In my methodology the loader always continues to be built into the firmware. It becomes a job of the host interface downloader program to perform some validity checks of the firmware update image against the target product. The host interface program asks the loader for some statistics such as as the size of the fixed loader region. The host program then reads the loader section out of the target product and compares it against the loader image region in the new upgrade image area. If they do not match 100% the re-programming operation is then terminated. If OK then the host program requests erases the flash blocks after the target loader image area. Then when it writes the update to the target it skips over the first part of the image file and only writes the actual application portion. Upon verify it reads out the whole FLASH and recompares the whole thing to the update image file as a full sanity check that the target took the update OK.

I always use binary format for the update image files so casual users do not try to open them with text file type processing tools.

Michael Karas