Hello @Jakub Standarski ,
In 1 image setup, if the update is done by the SBSFU loader, you can follow what is done in file
1_Image\1_Image_SBSFU\SBSFU\App\sfu_loader.c
in function
SFU_ErrorStatus SFU_COM_YMODEM_DataPktRxCpltCallback(uint8_t *pData, uint32_t uSize)
This function is called when Ymodem protocol receives a new packet.
The first packet containing .sfb file will contain the header.
This signature of the header is immediately checked, reason why you can see a little delay after first pack transmission.
Then if signature is OK, the rest is decrypted "on the fly" but with software crypto, and written into flash.
Once all transfer is done, SBSFU computes the hash of the whole firmware and compares is with the one provided in the authenticated header.
If the check fails, firmware is erased and SBSFU waits for a new download.
I hope it answers your question.
Best regards
Jocelyn