of the SEC Tool application is subject to the installation folder.

All the supported commands and arguments used in the command line as described in chapters below can also be specified in a separate configuration JSON file.
This JSON file is then passed as a command-line argument.
For more information see [Examples of args-file JSON usage](#examples-of-args-file-json-usage).

## CLI arguments

This section describes CLI arguments that are used globally or shared across multiple commands.

### Argument specified in JSON file

```{table} args-file argument
:name: args-file-argument
| Argument                  | Description |
| ------------------------- | ----------- |
| `--args-file <ARGS_FILE>` | Path to the JSON file with CLI arguments, allowing you to specify all arguments in one file. The path is absolute or relative to the current working directory. The file format is specified by `schema/cli_args_file_schema_v?.json`. |
```

### Arguments for the processor selection

```{table} Processor selection arguments
:name: device-arguments
| Argument                                | Description |
| --------------------------------------- | ----------- |
| `--board <BOARD_NAME>`                  | Target board (implicit specification of the processor). During creation of new workspace, the board argument is used to configure default values for the board. |
| `--device <PROCESSOR_NAME>`             | Target processor. |
```
To display the list of supported processors and boards, use the `securep devices-info processors` command.

### Arguments for the boot device selection

```{table} Boot-device arguments (mutually exclusive)
:name: boot-device-arguments
| Argument                                | Description |
| --------------------------------------- | ----------- |
| `--boot-device <VALUE>`                 | Predefined boot memory. Run `securep --help` to see all supported boot memories. |
| `--boot-device-file <BOOT_DEVICE_FILE>` | File with boot memory configuration. |
| `--boot-device-type <TYPE>`             | Boot memory type, one of the following types: `flex-spi-nor`, `flex_spi_nand`, `ifr_memory`, `onchip_memory`, `onchip_ram`, `sdhc_emmc`, `sdhc_emmc_mpu`, `sdhc_sd_card`, `sdhc_sd_card_mpu`, `semc_nand`, `serial_downloader`, `xspi-nor`. Default-predefined boot memory of this type is applied. |
```

### Arguments for connection selection

```{table} Connection arguments (mutually exclusive)
:name: connection-arguments
| Argument                               | Description |
| -------------------------------------- | ----------- |
| `--usb <VID> <PID>`                    | Connect to the target over USB HID device denoted by VID/PID. USB HID connection is default. VID/PID can be specified in decimal form \(for example, `123`\) or hexadecimal form \(for example, `0xBEEF`\). |
| `--uart <UART>`                        | Connect to the target over UART. Specify the COM port \(see `--baud-rate` argument\). Example: `--uart COM3` |
| `--baud-rate <BAUD_RATE>`              | Connect to the target over UART with a specified baud rate. `--uart` argument must also be specified. Example: `--baud-rate 9600` |
| `--i2c address <speed_kHz>`            | Connect to the target over I2C via USB bridge. Specify the I2C device address and clock in kHz. The SIO device is autoselected if the `--sio-device` argument is not specified. Example: `--i2c 0x10 400` |
| `--spi <speed_kHz> <polarity> <phase>` | Connect to the target over SPI through a USB bridge. Specify SPI clock in kHz, polarity \(SPI CPOL option\) and phase \(SPI CPHA option\). The SIO device is autoselected if the `--sio-device` argument is not specified. Example: `--spi 1000 1 1` |
| `--sio-device <SIO_DEVICE>`            | Connect to the target over USB-SIO \(I2C or SPI\) via a specified SIO device. `--i2c` or `--spi` argument must also be specified. Example: `--sio-device HID\VID_1FC9&PID_0090&MI_03\7&96E050B&0&0000` |
```

### Environment variables in filepath-based arguments

The SEC Tool accepts environment variables in all arguments specifying paths, for example:

```doscon
> securep.exe -w /workspaces/mcuxprovi --device MIMX9596 --boot-device-type
  onchip_ram --boot-type unsigned build --additional-images
  additional_images_cfg.json --ele-firmware
  "${MCUX_SDK_16}\firmware\edgelock\mx95a0-ahab-container.img" --save-settings
```

## CLI commands

The tool supports the following CLI commands:
- [build](#build-command)
- [write](#write-command)
- [generate](#generate-keys-command) keys
- [manufacture](#manufacture-command)
- [devices-info](#devices-info-command)
- [test-connection](#test-connection-command)
- [detect](#detect-usb-devices-command) processor connected via USB
- [start-flashloader](#start-flashloader-command)
- [apply-settings](#apply-settings-command)
- [create-workspace-gui](#create-workspace-in-gui-command)
- [debug-auth](#debug-authentication-command)
- [print-cli-examples](#print-cli-examples-command)

### Build command

With the **build** command, you can perform actions that you can otherwise perform in the **Build image** view of SEC, that is, building a bootable image and preparing data for provisioning.

```{table} Build command arguments
:name: build-command-arguments
| Argument                                             | Description |
| ---------------------------------------------------- | ----------- |
| `-h, --help`                                         | Show help message and exit. |
| `--additional-images-cfg`                            | Path to JSON with configuration of additional images for the build. The file format is specified by the schema `schema/additional_images_schema_v?.json.` |
| `--bee-user-keys-config <BEE_USER_KEYS_CONFIG.json>` | JSON file with the BEE configuration. See the `schema/bee_image_encryption_schema_v2.json` in the installation folder. The parameter is applicable for encrypted XIP \(BEE user keys\) boot type only. |
| `--boot-type <VALUE>`                                | Secure boot type. Run `securep --help` to see all supported boot types. |
| `--cfpa-cfg <CFPA_CFG.json>`                         | Path to JSON file with USER CFPA configuration. It is recommended to export the file from the PFR Configuration dialog. |
| `--cmpa-cfg <CMPA_CFG.json>`                         | Path to JSON file with USER CMPA configuration. It is recommended to export the file from the PFR Configuration dialog. |
| `--csf-cert <CSF_CERT>`                              | Path to the public CSF key file used for signing the image. If not specified, it is derived from the img-cert pathname according to the HAB4 PKI Tree naming convention. |
| `--dcd <DCD.bin>`                                    | Path to the Device Configuration Data binary file. |
| `--dekkey <DEKKEY>`                                  | 32/48/64 HEX characters: data encryption key used for AHAB encryption. The argument is applicable for processors with the AHAB security system. |
| `--dual-image-boot-cfg <DUAL_IMAGE_BOOT_CFG.json>`   | JSON file with dual image boot configuration; file format is specified by `schema/dual_image_boot_schema_v?.json`. The argument is applicable for processors that support dual image boot. |
| `--ele-firmware <ELE_FIRMWARE>`                      | Path to the EdgeLock Enclave \(ELE\) firmware file. The argument is applicable for encrypted boot types for processors with the AHAB security system. |
| `--firmware-version <FIRMWARE_VERSION>`              | Version of the application image firmware. |
| `--iee-config <IEE_CONFIG.json>`                     | JSON file with the IEE configuration. See the `schema/iee_image_encryption_schema_v?.json` in the installation folder. The parameter is applicable for IEE encrypted boot type only. |
| `--ignore-error <ERROR_CODE>`                        | Error code to be ignored (displayed as a warning). Use with caution, may cause unexpected or wrong behavior. Works only in CLI mode. The list of supported error codes is displayed using command `securep -h`. |
| `--image-version <IMAGE_VERSION>`                    | The version of the bootable image can be either in 4-bytes format, for example, `0xFFFE0001` \(the lower 2 bytes are the real version number, and the upper 2 bytes are the invert value of lower 2 bytes\) or just the real version number \(2 bytes\). The argument is only applicable for processors that support the image version on the build tab. |
| `--img-cert <IMG_CERT>`                              | Path to the public IMG key file that is used for signing the image. For processors with a dual key schema, use the path to the primary key for signing pair identification. It is recommended to use the command with a workspace with already initialized key management. If the keys are not specified in the workspace settings file, they are imported. |
| `--iped-cfg <IPED_CFG.json>`                         | JSON file with PRINCE configuration; file format is specified by `schema/prince_config_schema_v?.json` |
| `--keyblob-keyid <KEYBLOB_KEYID>`                    | 32-bit value: Keyblob encryption key identifier. The argument is applicable for processors with the AHAB security system. |
| `--keysource <OTP, KeyStore>`                        | Key source for RT5xx/6xx secured images |
| `--life-cycle <LIFE_CYCLE_ID>`                       | Requested life-cycle state of the processor. The list of supported IDs is displayed using command `securep -h`. |
| `--misr-seed <MISR_SEED>`                            | 32 HEX characters: Seed used to initialize the MISR (Multiple Input Signature Register) used during image signing. |
| `--nbu-fw <NBU_FW>`                                  | Path to the SB file with NBU firmware used for NBU firmware provisioning. Supported for devices with NBU firmware stored in on-chip flash. |
| `--otfad-config <OTFAD_CONFIG.json>`                 | JSON file with the OTFAD configuration. See the `schema/otfad_image_encryption_schema_v?.json` in the installation folder. The parameter is applicable for OTFAD encrypted boot type only. |
| `--otp-cfg <OTP_CFG.json>`                           | Path to JSON file with USER OTP configuration. It is recommended to export the file from the OTP Configuration dialog. |
| `--prince-cfg <PRINCE_CFG.json>`                     | JSON file with PRINCE configuration. See `schema/prince_config_schema_v?.json` in the SEC installation folder. |
| `--romcfg-cfg <ROMCFG_CFG.json>`                     | Path to JSON file with USER ROMCFG configuration. It is recommended to export the file from the IFR Configuration dialog. |
| `--save-settings`                                    | Save workspace settings. |
| `--sbkek, --cust_mk_sk, --sb3kdk <SBKEK>`            | 64 HEX characters: Key used as key encryption key to handle SB2 file; Needed only for Secure Binary images; If not specified, it is read from workspace. |
| `--script-only`                                      | Generate build script only, do not launch it. |
| `--secret-key-type <TYPE>`                           | The HAB encryption algorithm, default is processor-specific. Possible values: `AES-128`, `AES-192`, `AES-256` |
| `--source-image <SOURCE_IMAGE>`                      | Source image path for building the boot image. |
| `--start-address <START_ADDRESS>`                    | Start address of the executable image data within the source image. Applicable and required only for binary source images. |
| `--target-image <TARGET_IMAGE>`                      | Target image path for building the boot image. |
| `--trust-provi <TYPE>`                               | Trust provisioning type. Possible values: `disabled`, `device_hsm`, `el2go_indirect` \(EdgeLock 2GO proxy flow\), `wpc_no_provi`, `wpc_device_hsm` |
| `--trust-zone <TRUST_ZONE>`                          | Either `disabled` \(for the TrustZone disabled image\) or `default` \(for the TrustZone enabled image with default data from the processor\) or path to the custom TrustZone configuration JSON or YAML file \(for the TrustZone enabled image with custom configuration\) |
| `--userkey <USERKEY>`                                | Key applicable for RT5xx/6xx secured images: for OTP key-source it represents the master key; for key-store it represents the key used for the signature |
| `-v, --verbose`                                      | Increase output verbosity |
| `-w, --workspace <WORKSPACE>`                        | Workspace location, path to the workspace directory. **Note:** Any settings from the workspace are loaded automatically. All command-line parameters can be used to override loaded settings. |
| `--xip-enc-otpmk-config <XIP_ENC_OTPMK_CONFIG.json>` | JSON file with the XIP Encryption with OTPMK configuration. See the `schema/xip_enc_otpmk_schema_v?.json` in the installation folder. The argument is applicable for XIP encrypted \(BEE OTPMK\) and XIP encrypted \(OTFAD OTPMK\) boot types only. |
| `--xmcd-cfg <XMCD_CFG>`                              | Path to YAML or binary file with the XMCD configuration \(simplified or full\), or use the special value `from-src-image` to extract and reuse XMCD configuration from the source image. For XMCD YAML configuration template/format, see the SPSDK command `nxpimage bootable-image xmcd get-templates`. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

For boot-device arguments, see [Arguments for boot device selection](#arguments-for-the-boot-device-selection).

### Write command

With the **write** command, you can perform actions that you can otherwise perform in the **Write image** view of SEC, that is, provisioning the chip and writing a bootable image.

```{table} Write command arguments
:name: write-command-arguments
| Argument                                     | Description |
| -------------------------------------------- | ----------- |
| `-h, --help`                                 | Show help message and exit. |
| `--source-image <SOURCE_IMAGE>`              | Source image path to be uploaded to the target. |
| `--write-params-cfg <WRITE_PARAMS_CFG.json>` | JSON file with parameters needed in write and fuses to be burnt by write script \(or shadow registers\). See the `schema/write_parameters_schema_v?.json` in the installation folder. |
| `--life-cycle <LIFE-CYCLE-ID>`               | Requested life-cycle state of the processor. The list of supported IDs is displayed using command `securep -h`. |
| `--trust-provi <TYPE>`                       | Trust provisioning type. Possible values: `disabled`, `device_hsm`, `el2go_indirect`, `wpc_no_provi`, `wpc_device_hsm` |
| `-v, --verbose`                              | Increase output verbosity. |
| `--boot-type <VALUE>`                        | Secure boot type. Run `securep --help` to see all supported boot types. |
| `--script-only`                              | Generate script only, do not launch. |
| `-w, --workspace <WORKSPACE>`                | Workspace location. **Note:** Any settings from the workspace are loaded automatically. All command-line parameters can be used to override loaded settings. |
| `--debug-probe <PROBE>`                      | Select a debug probe. Use `--debug-probe auto` to select any debug probe. Use `--debug-probe invalid` to list all connected debug probes. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

For boot-device arguments, see [Arguments for boot device selection](#arguments-for-the-boot-device-selection).

For connection arguments, see [Arguments for connection selection](#arguments-for-connection-selection)

**Note:** For connection to the board, a USB or Serial port has to be specified. If nothing is specified, USB autodetection is applied.

### Generate keys command

With the **generate** command, you can perform actions that you can otherwise perform in the **Generate Keys** view. Compared to the GUI, command-line functionality is restricted.

```{table} Generate keys arguments
:name: generate-keys-arguments
| Argument                      | Description |
| ------------------------------| ----------- |
| `-h, --help`                  | Show help message and exit. |
| `--keys-cfg <KEYS_CFG.json>`  | File with the keys configuration. **Note:** For the keys configuration see JSON schema located in `schema/keys_management_schema_YY_MM.json`. Also the content of `keys_generation_settings` key from the workspace settings file `settings.sptjson` can be used as a template. |
| `--boot-type <VALUE>`         | Secure boot type. Run `securep --help` to see all supported boot types. |
| `--script-only`               | Generate script only, do not launch. |
| `-w, --workspace <WORKSPACE>` | Workspace location. **Note:** Any settings from the workspace are loaded automatically. All command-line parameters can be used to override loaded settings. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

For boot-device arguments, see [Arguments for boot device selection](#arguments-for-the-boot-device-selection).

### Manufacture command

The **manufacture** command allows running the selected script several times in parallel, each time for a different connection.

```{table} Manufacture command arguments
:name: manufacture-command-arguments
| Argument                                       | Description |
| ---------------------------------------------- | ----------- |
| `-h, --help`                                   | Show help message and exit. |
| `--init-flashloader`                           | Initialize flashloader before running the script. |
| `--script_path <SCRIPT_PATH>`                  | Path to the script to be executed. This option is recommended when USB is used, because it also handles changes to the USB path after the flashloader is initialized. |
| `--script_params <SCRIPT_PARAMS>`              | Parameters of the script. For more information, see [Manufacturing Tool](05_user_interface.md#manufacturing-tool). |
| `--connections <CONNECTION>[,<CONNECTION>...]` | List of all connections devices to be used in manufacturing, in format `-p <port>,<baud>` or `-u <usb-path>` or `-l usb,<usb-path>,spi[,<port>,<pin>,<speed_kHz>,<polarity>,<phase>]` or `-l usb,<usb-path>,i2c[,<address>,<speed_kHz>]`. To find all available USB/USB-SIO connections, automatically use `-u <autodetect-all-USBs>` or `-l usb,<autodetect-all-USBSIOs>,spi[,<port>,<pin>,<speed_kHz>,<polarity>,<phase>]` or `-l usb,<autodetect-all-USBSIOs>,i2c[,<address>,<speed_kHz>]`. Parameters and default values for SIO operation are described in the SPSDK documentation. |
```

### Devices info command

With the **devices-info** command, you can get information about supported processors and their supported boot devices.

```{table} The devices-info command arguments
:name: devices-info-command-arguments
| Mode           | Description |
| -------------- | ----------- |
| `processors`   | Information about supported processors and their supported boot devices. This mode is default. |
| `boot-devices` | Information about supported boot devices memory. |
```

```{table} Devices-info-specific arguments
:name: devices-info-specific-arguments
| Argument               | Description |
| ---------------------- | ----------- |
| `-h, --help`           | Show help message and exit. |
| `--format <FORMAT>`    | Format of the output. The default value is `json` for file output, `txt` for STDOUT. For processors JSON, see `schema/devices_info_schema_v?.json`. For boot devices JSON, see `schema/boot_devices_info_schema_v?.json` |
| `--output <OUTPUT>`    | Path to a file where to store the output. If not provided, the output is printed to STDOUT. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

### Test connection command

The **test-connection** command performs a processor-specific connection test. The device must be specified either in the workspace or via the command-line option. If no connection is specified in the workspace or as an option, the default connection is used. The connection test is successful if a matching device is connected and is in ISP mode.

```{table} Test connection command arguments
:name: test-connection-command-arguments
| Argument                      | Description |
| ----------------------------- | ----------- |
| `-h, --help`                  | Show help message and exit. |
| `-v, --verbose`               | Increase output verbosity. |
| `-w, --workspace <WORKSPACE>` | Workspace location. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

### Detect USB devices command

The **detect** command identifies any processor connected via USB. For detection to succeed, the processor must be in ISP mode.

### Start flashloader command

The **start-flashloader** command starts the flashloader on the i.MX RT processors.

```{table} Start-flashloader command arguments
:name: start-flashloader-command-arguments
| Argument                      | Description |
| ----------------------------- | ----------- |
| `-h, --help`                  | Show help message and exit. |
| `-v, --verbose`               | Increase output verbosity |
| `-w, --workspace <WORKSPACE>` | Workspace location. |
| `--script-only`               | Generate script only, do not launch. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

For connection arguments, see [Arguments for connection selection](#arguments-for-connection-selection).

### Apply settings command

Command **apply-settings** supports two main use cases

- Modifying an existing workspace
- Creating a new workspace

For modifying an existing workspace, specify the path to the workspace and the options to change. General options can be used for this purpose.

For creating a new workspace, at minimum, the boot-device and device options must be specified.

```{table} Apply-settings command arguments
:name: apply-settings-command-arguments
| Argument                       | Description |
| ------------------------------ | ----------- |
| `-h, --help`                   | Show help message and exit. |
| `-v, --verbose`                | Increase output verbosity. |
| `-w, --workspace <WORKSPACE>`  | Workspace location. |
| `--life-cycle <LIFE_CYCLE_ID>` | Requested life-cycle state of the processor. The list of supported IDs is displayed using command `securep -h`. |
| `--trust-provi <TYPE>`         | Trust provisioning type. Possible values: `disabled`, `device_hsm`, `el2go_indirect`, `wpc_no_provi`, `wpc_device_hsm` |
| `--boot-type <VALUE>`          | Secure boot type. Run `securep --help` to see all supported boot types. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

For boot-device arguments, see [Arguments for boot device selection](#arguments-for-the-boot-device-selection).

For connection arguments see, [Arguments for connection selection](#arguments-for-connection-selection).

### Create workspace in GUI command

Command **create-workspace-gui** will open a dialog for creating a new workspace in GUI with predefined values from the arguments.

```{table} Create-workspace-gui command
:name: create-workspace-gui-arguments
| Argument                        | Description |
| ------------------------------- | ----------- |
| `-h, --help`                    | Show help message and exit. |
| `-w, --workspace WORKSPACE`     | Workspace location. |
| `--source-image <SOURCE_IMAGE>` | (Optional) Path to the source image for building the boot image. |
```

For processor selection arguments, see [Arguments for processor selection](#arguments-for-the-processor-selection).

### Debug authentication command

The **debug-auth** command allows to specify the configuration for the debug authentication (in GUI) and open the debug port if the configuration is specified.
Usage of the command: `securep debug-auth <SUB_COMMAND> <DEBUG_PROBE_ID> --beacon <BEACON>`, where

- `<SUB_COMMAND>` is either `configure-in-gui` or `open`
  - **configure-in-gui**: to open the configuration dialog and specify the parameters for debug authentication; the parameters are stored in the workspace. The command is the same as **main menu > Tools > Debug Authentication** command in the tool.
  - **open**: to open the debug port. If this command is used for the first time and configuration is not yet specified, it opens the debug configuration GUI automatically. Otherwise, it opens a debug port (without any GUI).
- `<DEBUG_PROBE_ID>` is an identifier (serial number) of the debug probe used for the authentication process.
- `<BEACON>` is an optional integer parameter for the debug mailbox passed to the processor during the debug authentication; its value is application-specific.

## Command-line examples

### Example: How to build and write an image for configuration stored in the workspace folder

In this example, it is assumed that the GUI was already used to prepare complete configuration within a workspace \(keys generated, build image configured, write image configured\).

```doscon
> securep.exe -w /workspaces/mcuxprovi build
```

```doscon
> securep.exe -w /workspaces/mcuxprovi write
```

### Print CLI examples command

To print many additional CLI examples, use the following command:

```doscon
> securep.exe print-cli-examples
```

### Examples of args-file JSON usage

The following examples demonstrate the usage of an args-file JSON file in place of direct command-line arguments.
In each case, the original command-line invocation is shown first, followed by the equivalent args-file command and the contents of the JSON file.

#### Build example

**Example CLI arguments for build:**

```doscon
> securep.exe -w /workspaces/mcuxprovi --device MIMX9596 --boot-device-type
  onchip_ram --boot-type unsigned build --additional-images
  additional_images_cfg.json --ele-firmware mx95a0-ahab-container.img
  --save-settings
```

**Equivalent args-file argument for above build arguments:**

```doscon
> securep.exe --args-file args_file_build.json
```

`args_file_build.json` content \(only the first additional image is listed\):

```json
{
  "cli_args": {
    "-w": "/workspaces/mcuxprovi",
    "--device": "MIMX9596",
    "--boot-device-type": "onchip_ram",
    "--boot-type": "unsigned",
    "build": [],
    "--additional-images": {
      "images": [
        {
          "entry_type": "oei_ddr",
          "container_set": "#1",
          "extra_settings": {
            "lpddr_imem_path": "${ENV_VAR_DDR}/lpddr5_imem_v202311.bin",
            "lpddr_imem_qb_path": "${ENV_VAR_DDR}/lpddr5_imem_qb_v202311.bin",
            "lpddr_dmem_path": "${ENV_VAR_DDR}/lpddr5_dmem_v202311.bin",
            "lpddr_dmem_qb_path": "${ENV_VAR_DDR}/lpddr5_dmem_qb_v202311.bin",
            "oei_ddr_path": "source_images/oei-m33-ddr.bin"
          }
        }
      ]
    },
    "--ele-firmware": "source_images/mx95a0-ahab-container.img",
    "--save-settings": []
  }
}
```

#### Write example

**Example CLI arguments for write:**

```doscon
> securep.exe -w /workspaces/mcuxprovi --device MIMX9596 --boot-device-type
  onchip_ram --boot-type unsigned write --source-image bootable_images/flash.bin
```

**Equivalent args-file argument for above write arguments:**

```doscon
> securep.exe -w /workspaces/mcuxprovi --args-file args_file_write.json
```

`args_file_write.json` content:

```json
{
  "cli_args": {
    "--device": "MIMX9596",
    "--boot-device-type": "onchip_ram",
    "--boot-type": "unsigned",
    "write": [],
    "--source-image": "bootable_images/flash.bin"
  }
}
```

Arguments passed directly in the command line are combined with arguments in the args-file.
However, the same argument cannot be specified in both places at once.

## Command-line tools

The SEC tool depends on the following command-line tools to generate keys and build/write the image:

- **openssl**:
    Key generation.
- **spsdk**:
    Secure Provisioning SDK.
    For more information, see *main menu \> Help \> SPSDK Online Documentation* in GUI.
    The following CLI tools are available as part of SPSDK:
  - **blhost**:
      Replacement for the legacy blhost tool.
  - **dk6prog**:
      Tool for reading and programming flash memory of DK6 target devices.
  - **el2go-host**:
      Managing the EdgeLock 2GO provisioning operations.
  - **lpcprog**:
      Utility for communication with the bootloader on LPC8xx target.
  - **nxpcrypto**:
      Operations with keys and certificates.
  - **nxpdebugmbox**:
      Debug mailbox and debug credential file generator tool.
  - **nxpdevhsm**:
      Creates an SB3 provisioning file for initial device provisioning by the OEM.
  - **nxpdevscan**:
      Utility that detects NXP devices connected to the host PC over USB, UART, I2C, and SPI connections
  - **nxpdice**:
      Application designed to cover DICE-related operations.
  - **nxpele**:
      Utility for communication with the EdgeLock Enclave on target.
  - **nxpfuses**:
      NXP Fuse Tool.
  - **nxpimage**:
      Builds bootable image and SB files.
  - **nxpmemcfg**:
      Collection of utilities for memory configuration operations.
  - **nxpshe**:
      NXP tool for working with SHE (Secure Hardware Extension).
  - **nxpuuu**:
      The application for image deployment for i.MX MPUs. It is based on libUUU (universal update utility).
  - **nxpwpc**:
      Utility covering WPC operations.
  - **pfr**:
      Generates protected flash region files \(cmpa/cfpa\) and IFR.
  - **sdphost**:
      Replacement for the legacy sdphost utility.
  - **sdpshost**:
      Utility for communication with ROM on i.MX targets using SDPS protocol (i.MX8/9).
  - **shadowregs**:
      Shadow registers control tool.
  - **spsdk**:
      Main entry point for all SPSDK applications. Additionally provides access to `utils`.
- **imgtool**:
    MCUboot's image signing and key management.