OpenSK for the ICBbuy SuperMini nRF52840

This repository targets the ICBbuy SuperMini nRF52840 Pro Micro-form-factor board sold with the black PCB / ENIG finish sometimes called “Black Gold.” It does not target a genuine nice!nano.

Identity layer	Required value
Physical PCB	ICBbuy SuperMini nRF52840
CircuitPython board ID / control image	supermini_nrf52840
OpenSK/Wasefire runner	board-supermini-direct
Factory bootloader volume	NICENANO
Factory bootloader Board-ID	nRF52840-nicenano

The last two values are compatibility identities advertised by the Adafruit bootloader shipped on the clone. They do not mean the physical board is a nice!nano, and they must never be used to select board-specific test firmware.

Verified hardware: two matching SuperMinis completed WebAuthn registration, PIN setup, user presence, and authentication in Chrome. One unit then upgraded from Standard to APPROTECT and authenticated the credential created before the upgrade. The stock Adafruit bootloader still accepts unsigned firmware and exposes application readback, so APPROTECT is defense in depth rather than a physical-security boundary. This is research firmware, not a FIDO-certified product; do not use it as the only authentication method for an account.

Features

• CTAP2/FIDO2 and CTAP1/U2F
• Client PIN and user verification
• Persistent credential storage in internal flash
• Physical user-presence input on P0.22
• Adafruit UF2 drag-and-drop updates
• Standard and opt-in APPROTECT firmware profiles

Hardware

You need:

• the ICBbuy SuperMini nRF52840 described in the identity table above;
• a USB-C data cable;
• a normally open momentary switch between P0.22 and GND.

Board-specific pin facts:

• P0.13 is VCC_OFF; this port drives it high to keep the external 3.3 V rail enabled.
• P0.24 is connected to battery-divider circuitry on the physical PCB. Enabling hardware edge counting on it hard-faulted a tested board, so it is not the user-presence input.
• CircuitPython names P0.15 as LED, but the visible blue indicator on the tested unit behaved independently of firmware. It is not a diagnostic channel.

Install

Run the guided installer:

python3 scripts/install.py

It identifies the bootloader, checks the S140 SoftDevice byte-for-byte, repairs factory corruption when found, and offers two profiles:

1. Standard — the complete FIDO2 key without SWD lockout.
2. Hardened — verifies Standard first, then installs the separate APPROTECT image after explaining that the change is permanent without SWD hardware.

For manual installation, double-tap reset (or bridge RST to GND twice within approximately half a second). The NICENANO volume should appear. Its tested bootloader report is:

UF2 Bootloader 0.11.0
Board-ID: nRF52840-nicenano
SoftDevice: S140 6.1.1

That is the bootloader identity, not the board model. If the bootloader is older, copy firmware/update-nice_nano_bootloader-0.11.0_nosd.uf2 to NICENANO. This is Adafruit's unmodified updater for that bootloader Board-ID.

INFO_UF2.TXT proves only that the SoftDevice info page is intact. Check the actual region before flashing OpenSK:

python3 scripts/check_softdevice.py

Then copy the selected image:

firmware/opensk-supermini-nrf52840.uf2
firmware/opensk-supermini-nrf52840-approtect.uf2

The first is Standard. The second enables permanent APPROTECT hardening on its first boot. After either manual flash, unplug USB, wait two seconds, and reconnect normally; the SuperMini requires this cold boot after leaving the UF2 bootloader. Use the guided installer unless you already understand the recovery implications in SECURITY.md.

Test

Open webauthn.io in Chrome or another WebAuthn browser.

1. Register a credential.
2. When the browser requests user presence, press the P0.22-to-GND button.
3. Set the authenticator PIN when prompted.
4. Authenticate with the saved credential.

Upgrade without losing credentials

Both UF2 profiles write only the application region. Credential storage remains at 0xda000..0xe0000.

To upgrade without losing credentials:

1. Double-tap reset.
2. Copy the selected UF2 to NICENANO.
3. Unplug USB, wait two seconds, and reconnect normally.
4. Authenticate with an existing credential.

Do not use CTRL-AP ERASEALL unless you intend to erase every credential and the UICR configuration.

Build from source

Prerequisites:

• Git
• Rustup
• Python 3
• rsync
• Linux packages required by libusb when building on Linux

Build:

./setup.sh
./scripts/build_firmware.sh

Output:

dist/opensk-supermini-nrf52840.uf2
dist/opensk-supermini-nrf52840-approtect.uf2
dist/SHA256SUMS

The setup script pins:

• OpenSK: b3b16fb3af12bd8249b9e2a6b4b5869d9036ccda
• Wasefire: 6d8f4fc9714004af9d86b4218da0ce6d52db84f4
• Rust: nightly-2026-06-03 through OpenSK's toolchain file

Repository contents

Path	Purpose
firmware/	Prebuilt UF2 images, checksums, and build manifest
overlay/	Source files applied over pinned OpenSK and Wasefire revisions
scripts/build_firmware.sh	Builds Standard and APPROTECT UF2 images
scripts/install.py	Guided Standard/Hardened installer with SoftDevice check
scripts/flash_on_mount.py	Waits for NICENANO and flashes one UF2
scripts/flash_sequence.py	Updates the tested bootloader, then flashes production firmware
scripts/check_softdevice.py	Detects a corrupt SoftDevice region through the bootloader
scripts/make_sd_repair.py	Builds a UF2 that restores genuine S140 6.1.1
scripts/verify_uf2.py	Checks UF2 family, address bounds, and store separation
TROUBLESHOOTING.md	Observed symptoms and diagnostic procedure
SECURITY.md	Security properties and recovery behavior
RELEASES.md	Release provenance, reproducibility status, and upgrade gates
THIRD_PARTY_NOTICES.md	Upstream revisions and license notices

Security properties and limits

The Standard image leaves SWD access unchanged. The separate APPROTECT image programs UICR.APPROTECT; on newer silicon covered by Nordic erratum 249 it also locks the software branch for the current boot. APPROTECT blocks debugger access but does not encrypt flash or add side-channel resistance.

Once APPROTECT is latched, CPU ERASEUICR is blocked. Removing it requires CTRL-AP ERASEALL over SWD hardware, which erases application flash, credentials, PIN state, and UICR. UF2 application upgrades remain available, but they cannot undo APPROTECT.

The stock bootloader permits physical firmware replacement. See SECURITY.md before enrolling any sensitive account.

License

Repository-original files are MIT licensed. Modified OpenSK and Wasefire files remain Apache-2.0. The vendored nrf-usbd source remains MIT OR Apache-2.0. Full license texts and notices are in LICENSES/ and THIRD_PARTY_NOTICES.md.