STM32N6 DK 570: Binary Signing & Header Alignment Required for Successful Boot

[ankurmajumdar]

(v2.21.0+) (Cube IDE)

Hello everyone,

I am currently working with the STM32N6 DK 570 board for an ST Innovation Fair 2026 project and wanted to share an important observation related to binary signing and boot behavior, which may help others working on this platform especially first-time users.

Since the STM32N6 series has no internal flash, the device boots only signed binaries from external memory. Unsigned .bin or .hex files generated directly by STM32CubeIDE are rejected by the hardware, which is expected, but not very clearly emphasized in the current documentation.

---

Observed Issue: Header Alignment Requirement

While signing binaries using STM32_SigningTool_CLI v2.21.0 and later, I faced repeated boot failures (black screen) even though the binary was correctly signed.

After debugging, I observed the following:

• The STM32N6 ROM expects the application header at a 0x400 offset

• Newer versions of the signing tool do not automatically pad or align the binary

• Without explicit alignment, the First Stage Bootloader (FSBL) fails to locate the application

This behavior appears stricter compared to earlier versions of the signing tool, where alignment was handled more transparently.

---

Initial (Failing) Signing Command

STM32_SigningTool_CLI -bin build/Project.bin -nk -t ssbl -hv 2.3 -o build/Project_sign.bin

The signed binary was programmed at address 0x70100000, but the board failed to boot due to missing header alignment.

---

Required Fix: Explicit Alignment & Load Address

To resolve the issue, the signing process must explicitly:

• Enforce mandatory header alignment (-align)

• Specify the explicit load address for execution in internal RAM

• Generate a signed binary (_sign.bin) suitable for external flash boot

Working command:

STM32_SigningTool_CLI -s -bin Project.bin -nk -of 0x80000000 -t ssbl -hv 2.3 -o Project_sign.bin -align

---

Recommended: Automate via Post-Build Step

I have now added the signing process as a post-build step in STM32CubeIDE to avoid manual errors:

"C:/Program Files/STMicroelectronics/STM32Cube/STM32CubeProgrammer/bin/STM32_SigningTool_CLI.exe" -s -bin "${BuildArtifactFileBaseName}.bin" -nk -of 0x80000000 -t ssbl -hv 2.3 -o "${BuildArtifactFileBaseName}_sign.bin" -align

This ensures:

• Correct header alignment

• Correct load address configuration

• Valid signed binary on every build

---

Suggestion

It would be very helpful if the STM32N6 documentation could:

• Clearly mention the mandatory -align requirement

• Highlight the stricter behavior of STM32_SigningTool_CLI v2.21.0+

• Provide a recommended post-build signing workflow

A significant amount of time was spent debugging this behavior, and I hope this post helps others avoid the same issues.

Happy to discuss further or clarify if anyone is facing similar problems.

Best regards,
Ankur Majumdar
Team JIIT
ST Innovation Fair 2026