fix(core/prodtest): exclude `backup-ram-erase` command from production prodtest
What the developer wrote
Authored by Roman Zeyde
fix(core/prodtest): exclude `backup-ram-erase` command from production prodtest
Following 73684a2811101d2c5207fac96551e6ff27f3a6a3.
[no changelog]
What changed, and why it matters
This commit removes a factory-testing command called backup-ram-erase from production builds of Trezor hardware wallets. The command was previously available in both production and non-production (development/test) builds, but should only exist in development builds. It is a hardening/cleanup change rather than a fix for an active exploit, because reaching the production-test command interface already requires physical access and special tooling.
Verify that production prodtest binaries no longer list backup-ram-erase and that the prior commit's rationale is documented. No urgent user action is required because prodtest is not end-user firmware.
Security signals we found
Command exposure reduction in production firmware
Follow-up to prior commit 73684a2811101d2c5207fac96551e6ff27f3a6a3
Defense in depth: limits backup RAM erase capability to non-production builds
Evidence from the diff
The change moves the PRODTEST_CLI_CMD registration for backup-ram-erase inside an #if !PRODUCTION preprocessor guard. Previously, backup-ram-erase was registered unconditionally while backup-ram-read was already guarded. The commit aligns the erase command with the read command so neither is exposed in production prodtest firmware. The underlying erase function (prodtest_backup_ram_erase) remains compiled; only its CLI registration is excluded from production builds.
Changed components
core/embed/projects/prodtest/cmd/prodtest_backup_ram.cProduction prodtest CLI command tableInspect captured patch +2 / −2
diff --git a/core/embed/projects/prodtest/cmd/prodtest_backup_ram.c b/core/embed/projects/prodtest/cmd/prodtest_backup_ram.c
index d0aecf7c..c61ce2e9 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_backup_ram.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_backup_ram.c
@@ -187,6 +187,8 @@ PRODTEST_CLI_CMD(
.args = ""
);
+#if !PRODUCTION
+
PRODTEST_CLI_CMD(
.name = "backup-ram-erase",
.func = prodtest_backup_ram_erase,
@@ -194,8 +196,6 @@ PRODTEST_CLI_CMD(
.args = ""
);
-#if !PRODUCTION
-
PRODTEST_CLI_CMD(
.name = "backup-ram-read",
.func = prodtest_backup_ram_read,
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.