KryonOS v2.0.1 - Security Hardening, Permissions & Runtime Improvements

[Haris16-code]

Release Highlights

This update introduces new features, stronger security protections, improved application sandboxing and permissions management, Web Manager hardening, performance improvements, and numerous bug fixes.

Added

• Dynamic TLS Build Epoch Time Sync: Added a compile-time build epoch baseline using __DATE__ and __TIME__, allowing the system clock to be initialized safely on boot before certificate validation. Added non-blocking SNTP synchronization after Wi-Fi connection.
• Settings Permissions Manager: Added a dedicated Permissions Manager with a paginated application list, permission status badges, individual [ Revoke ] controls, and a [ Reset All ] confirmation dialog.
• On-Demand Runtime Storage Permissions: Replaced pre-install permission barriers with runtime permission requests. Applications can now install without storage permission prompts and request access only when required.
• Cross-Storage Sandboxing: Added bidirectional sandbox protection between LittleFS and SD storage. Applications accessing another storage location or external paths trigger an interactive permission dialog with Allow Once, Always Allow, and Deny options.
• Compact Settings UI: Reorganized the Settings menu with seven compact 200x30 px buttons for Wi-Fi, Touch Calibration, App Management, Permissions, Time & Region, About Device, and System Updates.
• Web Manager Session Security: Added modern session-based authentication, secure HTTP cookies with SameSite=Strict, session expiration, and a Remember Me option.
• Web Manager Rate Limiting: Added brute-force protection with a 30-second lockout after five consecutive failed login attempts.
• Web Manager Authentication API: Added dedicated /api/login and /api/logout endpoints.
• Recursive Folder Uploads: Added drag-and-drop file and folder uploads with recursive directory handling and automatic parent-folder creation.
• Upload Folder: Added dedicated folder upload support using webkitdirectory.
• Online Help Center: Added an eight-category Help Center covering Setup, Wi-Fi, Web Server, App Store, Permissions, KryonCloud & AI, Settings, and FAQs.
• Web Server Customization: Added on-device keyboard controls for changing Web Manager usernames and passwords directly from the device.
• Hardware-Protected Wi-Fi Credentials: Wi-Fi credentials are now encrypted using AES-256-CBC and stored in a protected system location. Each device generates a unique encryption key using the ESP32 hardware random number generator.
• Automatic Wi-Fi Credential Migration: Legacy cleartext Wi-Fi configuration files are automatically migrated to encrypted storage and securely removed after migration.
• TLS Certificate Validation: Added centralized TLS certificate handling with Mozilla CA trust support, including trusted root certificates from ISRG, DigiCert, and Amazon.
• App Store Package Integrity Verification: Added SHA-256 streaming verification for downloaded application packages before installation.
• JavaScript Filesystem Sandboxing: JavaScript applications are now restricted to their package directory or explicitly configured data directory, with protection against path traversal and filesystem escapes.
• Privacy & Telemetry Hardening: Removed automatic GitHub star-count requests during boot and Settings access. Star-count telemetry is now opt-in and cached locally.

Changed

• Web Manager CORS: Removed the wildcard Access-Control-Allow-Origin: * policy to reduce cross-origin LAN attack exposure.
• Filesystem Architecture: Added reserved /system directories for OS-internal configuration and security data with system-level path protection.
• App Store Update Feedback: The update screen now displays No Update found. when all installed applications are up to date.
• App Store Security Feedback: Installation now reports Installation Blocked: Hash Not Found in store. when a catalog entry does not contain a SHA-256 hash.

Fixed

• JavaScript Runtime Memory Leak: Fixed heap retention and display-buffer memory leaks when JavaScript applications terminate. Up to 153.6 KB of RAM can now be released immediately by properly deallocating display buffers and resetting display caches.
• Web Manager Credential Disclosure: Fixed plaintext credential exposure through the Web Manager download endpoint.
• Web Manager Remote Code Execution: Fixed vulnerabilities that could allow unauthenticated code execution and unauthorized storage deletion through the Web Manager.
• TLS Security: Fixed TLS man-in-the-middle vulnerabilities affecting KryonCloud, KryonAI, OTA Manager, and network clients.
• App Store Package Execution: Fixed the ability to execute untrusted application packages by enforcing SHA-256 package verification.
• JavaScript Filesystem Security: Fixed arbitrary filesystem read/write vulnerabilities in the Duktape runtime through strict filesystem sandboxing.
• Web Manager File Descriptor Leak: Fixed file descriptor leaks caused by client disconnections during streaming uploads.

Security

KryonOS v2.0.1 includes significant security hardening across the Web Manager, TLS networking, App Store, JavaScript runtime, filesystem access, Wi-Fi credential storage, and application permission system.

Users are strongly encouraged to update to v2.0.1 to benefit from the latest security fixes, runtime improvements, and new features.

Firmware Binaries & Flash Offsets

The following firmware binaries are provided for each supported board target. Always flash the files for your exact board model and verify the SHA-256 checksum before flashing.

ESP32-CYD-28 (esp32-cyd-28)

File Name	Flash Offset	Role	SHA-256 Checksum
KryonOS-v2.0.1-esp32-cyd-28-bootloader-0x1000.bin	0x1000	Bootloader	3d234a7471f67b013686dabd4dee7c1fa915c9928463616a94bc9297acf1abf8
KryonOS-v2.0.1-esp32-cyd-28-partitions-0x8000.bin	0x8000	Partition Table	0a8b5720e7b77ff11f1462458c3a509dee79224e5279898f26d6a2e3ae0517b7
KryonOS-v2.0.1-esp32-cyd-28-firmware-0x10000.bin	0x10000	Firmware (App)	a3d4bb0110ae426efb9c53a82ce1f223b3458ea4558ff26a53852a6918e9267d

ESP32-S3 DevKitC-1 N16R8 (esp32-s3-devkitc-1-n16r8)

File Name	Flash Offset	Role	SHA-256 Checksum
KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-bootloader-0x0000.bin	0x0000	Bootloader	2a71d69b471e20c2bac7fb469f3c6a807b3ebee780e348e5889db0da849ca363
KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-partitions-0x8000.bin	0x8000	Partition Table	bd0f7954aca2ef7d925ee21aaa1f3dc8822d1d6ce5cbbd26a135e5886bfff6ce
KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-firmware-0x10000.bin	0x10000	Firmware (App)	c576b65d1a3ae4b4e00009071df408a9f7897756b674e135eae778c5872662b4

ESP32 DOIT DevKit V1 (esp32doit-devkit-v1)

File Name	Flash Offset	Role	SHA-256 Checksum
KryonOS-v2.0.1-esp32doit-devkit-v1-bootloader-0x1000.bin	0x1000	Bootloader	3d234a7471f67b013686dabd4dee7c1fa915c9928463616a94bc9297acf1abf8
KryonOS-v2.0.1-esp32doit-devkit-v1-partitions-0x8000.bin	0x8000	Partition Table	0a8b5720e7b77ff11f1462458c3a509dee79224e5279898f26d6a2e3ae0517b7
KryonOS-v2.0.1-esp32doit-devkit-v1-firmware-0x10000.bin	0x10000	Firmware (App)	c39e101c1b075d6134f3084cdb96a13557b80bf183c4f5e668ee6a3d5560d1ee

LilyGO T-HMI (lilygo-t-hmi)

File Name	Flash Offset	Role	SHA-256 Checksum
KryonOS-v2.0.1-lilygo-t-hmi-bootloader-0x0000.bin	0x0000	Bootloader	1776e4dd896a69d0a5c2e79957b0e2a88aa4129b1381d6478683515a1f6af343
KryonOS-v2.0.1-lilygo-t-hmi-partitions-0x8000.bin	0x8000	Partition Table	bd0f7954aca2ef7d925ee21aaa1f3dc8822d1d6ce5cbbd26a135e5886bfff6ce
KryonOS-v2.0.1-lilygo-t-hmi-firmware-0x10000.bin	0x10000	Firmware (App)	fec59cbcf84320eed07c7d3c1230da83e7ea0a6e0110a6ad8f348e27899df3be

M5Stack Cardputer (m5stack-cardputer)

File Name	Flash Offset	Role	SHA-256 Checksum
KryonOS-v2.0.1-m5stack-cardputer-bootloader-0x0000.bin	0x0000	Bootloader	1776e4dd896a69d0a5c2e79957b0e2a88aa4129b1381d6478683515a1f6af343
KryonOS-v2.0.1-m5stack-cardputer-partitions-0x8000.bin	0x8000	Partition Table	f847fbb42780b47e31b109c26586d84f0518292d514901fb58610e397c55db14
KryonOS-v2.0.1-m5stack-cardputer-firmware-0x10000.bin	0x10000	Firmware (App)	290e1126e29a5ed0c5a6fdf855ccf9c6dd3dbb9daba3a0d8f2df5178e9d6a49a

Flashing Guide

KryonOS v2.0.1 provides separate bootloader, partition table, and firmware binaries. Use the flashing offsets listed above for your specific board.

Requirements

• A supported ESP32 board.
• A USB data cable.
• A Windows, macOS, or Linux computer.
• Python 3 installed.
• esptool installed and available from the command line.
• The three firmware binaries for your exact board target.

1. Install esptool or use any other ESP32 Flasher

Install the latest available version of esptool:

python -m pip install esptool

Verify the installation:

esptool version

2. Connect Your Board

Connect your ESP32 board to your computer using a USB data cable. Identify the serial port assigned to the board.

• Windows: Usually COM3, COM4, etc.
• Linux: Usually /dev/ttyUSB0 or /dev/ttyACM0.
• macOS: Usually /dev/cu.usbmodem* or /dev/cu.usbserial*.

3. Verify the Firmware Checksums

Before flashing, calculate the SHA-256 checksum of each downloaded binary and compare it with the checksum listed in the firmware tables above. Do not flash a file if its checksum does not match.

Windows PowerShell

Get-FileHash .\KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-firmware-0x10000.bin -Algorithm SHA256

Linux

sha256sum KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-firmware-0x10000.bin

macOS

shasum -a 256 KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-firmware-0x10000.bin

Replace the filename in the command with the binary you are verifying.

4. Erase the Flash

A full flash erase is recommended when performing a fresh installation or upgrading from an older KryonOS release with incompatible storage or partition data.

esptool --port COM3 erase-flash

Replace COM3 with your actual serial port.

5. Flash KryonOS

Use the bootloader, partition table, and firmware binaries corresponding to your board. The offsets must match the firmware tables above.

ESP32-CYD-28

esptool --port COM3 write-flash \
  0x1000 KryonOS-v2.0.1-esp32-cyd-28-bootloader-0x1000.bin \
  0x8000 KryonOS-v2.0.1-esp32-cyd-28-partitions-0x8000.bin \
  0x10000 KryonOS-v2.0.1-esp32-cyd-28-firmware-0x10000.bin

ESP32-S3 DevKitC-1 N16R8

esptool --port COM3 write-flash \
  0x0000 KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-bootloader-0x0000.bin \
  0x8000 KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-partitions-0x8000.bin \
  0x10000 KryonOS-v2.0.1-esp32-s3-devkitc-1-n16r8-firmware-0x10000.bin

ESP32 DOIT DevKit V1

esptool --port COM3 write-flash \
  0x1000 KryonOS-v2.0.1-esp32doit-devkit-v1-bootloader-0x1000.bin \
  0x8000 KryonOS-v2.0.1-esp32doit-devkit-v1-partitions-0x8000.bin \
  0x10000 KryonOS-v2.0.1-esp32doit-devkit-v1-firmware-0x10000.bin

LilyGO T-HMI

esptool --port COM3 write-flash \
  0x0000 KryonOS-v2.0.1-lilygo-t-hmi-bootloader-0x0000.bin \
  0x8000 KryonOS-v2.0.1-lilygo-t-hmi-partitions-0x8000.bin \
  0x10000 KryonOS-v2.0.1-lilygo-t-hmi-firmware-0x10000.bin

M5Stack Cardputer

esptool --port COM3 write-flash \
  0x0000 KryonOS-v2.0.1-m5stack-cardputer-bootloader-0x0000.bin \
  0x8000 KryonOS-v2.0.1-m5stack-cardputer-partitions-0x8000.bin \
  0x10000 KryonOS-v2.0.1-m5stack-cardputer-firmware-0x10000.bin

On Linux or macOS, replace COM3 with the appropriate serial device path.

6. Enter Download Mode If Required

If esptool cannot connect to the board automatically, manually enter download mode:

1. Disconnect the USB cable.
2. Press and hold the board's BOOT button.
3. Connect the USB cable while continuing to hold BOOT.
4. Release BOOT after the board is detected.
5. Run the flashing command again.

The exact button procedure may vary between board models.

7. Restart the Device

After flashing completes successfully, reset or power-cycle the board. KryonOS should start automatically using the newly flashed firmware.

Important Notes

• Always use binaries intended for your exact board target.
• Do not change the flash offsets provided in the firmware tables.
• Verify all SHA-256 checksums before flashing.
• A full flash erase removes existing data stored on the device.
• Back up important LittleFS and SD-card data before performing a fresh installation.
• Do not disconnect the board while the flash operation is in progress.

Quick Flash Reference

Board	Bootloader	Partition Table	Firmware
ESP32-CYD-28	0x1000	0x8000	0x10000
ESP32-S3 DevKitC-1 N16R8	0x0000	0x8000	0x10000
ESP32 DOIT DevKit V1	0x1000	0x8000	0x10000
LilyGO T-HMI	0x0000	0x8000	0x10000
M5Stack Cardputer	0x0000	0x8000	0x10000

---

This discussion was created from the release KryonOS v2.0.1 - Security Hardening, Permissions & Runtime Improvements.