Identification for 06cb:00a8 — it reports sensor type `0x2449`

This device can be identified without pairing or writing anything to it, so
here are concrete numbers for 06cb:00a8.

Key point: tls.cmd() transmits in plaintext while no TLS session is open
(that is why read_tls_flash() works before tls.open()). So identify_sensor()
— command 0x75 — can simply be asked directly, no pairing required:

--> 0x75 identify_sensor()
    10 bytes, status 0x0000
    0000  00 00 00 00 00 00 6e 00 90 01

    zeroes = 0x00000000   (passes the `if zeroes != 0` sanity check)
    minor  = 0x006e
    major  = 0x0190

Feeding that through dev_info_lookup() from validitysensor/hw_tables.py:

DeviceInfo(0x0190, 0x2449, 0x6e, 0xff, '86C  TM3261-003-004')

So 06cb:00a8 is sensor type 0x2449. sensor.py only handles 0x199 and
0x00db, which is why adding the USB ID alone cannot work — it would fail at
Device %s is not supported (sensor type 0x%x).

Worth noting for anyone tempted to reason from neighbouring firmware versions:
the minor values are firmware build numbers, not a hardware ordering. Around
ours: 0x6a→0x199, 0x6b→0x191, 0x6d→0x0000, 0x6e→0x2449,
0x6f→0x581. Adjacency means nothing.

The device speaks the protocol fine

All plaintext informational commands are answered with status 0x0000:

--> 0x01   RomInfo.get()            38 bytes, status 0x0000
    0000  00 00 10 b6 04 54 9a 00 00 00 06 14 01 33 00 01
    0010  00 00 4e 4a 49 00 48 1d 00 21 00 00 00 00 01 00
    0020  00 00 00 00 00 06

--> 0x19   (part of send_init)      68 bytes, status 0x0000
    0000  00 00 02 00 21 00 10 01 00 00 00 00 00 00 00 00
    0010  00 00 00 00 XX XX XX XX 00 00 00 00 XX XX XX XX
    0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    (XX = redacted, these two words look device-unique)

--> 0x3e   get_flash_info()         16 bytes, status 0x0000
    0000  00 00 ff 00 ff 00 00 10 10 00 00 00 01 00 00 00

--> 0x4302 get_fw_info()             2 bytes, status 0x04af

The 0x04af on get_fw_info() is just the fwext is not loaded / "clean
slate" state that send_init() already handles — not an incompatibility.

What is actually missing for `0x2449`

I checked the tables rather than guessing:

Piece	Status
`SensorTypeInfo` (geometry: `bytes_per_line`, `line_width`, `lines_per_calibration_data`)	27 types present, `0x2449` absent
`SensorCaptureProg` (capture program)	28 `dev_type` values present, `0x2449` absent
`calibration_blob`	likely a non-issue — 7 of the 8 types with geometry `120/112` share one identical blob; only `0x00e4` differs

So the blocker is the capture program for type 0x2449, plus the geometry
row. Both would have to come out of the Windows driver the same way the rest of
generated_tables.py did.

Probe script for other affected owners

Devices reported to use 06cb:00a8 include Clevo N150U / N151ZU and the
machines built on them (Wortmann Terra Mobile 1550, System76 Darter Pro,
TUXEDO InfinityBook v5). If you have one, this prints your major/minor and
looks up the type. It is read-only: it never sends 0x3f (erase_flash), never
uploads a firmware extension, never pairs. Uses ctypes + libusb, so there is
nothing to install.

validity_probe.py

#!/usr/bin/env python3
"""
Read-only identification probe for Synaptics/Validity fingerprint sensors.

Purpose: find out which sensor type (dev_info) an unsupported 06cb device
reports, without writing anything to it.

It sends ONLY informational commands that python-validity's send_init() issues
before TLS is established:

    0x01      RomInfo.get()
    0x19      (part of send_init)
    0x75      identify_sensor()   <- the interesting one
    0x3e      get_flash_info()

Note that tls.cmd() transmits in plaintext while no TLS session is open (this
is why read_tls_flash() works before tls.open()), so 0x75 can be answered
without pairing.

NOT sent: 0x3f (erase_flash), 0x40 (read_flash), no firmware extension upload,
no pairing, no reboot. Nothing is written to the device.

Usage:  sudo python3 validity_probe.py
"""
import ctypes, sys

VENDOR = 0x06CB
EP_OUT, EP_IN, IFACE = 0x01, 0x81, 0

# Candidate product IDs to look for; extend as needed.
CANDIDATES = [0x00a8, 0x0090, 0x0097, 0x009a, 0x009b, 0x00a2, 0x00b7, 0x00bb,
              0x00bd, 0x00be, 0x00c2, 0x00cb, 0x00d8, 0x00da, 0x00df, 0x00e7,
              0x00e9, 0x00f0, 0x00f9, 0x00fc, 0x0100, 0x0104, 0x0123]

lib = ctypes.CDLL("libusb-1.0.so.0")
lib.libusb_open_device_with_vid_pid.restype = ctypes.c_void_p
lib.libusb_open_device_with_vid_pid.argtypes = [ctypes.c_void_p, ctypes.c_uint16, ctypes.c_uint16]
for fn, args in (("libusb_claim_interface", [ctypes.c_void_p, ctypes.c_int]),
                 ("libusb_release_interface", [ctypes.c_void_p, ctypes.c_int]),
                 ("libusb_close", [ctypes.c_void_p]),
                 ("libusb_set_auto_detach_kernel_driver", [ctypes.c_void_p, ctypes.c_int])):
    getattr(lib, fn).argtypes = args
lib.libusb_bulk_transfer.argtypes = [ctypes.c_void_p, ctypes.c_ubyte,
                                     ctypes.POINTER(ctypes.c_ubyte), ctypes.c_int,
                                     ctypes.POINTER(ctypes.c_int), ctypes.c_uint]
lib.libusb_error_name.restype = ctypes.c_char_p


def hexdump(b, indent="    "):
    out = []
    for i in range(0, len(b), 16):
        c = b[i:i + 16]
        out.append("%s%04x  %-47s  %s" % (
            indent, i, " ".join("%02x" % x for x in c),
            "".join(chr(x) if 32 <= x < 127 else "." for x in c)))
    return "\n".join(out)


ctx = ctypes.c_void_p()
if lib.libusb_init(ctypes.byref(ctx)) != 0:
    sys.exit("libusb_init failed")

handle, pid = None, None
for p in CANDIDATES:
    handle = lib.libusb_open_device_with_vid_pid(ctx, VENDOR, p)
    if handle:
        pid = p
        break
if not handle:
    sys.exit("No 06cb device opened. Run as root, and add your PID to CANDIDATES.")

print("Device: %04x:%04x\n" % (VENDOR, pid))
lib.libusb_set_auto_detach_kernel_driver(handle, 1)
rc = lib.libusb_claim_interface(handle, IFACE)
if rc != 0:
    lib.libusb_close(handle)
    sys.exit("claim_interface failed: %s" % lib.libusb_error_name(rc).decode())


def cmd(payload, timeout=3000):
    buf = (ctypes.c_ubyte * len(payload))(*payload)
    n = ctypes.c_int(0)
    if lib.libusb_bulk_transfer(handle, EP_OUT, buf, len(payload), ctypes.byref(n), timeout) != 0:
        return None
    rbuf, rn = (ctypes.c_ubyte * 4096)(), ctypes.c_int(0)
    if lib.libusb_bulk_transfer(handle, EP_IN, rbuf, 4096, ctypes.byref(rn), timeout) != 0:
        return None
    return bytes(rbuf[:rn.value])


ident = None
for payload, label in ((b"\x01", "0x01   RomInfo.get()"),
                       (b"\x19", "0x19   (part of send_init)"),
                       (b"\x75", "0x75   identify_sensor()"),
                       (b"\x3e", "0x3e   get_flash_info()"),
                       (b"\x43\x02", "0x4302 get_fw_info()")):
    rsp = cmd(payload)
    print("--> %s   sent: %s" % (label, payload.hex()))
    if rsp is None:
        print("    no response\n")
        continue
    st = int.from_bytes(rsp[:2], "little")
    print("    %d bytes, status 0x%04x%s" % (len(rsp), st, "" if st == 0 else "  (error)"))
    print(hexdump(rsp) + "\n")
    if payload == b"\x75" and st == 0:
        ident = rsp

if ident and len(ident) >= 10:
    body = ident[2:]
    zeroes = int.from_bytes(body[0:4], "little")
    minor = int.from_bytes(body[4:6], "little")
    major = int.from_bytes(body[6:8], "little")
    print("identify_sensor: zeroes=0x%08x  minor=0x%04x  major=0x%04x" % (zeroes, minor, major))
    try:
        from validitysensor.hw_tables import dev_info_lookup
        print("dev_info_lookup ->", dev_info_lookup(major, minor))
    except Exception:
        print("(python-validity not importable here - look up (major, minor) "
              "in validitysensor/hw_tables.py manually)")
else:
    print("0x75 was not answered in plaintext on this device.")

lib.libusb_release_interface(handle, IFACE)
lib.libusb_close(handle)
print("\nDone. Nothing was written to the device.")

Run with sudo python3 validity_probe.py. If several 0x2449 devices turn out
to share one firmware build, that at least narrows down what a future
0x2449 table entry would have to cover.

Identification for 06cb:00a8 — it reports sensor type 0x2449

The device speaks the protocol fine

What is actually missing for 0x2449

Probe script for other affected owners

Identification for 06cb:00a8 — it reports sensor type `0x2449`

What is actually missing for `0x2449`

Support for 06cb:00a8 #179

Description

Activity

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions