Add 06cb:00cb (HP Pavilion x360 14-dh, sensor type 0x969)#3
Open
ggiesen wants to merge 1 commit into
Open
Conversation
Same 0x969 silicon as the ZBook 138a:00ab already supported on this branch, so it reuses the existing 0x199-profile handling and needs only its own device registration, reset_blob, and firmware. - usb.py: register DEV_CB = (0x06cb, 0x00cb). - blobs_00cb.py: init_hardcoded / init_hardcoded_clean_slate / db_write_enable are byte-identical to blobs_9a; only reset_blob is 06cb:00cb-specific (every existing set's reset_blob is rejected 0404/04be on this chip, so factory_reset couldn't wipe a foreign pairing). Recovered by static RE of HP's Windows SGX driver (synaWudfBioUsb116SGX.dll) and confirmed on hardware. - firmware_tables.py: fetch 6_07f_hp_mis_qm.xpfwext from HP SoftPaq sp138431 (validity-sensors-firmware auto-provisions it). Confirmed on hardware: factory_reset wipes the foreign pairing, then re-partition / pair / calibrate / enroll / verify all work.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
06cb:00cbis the HP Pavilion x360 14-dh1008ca fingerprint reader -- a Validity VCSFW sensor type0x969(identifies "57K0 FM-3439"), the same silicon as the ZBook138a:00abthis branch already supports. So it reuses the existing0x969 -> 0x199profile handling and only needs its device registration, its ownreset_blob, and its firmware.What's here
usb.py:DEV_CB = (0x06cb, 0x00cb).blobs_00cb.py:init_hardcoded,init_hardcoded_clean_slate, anddb_write_enableare byte-identical toblobs_9a(imported from it); onlyreset_blobdiffers.firmware_tables.py:6_07f_hp_mis_qm.xpfwext, auto-fetched from HP SoftPaqsp138431(URL + sha512 verified;validity-sensors-firmwareextracts it via innoextract/cabextract like the other HP entries).No
sensor.pychange -- the0x969alias and theFM-3439suspend/resume handling on this branch already cover it (thecapture()b[0]==3fix already keys offreal_device_type in (0xd51, 0x969)).Why a device-specific
reset_blobThis unit shipped paired to a previous host, and
factory_reset()couldn't wipe it: thereset_blobfrom every existing set (blobs_90/97/9a/9d) is rejected0404/04beon0x00cb. So it needs its own. I recovered it by static RE of HP's Windows SGX driver (synaWudfBioUsb116SGX.dll) -- the signed blobs are stored there in a 30-entry descriptor table, without their leading06command byte. A passive USB capture is a dead end here (the driver's reset rides an ephemeral-ECDH bootstrap TLS session, so the key isn't recoverable from a pcap). Two ~12 KB table entries were size-plausible; I trialled both on hardware -- the 11972-byte one is accepted (0x0000, wipes the flash 5 partitions -> 0), the other rejected (0x04aa).Validation
Confirmed on the actual
06cb:00cbhardware running this branch's exact code (real_type=0x969at open): the sensor initializes, calibrates via the0x969 -> 0x199profile, and enroll, verify, and delete all work -- verify matches the enrolled finger and rejects others; it also survives a reboot (firmware restored into/runbefore the daemon opens).init_hardcoded/init_hardcoded_clean_slate/db_write_enable==blobs_9ais confirmed (the on-wireinit_hardcodedmatches andinit_dbsucceeds). Thereset_blobwas confirmed on the foreign-paired unit (accepted0x0000, wipes the flash);factory_resetsends it as a raw pre-TLSusb.cmd, so it's independent of the profile routing.RE detail and the full story: uunicorn#263.