What changed, and why it matters
This commit simply deletes an internal developer/reflashing utility called 'reflash' from the Trezor firmware source tree. It removes the build rules, linker script, and source code that allowed writing the boardloader and bootloader from an SD card. There is no patch to any runtime security boundary, no disclosed vulnerability, and no evidence this change fixes an exploitable bug.
No security action required. Treat as routine repository maintenance. If the reflash tool is still needed for manufacturing or repair, verify it is retained in an internal branch or separate tooling repository.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit removes the ‘reflash’ project under core/embed/projects/reflash, its SConscript, Makefile targets, and SConstruct registration. The deleted main.c implemented an SD-card-based reflashing tool that erased and rewrote BOARDLOADER_AREA and BOOTLOADER_AREA from raw SD card sectors. The change is a build-tree cleanup (chore) with [no changelog] and no functional replacement. It does not alter the firmware, bootloader, boardloader, or any cryptographic/secure-element code paths that are active in production devices.
Changed components
core/embed/projects/reflash (deleted)core/Makefilecore/SConstructcore/SConscript.reflash (deleted)Inspect captured patch +1 / −375
diff --git a/core/Makefile b/core/Makefile
index 158ecff9b..ea2695cdf 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -17,7 +17,6 @@ BOOTLOADER_CI_BUILD_DIR = $(BUILD_DIR)/bootloader_ci
BOOTLOADER_EMU_BUILD_DIR = $(BUILD_DIR)/bootloader_emu
PRODTEST_BUILD_DIR = $(BUILD_DIR)/prodtest
PRODTEST_EMU_BUILD_DIR = $(BUILD_DIR)/prodtest_emu
-REFLASH_BUILD_DIR = $(BUILD_DIR)/reflash
KERNEL_BUILD_DIR = $(BUILD_DIR)/kernel
SECMON_BUILD_DIR = $(BUILD_DIR)/secmon
FIRMWARE_BUILD_DIR = $(BUILD_DIR)/firmware
@@ -315,11 +314,6 @@ build_prodtest: ## build production test firmware
build_prodtest_emu: ## build the unix prodtest emulator
$(SCONS) $(PRODTEST_EMU_BUILD_DIR)/prodtest.elf
-build_reflash: ## build reflash firmware + reflash image
- $(SCONS) $(REFLASH_BUILD_DIR)/reflash.bin
- dd if=build/boardloader/boardloader.bin of=$(REFLASH_BUILD_DIR)/sdimage.bin bs=1 seek=0
- dd if=build/bootloader/bootloader.bin of=$(REFLASH_BUILD_DIR)/sdimage.bin bs=1 seek=49152
-
build_secmon: ## build security monitor image
$(SCONS) $(SECMON_BUILD_DIR)/secmon.bin
@@ -351,7 +345,7 @@ build_cross: ## build mpy-cross port
## clean commands:
clean: clean_boardloader clean_bootloader clean_bootloader_emu clean_bootloader_ci \
- clean_prodtest clean_reflash clean_firmware clean_kernel clean_secmon clean_unix clean_cross ## clean all
+ clean_prodtest clean_firmware clean_kernel clean_secmon clean_unix clean_cross ## clean all
rm -f ".sconsign.dblite"
clean_boardloader: ## clean boardloader build
@@ -369,9 +363,6 @@ clean_bootloader_emu: ## clean bootloader_emu build
clean_prodtest: ## clean prodtest build
rm -rf $(PRODTEST_BUILD_DIR)
-clean_reflash: ## clean reflash build
- rm -rf $(REFLASH_BUILD_DIR)
-
clean_secmon: ## clean security monitor build
rm -rf $(SECMON_BUILD_DIR)
diff --git a/core/SConscript.reflash b/core/SConscript.reflash
deleted file mode 100644
index 763ee0fed..000000000
--- a/core/SConscript.reflash
+++ /dev/null
@@ -1,205 +0,0 @@
-# pylint: disable=E0602
-
-import os
-import tools, models, ui
-
-TREZOR_MODEL = ARGUMENTS.get('TREZOR_MODEL', 'T2T1')
-CMAKELISTS = int(ARGUMENTS.get('CMAKELISTS', 0))
-HW_REVISION = ARGUMENTS.get('HW_REVISION', None)
-
-if TREZOR_MODEL in ('D001', 'D002'):
- # skip reflash build
- env = Environment()
- def build_reflash(target,source,env):
- print(f'Reflash: nothing to build for Model {TREZOR_MODEL}')
- program_bin = env.Command(
- target='reflash.bin',
- source=None,
- action=build_reflash)
- Return()
-
-FEATURES_WANTED = [
- "display",
- "input",
- "sd_card",
- ]
-
-CCFLAGS_MOD = ''
-CPPPATH_MOD = []
-CPPDEFINES_MOD = []
-SOURCE_MOD = []
-SOURCE_MOD_CRYPTO = []
-CPPDEFINES_HAL = []
-SOURCE_HAL = []
-PATH_HAL = []
-RUST_UI_FEATURES = []
-
-CPPDEFINES_MOD += [
- 'KERNEL_MODE',
- 'SECURE_MODE',
-]
-
-# modtrezorcrypto
-CPPPATH_MOD += [
- 'vendor/trezor-crypto',
- 'vendor/trezor-storage',
-]
-SOURCE_MOD_CRYPTO += [
- 'vendor/trezor-crypto/memzero.c',
-]
-
-# modtrezorui
-CPPPATH_MOD += [
- 'vendor/micropython/lib/uzlib',
-]
-SOURCE_MOD += [
- 'embed/gfx/bitblt/gfx_bitblt.c',
- 'embed/gfx/bitblt/gfx_bitblt_mono8.c',
- 'embed/gfx/bitblt/gfx_bitblt_rgb565.c',
- 'embed/gfx/bitblt/gfx_bitblt_rgba8888.c',
- 'embed/gfx/fonts/font_bitmap.c',
- 'embed/gfx/gfx_color.c',
- 'embed/gfx/gfx_draw.c',
- 'embed/gfx/terminal.c',
- 'embed/io/display/display_utils.c',
- 'embed/util/image/image.c',
- 'embed/util/rsod/rsod.c',
- 'embed/util/scm_revision/scm_revision.c',
- 'embed/rtl/error_handling.c',
- 'embed/rtl/mini_printf.c',
- 'vendor/micropython/lib/uzlib/adler32.c',
- 'vendor/micropython/lib/uzlib/crc32.c',
- 'vendor/micropython/lib/uzlib/tinflate.c',
- 'vendor/trezor-storage/flash_area.c',
-]
-
-ui.init_ui(TREZOR_MODEL, "prodtest", RUST_UI_FEATURES)
-
-env = Environment(
- ENV=os.environ,
- CFLAGS='%s -DPRODUCTION=%s' % (ARGUMENTS.get('CFLAGS', ''), ARGUMENTS.get('PRODUCTION', '0')),
- CPPDEFINES_IMPLICIT=[],
- CPPDEFPREFIX="-D'",
- CPPDEFSUFFIX="'",
-)
-
-FEATURES_AVAILABLE = models.configure_board(TREZOR_MODEL, HW_REVISION, FEATURES_WANTED, env, CPPDEFINES_HAL, SOURCE_HAL, PATH_HAL)
-
-SOURCE_REFLASH = [
- 'embed/projects/reflash/header.S',
- 'embed/projects/reflash/main.c',
-]
-
-env.Replace(
- CAT='cat',
- CP='cp',
- AS='arm-none-eabi-as',
- AR='arm-none-eabi-ar',
- CC='arm-none-eabi-gcc',
- LINK='arm-none-eabi-gcc',
- SIZE='arm-none-eabi-size',
- STRIP='arm-none-eabi-strip',
- OBJCOPY='arm-none-eabi-objcopy',
- PYTHON='python',
- MAKECMAKELISTS='$PYTHON tools/make_cmakelists.py',)
-
-env.Replace(
- TREZOR_MODEL=TREZOR_MODEL, )
-
-env.Replace(
- COPT=env.get('ENV').get('OPTIMIZE', '-Os'),
- CCFLAGS='$COPT '
- '-g3 '
- '-nostdlib '
- '-std=gnu11 -Wall -Werror -Wdouble-promotion -Wpointer-arith -Wno-missing-braces -fno-common '
- '-fsingle-precision-constant -fdata-sections -ffunction-sections '
- '-ffreestanding '
- '-fstack-protector-all '
- + env.get('ENV')["CPU_CCFLAGS"] + CCFLAGS_MOD,
- CCFLAGS_QSTR='-DNO_QSTR -DN_X64 -DN_X86 -DN_THUMB',
- LINKFLAGS=f'-T build/reflash/memory.ld -Wl,--gc-sections -Wl,-Map=build/reflash/reflash.map -Wl,--warn-common',
- CPPPATH=[
- 'embed/projects/reflash',
- 'embed/rtl/inc',
- 'embed/models',
- 'embed/gfx/inc',
- 'embed/sys/bsp/inc',
- 'embed/util/image/inc',
- 'embed/util/rsod/inc',
- 'embed/util/scm_revision/inc',
- 'embed/upymod/modtrezorui',
- ] + CPPPATH_MOD + PATH_HAL,
- CPPDEFINES=[
- 'TREZOR_MODEL_'+TREZOR_MODEL,
- 'USE_HAL_DRIVER',
- ] + CPPDEFINES_MOD + CPPDEFINES_HAL,
- ASFLAGS=env.get('ENV')['CPU_ASFLAGS'],
- ASPPFLAGS='$CFLAGS $CCFLAGS',
- )
-
-env.Replace(
- HEADERTOOL='headertool',
-)
-
-env.Replace(
- ALLSOURCES=SOURCE_MOD + SOURCE_MOD_CRYPTO + SOURCE_REFLASH + SOURCE_HAL,
- ALLDEFS=tools.get_defs_for_cmake(env['CPPDEFINES'] + env['CPPDEFINES_IMPLICIT']))
-
-cmake_gen = env.Command(
- target='CMakeLists.txt',
- source='',
- action='$MAKECMAKELISTS --sources $ALLSOURCES --dirs $CPPPATH --defs $ALLDEFS',
-)
-
-#
-# Program objects
-#
-
-obj_program = []
-obj_program += env.Object(source=SOURCE_MOD)
-obj_program += env.Object(source=SOURCE_MOD_CRYPTO, CCFLAGS='$CCFLAGS -ftrivial-auto-var-init=zero')
-obj_program += env.Object(source=SOURCE_REFLASH)
-obj_program += env.Object(source=SOURCE_HAL)
-
-VENDORHEADER = f'embed/models/{TREZOR_MODEL}/vendorheader/vendorheader_' + ('unsafe_signed_dev.bin' if ARGUMENTS.get('PRODUCTION', '0') == '0' else 'satoshilabs_signed_prod.bin')
-
-tools.embed_raw_binary(
- obj_program,
- env,
- 'vendorheader',
- 'embed/projects/firmware/vendorheader.o',
- VENDORHEADER,
- )
-
-linkerscript_gen = env.Command(
- target='memory.ld',
- source=[f'embed/models/{TREZOR_MODEL}/memory.ld', env.get('ENV')['LINKER_SCRIPT'].format(target='prodtest')],
- action='$CAT $SOURCES > $TARGET',
-)
-
-program_elf = env.Command(
- target='reflash.elf',
- source=obj_program,
- action=
- '$LINK -o $TARGET $CCFLAGS $CFLAGS $LINKFLAGS $SOURCES -lc_nano -lgcc',
-)
-
-env.Depends(program_elf, linkerscript_gen)
-
-BINARY_NAME = f"build/reflash/reflash-{TREZOR_MODEL}"
-BINARY_NAME += "-" + tools.get_version('embed/projects/reflash/version.h')
-BINARY_NAME += "-" + tools.get_git_revision_short_hash()
-BINARY_NAME += "-dirty" if tools.get_git_modified() else ""
-BINARY_NAME += ".bin"
-
-if CMAKELISTS != 0:
- env.Depends(program_elf, cmake_gen)
-
-program_bin = env.Command(
- target='reflash.bin',
- source=program_elf,
- action=[
- '$OBJCOPY -O binary -j .vendorheader -j .header -j .flash -j .data -j .confidential $SOURCE $TARGET',
- '$HEADERTOOL $TARGET ' + ('-D' if ARGUMENTS.get('PRODUCTION', '0') == '0' else ''),
- '$CP $TARGET ' + BINARY_NAME,
- ], )
diff --git a/core/SConstruct b/core/SConstruct
index 48a677dc2..af21e6cce 100644
--- a/core/SConstruct
+++ b/core/SConstruct
@@ -12,7 +12,6 @@ SConscript('SConscript.kernel', variant_dir='build/kernel', duplicate=False)
SConscript('SConscript.firmware', variant_dir='build/firmware', duplicate=False)
SConscript('SConscript.prodtest', variant_dir='build/prodtest', duplicate=False)
SConscript('SConscript.prodtest_emu', variant_dir='build/prodtest_emu', duplicate=False)
-SConscript('SConscript.reflash', variant_dir='build/reflash', duplicate=False)
SConscript('SConscript.unix', variant_dir='build/unix', duplicate=False)
if ARGUMENTS.get('QUIET_MODE', '0') == '1':
diff --git a/core/embed/projects/reflash/header.S b/core/embed/projects/reflash/header.S
deleted file mode 100644
index e41f02e8d..000000000
--- a/core/embed/projects/reflash/header.S
+++ /dev/null
@@ -1,35 +0,0 @@
- .syntax unified
-
-#include "version.h"
-
- .section .header, "a"
-
- .type g_header, %object
- .size g_header, .-g_header
-
-g_header:
- .byte 'T','R','Z','F' // magic
- .word g_header_end - g_header // hdrlen
-#ifdef TREZOR_MODEL_T2T1
- .word 0 // expiry
-#else
- .word 1 // expiry
-#endif
- .word _codelen // codelen
- .byte VERSION_MAJOR // vmajor
- .byte VERSION_MINOR // vminor
- .byte VERSION_PATCH // vpatch
- .byte VERSION_BUILD // vbuild
- .byte FIX_VERSION_MAJOR // fix_vmajor
- .byte FIX_VERSION_MINOR // fix_vminor
- .byte FIX_VERSION_PATCH // fix_vpatch
- .byte FIX_VERSION_BUILD // fix_vbuild
- .word HW_MODEL // type of the designated hardware
- .byte HW_REVISION // revision of the designated hardware
- .byte FIRMWARE_MONOTONIC_VERSION // monotonic version of the binary
- . = . + 2 // reserved
- . = . + 512 // hash1 ... hash16
- . = . + 415 // reserved
- .byte 0 // sigmask
- . = . + 64 // sig
-g_header_end:
diff --git a/core/embed/projects/reflash/main.c b/core/embed/projects/reflash/main.c
deleted file mode 100644
index ced73512a..000000000
--- a/core/embed/projects/reflash/main.c
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-
-#include <trezor_model.h>
-#include <trezor_rtl.h>
-
-#include <gfx/gfx_draw.h>
-#include <gfx/terminal.h>
-#include <io/display.h>
-#include <io/sdcard.h>
-#include <io/touch.h>
-#include <sec/rng.h>
-#include <sys/bootutils.h>
-#include <sys/system.h>
-#include <sys/systimer.h>
-#include <util/flash.h>
-#include <util/image.h>
-#include <util/rsod.h>
-#include "flash.h"
-
-#ifdef USE_HASH_PROCESSOR
-#include <sec/hash_processor.h>
-#endif
-
-static void progress_callback(int pos, int len) { term_printf("."); }
-
-static void flash_from_sdcard(const flash_area_t *area, uint32_t source,
- uint32_t length) {
- static uint32_t buf[SDCARD_BLOCK_SIZE / sizeof(uint32_t)];
-
- _Static_assert(SDCARD_BLOCK_SIZE % FLASH_BLOCK_SIZE == 0);
- ensure(sectrue * (source % SDCARD_BLOCK_SIZE == 0),
- "source not a multiple of block size");
- ensure(sectrue * (length % SDCARD_BLOCK_SIZE == 0),
- "length not a multiple of block size");
-
- for (uint32_t i = 0; i < length / SDCARD_BLOCK_SIZE; i++) {
- term_printf("read %d\n", (unsigned int)(i + source / SDCARD_BLOCK_SIZE));
-
- ensure(sdcard_read_blocks(buf, i + source / SDCARD_BLOCK_SIZE, 1),
- "sdcard_read_blocks");
-
- for (uint32_t j = 0; j < SDCARD_BLOCK_SIZE / FLASH_BLOCK_SIZE; j++) {
- ensure(flash_area_write_block(
- area, i * SDCARD_BLOCK_SIZE + j * FLASH_BLOCK_SIZE,
- &buf[j * FLASH_BLOCK_WORDS]),
- NULL);
- }
- }
-}
-
-int main(void) {
- system_init(&rsod_panic_handler);
-
- sdcard_init();
- touch_init();
-
-#ifdef USE_HASH_PROCESSOR
- hash_processor_init();
-#endif
-
- display_set_orientation(0);
- gfx_clear();
- display_set_backlight(255);
-
- ensure(sdcard_is_present(), "sdcard_is_present");
-
- term_printf("updating boardloader + bootloader\n");
-
- term_printf("erasing sectors");
- ensure(flash_area_erase(&BOARDLOADER_AREA, progress_callback),
- "flash_erase_sectors");
- ensure(flash_area_erase(&BOOTLOADER_AREA, progress_callback),
- "flash_erase_sectors");
- term_printf("\n");
- term_printf("erased\n");
-
- ensure(flash_unlock_write(), NULL);
-
- ensure(sdcard_power_on(), NULL);
-
-#define BOARDLOADER_CHUNK_SIZE (16 * 1024)
-#define BOARDLOADER_TOTAL_SIZE (3 * BOARDLOADER_CHUNK_SIZE)
-#define BOOTLOADER_TOTAL_SIZE (128 * 1024)
-
- flash_from_sdcard(&BOARDLOADER_AREA, 0, BOARDLOADER_TOTAL_SIZE);
- flash_from_sdcard(&BOOTLOADER_AREA, BOARDLOADER_TOTAL_SIZE,
- BOOTLOADER_TOTAL_SIZE);
-
- term_printf("done\n");
- sdcard_power_off();
- ensure(flash_lock_write(), NULL);
-
- return 0;
-}
diff --git a/core/embed/projects/reflash/version.h b/core/embed/projects/reflash/version.h
deleted file mode 100644
index 07bd5a3a1..000000000
--- a/core/embed/projects/reflash/version.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#pragma once
-
-#include "model_version.h"
-
-#define VERSION_MAJOR 0
-#define VERSION_MINOR 1
-#define VERSION_PATCH 0
-#define VERSION_BUILD 0
-
-#define FIX_VERSION_MAJOR 0
-#define FIX_VERSION_MINOR 1
-#define FIX_VERSION_PATCH 0
-#define FIX_VERSION_BUILD 0
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.