Issue with False Seed Words from Compact Seed QR

[Specterfan]

Problem:

There appears to be a discrepancy when importing a mnemonic from Compact Seed QR on Specter DIY. Specifically, when scanning a Compact Seed QR generated from the SeedSigner test vector, the imported seed words differ from the correct mnemonic.

Steps to Reproduce:

1. Use the CompactSeedQR test vector from the SeedSigner documentation.
2. Scan the Compact Seed QR on Specter DIY.

Observed Behavior:
The imported mnemonic is:

attack pizza motion avocado network gather crisp broom patrol unusual wild holiday candy pony ranch woman unfair equal face various slogan salon goddess expose

Expected Behavior:
The correct mnemonic, as confirmed by Standard Seed QR, should be:

attack pizza motion avocado network gather crop fresh patrol unusual wild holiday candy pony ranch winter theme error hybrid van cereal salon goddess expire

Additional Observation:
The same issue occurs when:

1. A Compact Seed QR is created on Specter DIY from the correct seed phrase.
2. A photo of this QR is taken.
3. The QR is re-imported back into Specter DIY.

Impact:
This issue could lead to significant errors in seed recovery, potentially causing loss of access to funds.

Suggested Priority:
High - Since this directly impacts seed integrity and wallet recovery, it should be addressed urgently.

Environment:
Specter DIY Firmware version 1.9.0

[k9ert]

This was a scammer comment. Don't trust this person. He's not a Developer of this project.

[k9ert]

At least with the simulator, i can't reproduce the issue.

Those kind of things doesn't improve my trust in seedQR.

@kdmukai any thoughts from your side?

Update: As the Compact Seed QR is based on binary data, probably we have some encoding issue somewhere. I'm tending to deprecate compactSeedQR instead of fixing this issue which might not be fixable in a reliable way as new scanners might always have some strange encoding issue.

[Schnuartz]

So the reason for the error are the new QR-Scanners.

The suppliers from AliExpress and Alibaba changed the QR Scanners. Without mentioning something, they even used the same product pictures as before. I asked them, it is not possible to receive the old scanner.

Here you get the "buggy" Scanners they since maybe two months:
https://www.alibaba.com/product-detail/GROW-GM65S-High-Quality-USB-UART_60674655312.html?spm=a2700.shop_index.89.7.164712caXzp4yC

https://de.aliexpress.com/item/33008958186.html?spm=a2g0o.order_list.order_list_main.5.5f1e5c5flmoh5J&gatewayAdapt=glo2deu

In this pictures you can see the difference between the old and the new scanner:

Here is the manual for the old scanner. Probably the same as for the new one.
GM65-S Barcode reader module User Manual.pdf

[Schnuartz]

The QR Code scanner are scanning the QR-Code wrong in a consistent way here are some examples:

1. mirror
2. devote
3. shuffle
4. eyebrow
5. trap
6. remember
7. promote
8. tribe
9. lens
10. quick
11. spatial
12. frown

gets

_1. river
2. lamp
3. shuffle
4. eyebrow
5. trap
6. remember
7. promote
8. tribe
9. lens
10. quick
11. spatial
12. frequent_

---

1. devote
2. mirror
3. shuffle
4. eyebrow
5. trap
6. remember
7. promote
8. tribe
9. lens
10. quick
11. spatial
12. frost

Stays

1. devote
2. mirror
3. shuffle
4. eyebrow
5. trap
6. remember
7. promote
8. tribe
9. lens
10. quick
11. spatial
12. frost

---

1. border
2. category
3. during
4. ship
5. robust
6. behind
7. robot
8. notable
9. pony
10. picture
11. acid
12. pave

stays

1. border
2. category
3. during
4. ship
5. robust
6. behind
7. robot
8. notable
9. pony
10. picture
11. acid
12. pave

---

1. mirror
2. devote
3. abandon
4. ability
5. able
6. about
7. baby
8. bachelor
9. bacon
10. badge
11. naive
12. mutual

gets

_1. river
2. lamp
3. abandon
4. ability
5. able
6. about
7. baby
8. bachelor
9. bacon
10. badge
11. naive
12. negative_

---

1. broken
2. abondon
3. abondon
4. abondon
5. abondon
6. abondon
7. abondon
8. abondon
9. abondon
10. abondon
11. abondon
12. abondon

Stays

1. broken
2. abondon
3. abondon
4. abondon
5. abondon
6. abondon
7. abondon
8. abondon
9. abondon
10. abondon
11. abondon
12. abondon

---

1. milk
2. just
3. hole
4. chief
5. hawk
6. call
7. fresh
8. city
9. word
10. radio
11. endorse
12. wish

gets

_1. rude
2. vapor
3. hole
4. chicken
5. inspire
6. parrot
7. fresh
8. city
9. word
10. radio
11. endocrs
12. woman_

---

1. syrup
2. boss
3. grape
4. hip
5. gather
6. neck
7. fee
8. chat
   9. miracle
   10. absent
9. envelope
   12. over

gets

1. syrup
2. boss
3. grape
4. hip
5. gather
6. neck
7. fee
8. chat
9. rythm
10. suffer
11. envelope
**12. output**

---

1. mirror
2. mirror
3. mirror
4. mirror
5. mirror
6. mirror
7. mirror
8. mirror
9. mirror
10. mirror
11. mirror
12. absurd

gets

1. rigid
2. stereo
3. mirror
4. mirror
5. mirror
6. mirror
7. mirror
8. mirror
9. rigid
10. stereo
11. mirror
12. ability

---

1. devote
2. devote
3. devote
4. devote
5. devote
6. devote
7. devote
8. devote
9. devote
10. devote
11. devote
12. absent

stays

1. devote
2. devote
3. devote
4. devote
5. devote
6. devote
7. devote
8. devote
9. devote
10. devote
11. devote
12. absent

Update: Now I fixed the mistakes I made

[kdmukai]

@k9ert unfortunately my original Specter DIY from 2019 seems to be unusable now; everything with the DISCO board seems fine but my QR scanner module is no longer communicating with the board, afaict. Wiring hasn't changed in 5yrs, the connections still look fine. I did a firmware upgrade about 3 weeks ago, so maybe something in there...?

Either way, it's probably time for me to get a current Specter DIY build, proper enclosure, etc. But I'm back to being a 100% volunteer FOSS dev (i.e. NO FUNDING 😭), so I'd need someone to be willing to send me a unit.

[Specterfan]

There was no problem when signing a message with Sparrow Wallet and Specter DIY. The signature was correct. Presumably because there are only ASCII characters in the QR code.

This means that the problem only occurs with binary Compact Seed QR.
QR codes should support:

Numeric: 0-9
Alphanumeric: Capital letters, numbers, and selected special characters
Byte (binary): ISO/IEC 8859-1 and UTF-8 (for modern QR codes)
Kanji: Shift-JIS for Japanese characters
Extended encodings: Via ECI for special applications

Apparently there are problems with ISO/IEC 8859-1 and UTF-8.

[3rdIteration]

@k9ert unfortunately my original Specter DIY from 2019 seems to be unusable now; everything with the DISCO board seems fine but my QR scanner module is no longer communicating with the board, afaict. Wiring hasn't changed in 5yrs, the connections still look fine. I did a firmware upgrade about 3 weeks ago, so maybe something in there...?

Either way, it's probably time for me to get a current Specter DIY build, proper enclosure, etc. But I'm back to being a 100% volunteer FOSS dev (i.e. NO FUNDING 😭), so I'd need someone to be willing to send me a unit.

So when you select scan, what happens? I observed that the QR scanner module could sometimes get into a bugged state and would throw an error when scanning. This was fixed by scanning the factory reset QR.

[kdmukai]

This was fixed by scanning the factory reset QR.

SUCCESS!! Scanner was weird for a few scans after scanning the reset QR, but it just read in a Compact SeedQR successfully!

Random googling yielded this reset QR that worked for me:

[kdmukai]

Looks like @Schnuartz has it right. I can confirm that my old scanner (2019, matches the "good" pic) can read [mirror * 11, absurd] correctly.

If someone would like to send me a newer barcode scanner module, I'd be happy to do some experimenting.

[k9ert]

If someone would like to send me a newer barcode scanner module, I'd be happy to do some experimenting.

It's on the way. However, it's (unfortunately) already flashed. So you'll need to remove the write protection:
https://github.com/cryptoadvance/specter-bootloader/blob/fc6e61eeada07c36b00c99f18f74c26b95b36ddb/doc/remove_protection.md

[k9ert]

Had a call with Stepan and he did some investigations which i'm reproducing here. He printed out the hex codes and checked whether there are any regularities in the bytes. However, we couldn't find any.

from embit import bip39

# wrong
s1a = "mirror devote shuffle eyebrow trap remember promote tribe lens quick spatial frown" 
s1b = "river lamp shuffle eyebrow trap remember promote tribe lens quick spatial frequent"

# correct
s2a = "devote mirror shuffle eyebrow trap remember promote tribe lens quick spatial frost" 
s2b = "devote mirror shuffle eyebrow trap remember promote tribe lens quick spatial frost"

# wrong
s3a = "mirror devote abandon ability able about baby bachelor bacon badge naive mutual" 
s3b = "river lamb abandon ability able about baby bachelor bacon badge naive negative"

# wrong
s4a = "milk just hole chief hawk call fresh city word radio endocrs wish" 
s4b = "rude vapor hole chicken inspire parrot fresh city word radio endocrs woman"

#wrong
s5a = "syrup boss grape hip gather neck fee chat miracle absent envelope over" 
s5b = "syrup boss grape hip gather neck fee chat rythm suffer envelope output"

#wrong
s6a = "mirror mirror mirror mirror mirror mirror mirror mirror mirror mirror mirror absurd" 
s6b = "rigid stereo mirror mirror mirror mirror mirror mirror rigid stereo mirror ability"

def bitcomp(sa, sb):
    print(sa)
    print(sb) 
    b1 = bip39.mnemonic_to_bytes(sa)
    b2 = bip39.mnemonic_to_bytes(sb)
    for i in range(len(b1)):
        if b1[i] != b2[i]:
            print( i, bytes([b1[i]]).hex() , bytes([b2[i]]).hex())
    print("-------------------------")

bitcomp(s1a, s1b)
bitcomp(s2a, s2b)
#bitcomp(s3a, s3b)
#bitcomp(s4a, s4b)
#bitcomp(s5a, s5b)
bitcomp(s6a, s6b)

Some of the "seeds" have words in it, which are not even valid. Thos are the once which are commented above. E.g. s3b has "lamb" in it which is not a valid bip39 word. Here is the output:

kim@nucii ➜  specter-diy git:(master) ✗ python3 check.py
mirror devote shuffle eyebrow trap remember promote tribe lens quick spatial frown
river lamp shuffle eyebrow trap remember promote tribe lens quick spatial frequent
0 8d ba
1 87 cf
-------------------------
devote mirror shuffle eyebrow trap remember promote tribe lens quick spatial frost
devote mirror shuffle eyebrow trap remember promote tribe lens quick spatial frost
-------------------------
mirror mirror mirror mirror mirror mirror mirror mirror mirror mirror mirror absurd
rigid stereo mirror mirror mirror mirror mirror mirror rigid stereo mirror ability
0 8d b9
1 91 fa
11 8d b9
12 91 fa
-------------------------

Stepan assumes that there is a bug in the firmware. Probably we should contact the vendor and report it. A reasonable workaround is to deactivate compact-seed for this scanner. In order to do this, we need to figure out, which hardware-version is the wrong one and which is the good one. The datasheet gives a hint in section 8.5 on page 47.

How do you read those values? See here:
https://github.com/cryptoadvance/specter-diy/blob/master/src/hosts/qr.py#L22

This line is defining the address and a bit later in the file explains how to read it out:

val = self.get_setting(SETTINGS_ADDR)

[k9ert]

Random googling yielded this reset QR that worked for me

btw, the reset-QR did not fix it for the new broken scanner-model.

[Schnuartz]

Some of the "seeds" have words in it, which are not even valid. Thos are the once which are commented above. E.g. s3b has "lamb" in it which is not a valid bip39 word. Here is the output:

This is a mistake from my side. Not from the Specter DIY or the scanner. I typped every word by hand out of the Specter DIY into GitHub. So probably I did a writing mistake.

[Schnuartz]

Now I found a good way of testing the QR Scanner. Just take the scanner board from the normal Specter DIY and plug the QR scanner in it for testing. Then it is possible to test the scanner directly with the PC using a micro usb cable.

I now scanned this QR Code and got two different outputs.

Old good scanner:
ç↔«ukkB%B:

New buggy scanner:
¤↔«ukkB%B:

And I used my smarphone and got a completely different return:
��� ��ukk B�5�B.

I also sent my tests to the company that can be found in the datasheet:
http://en.hzgrow.com/product/81.html
email: winni@hzgrow.com

[3rdIteration]

I am back now and ordered some of these, both from a random Aliexpress seller and from the official Grow store. Both sets are using the newer hardware now.

I was playing around with this yesterday using the Waveshare QR scanner module and this python library that I modified here: https://github.com/3rdIteration/GM65 that makes it easy to see what data is coming out of it. (It shows it as hex, so it's more useful to compare)

Basically it does look as though the data coming from the newer ones can't be trusted, as there are a few bytes that are incorrect each time. (Though notably it is the same bytes each time, which makes me think it's certainly a bug in the firmware on the scanners)

The good news is that the old/new hardware can be identified through either the software version of the software year, so I think it would make sense to basically check for the hardware in specter and enable/disable compactseedQR as required. (Looks like for any software year 2023 or newer)

I'm also curious to see what other versions of software/hardware folk have.

Device	HardwareVersion	SoftwareVersion	SoftwareYear
Working GM65	641f13	87d25e	146184
Broken GM65	641f13	69cebe	1751e7
Broken GM805	641f13	69cebe	1751e7
Working M3Y-W	TBC	TBC	TBC

Note: I haven't trimmed the extra data of any of the date/version reply, the first two characters are what we are interested in.

I also checked a GM805 that I was testing with the shield lite (that can drop the price even more, though doesn't have the laser to spot for scanning) and it exhibits the same behavior (returns the same data) as the broken GM65 and also returns the same hardware info.