Thursday, May 3, 2018

PiTrezor : An homemade Trezor bitcoin wallet build with a raspberry pi zero

The trezor is a hardware bitcoin wallet made by satoshilabs used to secure online transactions. The security reside in the fact that the private key used to sign a
transaction never leave the device.

The raspberry pi zero is a very cheap and small but yet powerful computer. You can buy one for about 5$. It is used on numerous projects by ton of developers and hobbyists around the world.

I am myself a developer. In this web page, I will show you how to create your own trezor device using a pi zero.

Features:

  • Low cost parts
  • Easy to build
  • Use the original trezor code. Only a thin layer is used to adapt the code to the pi zero Linux platform. 
  • All code modifications are open source, like the original trezor code.
  • 100% Compatible with trezor web wallet to perform transactions.
  • Use the hardware random number generator of the raspberry pi for more security.
  • Can be very secure if you use a pass phrase (see security section below)
  • Support small OLED display and/or display via HDMI output.
  • Adafruit OLED bonnet is also supported
  • Adjustable display scale factor on HDMI output
  • Fast boot (around 5 seconds)
  • No trezor shield required 
  • Software is free but donations are accepted!

News:

  • Updated May 3rd 2018:
    • Based on trezor firmware 1.6.1
    • Added support of SPI OLED (I2C OLED were already supported)
    • Added option to flip screen vertically
    • Added option to customize GPIO pins used by buttons
    • Support the Adafruit OLED bonnet
    • Renamed TREZOR_SDL_SCALE to TREZOR_OLED_SCALE setting in pitrezor.config file to respect new firmware.

Photos

HDMI Display:

The basic version only needs to connect  two push buttons to the pi zero to act as the 2 input buttons of the device. The pi zero as an HDMI connector that is used for output in this configuration. This is a simple solution to start with.

Only two buttons required!

 

OLED Display:

 

Instead of using the HDMI connector, a small OLED display can be attached to the pi zero. In that case, I recommend to use a small plastic box to protect the components and to give a more professional look!

Adafruit Bonnet:


(Picture courtesy of Damian Bevan)

It is also possible to use the Adafruit bonnet (see https://www.adafruit.com/product/3531). In that case you just have to install the pins on the pi zero and connect the bonnet!

Quick start guide:

List of required components:


Required components for the PiTrezor

  1. A raspberry pi zero. You don't need the pi zero W, it cost probably a little bit more than the regular pi zero, but it will work anyway. The difference is that pi zero W has wifi and bluetooth but this project don't use it. The network drivers are not loaded by the platform so the W can be considered as secure.
  2. An SD card. The image to write on the SD card is very small (around 50 Megs) so virtually any decent SD card should work. Make sure you have one that is compatible with the pi.
  3. A good micro-usb to usb cable.
  4. A mini HDMI male to HDMI female adapter to verify the output via the HDMI output. You need HDMI cable and a TV or monitor too!
  5. Two push buttons (normally open contact, SPST)
  6. Some wires to solder the buttons to the pi zero
  7. Optionally, an I2C or SPI OLED display. Supported OLED are based on the SH1106 controller or Adafruit controller.
  8. Optionally, a box or enclosure for a more professional look. 
You will also need standard tool like solder iron, pliers, ...

Of course, If you are using the Adafruit bonnet, you don't need separate push buttons or OLED. Refer to Adafruit documentation about how to connect the bonnet to the pi zero.

Step-By-Step instructions:

  1. If you don't have the software called "etcher" already installed in your computer, download it here : https://etcher.io/ . This software is used to write the program image to the SD card.
  2. Download the latest pitrezor image by clicking here
  3. Start etcher and follow the instructions. You will need to connect the SD card to your computer to flash the pitrezor image file.
  4. After the card is flashed, put it in the SD card slot in the pi zero.
  5. Connect the HDMI output to a monitor or tv using the cable and adapter.
  6. Connect the USB cable in the USB port near the center of the pi zero, not the one near the corner. Refer to next picture. 
  7. Connect the other end of the USB cable to your computer or a USB power supply. You should see the pi zero boot sequence in the monitor and after 4-5 seconds the trezor logo should appear. Good! That confirms that your pi zero and SD card are working correctly.
  8. At this point you cannot do much, so disconnect the USB cable, HDMI adapter and cable and remove SD card.
  9. If you are using the Adafruit bonnet, it is time to connect it and go straight to the "Configuration" section below. Otherwise, continue reading
  10. Solder the 2 buttons to the pi zero as showed in the following diagram. The left button (called "no") is connected to the pins 30 and 32 (in yellow in the next picture). The right button (called "yes") is connected to the pins 34 and 36 (in red in the picture). This is the default setup but can be tweaked from configuration file.
    connecting the button
  11. Put back the SD card in the pi zero and reconnect the HDMI and USB cable back to your computer.
  12. It should boot again, otherwise that means something went bad during the soldering of the buttons :(
  13. Open a browser on your computer and navigate to https://wallet.trezor.io
  14. You will be requested to install the trezor bridge if you never did it before. Select your operating system to download the correct bridge software and perform installation.
  15. If you installed the bridge, close and reopen your browser and go back to https://wallet.trezor.io
  16. If the bridge is already installed, you should see a message that invites you to connect your trezor. Connect the USB cable of your pi zero.
  17. The browser application should detect the device and invite you to perform the trezor setup.
  18. During the setup you will need the buttons to, at least, go from one seed word to another.
  19. If all is working correctly you can disconnect everything to solder the OLED display. The I2C OLED display need 4 wires to solder and the SPI OLED uses 7 wires. Refer to the next picture to determine how to solder the OLED depending on interface.:
  20. Connect the SD card back to your computer and refer to the configuration section below to correctly configure your OLED model and orientation. Their is only 2 possibles orientations so you can try both and see which one is better for you.
  21. Reconnect everything and retry your device. Now you should see the output on the HDMI connector if connected and also on the OLED at the same time.
  22. If that work, put everything in a box!
  23. Enjoy! And don't forget to send a donation (see below)

Download


You can download the latest pitrezor image clicking here .

Configuration

If you connect the SD card in your computer you should see a file named "pitrezor.config" in the first partition (boot partition). You can open this file with your favorite text editor. You will be able to change the configuration variables which are:
  • TREZOR_OLED_SCALE : This control the scale factor of the display to apply when using the HDMI output. A scale factor of 1 means the default size of 128x64 pixel. A scale factor of 2 will stretch the image to 256x128 and so on.
  • TREZOR_OLED_TYPE: Specify the type of OLED connected to the pi zero. The file enumerate the different value and their meaning. Select the one that match your OLED display.
  • TREZOR_OLED_FLIP: Set to 0 or 1 to control the image vertically (normal or inverted) This is useful depending how you assemble the OLED in n enclosure.
  • TREZOR_GPIO_YES and TREZOR_GPIO_NO : Specify the GPIO number to use for the yes/no button. If you soldered the buttons like mentionned in the tutorial, you can keep the default values.
When you change a value, keep the line formating as-is with the export statement. Just change the number after the equal sign. If you change something else, this could prevent the pi trezor application to start correctly.

For the Adafruit bonnet, you must change the values to these (courtesy of Damian Bevan):

export TREZOR_OLED_TYPE=1
export TREZOR_OLED_FLIP=1
export TREZOR_GPIO_YES=6
export TREZOR_GPIO_NO=5

Is this secure ?

The main difference of this device versus the real trezor device is that the pi zero stores everything on the SD card. The equivalent of the flash memory for the trezor is stored in a file on the first partition. That means that anybody that has your SD card can access your seed words and private key.

However, the wallet supports the usage of a passphrase. The passphrase is a kind of an extra seed word that is not stored on SD card. By using a passphrase, you would prevent a thief that could have your SD card to empty your wallet.

Thus, the recommendation is to always use a passphrase!

Updating from previous pitrezor image

If you are updating your pitrezor to the latest image you have 2 options. In both cases, make sure you have your seed word list near you.

1) Simply reflash you the SD card with the latest image. This is like wiping out the device. When you will reconnect it to the wallet application, select the recovery option and reenter the words on your seed list.
2) Connect the SD card on your computer and copy the file "emulator.img" to your computer. Then flash the SD card with the new image using etcher. After the card is flashed, disconnect it and reconnect it to your computer. Then, you can copy the "emulator.img" file back to its original location. Don't forget to remove the "emulator.img" of your computer after!

In both cases, if you have customized the pitrezor.config file, you will need to redo your modifications.

For developers


The modification to trezor original code are available in this repo: https://github.com/heneault/trezor-mcu

The platform code is based on yocto to which I added my own layer and some build scripts. The repo is there: https://github.com/heneault/yocto-pitrezor

Questions ?


Comments are welcome in the comment section below. You can also reach me at info@pitrezor.com

Scan to send bitcoin donation!

Donation !

A lot of work and effort has been made in this project. If you like it, donations are always welcome:

Bitcoin: 1trezor8MpRmFHcMCLdANpiVoEM9zqe2n

Paypal:


Copyright and Legal Warning

There are inherent dangers in the use of any software available for download on the Internet, and I caution you to make sure that you completely understand the potential risks before downloading any of the software.
The Software and SD card image available on this website are provided "as is" without warranty of any kind, either express or implied. Use at your own risk.
The use of the software and SD card image downloaded on this site is done at your own discretion and risk and with agreement that you will be solely responsible for any damage to your computer system or loss of data that results from such activities. You are solely responsible for adequate protection and backup of the data and equipment used in connection with any of the software, and I will not be liable for any damages that you may suffer in connection with using, modifying or distributing any of this software. No advice or information, whether oral or written, obtained by you from me or from this website shall create any warranty for the software.
I make no warranty that:

  • the software will meet your requirements
  • the software will be uninterrupted, timely, secure or error-free
  • the results that may be obtained from the use of the software will be effective, accurate or reliable
  • the quality of the software will meet your expectations
  • any errors in the software obtained from me will be corrected.
The software, SD card image and its documentation made available on this website:

  • could include technical or other mistakes, inaccuracies or typographical errors. I may make changes to the software or documentation made available on its web site at any time without prior-notice.
  • may be out of date, and I make no commitment to update such materials.
I assume no responsibility for errors or omissions in the software or documentation available from its web site.
In no event shall I be liable to you or any third parties for any special, punitive, incidental, indirect or consequential damages of any kind, or any damages whatsoever, including, without limitation, those resulting from loss of use, data or profits, and on any theory of liability, arising out of or in connection with the use of this software. 

© Yannick Heneault, 2018. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Yannick Heneault with appropriate and specific direction to the original content.

The name and logo trezor are the properties of satoshilabs
The name and logo raspberry pi and raspberry pi zero are properties of the raspberry pi foundation

60 comments:

  1. Wow this is very good. I will test this once I got the parts.

    Question: In future, how about updates to the software?

    ReplyDelete
  2. Make sure you get the proper oled device. Right now I'm supporting only I2C (not SPI).

    For the update, I will align my updates on the official firmware release from trezor. Basically you will have 2 options. I will post a page with the details on first update. 1) You simply reflash the sd card. That mean you will lost all your data and will have to reenter your seed words via the wallet application. 2) You backup the emulator.img file in the boot partition on a computer. then you flash the sd card and you move back the emulator.img file. This is an extra manipulation but will save time.

    ReplyDelete
  3. Are there any pitrezor images to RPI 1, RPI2 or RPI3 variants? (What's the modification that are needed to pizero image?)

    ReplyDelete
    Replies
    1. No I only have pizero image because only this model can be used as a USB device.

      On regular pi, you can recompile trezor code in "emulator" mode to play with. You will simply need a keyboard and a screen to interact with it.

      Delete
  4. Is there a way to change the pins that the buttons use?

    ReplyDelete
    Replies
    1. This can be easily changed in the code but will require to recompile pitrezor. I'm about to release a new image, I could make it configurable via the config file if you need this feature.

      Delete
    2. That would be awesome if you can make it configurable via the config file.

      Delete
  5. Would it be possible to add g_mass_storage to use the rest of the sd card?
    e.g. a third partition that takes up the remaining space and gets mounted as a usb drive when plugged in to devices.
    I guess it would only be useful if the pi doesn't get unpluged

    ReplyDelete
    Replies
    1. Exactly, I think their will be some risk of corruption if not disconnected at the right moment but that would be possible. A bootup script could extend the partition, format it and export it as usb key. Do you have an idea in mind about its usage?

      Delete
    2. well I would like to use it to carry around the browser Plugin for TREZOR and possibly a portable version of a web browser with the trezor wallet site as the homepage.

      Delete
    3. mostly read-only files

      Delete
    4. The different bridges and the chrome plugin could be downloaded and put in a usb image but the trezor javascript wallet code doesn't seem to be on trezor github anymore. Maybe an alternative like electrum, that can use the trezor hardwarde, could be preinstalled.

      Delete
    5. if config file had way to enable/disable and set read/write or read only mode

      maybe it can be used to boot a pc to a Live OS

      Delete
    6. That could probably work. An iso could probably be exported (and kept read only) to avoid security breach from the host computer. Something to look at!

      Delete
  6. hello,

    i'm using an ssd 1306 1.3" 128x64 OLED display from adafruit. it doesnt power on. is the wiring scheme the same? do i need to install any additional software? thanks.

    ReplyDelete
    Replies
    1. Look at the pitrezor.config file on the sd and check that TREZOR_OLED_TYPE is set to the Adafruit SSD 1306 I2C

      Delete
    2. 'Adafruit SSD 1306 I2C' is 'OLED_ADAFRUIT_I2C_128x64'
      so you change the number in the line
      export TREZOR_OLED_TYPE=3
      to a 1
      export TREZOR_OLED_TYPE=1

      Delete
    3. Please let me know if that work correctly. I don't have myself this oled to test but the driver code in the platform should work. The I2C wiring is the same. I only tested using oled with sh1106 controller.

      Btw, next release will also have SPI interface oled driver code in it.

      Delete
    4. Hi Yannick,

      I changed the config to type=1 but it still wont power on. FYI my wiring scheme is (from OLED to pi zero):

      Vin to pin 1
      Gnd to pin 6
      Data to pin 3
      Clk to pin 5
      Rst to pin 18

      I bridged connections of the back of the OLED on pads SJ1 and Sj2, as mentioned by Adafruit to enable I2C functionality.

      Is this correct? I can email you screenshots of the wiring if that helps. Thanks.

      Delete
    5. It works with the 'Adafruit 128x64 OLED Bonnet for Raspberry Pi'
      https://www.adafruit.com/product/3531https://ibb.co/nmzi1n
      but the buttons and joystick on it need the pin config feature

      pic of the screen working
      https://image.ibb.co/dtZGMn/2018_04_15_170032_workingCopy.png
      I used some jumper wires to get the buttons to work
      -Damian

      Delete
    6. https://learn.adafruit.com/monochrome-oled-breakouts/wiring-128x64-oleds
      if I'm reading this right Vin needs 5v but you have it plugged into pin 1 and that's 3.3v
      http://webofthings.org/wp-content/uploads/2016/10/pi-gpio.png
      pin 2 and 4 are 5v

      Delete
    7. Awesome work with the Bonnets! Would you mind sending some good pic to info@pitrezor.com. I could add it to the blog. I could also provide you a test image with gpio buttons configurable to test it.

      Delete
    8. I don't think you need rst to be connected in i2c mode. Maybe the 3.3v / 5v is the solution. Otherwise, you can probably follow adafruit tutorial to make sure its driver is working correctly. I found some tutorial for the 128x32 at https://learn.adafruit.com/adafruit-pioled-128x32-mini-oled-for-raspberry-pi?view=all to start playing with.

      Delete
  7. Yannick I sent you an email just wondering if you have received it yet?
    -Damian

    ReplyDelete
    Replies
    1. I just answered. You can check your email.

      Delete
    2. Hi Yannick
      If we send you an email how long should we wait for a reply?

      Delete
  8. Hi Yannick

    Are the pitrezor image is not available, links is not works.

    ReplyDelete
    Replies
    1. I just restored the link for download. It seems my file hosting provider has some issue...

      Delete
  9. Thank you for tutorial,
    Trezor update firmware to 1.6.1, how can we update too?

    ReplyDelete
    Replies
    1. I'm in the process of updating the image and documentation. It should be ready in the next few days.

      Delete
    2. Hi Yannick, any good news on 1.6.1?

      Delete
    3. Finally I got the time to update the site! It is there!

      Delete
  10. Hi,
    Awesome tutorial.
    I am also using the "Adafruit 128x64 OLED Bonnet for Raspberry Pi". (https://www.adafruit.com/product/3531).
    I change the config file to use the OLED Bonnet. The OLED Bonnet powers up and displays the Lock with the "Go to trezor.io/start" text.
    I installed the Trezor Bridge but the raspberry pi w does not connect to the Trezor Wallet. The browser application DOES NOT detect the device. Not sure what is the problem..... Any help would be appreciated.

    Also, is there a way to configure the buttons on the Bonnet OLED screen?

    Thanks,
    Tony

    ReplyDelete
    Replies
    1. Is the usb plugged into the port labeled "usb" on the pi?

      Delete
    2. The next image will support the bonnet as-is, it should be available in the next few days.

      Delete
    3. Yes, I plugged the usb cable into the port labeled "usb" on the pi and plugged the other end into the computer. It was not detected by the computer. At one point the computer did say "unrecognized usb", but it was not detected by the Wallet.

      Cool, cant wait for the new image.

      Thanks for the help,
      Tony

      Delete
    4. What operating system are you guys using? I am using Windows 10. Maybe that is the issue.... I also tried using the chrome extension, still didn't get recognized. The raspberry pi is not recognized by windows....

      Tony

      Delete
    5. Windows in general can be a bit fussy with usb devices.
      have you tried plugging it into a different usb port on the windows system end (sometimes that works as it thinks its a new device and installs the driver)

      But you still would need to wait until Yannick releases the next image to use the buttons on your Bonnet OLED screen.
      If it still won't get recognized by windows let me know.
      -Dave

      Delete
    6. Check with another usb cable if you can. Sometime a bad quality cable can cause this

      Delete
    7. Still working on it. I tried another usb port, still doesnt work. I tried a new usb cable, still doesnt work. I will wait for the new image that utilizes the Bonnet OLED.

      Thanks,
      Tony

      Delete
    8. New image is there if you want to give it a shot. Maybe trying on another computer could be something worth to try.

      Delete
    9. Awesome! Thanks. So, I used windows 7 and it took a while to install drivers, but it worked. The raspberry pi finally connected to the computer and connected to the website. The buttons for the OLED Bonnet works too.

      Delete
    10. I'm glad to hear that! Congratulation!

      Delete
  11. Do you have a 3d-model (.stl) file for the closing box? I appreciate if you upload it as well!

    ReplyDelete
    Replies
    1. I don't have the files but that would be awesome if someone could send them to me. For my version I used a standard ABS box and I cut plastic with a dremel cutting disc. My main concern with 3D files would be the buttons. Depending on the type of buttons, the position/size would not be the same. At least, Oled on the other hand are relatively standard.

      Delete
    2. After some research, I'll try to print the following module: https://www.thingiverse.com/thing:1193350 . Though, I agree with the concerns about the buttons.

      Delete
    3. Some things I noticed about it. The usb port opening is not the correct one. It seems to expose the usb power. Also it doesn't seem to have scoket to use screws to maintain the back in place.

      Delete
    4. That is correct! After some modification it works great . I will upload the new stl files in the following week.

      Delete
  12. Any chance to get this working with the new firmware for the Trezor Model T? https://github.com/trezor/trezor-core
    It would require a touchscreen to be hooked to the Pi Zero.

    ReplyDelete
    Replies
    1. Yes I was thinking of it but the price of a touchscreen color display make me think that this port would be less interesting as a DIY project.

      Delete
  13. Can you highlights the modification that you were doing to the trezor's source code ? (For security reasons, and to learn more about how to add new feature to it..). I found it really hard to make a diff with the trezor repo.

    ReplyDelete
    Replies
    1. you can see the diff to original trezor code directly in github : https://github.com/trezor/trezor-mcu/compare/master...heneault:pitrezor

      Fell free to ask questions if something is not clear

      Delete
  14. Hi Yannick,

    Great tutorial! I was wondering if I can get some help.
    I am new to yocto. I am trying to understand yocto and the layers. Why did you created meta-pitrezor layer? Could you have just built a generic raspberry pi distro and run the trezor code on it? Is that possible? Im just trying to learn and understand. Thanks.

    ReplyDelete
    Replies
    1. The meta-pitrezor layer allow me to add my port of the trezor application as part of yocto build. It also contain the image file that list the applications to install in the image file. This allow me to create a very small distro with only was is required to run. The layer also contains some fixes to other application and some custom configurations to reduce the image footprint.

      I think yocto was the best choice for this project. Distro for the pi like raspbian contain a lot of softwares not required for pitrezor because they are more desktop oriented. Using a distro like this would have implied to remove or cleanup a lot of packages. With yocto I can select what I want to be installed more granulary.

      I you have some other questions about yocto, feel free to PM me.

      Delete
  15. Hey, thank you for the tutorial! Unfortunately I'm having some trouble. I can get the device to show the Trezor screen on a TV connected via HDMI, but when I go to the trezor.io/start page, it never gets past asking me to connect my device to start.
    As a separate issue I can't seem to get the Adafruit Bonnet to work, but I think that's just my own problem with being unfamiliar with it.

    ReplyDelete
    Replies
    1. some things you could try: Check with another usb cable, check with another monitor, check in system manager for the list of usb device connected to see if it is there. You can also try to reflash the sd card with an original Pi distro like raspbian to see if it boot correctly and if you have hdmi output.

      Delete
  16. Hi friends. It's a great project, I've ordered parts and waiting for delivery. But I wanted to inform you that I am a graphic designer and a 3D designer. How will everything be made up at home, I will make a box and a public. If the interest and creator of the PiTrezor project will want, I can present myself as part of this blog. I ordered the Adafruit 128x64 OLED Bonnet. If I get in the Czech Republic, I will make a second modification. (or you can send it to me - I'll pay). Here it is just in the Czech Republic OLED model http://rpishop.cz/displeje/874-adafruit-128x32-pioled.html.

    I apologize for poor English I am from the Czech Republic. My nick is MoDDO / fX - (moddo@moddo.cz)

    ReplyDelete
    Replies
    1. I would also like to try this. Has anyone not tried yet? https://bit.ly/2IQZ6Fu

      Delete

Please share your thoughts