Trezor firmware

This commit removes a feature that would have sent a 'MCU attestation'—a cryptographic proof signed by the device's microcontroller—during device authentication. The change itself is a simple deletion of the attestation code and its changelog entry. There is no direct evidence in the commit of a security vulnerability; it appears to be a product decision to stop sending this proof, possibly because the feature was not ready or was being reconsidered. It reduces the amount of identity information the device exposes during authentication.

This commit changes how the Trezor firmware exposes its internal Git commit hash (the 'revision ID'). Previously the full hash was directly readable by software. Now only a shortened version is stored plainly, while the full hash is lightly scrambled (XORed) and only returned through a function that requires a specific key byte. The goal is to make it harder for a malicious fake Trezor to copy the revision ID from an official firmware update and pretend it is running that official firmware. It is a defensive hardening change, not a fix for an active bug or vulnerability in the traditional sense.

This commit is a cleanup of how the word 'const' is used in the Trezor firmware's ed25519 cryptographic code. Previously, the code defined a custom 'CONST' macro that meant 'const' on newer compilers and nothing on older GCC versions. The commit removes that macro and uses plain 'const' everywhere. It also adjusts a Rust build script comment and compiler flag. There is no indication in the commit that this fixes a security vulnerability or changes runtime behavior.

This commit is a straightforward code reorganization: it moves the emulator's profile-handling code from one directory to another and updates the build files and include paths accordingly. There is no change to what the code does, no bug fix, and no security-related change.

This commit is a straightforward internal code refactor. It renames a build feature flag from 'applet' to 'applets' and replaces the KERNEL preprocessor guard with a new USE_APPLETS guard in the relevant source files. There is no change to actual security logic, no bug fix, and no indication of a vulnerability being addressed.

This commit updates the Trezor firmware build system and emulator code to use SDL3 instead of the older SDL2 library. It is a routine dependency migration affecting only emulator builds (software simulations of the hardware wallet), not the real device firmware. The changes rename functions and constants to match SDL3's API, adjust build scripts, and add a couple of small safety checks. There is no indication this fixes a known security vulnerability.

This commit fixes a logic error in the build scripts that decide whether to use development or production signing keys when preparing Trezor firmware images. Before the fix, the condition was accidentally inverted, so production builds may have used development keys and development builds may have used production keys. Using the wrong keys could make firmware signatures invalid or cause devices to reject genuine firmware, but the commit itself does not show an exploitable runtime vulnerability in shipped code.

This patch fixes several integer-handling bugs in the Trezor bootloader's USB message decoder. The changes prevent small or maliciously crafted message sizes from causing arithmetic overflows or underflows when the device calculates how many USB packets to read. Such flaws could potentially let an attacker confuse the bootloader into reading memory out of bounds or behaving unpredictably during a firmware update.

This commit fixes an out-of-bounds memory read bug in the Trezor bootloader's firmware header parser. The read_vendor_header function previously trusted size values inside a firmware file without first checking whether those sizes fit within the actual data buffer. A malformed firmware update or a corrupted on-device firmware image could have caused the bootloader to read memory beyond the allowed region. The patch adds size checks so the parser rejects too-small or oversized headers before using their contents.

This commit renames and restructures how Trezor firmware selects cryptographic signing keys for bootloaders. Previously, non-production builds automatically used weaker development/QA keys. Now, a dedicated BOOTLOADER_DEVEL flag controls that, while a separate FORCE_BOOTLOADER_UPGRADE flag controls whether the firmware should forcibly update the bootloader. The change also prevents combining PRODUCTION=1 with BOOTLOADER_DEVEL=1. This is primarily a build-hardening and internal workflow cleanup; it does not by itself fix a remotely exploitable bug in shipped devices.

This commit adds a new backup and recovery method called N4W1 to Trezor firmware. It is a feature addition that lets users back up and restore their wallet seed using a near-field wireless tag instead of typing words on the device screen. The change is mostly about adding new code paths and tests; it does not appear to fix a known security bug, nor does the vendor describe it as a security patch.

This commit fixes an off-by-one-style bounds check in the Ethereum clear-signing code on Trezor hardware wallets. The old check only verified that the starting position was inside the data, but did not verify that the code was about to read 32 bytes from that position. As a result, a malformed Ethereum transaction or message could trick the device into reading past the end of a buffer while decoding human-readable fields. The fix now checks that offset plus 32 bytes does not exceed the data length before reading.

This commit adds a new feature to Trezor Ethereum signing that lets the device ask the connected computer or phone for extra token/contract display information during a transaction. It is a feature addition (not a direct bug fix), so it mainly changes how the wallet and device talk to each other. There is no clear security vulnerability visible in the diff, but any new request/response protocol introduces places where a malicious or buggy host could supply misleading data, and the device must carefully validate what it receives. The commit does not itself describe a security issue or credit a researcher.

This commit changes how Trezor displays Ethereum token-approval amounts that exceed a safety threshold. Previously, the code returned 'None' for such large amounts, and the user interface fell back to a generic 'Unlimited amount' warning. Now the formatter explicitly returns a special 'AboveThreshold' marker carrying the text 'Unlimited', and each device UI layout uses that marker to show the same warning and display text. The change is a user-interface refinement, not a fix for a cryptographic bug or a remote exploit. It does, however, make the 'unlimited' signal explicit rather than implicit, which slightly reduces the chance that a future UI change would accidentally treat a huge allowance as an ordinary amount.

This commit fixes a UI bug in how the Trezor hardware wallet counts and displays the last character of a passphrase when it contains multi-byte UTF-8 characters (such as emoji or accented letters). Previously, the code measured length in bytes and sliced the string by byte position, which could split a multi-byte character and produce a broken or incorrect last-character display. The change adds proper character-based counting and a safe way to retrieve the last character. It is a correctness/robustness fix rather than a clear security vulnerability, and there is no evidence it was disclosed or exploited as a security issue.

This is a routine cleanup change that removes an unused visual border feature from the Trezor firmware's Delizia user interface. It does not change any security-sensitive behavior; it only simplifies the code by deleting a function that always returned zero-width borders and updating two places that called it to no longer use a border wrapper.

This commit changes how Trezor hardware wallets display passphrase entry on screen. Previously, the passphrase characters were shown in plain text as the user typed them. After this change, already-typed characters are hidden (shown as dots or asterisks), with only the most recently typed character briefly visible. The user can press and hold in the input area to reveal the full passphrase for verification. This is a security/usability improvement to reduce shoulder-surfing risk, not a fix for an exploitable vulnerability.

This commit changes how Trezor devices reveal a passphrase on screen while typing. Previously, the revealed passphrase would hide again if the user's finger slid outside a specific extended area below the input box. Now, the passphrase stays visible until the user simply lifts their finger anywhere on the screen. This is a user-experience refinement, not a security fix or vulnerability.

This commit is a straightforward code cleanup: it takes one large Rust source file for the Trezor hardware wallet's homescreen and splits it into three smaller, logically organized files (header, notification center, and helpers) plus a module entry point. No user-facing behavior, security logic, or data handling changed.

This commit only changes the text label on a bootloader button from 'INSTALL FIRMWARE'/'INSTALL FW' to 'INITIATE CONNECTION'/'Init connection' on three Trezor hardware wallet models. It is a user-interface wording improvement with no security or functional code changes.

This commit simply removes an unused Monero hashing helper (the 'Hasher' class and related C functions) from the Trezor firmware codebase. It deletes dead code, tests, and type stubs. There is no indication this fixes or introduces a security vulnerability.

This commit is a simple renaming cleanup. It changes identifiers like 'EthereumERC7730DisplayFormatInfo' to 'EthereumDisplayFormatInfo' and 'ETHEREUM_ERC7730_DISPLAY_FORMAT' to 'ETHEREUM_DISPLAY_FORMAT' across protobuf definitions, generated code, and tests. There are no functional changes to how data is validated, parsed, or displayed.

This commit only adds and updates automated tests for Trezor's Ethereum 'clear signing' feature (ERC-7730 display formats). It does not change the firmware's security logic, so it is not a security patch. The tests verify that malformed or mismatched definitions are rejected, which is a normal defensive testing activity.

This commit only adds stronger checks to existing automated tests for Ethereum 'clear signing' on Trezor devices. It does not change any firmware, wallet, or production code, so it cannot introduce a security vulnerability or fix one in shipped software.

This commit changes how Trezor handles Ethereum transactions with large amounts of embedded data. Previously, the device always tried to 'clear sign' (show human-readable details on screen) for every transaction. Now, if the transaction data is larger than an internal storage limit, it skips clear signing and falls back to 'blind signing' (showing a generic warning). The change is described as a workaround because the clear-signing parser cannot fetch additional data chunks, and enabling it would remove the ability to fall back to blind signing. This is a defensive/hardening change rather than a fix for an active vulnerability, but it reduces the chance that a large malicious transaction could confuse the parser or the user.