security: SolanaSignMessage AdvancedMode gate + TransferChecked with token_info

Author: BitHighlander

scripts/generate-test-report.py

@@ -19,7 +19,7 @@ def _read_png_pixels(path):
     """Read a 256x64 grayscale PNG and return raw pixel bytes (256*64 bytes, 0 or 255)."""
     with open(path, 'rb') as f:
         data = f.read()
-    # Minimal PNG parser -- skip signature, find IDAT, decompress
+    # Minimal PNG parser — skip signature, find IDAT, decompress
     assert data[:8] == b'\x89PNG\r\n\x1a\n'
     pos = 8
     idat_chunks = []
@@ -191,14 +191,14 @@ def _is_setup_frame(path):
     """Check if a screenshot is a setUp noise frame (IMPORT RECOVERY, WIPE, or blank/logo)."""
     try:
         pixels, w, h = _read_png_pixels(path)
-        # Count non-zero pixels -- blank/logo frames have very few or very specific patterns
+        # Count non-zero pixels — blank/logo frames have very few or very specific patterns
         lit = sum(1 for b in pixels if b > 128)
         total = w * h
         # Very blank (< 5% lit) = idle/logo screen
         if lit < total * 0.05:
             return True
         # Check for "IMPORT RECOVERY" text by looking at pixel density in top-left region
-        # setUp always shows this screen -- it's ~20% lit with specific pattern
+        # setUp always shows this screen — it's ~20% lit with specific pattern
         # Real test screens vary widely, so we check the raw bytes for known patterns
         # Simple heuristic: if first 2 btn frames match, skip them (setUp wipe + load)
         return False
@@ -212,7 +212,7 @@ def _pick_best_frame(test_dir, btn_files):
     if not btn_files:
         return None
     # 3+ frames: [0]=setUp wipe, [1]=setUp load or instruction detail, [-1]=final confirm
-    # Prefer second-to-last frame -- it's the instruction-specific content
+    # Prefer second-to-last frame — it's the instruction-specific content
     # (amounts, addresses, parameters). The last frame is usually a generic
     # "Sign this transaction?" confirmation that's the same for every tx.
     if len(btn_files) > 2:
@@ -221,10 +221,10 @@ def _pick_best_frame(test_dir, btn_files):
         return os.path.join(test_dir, btn_files[idx])
     elif len(btn_files) == 2:
         # 2 frames: btn00000 is always setUp (wipe confirm), btn00001 is the test.
-        # Always show btn00001 -- it's the only real test frame.
+        # Always show btn00001 — it's the only real test frame.
         return os.path.join(test_dir, btn_files[1])
     else:
-        # Single frame -- almost always setUp noise (wipe confirm from setUp).
+        # Single frame — almost always setUp noise (wipe confirm from setUp).
         return None
 
 def detect_fw():
@@ -263,7 +263,7 @@ def parse_junit(path):
         # Key by module::method (disambiguates collisions like test_sign_btc_eth_swap)
         if mod:
             results[f'{mod}::{name}'] = status
-        # Bare method fallback -- only set if no collision
+        # Bare method fallback — only set if no collision
         if name not in results or status == 'pass':
             results[name] = status
     return results
@@ -649,13 +649,13 @@ def parse_junit(path):
          ('E16', 'test_msg_ethereum_signtx', 'test_ethereum_blind_sign_blocked',
           'Blind sign BLOCKED (AdvancedMode OFF)',
           'Contract data with AdvancedMode disabled. Device shows BLOCKED screen and refuses to sign. '
-          'This is the default behavior -- blind signing must be explicitly enabled.',
-          ['BLOCKED screen']),
+          'This is the default behavior — blind signing must be explicitly enabled.',
+          []),  # screenshots added when AdvancedMode policy lands (7-prep)
          ('E17', 'test_msg_ethereum_signtx', 'test_ethereum_blind_sign_allowed',
           'Blind sign ALLOWED (AdvancedMode ON)',
           'Contract data with AdvancedMode enabled. Device shows BLIND SIGNATURE warning '
           'before proceeding. User sees raw data and must explicitly confirm.',
-          ['BLIND SIGNATURE warning'])
+          []),  # screenshots added when AdvancedMode policy lands (7-prep)
      ]),
 
     ('R', 'Ripple (XRP)', '7.0.0',
@@ -835,7 +835,10 @@ def parse_junit(path):
          ('S3', 'test_msg_solana_getaddress', 'test_solana_deterministic',
           'Deterministic derivation', 'Same path always produces same address.', []),
          ('S3b', 'test_msg_solana_getaddress', 'test_solana_show_address',
-          'Show address on OLED', 'Full 44-char base58 address with QR code on OLED display.', ['Solana QR + 44-char address']),
+          'Show Solana address on OLED',
+          'Full 44-character base58 address with QR code and derivation path displayed on OLED. '
+          'User compares against wallet app — primary defense against address substitution.',
+          ['Solana QR + address']),
          ('S4', 'test_msg_solana_signtx', 'test_solana_sign_system_transfer',
           'Sign SOL transfer', 'System::Transfer with full address + amount display.', ['SOL amount + address']),
          ('S5', 'test_msg_solana_signtx', 'test_solana_sign_message',
@@ -879,13 +882,20 @@ def parse_junit(path):
          ('T3', 'test_msg_tron_getaddress', 'test_tron_deterministic',
           'Deterministic derivation', 'Same path always produces same address.', []),
          ('T3b', 'test_msg_tron_getaddress', 'test_tron_show_address',
-          'Show address on OLED', 'Full 34-char Base58Check TRON address with QR code.', ['TRON QR + 34-char address']),
+          'Show TRON address on OLED',
+          'Full 34-character base58 address with QR code and derivation path m/44\'/195\'/0\'/0/0 '
+          'displayed on OLED. User compares against wallet app to detect address substitution.',
+          ['TRON QR + address']),
          ('T4', 'test_msg_tron_signtx', 'test_tron_sign_transfer_structured',
           'Sign TRX transfer', 'Structured clear-sign with full address display.', ['TRX send']),
          ('T5', 'test_msg_tron_signtx', 'test_tron_sign_transfer_legacy_raw_data',
           'Sign TRX legacy raw', 'Raw protobuf data triggers blind sign path.', ['Blind sign']),
          ('T6', 'test_msg_tron_signtx', 'test_tron_sign_trc20_transfer',
-          'Sign TRC-20 USDT transfer', 'Known TRC-20 token decoded from ABI data. Shows "Send 1.00 USDT to [address]".', ['Token + amount']),
+          'Sign TRC-20 USDT transfer',
+          'Device decodes the ABI transfer(address,uint256) call, matches the contract address '
+          '(TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t) against its hardcoded USDT entry, and shows '
+          '"Send 1.00 USDT to [address]" with the decoded token name and amount.',
+          ['Token name + amount']),
          ('T7', 'test_msg_tron_signtx', 'test_tron_sign_missing_fields_rejected',
           'Missing fields rejected', 'Incomplete transaction data is refused.', []),
      ]),
@@ -904,7 +914,10 @@ def parse_junit(path):
          ('N2', 'test_msg_ton_getaddress', 'test_ton_different_accounts',
           'Different accounts', 'Different indices produce different addresses.', []),
          ('N2b', 'test_msg_ton_getaddress', 'test_ton_show_address',
-          'Show address on OLED', 'Full 48-char base64url TON address with QR code.', ['TON QR + 48-char address']),
+          'Show TON address on OLED',
+          'Full 48-character base64url address with QR code and derivation path displayed on OLED. '
+          'User verifies against wallet app.',
+          ['TON QR + address']),
          ('N3', 'test_msg_ton_getaddress', 'test_ton_address_format',
           'Address format validation', 'Bounceable/non-bounceable format check.', []),
          ('N4', 'test_msg_ton_signtx', 'test_ton_sign_structured',
@@ -1048,7 +1061,7 @@ def render(output_path, fw_version, results, screenshot_dir=None):
             pb.check(9, f'{tid} {meth}', r)
             pb.text(7, f'{title}  ({mod}.py)')
             for cline in _w(ctx, 95): pb.text(7, cline)
-            # Embed OLED screenshots -- use _pick_best_frame for the primary image,
+            # Embed OLED screenshots — use _pick_best_frame for the primary image,
             # then show up to 2 more frames for multi-screen flows (signing, swaps)
             if screenshot_dir:
                 test_dir = os.path.join(screenshot_dir, mod.replace('test_',''), meth)

test-report.pdf

@@ -146,7 +146,7 @@ def requires_message(self, msg_name):
                     continue
         if proto is None or not hasattr(proto, msg_name):
             self.skipTest("%s proto message not available" % msg_name)
-        # Send a minimal probe -- if firmware returns Failure_UnexpectedMessage, skip.
+        # Send a minimal probe — if firmware returns Failure_UnexpectedMessage, skip
         from keepkeylib import messages_pb2 as base_proto
         msg = getattr(proto, msg_name)()
         try:

tests/common.py

@@ -74,6 +74,7 @@ def test_ethereum_signtx_data(self):
             "691f73b145647623e2d115b208a7c3455a6a8a83e3b4db5b9c6d9bc75825038a",
         )
 
+        # Third sign — different params, different signature
         sig_v, sig_r, sig_s = self.client.ethereum_sign_tx(
             n=[0, 0],
             nonce=123456,
@@ -96,11 +97,13 @@ def test_ethereum_signtx_data(self):
         self.client.apply_policy("AdvancedMode", 0)
 
     def test_ethereum_blind_sign_blocked(self):
-        """AdvancedMode OFF + contract data = device refuses to sign.
+        """AdvancedMode OFF + contract data = device refuses to sign (7.14.0+).
 
-        OLED shows 'BLOCKED -- Blind signing requires AdvancedMode' then Failure.
+        OLED shows 'BLOCKED — Blind signing requires AdvancedMode' then Failure.
+        Prior to 7.14.0, firmware showed a warning but allowed signing.
         """
         self.requires_firmware("7.14.0")
+        self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 0)
 
@@ -119,12 +122,13 @@ def test_ethereum_blind_sign_blocked(self):
             self.assertIn("Blind signing disabled", str(e))
 
     def test_ethereum_blind_sign_allowed(self):
-        """AdvancedMode ON + contract data = device shows BLIND SIGNATURE warning.
+        """AdvancedMode ON + contract data = device shows BLIND SIGNATURE warning (7.14.0+).
 
-        OLED shows 'BLIND SIGNATURE -- You are signing raw contract data'
+        OLED shows 'BLIND SIGNATURE — You are signing raw contract data'
         before showing the data and allowing signing.
         """
         self.requires_firmware("7.14.0")
+        self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 1)
 

tests/emulator.img

@@ -199,12 +199,8 @@ def test_invalid_bip39_word_rejected(self):
         self.assertIsInstance(ret, proto.CharacterRequest)
         ret = self.client.call_raw(proto.CharacterAck(character=' '))
 
-        # Firmware 7.14.0+ rejects immediately with Failure -- word not in BIP-39 wordlist.
-        # Older firmware accepts any word (no per-word validation) -- skip if so.
-        if not isinstance(ret, proto.Failure):
-            # Cancel recovery and skip -- firmware lacks per-word validation
-            self.client.call_raw(proto.Cancel())
-            self.skipTest("Firmware does not reject invalid BIP-39 words (needs PR #3)")
+        # Firmware rejects immediately with Failure — word not in BIP-39 wordlist
+        self.assertIsInstance(ret, proto.Failure)
         self.assertIn("Word not found", ret.message)
 
         # Capture the OLED rejection screen via DebugLink

tests/test_msg_ethereum_signtx.py

@@ -66,20 +66,6 @@ def test_solana_get_address(self):
             "Invalid Solana address format: '%s' (len=%d)" % (address, len(address))
         )
 
-    def test_solana_show_address(self):
-        """Display Solana address on OLED with QR code (show_display=True)."""
-        self.requires_firmware("7.14.0")
-        self.requires_message("SolanaGetAddress")
-        self.setup_mnemonic_allallall()
-
-        resp = self.client.call(
-            solana_proto.SolanaGetAddress(
-                address_n=[H + 44, H + 501, H + 0, H + 0],
-                show_display=True,
-            )
-        )
-        self.assertIsInstance(resp, solana_proto.SolanaAddress)
-
     def test_solana_different_accounts(self):
         """Different account indices must produce different addresses."""
         self.requires_firmware("7.14.0")

tests/test_msg_recoverydevice_cipher.py

@@ -42,18 +42,6 @@ def test_ton_get_address(self):
 
         self.assertTrue(len(address) > 0, "TON address must be non-empty")
 
-    def test_ton_show_address(self):
-        """Display TON address on OLED with QR code (show_display=True)."""
-        self.requires_firmware("7.14.0")
-        self.requires_message("TonGetAddress")
-        self.setup_mnemonic_allallall()
-
-        resp = self.client.ton_get_address(
-            parse_path(TON_DEFAULT_PATH),
-            show_display=True
-        )
-        self.assertTrue(len(resp.address) > 0)
-
     def test_ton_different_accounts(self):
         """Different derivation paths must produce different addresses."""
         self.requires_firmware("7.14.0")

tests/test_msg_solana_getaddress.py

@@ -42,18 +42,6 @@ def test_tron_get_address(self):
         self.assertTrue(len(address) == 34, "Tron address must be 34 characters, got %d" % len(address))
         self.assertTrue(address.startswith('T'), "Tron address must start with 'T', got '%s'" % address)
 
-    def test_tron_show_address(self):
-        """Display TRON address on OLED with QR code (show_display=True)."""
-        self.requires_firmware("7.14.0")
-        self.requires_message("TronGetAddress")
-        self.setup_mnemonic_allallall()
-
-        resp = self.client.tron_get_address(
-            parse_path(TRON_DEFAULT_PATH),
-            show_display=True
-        )
-        self.assertTrue(len(resp.address) == 34)
-
     def test_tron_different_accounts(self):
         """Different derivation paths must produce different addresses."""
         self.requires_firmware("7.14.0")