Validity90 icon indicating copy to clipboard operation
Validity90 copied to clipboard

Add support for 06cb:00be

Open JThyroff opened this issue 6 years ago • 169 comments

It would be really nice, if i could use the fingerprintreader in my new lenovo Ideapad. ;)

JThyroff avatar Jun 27 '19 21:06 JThyroff

+1

msolefonte avatar Nov 10 '19 09:11 msolefonte

Any progress on this?

imreallyliam avatar Jan 25 '20 19:01 imreallyliam

+1

pfuhlert avatar Mar 20 '20 15:03 pfuhlert

This project seems not quite active. There has been a little bit of hope for 20.04 Focal Fossa: https://askubuntu.com/questions/1214592/fingerprint-reader-lenovo-thinkpad-l13-synaptics-driver

jsplate avatar May 02 '20 19:05 jsplate

Anyone got it to work with 20.04?

pfuhlert avatar May 11 '20 10:05 pfuhlert

I have not got it working yet.

imreallyliam avatar May 11 '20 13:05 imreallyliam

I'll test it today. "You'll need at least fwmgr-1.3.5 and fprintd-1.90. Then enable testing remote in fwupdmgr. See here how: github.com/fwupd/fwupd/wiki/LVFS-Testing-remote The Firmware you need to install is listed here: fwupd.org/lvfs/search?value=prometheus"

mandresve avatar May 19 '20 23:05 mandresve

It didn't work for me. The firmware from the link is for 00bd only according to the contained XML file.

p-try avatar May 20 '20 11:05 p-try

It does not support this device, unfortunately.

imreallyliam avatar May 22 '20 16:05 imreallyliam

I've added $100 bounty on https://www.bountysource.com/issues/76164422-add-support-for-06cb-00be for anyone who can solve it. I need this.

Freedom9339 avatar Jun 09 '20 04:06 Freedom9339

I too would like to see this supported +1

daniromome avatar Sep 02 '20 03:09 daniromome

I support, really need

sherer-pro avatar Sep 03 '20 00:09 sherer-pro

Support too, really need it soon :( So many advances in 00bd but not for our 00be

quaxam avatar Sep 06 '20 02:09 quaxam

I too would like to see this supported ☺️

ADernild avatar Dec 29 '20 23:12 ADernild

I added $250 to the bounty for this (non-expiring), so the bounty for this issue is now at $350.

suchipi avatar Feb 23 '21 08:02 suchipi

I added $250 to the bounty for this (non-expiring), so the bounty for this issue is now at $350.

It wouldn`t be like buy a pancake on the street for some digits with any symbols.. rather like janitor or porter, do you ready to let him in?

nikolobok avatar Feb 23 '21 09:02 nikolobok

It's been a while, but I'm currently working on reverse engineering the Windows driver for this model (Synaptics FM-3463 / 06cb:00be). Don't expect anything soon though, as the driver is complex and it's more a side project than my current focus. I'll post major updates on progress here (if that's OK).

Popax21 avatar Jun 14 '21 14:06 Popax21

Just purchased a Lenovo Ideapad 5 Flex (Model 14ITL05) and everything on Linux works except the fingerprint reader!

I'm on Mint 20 Uma, which uses Ubuntu 20.04 as it's base. Kernel is 5.11.0-22-generic and I have a 06cb:00be Synaptic device shown in the output of lsusb.

As a test, I just installed Ubuntu 21.04 on my machine in the hopes that a newer driver was included in the newer version - no luck, unfortunately.

  • The default install, without any further updates, is on fwupdmgr v1.5.8; gusb is 0.3.5
  • After installing updates through the update manager (almost 600 MB worth since it was released in April!), fwupdmgr version remained the same.
  • The version of fwupdmgr in Linux Mint 20 Uma is actually much newer (1.9.0+); using snap to install the latest on Ubuntu only got me up to version 1.6.1-1 with gusb v0.3.7

If this shows any potential means of gaining traction, I may just increase the bounty to $500 total.

kmanwar89 avatar Jul 15 '21 00:07 kmanwar89

For anyone wondering how I'm progressing: I'm almost at the point of having fully functioning initialization & pairing routines. My reverse engineering effort started completly from scratch, so I didn't look much at the work inside this repo, but as it turns out, the tudor family of sensors (that's what they're called in the driver) shares some, but not all characteristics with the sensors which this repo focuses on. However, I was able to clarify many things, because I am reverse engineering the Windows driver (which conveniently has debug symbols/printfs inside of it), while (I think) they only looked at captured USB packets. I might create a pull request claryfing overlapping info. As of yet it's still to early to release anything, but when I do, I'll post the link (and any major updates on progress) here.

PS: Just speculation, but I belive that my driver could also work for 06cb:00bd sensors, without the need for a FW update. It might also possible that other sensors could work too, but so far I only tested it on my laptop's 06cb:00be one.

Popax21 avatar Jul 30 '21 23:07 Popax21

For anyone wondering how I'm progressing: I'm almost at the point of having fully functioning initialization & pairing routines. My reverse engineering effort started completly from scratch, so I didn't look much at the work inside this repo, but as it turns out, the tudor family of sensors (that's what they're called in the driver) shares some, but not all characteristics with the sensors which this repo focuses on. However, I was able to clarify many things, because I am reverse engineering the Windows driver (which conveniently has debug symbols/printfs inside of it), while (I think) they only looked at captured USB packets. I might create a pull request claryfing overlapping info. As of yet it's still to early to release anything, but when I do, I'll post the link (and any major updates on progress) here.

PS: Just speculation, but I belive that my driver could also work for 06cb:00bd sensors, without the need for a FW update. It might also possible that other sensors could work too, but so far I only tested it on my laptop's 06cb:00be one.

Sounds a step in the right direction. I have the 06cb:00be sensor, so if you want me to confirm how it works here, I'm open to testing it. Just be adviced that I'm kinda new in this, so I might need more than the usual pointers if you are willing to.

shaqman avatar Jul 31 '21 00:07 shaqman

For anyone wondering how I'm progressing: I'm almost at the point of having fully functioning initialization & pairing routines. My reverse engineering effort started completly from scratch, so I didn't look much at the work inside this repo, but as it turns out, the tudor family of sensors (that's what they're called in the driver) shares some, but not all characteristics with the sensors which this repo focuses on. However, I was able to clarify many things, because I am reverse engineering the Windows driver (which conveniently has debug symbols/printfs inside of it), while (I think) they only looked at captured USB packets. I might create a pull request claryfing overlapping info. As of yet it's still to early to release anything, but when I do, I'll post the link (and any major updates on progress) here.

PS: Just speculation, but I belive that my driver could also work for 06cb:00bd sensors, without the need for a FW update. It might also possible that other sensors could work too, but so far I only tested it on my laptop's 06cb:00be one.

I'm also willing to be a guinea pig. I have an Ideapad Flex 5 (has 06cb:00be) with Arch that I can test it on. Like @shaqman, I have never been a driver tester so I may need a bit more instruction. Glad you're making progress, though!

frawgg avatar Jul 31 '21 00:07 frawgg

For anyone wondering how I'm progressing: I'm almost at the point of having fully functioning initialization & pairing routines. My reverse engineering effort started completly from scratch, so I didn't look much at the work inside this repo, but as it turns out, the tudor family of sensors (that's what they're called in the driver) shares some, but not all characteristics with the sensors which this repo focuses on. However, I was able to clarify many things, because I am reverse engineering the Windows driver (which conveniently has debug symbols/printfs inside of it), while (I think) they only looked at captured USB packets. I might create a pull request claryfing overlapping info. As of yet it's still to early to release anything, but when I do, I'll post the link (and any major updates on progress) here. PS: Just speculation, but I belive that my driver could also work for 06cb:00bd sensors, without the need for a FW update. It might also possible that other sensors could work too, but so far I only tested it on my laptop's 06cb:00be one.

I'm also willing to be a guinea pig. I have an Ideapad Flex 5 (has 06cb:00be) with Arch that I can test it on. Like @shaqman, I have never been a driver tester so I may need a bit more instruction. Glad you're making progress, though!

I am too ok being a guinea pig.

Endermen1094 avatar Aug 01 '21 03:08 Endermen1094

Count me in for testing as well. I have a Lenovo IdeaPad S740 (06cb:00be Synaptics, Inc.) running Manjaro and 5.13 kernel

patbakdev avatar Aug 02 '21 17:08 patbakdev

Well that was quick. A few days after getting initialization to work, I already have events (finger press/remove, etc) and image captures up and running. Yet I'm still not done. Image post processing and matching is still missing (the sensor has commands for that functionality). After I get that to run, I'll put everything in a Github repo and send the link here.

I'll probably release the driver in two stages: First, I'll release my prototype python driver, too check if it works on sensors in the wild and too fix any bugs. After that, I'll create a libfprint implementation, so that it can work with existing fingerprint infrastructure.

PS: Here's a little sneak peak: a capture of the side of my finger image

Popax21 avatar Aug 03 '21 09:08 Popax21

Same as @patbakdev. Count me in for testing!. I have two Lenovo machines with 06cb:00be sensors from Synaptics. Also running Manjaro and 5.14.rc3 kernel.

mandresve avatar Aug 03 '21 16:08 mandresve

Hey that sounds very nice! I can also test if you need another one 👍 Currently I'm running on a Thinkpad L490 with the 06cb:00be sensor using Ubuntu 21.04

pfuhlert avatar Aug 03 '21 17:08 pfuhlert

I just uploaded my current state of progress: https://github.com/Popax21/synaTudor. Note that some things are still incomplete, like on sensor matching, or a libfprint integration, but it should still be enough to do some first in-the-wild tests.

PS: I'm beginning to loose motivation for this project, so I might take a break from it. So if you don't hear anything from me for a while, that's the reason.

Popax21 avatar Aug 05 '21 22:08 Popax21

Great effort @Popax21 It is working for me :smile: (Manjaro and 5.14.rc3 kernel) Thanks! I look forward to hearing from you soon.

mandresve avatar Aug 06 '21 17:08 mandresve

Yes, this is great work. I had no problems. IdeaPad S740 with 5.10.53-1-MANJARO.

patbakdev avatar Aug 06 '21 18:08 patbakdev

I'm so glad I commented on this because it seems I revived an issue that had kind of gone to sleep (but not quite yet died!)

I'm also willing to be a driver testing guinea pig. I have been using Linux for years but never really had to mess with drivers, so specific instructions will be appreciated.

In case no one else mentions it --- please make sure to backup your installs just in case something breaks :) I like to use Clonezilla to make an exact clone; that way I have no qualms about completely bricking my install during test, and restoring the backup takes <30 minutes.

kmanwar89 avatar Aug 26 '21 18:08 kmanwar89

@Popax21 - if this works and continues gaining traction, I'd like to donate to either:

  1. A cause you care about on your behalf
  2. An OSS project you support
  3. Buy you a coffee/beer/wishlist item from Amazon.

Sincerely, thanks for your efforts with this. I'm still serious about helping the bounty up to $500!

kmanwar89 avatar Aug 26 '21 18:08 kmanwar89

I tried out the code on github, everything worked as expected. Can't wait for the libfprint implementation

Etaash-mathamsetty avatar Aug 26 '21 23:08 Etaash-mathamsetty

I've just uploaded a (primitive) libfprint integration, which just calls the python driver library (because I'm not in the mood of converting it to C as of now). However, don't get your hopes up, because I discovered that without the post processing algorithm which I yet have to reverse engineer, libfprint doesn't produce successfull matches, meaning: you can enroll, but not verify. I'm going to continue reverse engineering and posting updates here.

Popax21 avatar Sep 05 '21 10:09 Popax21

I figured out a way to extract the post processing code from the Windows driver and integrate it into the Python driver. However, libfprint is still unable to produce a match, even with the post processed images. I suspect that I have to implement on device matching, however that will take a while. Still, you should be able to test the libfprint integration + post processing code and check if it might work for you. If you do, please note to check the updated instructions of the python driver.

Popax21 avatar Sep 06 '21 21:09 Popax21

I was able to enroll my right index finger, but It is unable to match the fingerprint. That bounty is going to be yours very soon :D

Etaash-mathamsetty avatar Sep 07 '21 12:09 Etaash-mathamsetty

I wasn't able to make this work. Took some doing to get everything needed to build libfprint, etc., but then I ran into this issue. https://github.com/3v1n0/libfprint/issues/29.

After downgrading fprintd to 1.90.1 and running fprintd-enroll I got:

$ list_devices failed: Failed to activate service 'net.reactivated.Fprint': timed out (service_start_timeout=25000ms)
# list_devices failed: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

systemd[1]: Starting Fingerprint Authentication Daemon...
fprintd[20880]: Traceback (most recent call last):
fprintd[20880]:   File "wrapper.py", line 1, in <module>
fprintd[20880]: ModuleNotFoundError: No module named 'tudor'
fprintd[20880]: Couldn't load wrapper python module!
systemd[1]: fprintd.service: Main process exited, code=dumped, status=5/TRAP
systemd[1]: fprintd.service: Failed with result 'core-dump'.
systemd[1]: Failed to start Fingerprint Authentication Daemon.

Probably something I am missing wrt setting everything up. I'll have to try again later when I have more time.

Keep up the good work.

patbakdev avatar Sep 07 '21 17:09 patbakdev

I wasn't able to make this work. Took some doing to get everything needed to build libfprint, etc., but then I ran into this issue. 3v1n0/libfprint#29.

After downgrading fprintd to 1.90.1 and running fprintd-enroll I got:

$ list_devices failed: Failed to activate service 'net.reactivated.Fprint': timed out (service_start_timeout=25000ms)
# list_devices failed: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

systemd[1]: Starting Fingerprint Authentication Daemon...
fprintd[20880]: Traceback (most recent call last):
fprintd[20880]:   File "wrapper.py", line 1, in <module>
fprintd[20880]: ModuleNotFoundError: No module named 'tudor'
fprintd[20880]: Couldn't load wrapper python module!
systemd[1]: fprintd.service: Main process exited, code=dumped, status=5/TRAP
systemd[1]: fprintd.service: Failed with result 'core-dump'.
systemd[1]: Failed to start Fingerprint Authentication Daemon.

Probably something I am missing wrt setting everything up. I'll have to try again later when I have more time.

Keep up the good work.

Did you install the python driver module globaly? (see README.md in the pydrv directory)

Popax21 avatar Sep 07 '21 22:09 Popax21

Any updates for the on device processing? I think there might be some dumb mistake in the code lol

Etaash-mathamsetty avatar Sep 24 '21 00:09 Etaash-mathamsetty

Any updates for the on device processing? I think it might be some dumb mistake in the code lol

As I have to completely reverse engineer and replicate that part of the driver, it will take a while. It's the biggest part of the windows driver.

Popax21 avatar Sep 24 '21 12:09 Popax21

could you give another update?

Etaash-mathamsetty avatar Oct 14 '21 20:10 Etaash-mathamsetty

could you give another update?

I'm still making progress, but it's quite slow. Hopefully though, the next update will be an announcement of the fully functioning driver. However, it'll take a while.

Popax21 avatar Oct 14 '21 21:10 Popax21

another progress update plz?

Etaash-mathamsetty avatar Nov 03 '21 16:11 Etaash-mathamsetty

another progress update plz?

I currently don't have much time or motivation to work on this project, however, when I regain both, I'll continue working on it.

Popax21 avatar Nov 03 '21 22:11 Popax21

another progress update plz?

I currently don't have much time or motivation to work on this project, however, when I regain both, I'll continue working on it.

That's alright, but Can you upload what you have got? I would like to continue working on it

Etaash-mathamsetty avatar Nov 04 '21 22:11 Etaash-mathamsetty

another progress update plz?

I currently don't have much time or motivation to work on this project, however, when I regain both, I'll continue working on it.

That's alright, but Can you upload what you have got? I would like to continue working on it

I didn't get much past the current state of the repo, so everything should be in there. However, most of the reverse engineering work is quite messy, so it may take a while until you get used to it. rev.txt and the Ghydra export are the most important files, as they contain all the information already gathered, and the prototype driver contains the practical implementation of it, which might be easier to understand.

Popax21 avatar Nov 04 '21 23:11 Popax21

another progress update plz?

I currently don't have much time or motivation to work on this project, however, when I regain both, I'll continue working on it.

That's alright, but Can you upload what you have got? I would like to continue working on it

I didn't get much past the current state of the repo, so everything should be in there. However, most of the reverse engineering work is quite messy, so it may take a while until you get used to it. rev.txt and the Ghydra export are the most important files, as they contain all the information already gathered, and the prototype driver contains the practical implementation of it, which might be easier to understand.

good to know

Etaash-mathamsetty avatar Nov 05 '21 15:11 Etaash-mathamsetty

another progress update plz?

I currently don't have much time or motivation to work on this project, however, when I regain both, I'll continue working on it.

That's alright, but Can you upload what you have got? I would like to continue working on it

I didn't get much past the current state of the repo, so everything should be in there. However, most of the reverse engineering work is quite messy, so it may take a while until you get used to it. rev.txt and the Ghydra export are the most important files, as they contain all the information already gathered, and the prototype driver contains the practical implementation of it, which might be easier to understand.

I tried compiling your fork of ghidra and... it didn't work any help? im using arch linux now error: Could not find method helpIndexCompile() for arguments [javax.help:javahelp:2.0.05] on object of type org.gradle.api.internal.artifacts.dsl.dependencies.DefaultDependencyHandler. also an sha256 hash didn't match

Etaash-mathamsetty avatar Nov 07 '21 17:11 Etaash-mathamsetty

another progress update plz?

I currently don't have much time or motivation to work on this project, however, when I regain both, I'll continue working on it.

That's alright, but Can you upload what you have got? I would like to continue working on it

I didn't get much past the current state of the repo, so everything should be in there. However, most of the reverse engineering work is quite messy, so it may take a while until you get used to it. rev.txt and the Ghydra export are the most important files, as they contain all the information already gathered, and the prototype driver contains the practical implementation of it, which might be easier to understand.

I tried compiling your fork of ghidra and... it didn't work any help? im using arch linux now error: Could not find method helpIndexCompile() for arguments [javax.help:javahelp:2.0.05] on object of type org.gradle.api.internal.artifacts.dsl.dependencies.DefaultDependencyHandler.

Did you follow the regular Ghdira build guide?

Popax21 avatar Nov 07 '21 17:11 Popax21

yes i did

Etaash-mathamsetty avatar Nov 07 '21 17:11 Etaash-mathamsetty

yes i did

I did some research, and it might be related to not building with JDK 11

Popax21 avatar Nov 07 '21 17:11 Popax21

yes i did

I did some research, and it might be related to not building with JDK 11

wait what JDK do I use then???

Etaash-mathamsetty avatar Nov 07 '21 17:11 Etaash-mathamsetty

yes i did

I did some research, and it might be related to not building with JDK 11

wait what JDK do I use then???

Try JDK 11

Popax21 avatar Nov 07 '21 17:11 Popax21

yes i did

I did some research, and it might be related to not building with JDK 11

wait what JDK do I use then???

Try JDK 11

That's what I am using though?

Etaash-mathamsetty avatar Nov 07 '21 17:11 Etaash-mathamsetty

also extra error I removed the assert for it because I thought it was just some newer version causing the mismatch assert(sourceSha256.equals(expectedSha256)) | | | | false '81b7d19d57c4a3009f4761699a72e8d642b5e1d9251d2bb98df438b1e28f8ba9' 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'

Etaash-mathamsetty avatar Nov 07 '21 17:11 Etaash-mathamsetty

I will try using regular ghidra for now I guess nope, there was an error while analyzing the assembly I think I will just wait for you to finish the driver :(

Etaash-mathamsetty avatar Nov 07 '21 18:11 Etaash-mathamsetty

i have everything packaged ready for the AUR. thanks popax for your work.

nicman23 avatar Nov 30 '21 14:11 nicman23

another progress update plz?

I currently don't have much time or motivation to work on this project, however, when I regain both, I'll continue working on it.

Progress update? @Popax21

Etaash-mathamsetty avatar Dec 03 '21 18:12 Etaash-mathamsetty

I managed to disassemble the file in IDA freeware. I think this function matches the image func.txt Unfortunately I don't know much assembly and I have no idea how to convert the file to C (which I am very familar with). maybe one of you might find it useful.

Etaash-mathamsetty avatar Dec 09 '21 23:12 Etaash-mathamsetty

I tried to use the driver again but it failed with this error (the libfprint patch is too old :( ) usr/lib/fprintd: symbol lookup error: /usr/lib/fprintd: undefined symbol: fp_device_suspend_finish

Etaash-mathamsetty avatar Dec 10 '21 01:12 Etaash-mathamsetty

@Etaash-mathamsetty you do use arch ?

nicman23 avatar Dec 10 '21 19:12 nicman23

yes

Etaash-mathamsetty avatar Dec 10 '21 23:12 Etaash-mathamsetty

here the fprintd is an older from the repos the libfprint includes the patch and python driver.

nicman23 avatar Dec 11 '21 09:12 nicman23

also here is the aur package https://aur.archlinux.org/packages/libfprint-tudor (a built version is in the above tar)

nicman23 avatar Dec 11 '21 10:12 nicman23

Hello and thanks for the latests efforts. I was testing the provided packages and everything goes just fine, but the fprintd-verify function always return verify-no-match for me after enrolling. Is this already supported? (Matching) Thank you again.

mandresve avatar Dec 11 '21 17:12 mandresve

the fprintd-verify function always return verify-no-match for me after enrolling. Is this already supported?

It's not yet supported the following comments by Popax21 provide more info about it 1 2 3

daniromome avatar Dec 11 '21 17:12 daniromome

Little status update: Nothing much happened behind the scenes since the last update, as I just never found the motivation to continue reverse engineering, mainly because that part of the driver references a lot of new submodules. I don't want to promise too much, but I think I am going to have more time/motivation to work on this over newyears.

Popax21 avatar Dec 13 '21 00:12 Popax21

@Popax21 I got your version of ghidra to start compiling (idk if it will compile) you need gradle<7 for ghidra to compile edit: compile successful edit 2: the fingerprint matching function is massive man, probably the biggest chunk of code in the driver

Etaash-mathamsetty avatar Dec 14 '21 01:12 Etaash-mathamsetty

could you give a progress update? @Popax21

Etaash-mathamsetty avatar Jan 05 '22 21:01 Etaash-mathamsetty

Any progress on this?

Etaash-mathamsetty avatar Jan 24 '22 20:01 Etaash-mathamsetty

Nothing new since last time, and this project isn't at the top of my priority list at the moment.

Popax21 avatar Jan 25 '22 00:01 Popax21

Nothing new since last time, and this project isn't at the top of my priority list at the moment.

what files did you change in the libfprint patch? (I want to contribute :D)

Etaash-mathamsetty avatar Jan 26 '22 01:01 Etaash-mathamsetty

any updates on this? (also have you implemented qmModule, the way you organized the stuff is very different than what the actual driver is lol)

Etaash-mathamsetty avatar Apr 11 '22 00:04 Etaash-mathamsetty

any updates on this? (also have you implemented qmModule, the way you organized the stuff is very different than what the actual driver is lol)

Sadly not, I've been rather busy the last few months, and I don't know if I will have time to work on this project in the near future.

Also reverse engineering of the qmModule (which as far as I know is the module actually doing the matching) is still in very early stages, and would probably take a lot of work to get to a state where I could start recreating its functionality in the prototype driver. As such my plan for when I return to this project would be to try to tweak the parameters of libfprint's built in matcher and try to get it to succesfully match images. If that works, I would probably clean up the prototypr driver (including removing the assembly stubs ripped from the original driver), and create an actually useable libfprint driver, so that people can use the sensor, even though things like on-device matching would still be WIP.

Popax21 avatar Apr 16 '22 00:04 Popax21

any updates on this? (also have you implemented qmModule, the way you organized the stuff is very different than what the actual driver is lol)

Sadly not, I've been rather busy the last few months, and I don't know if I will have time to work on this project in the near future.

Also reverse engineering of the qmModule (which as far as I know is the module actually doing the matching) is still in very early stages, and would probably take a lot of work to get to a state where I could start recreating its functionality in the prototype driver. As such my plan for when I return to this project would be to try to tweak the parameters of libfprint's built in matcher and try to get it to succesfully match images. If that works, I would probably clean up the prototypr driver (including removing the assembly stubs ripped from the original driver), and create an actually useable libfprint driver, so that people can use the sensor, even though things like on-device matching would still be WIP.

that seems like an easier way to do it, since the matching code will take ages to reverse engineer. I am confused on how enrollment would work then

Etaash-mathamsetty avatar Apr 17 '22 03:04 Etaash-mathamsetty

Small update: my experiments with libfprint's builtin matcher went nowhere (in fact the image comparison function always returned the lowest possible score when matching .-.). However, I've found a new approach for the driver which, assuming it works, would provide THE EXACT SAME LEVEL OF FUNCTIONALITY as the Windows driver, but at the cost of not really helping with the reverse engineering effort. It's too early to upload anything regarding it yet though.

Popax21 avatar May 04 '22 11:05 Popax21

Small update: my experiments with libfprint's builtin matcher went nowhere (in fact the image comparison function always returned the lowest possible score when matching .-.). However, I've found a new approach for the driver which, assuming it works, would provide THE EXACT SAME LEVEL OF FUNCTIONALITY as the Windows driver, but at the cost of not really helping with the reverse engineering effort. It's too early to upload anything regarding it yet though.

I am intrigued, could you provide more details on this approach? (did you just re create something like wine lol)

Etaash-mathamsetty avatar May 04 '22 19:05 Etaash-mathamsetty

(do you just re create something like wine lol)

image .-.

Popax21 avatar May 04 '22 20:05 Popax21

(do you just re create something like wine lol)

image .-.

haha thought so that's really smart, and will allow windows drivers to be ported over the linux someday im sure

Etaash-mathamsetty avatar May 04 '22 21:05 Etaash-mathamsetty

(do you just re create something like wine lol)

image .-.

haha thought so that's really smart, and will allow windows drivers to be ported over the linux someday im sure

It's definetly a very promising approach which I already plan to experiment with some more once the driver's done, but I'll do that with a new, clean codebase, as the current one's kind of hacky, not very clean, and not really suitable for running anything other than the tudor driver.

Popax21 avatar May 04 '22 22:05 Popax21

any updates on this?

Etaash-mathamsetty avatar May 10 '22 03:05 Etaash-mathamsetty

any updates on this?

I got the driver to both initialize and pair the sensor, and am currently working on connecting the two halves of the driver (synaFpAdapter104.dll, the one implementing the WinBIO interface, and synaWudfBioUsb.dll, the actual driver)

PS: I might have found a vulnerability in the driver which could allow for USB devices to achieve ACE as the Local Service account (from which it's pretty easy to escalate to NT Authority)

Popax21 avatar May 11 '22 11:05 Popax21

Update: the driver halves are now communicating through simulated IOCTRLs, and as such everything from initialization to pairing, resetting, etc. is now working (admittedly with some questionable hacky code behind it all, but I kind of just want to get this project done for now, and potentially revisit and rewrite it in the future). The only thing which I still have to do before uploading something is creating a simple WINBIO pipeline frontend, so that one can actually use the sensor's functionality.

Popax21 avatar May 12 '22 21:05 Popax21

Update: the driver halves are now communicating through simulated IOCTRLs, and as such everything from initialization to pairing, resetting, etc. is now working (admittedly with some questionable hacky code behind it all, but I kind of just want to get this project done for now, and potentially revisit and rewrite it in the future). The only thing which I still have to do before uploading something is creating a simple WINBIO pipeline frontend, so that one can actually use the sensor's functionality.

I don't think anybody here really cares about hacky code, I just want something that works lol

Etaash-mathamsetty avatar May 12 '22 22:05 Etaash-mathamsetty

Update: I got EVERYTHING working, including enrolling, verification and identification. See the updated instructions in the repository (https://github.com/Popax21/synaTudor). Currently, there is only a simple CLI wrapper, and the code is very hacky and unstable, but if it turns out to work for other people I am gonna start work on a libfprint module soon.

Popax21 avatar May 15 '22 02:05 Popax21

Great. So many thanks Popax21, this is awesome. Can you provide please a comprehensive guide to init the sensor and get the enrollment? All I get is "GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7fbde4c42710]" Segmentation fault

mandresve avatar May 15 '22 02:05 mandresve

Great. So many thanks Popax21, this is awesome. Can you provide please a comprehensive guide to init the sensor and get the enrollment? All I get is "GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7fbde4c42710]" Segmentation fault

That's... not right. Can you try running it in GDB (it builds with debug symbols by default)?

Popax21 avatar May 15 '22 02:05 Popax21

Additionaly, you can try running it with -vv or -t, just note that I will only have time to look at this
again in about 8 hours or so

Popax21 avatar May 15 '22 03:05 Popax21

Using GDB: [INF] Initializing libcrypto... [INF] Initializing libusb... [New Thread 0x7ffff7a2a640 (LWP 9402)] [INF] Found sensor USB device [bus 1 addr 3 vid 0x06cb pid 0x00be] [INF] Opening sensor USB device... [INF] Dropping root privileges... [new uid=1000 new gid=1000] [New Thread 0x7ffff7229640 (LWP 9404)] [INF] Initializing tudor driver... [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [INF] Loaded driver DLL 'synaFpAdapter104.dll' [186656 bytes] [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [WRN] Data directory 4 has invalid bounds! [end 0x17ebe0 > image end 0x17e000] [INF] Loaded driver DLL 'synaWudfBioUsb104.dll' [1567712 bytes] [INF] Initializing driver DLL 'synaFpAdapter104.dll'... [INF] Initializing driver DLL 'synaWudfBioUsb104.dll'... [INF] Loading data from data store '/home/mandresve/Tudor/store.txt'... [INF] Opening tudor device... [WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7ffff68e7710] [New Thread 0x7ffff687b640 (LWP 9411)] [New Thread 0x7ffff607a640 (LWP 9412)] [New Thread 0x7ffff5879640 (LWP 9413)]

Thread 5 "tudor" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff607a640 (LWP 9412)] 0x00007ffff689e859 in ?? ()

Using -vv [INF] Initializing libcrypto... [INF] Initializing libusb... [INF] Found sensor USB device [bus 1 addr 3 vid 0x06cb pid 0x00be] [INF] Opening sensor USB device... [INF] Dropping root privileges... [new uid=1000 new gid=1000] [INF] Initializing tudor driver... [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [DBG] DLL synaFpAdapter104.dll: PE+ image [DBG] -> machine: 8664 [DBG] -> image size: 0002f000 [DBG] -> entry point: 0000e594 [DBG] -> num data dirs: 16 [DBG] -> num sections: 6 [DBG] -> num relocations: 853 [DBG] Copied image memory to mapping at 0x7fe9a5d94000 - 0x7fe9a5dc3000 [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [DBG] Applied 853 relocations [DBG] Applying memory protections to image [DBG] -> section .text | 0x7fe9a5d95000 - 0x7fe9a5daf143 | r-x [DBG] -> section .rdata | 0x7fe9a5db0000 - 0x7fe9a5dbb234 | r-- [DBG] -> section .data | 0x7fe9a5dbc000 - 0x7fe9a5dbe010 | rw- [DBG] -> section .pdata | 0x7fe9a5dbf000 - 0x7fe9a5dc0818 | r-- [DBG] -> section .rsrc | 0x7fe9a5dc1000 - 0x7fe9a5dc1698 | r-- [DBG] -> section .reloc | 0x7fe9a5dc2000 - 0x7fe9a5dc26f4 | r-- [INF] Loaded driver DLL 'synaFpAdapter104.dll' [186656 bytes] [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [WRN] Data directory 4 has invalid bounds! [end 0x17ebe0 > image end 0x17e000] [DBG] DLL synaWudfBioUsb104.dll: PE+ image [DBG] -> machine: 8664 [DBG] -> image size: 0017e000 [DBG] -> entry point: 0004b950 [DBG] -> num data dirs: 16 [DBG] -> num sections: 6 [DBG] -> num relocations: 1681 [DBG] Copied image memory to mapping at 0x7fe9a5c16000 - 0x7fe9a5d94000 [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import CM_Query_And_Remove_SubTreeA@api-ms-win-devices-config-l1-1-2.dll [VRB] Couldn't resolve import CM_Get_Device_Interface_List_SizeA@api-ms-win-devices-config-l1-1-2.dll [VRB] Couldn't resolve import CM_Get_Device_Interface_ListA@api-ms-win-devices-config-l1-1-2.dll [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import CM_Get_Device_Interface_PropertyW@api-ms-win-devices-config-l1-1-1.dll [VRB] Couldn't resolve import [email protected] [DBG] Applied 1681 relocations [DBG] Applying memory protections to image [DBG] -> section .text | 0x7fe9a5c17000 - 0x7fe9a5ce1494 | r-x [DBG] -> section .rdata | 0x7fe9a5ce2000 - 0x7fe9a5d70ba8 | r-- [DBG] -> section .data | 0x7fe9a5d71000 - 0x7fe9a5d89e54 | rw- [DBG] -> section .pdata | 0x7fe9a5d8a000 - 0x7fe9a5d91e0c | r-- [DBG] -> section .rsrc | 0x7fe9a5d92000 - 0x7fe9a5d924d0 | r-- [DBG] -> section .reloc | 0x7fe9a5d93000 - 0x7fe9a5d93e10 | r-- [INF] Loaded driver DLL 'synaWudfBioUsb104.dll' [1567712 bytes] [INF] Initializing driver DLL 'synaFpAdapter104.dll'... [INF] Initializing driver DLL 'synaWudfBioUsb104.dll'... [DBG] Binding WDF function table 'WUDFx02000' version 2.21#0... [261 functions] [INF] Loading data from data store '/home/mandresve/Tudor/store.txt'... [INF] Opening tudor device... [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'wbfMode' val type 4 buf size 4 suc 1 [DBG] Flushing WDF event queue... [DBG] Calling WDF device attachment callbacks... [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'DeviceInitializeFailures' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SetOwnershipFailureCount' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'UpdateFirmwareFailureCount' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SensorLockFailureCount' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'LastUpdateSystemTimeStamp' val type 4 buf size 4 suc 1 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'DeviceInitializeFailures' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SetOwnershipFailureCount' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'UpdateFirmwareFailureCount' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SensorLockFailureCount' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'LastUpdateSystemTimeStamp' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'wbfMode' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'wbfMode' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'useWbf' val type 4 buf size 4 suc 1 [WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7fe9a5c81710] [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'deviceInitializeFailures' val type 4 buf size 4 suc 1 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'LastUpdateSystemTimeStamp' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'PairingInProcess' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'UnairingInProcess' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'DeviceUpdateInProcess' val type 4 buf size 4 suc 1 SEGFAULT

mandresve avatar May 15 '22 03:05 mandresve

This is awesome. I subscribed to updates on this last week, thinking it would be a long time until there was anything to see. Got it installed, enrolled all of my fingers, didn't run into any issues. Thank you for this, it's very, very cool.

a-a-crabtree avatar May 15 '22 03:05 a-a-crabtree

Using GDB: [INF] Initializing libcrypto... [INF] Initializing libusb... [New Thread 0x7ffff7a2a640 (LWP 9402)] [INF] Found sensor USB device [bus 1 addr 3 vid 0x06cb pid 0x00be] [INF] Opening sensor USB device... [INF] Dropping root privileges... [new uid=1000 new gid=1000] [New Thread 0x7ffff7229640 (LWP 9404)] [INF] Initializing tudor driver... [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [INF] Loaded driver DLL 'synaFpAdapter104.dll' [186656 bytes] [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [WRN] Data directory 4 has invalid bounds! [end 0x17ebe0 > image end 0x17e000] [INF] Loaded driver DLL 'synaWudfBioUsb104.dll' [1567712 bytes] [INF] Initializing driver DLL 'synaFpAdapter104.dll'... [INF] Initializing driver DLL 'synaWudfBioUsb104.dll'... [INF] Loading data from data store '/home/mandresve/Tudor/store.txt'... [INF] Opening tudor device... [WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7ffff68e7710] [New Thread 0x7ffff687b640 (LWP 9411)] [New Thread 0x7ffff607a640 (LWP 9412)] [New Thread 0x7ffff5879640 (LWP 9413)]

Thread 5 "tudor" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff607a640 (LWP 9412)] 0x00007ffff689e859 in ?? ()

Using -vv [INF] Initializing libcrypto... [INF] Initializing libusb... [INF] Found sensor USB device [bus 1 addr 3 vid 0x06cb pid 0x00be] [INF] Opening sensor USB device... [INF] Dropping root privileges... [new uid=1000 new gid=1000] [INF] Initializing tudor driver... [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [DBG] DLL synaFpAdapter104.dll: PE+ image [DBG] -> machine: 8664 [DBG] -> image size: 0002f000 [DBG] -> entry point: 0000e594 [DBG] -> num data dirs: 16 [DBG] -> num sections: 6 [DBG] -> num relocations: 853 [DBG] Copied image memory to mapping at 0x7fe9a5d94000 - 0x7fe9a5dc3000 [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [DBG] Applied 853 relocations [DBG] Applying memory protections to image [DBG] -> section .text | 0x7fe9a5d95000 - 0x7fe9a5daf143 | r-x [DBG] -> section .rdata | 0x7fe9a5db0000 - 0x7fe9a5dbb234 | r-- [DBG] -> section .data | 0x7fe9a5dbc000 - 0x7fe9a5dbe010 | rw- [DBG] -> section .pdata | 0x7fe9a5dbf000 - 0x7fe9a5dc0818 | r-- [DBG] -> section .rsrc | 0x7fe9a5dc1000 - 0x7fe9a5dc1698 | r-- [DBG] -> section .reloc | 0x7fe9a5dc2000 - 0x7fe9a5dc26f4 | r-- [INF] Loaded driver DLL 'synaFpAdapter104.dll' [186656 bytes] [WRN] PE file contains unsupported resource data directory! [WRN] PE file contains unsupported exception data directory! [WRN] Data directory 4 has invalid bounds! [end 0x17ebe0 > image end 0x17e000] [DBG] DLL synaWudfBioUsb104.dll: PE+ image [DBG] -> machine: 8664 [DBG] -> image size: 0017e000 [DBG] -> entry point: 0004b950 [DBG] -> num data dirs: 16 [DBG] -> num sections: 6 [DBG] -> num relocations: 1681 [DBG] Copied image memory to mapping at 0x7fe9a5c16000 - 0x7fe9a5d94000 [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import CM_Query_And_Remove_SubTreeA@api-ms-win-devices-config-l1-1-2.dll [VRB] Couldn't resolve import CM_Get_Device_Interface_List_SizeA@api-ms-win-devices-config-l1-1-2.dll [VRB] Couldn't resolve import CM_Get_Device_Interface_ListA@api-ms-win-devices-config-l1-1-2.dll [VRB] Couldn't resolve import [email protected] [VRB] Couldn't resolve import CM_Get_Device_Interface_PropertyW@api-ms-win-devices-config-l1-1-1.dll [VRB] Couldn't resolve import [email protected] [DBG] Applied 1681 relocations [DBG] Applying memory protections to image [DBG] -> section .text | 0x7fe9a5c17000 - 0x7fe9a5ce1494 | r-x [DBG] -> section .rdata | 0x7fe9a5ce2000 - 0x7fe9a5d70ba8 | r-- [DBG] -> section .data | 0x7fe9a5d71000 - 0x7fe9a5d89e54 | rw- [DBG] -> section .pdata | 0x7fe9a5d8a000 - 0x7fe9a5d91e0c | r-- [DBG] -> section .rsrc | 0x7fe9a5d92000 - 0x7fe9a5d924d0 | r-- [DBG] -> section .reloc | 0x7fe9a5d93000 - 0x7fe9a5d93e10 | r-- [INF] Loaded driver DLL 'synaWudfBioUsb104.dll' [1567712 bytes] [INF] Initializing driver DLL 'synaFpAdapter104.dll'... [INF] Initializing driver DLL 'synaWudfBioUsb104.dll'... [DBG] Binding WDF function table 'WUDFx02000' version 2.21#0... [261 functions] [INF] Loading data from data store '/home/mandresve/Tudor/store.txt'... [INF] Opening tudor device... [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'wbfMode' val type 4 buf size 4 suc 1 [DBG] Flushing WDF event queue... [DBG] Calling WDF device attachment callbacks... [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'DeviceInitializeFailures' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SetOwnershipFailureCount' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'UpdateFirmwareFailureCount' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SensorLockFailureCount' val type 0 buf size 0 suc 0 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'LastUpdateSystemTimeStamp' val type 4 buf size 4 suc 1 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'DeviceInitializeFailures' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SetOwnershipFailureCount' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'UpdateFirmwareFailureCount' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'SensorLockFailureCount' val type 4 buf size 4 suc 0 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'LastUpdateSystemTimeStamp' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'wbfMode' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'wbfMode' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx (nil) key 'HKEY_LOCAL_MACHINE\SOFTWARE\Syna' value 'useWbf' val type 4 buf size 4 suc 1 [WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7fe9a5c81710] [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'deviceInitializeFailures' val type 4 buf size 4 suc 1 [VRB] REGWRITE | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'LastUpdateSystemTimeStamp' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'PairingInProcess' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'UnairingInProcess' val type 4 buf size 4 suc 1 [VRB] REGREAD | ctx 0x7fff515fb550 key 'HKEY_LOCAL_MACHINE\Tudor\Device' value 'DeviceUpdateInProcess' val type 4 buf size 4 suc 1 SEGFAULT

Can you try running in GDB and with -vvt at the same time? Also run bt and p tudor_windrv_dlls in GDB after it crashes. (might want to put the output in a pastebin though)

Popax21 avatar May 15 '22 08:05 Popax21

As for future plans: I am probably gonna submit a request to libfprint soon to allow for dynamic module/driver loading, as that feature would simplify development of the libfprint integration a lot. Additionally, I'm planning on potentially cleaning up and creating a standalone helper framework from the approach taken here (load and dynamically relink Windows driver DLLs). Also, with the new control over driver operations which all of this gives me, I might be able to black-box reverse engineer the protocol, potentially allowing for the creation of a clean open source driver, which might even be able to get merged into the main libfprint repository.

Popax21 avatar May 15 '22 13:05 Popax21

I just tried it, and it works perfectly!

Etaash-mathamsetty avatar May 15 '22 16:05 Etaash-mathamsetty

any updates on this? edit: what if instead of using fprint, we just create some kind of pam authentication system like howdy does it looking at the howdy source code, it does seem like a possibility, so let's see if I can get this idea somewhere

Etaash-mathamsetty avatar May 25 '22 15:05 Etaash-mathamsetty

any updates on this? edit: what if instead of using fprint, we just create some kind of pam authentication system like howdy does it looking at the howdy source code, it does seem like a possibility, so let's see if I can get this idea somewhere

Even though that could work, libfprint is the the de-facto standard for Linux fingerprint authentication systems, and as such a lot of software has support/bindings for it. Anyway, I'm currently just trying to catch and resolve any issues before starting work on that (one already came up which I should hopefully have pushed the fix for today).

Popax21 avatar May 25 '22 22:05 Popax21

any updates on this?

Etaash-mathamsetty avatar Jun 17 '22 20:06 Etaash-mathamsetty

Sorry, life got in the way, but the next step would be opening the feature request/issue for libfprint to add the ability to load external fingerprint driver modules, because honestly maintaining a own fork just to have support for the sensor isn't something I want to do, nor would be very clean (same as I already said earlier, I just need time to work on a proper formal request, which I didn't have recently)

Popax21 avatar Jun 23 '22 15:06 Popax21

I just opened the feature request issue for libfprint, after it gets implemented (assuming it even does), I will start working on the actual integration code.

Popax21 avatar Jun 28 '22 18:06 Popax21

im just gonna post a little update for people who weren't following the gitlab thread https://gitlab.freedesktop.org/3v1n0/libfprint/-/tree/tod essentially, the patch that popax21 was looking to make already exists, and there is example code on how to make a driver as a shared library that can then be loaded by the TOD fork of libfprint example code: https://gitlab.freedesktop.org/3v1n0/libfprint-tod-example-driver all that's left to do is write the code for the driver edit: looked at the example code, and yeah it probably shouldn't take more than a week or two lol depending on how much time I have, I could try playing with it tmrw and see where I reach

Etaash-mathamsetty avatar Jul 01 '22 21:07 Etaash-mathamsetty

and yeah it probably shouldn't take more than a week or two lol

I'm already working on it (in fact I just pushed the first commit splitting the relink project into two halves), but I doubt it will take "a week or two", mostly because of security. At the end of the day, this is basically downloading a proprietary driver, gluing it together with a lot of not-very-clean code, and then executing the entire thing as root - if one piece of this extremely fragile chain breaks, the entire system is compromised. As such I am planning on heavily sandboxing the entire relinking and driver code, and only letting it interact with the libfprint module with the least amount of attack surface possible. This will take more time to finish than a crude conversion into a libfprint-tod module, but would result in something I am probably gonna daily drive myself.

EDIT: Also while I definitely appreciate you trying to help and working the libfprint integration yourself, after more than a year of work spent on this project reverse engineering the driver, coding lots of different approaches, and in general trying to find a way to make this work, I would like to finish the project's code myself, if that's OK for you / the rest of the people waiting on this.

Popax21 avatar Jul 02 '22 00:07 Popax21

and yeah it probably shouldn't take more than a week or two lol

I'm already working on it (in fact I just pushed the first commit splitting the relink project into two halves), but I doubt it will take "a week or two", mostly because of security. At the end of the day, this is basically downloading a proprietary driver, gluing it together with a lot of not-very-clean code, and then executing the entire thing as root - if one piece of this extremely fragile chain breaks, the entire system is compromised. As such I am planning on heavily sandboxing the entire relinking and driver code, and only letting it interact with the libfprint module with the least amount of attack surface possible. This will take more time to finish than a crude conversion into a libfprint-tod module, but would result in something I am probably gonna daily drive myself.

EDIT: Also while I definitely appreciate you trying to help and working the libfprint integration yourself, after more than a year of work spent on this project reverse engineering the driver, coding lots of different approaches, and in general trying to find a way to make this work, I would like to finish the project's code myself, if that's OK for you / the rest of the people waiting on this.

sure you can finish it, I wasn't really considering security in that time estimate, but if we include security, then how long will it take?

Etaash-mathamsetty avatar Jul 02 '22 00:07 Etaash-mathamsetty