What the developer wrote
Authored by Roman Zeyde
chore(core): update T3W1 dev secmon
Also, add a comment about dev secmon build in `SConscript.kernel`.
[no changelog]
(cherry picked from commit 7d0ae5012dcbeecd038ef1bca6c6d5471ff94c5f)
What changed, and why it matters
This commit updates a pre-built binary file used only in developer builds of the Trezor T3W1 hardware wallet's secure monitor, and adds a one-line comment explaining how that developer binary is built. There is no indication this affects production firmware or fixes a security vulnerability. It appears to be a routine development-only maintenance change.
No immediate action required. If auditing, verify the regenerated `secmon_DEV.bin` against its intended source build and ensure it is not accidentally included in production release builds.
Security signals we found
Binary blob update for secure monitor (secmon) — contents not reviewable from diff
Only affects developer build configuration (`BOOTLOADER_DEVEL=1`, `UNSAFE_FW=1`)
No changelog entry and no security-related commit message
Evidence from the diff
The change touches two files: (1) core/SConscript.kernel adds a comment clarifying that _DEV secmon binaries are produced with make build_secmon BOOTLOADER_DEVEL=1; (2) core/embed/models/T3W1/secmon/secmon_DEV.bin is a regenerated binary blob for the T3W1 secure monitor in development mode. The diff provides no source-level detail about what changed in the binary. The _DEV path is selected only when BOOTLOADER_DEVEL=1 and UNSAFE_FW=1, so this is strictly a development/test artifact, not a production release path.
Changed components
core/embed/models/T3W1/secmon/secmon_DEV.bincore/SConscript.kernelInspect captured patch +1 / −0
diff --git a/core/SConscript.kernel b/core/SConscript.kernel
index 7a107ab2b..0922109d3 100644
--- a/core/SConscript.kernel
+++ b/core/SConscript.kernel
@@ -391,6 +391,7 @@ VENDORHEADER = f'embed/models/{TREZOR_MODEL}/vendorheader/vendorheader_{vendor}.
if BOOTLOADER_DEVEL:
if UNSAFE_FW:
+ # the `_DEV` binaries below are built using `make build_secmon BOOTLOADER_DEVEL=1`
SECMON = f'embed/models/{TREZOR_MODEL}/secmon/secmon_DEV.bin'
SECMON_API = f'embed/models/{TREZOR_MODEL}/secmon/secmon_api_DEV.o'
else:
diff --git a/core/embed/models/T3W1/secmon/secmon_DEV.bin b/core/embed/models/T3W1/secmon/secmon_DEV.bin
index 6a53420fa..e22b1e725 100755
Binary files a/core/embed/models/T3W1/secmon/secmon_DEV.bin and b/core/embed/models/T3W1/secmon/secmon_DEV.bin differ
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.