search

Popax21 / synaTudor

GNU Lesser General Public License v2.1
92 stars 10 forks source link

Possible support for `06cb:00c9` #20

Open vixalien opened 1 year ago

vixalien commented 1 year ago

Hello. Thanks for this awesome project.

My laptop has a 06cb:00c9 which is a similar Synaptics fingerprint device. I've been trying to get it to work using the current code. However, I hit a dead end. I'll first explain my process, then maybe you can help me. Full disclaimer: I'm not a low level programmer so this is why my skills in this area is very limited.

I created a fork where I made modifications specific to 00c9. Maybe when it's supported it can get merged back in.

I discovered the drivers for my HP PC are on the following link: https://ftp.hp.com/pub/softpaq/sp138001-138500/sp138227.exe which can be easily extracted with 7zip.

Running ./cli/tudor_cli hits me with the following log:

>>>> WARNING <<<<<
Even though the CLI employs sandboxing, its security is in no way comparable to the one found in the libfprint integration.
A malicious driver could take over your local user account!
This CLI is only intended to be used for debugging and/or small scale tests.
Press 'y' to continue, any key to exit: y
[INF] Initializing libcrypto...
[INF] Initializing libusb...
[INF] Found sensor USB device [bus 3 addr 4 vid 0x06cb pid 0x00c9]
[INF] Opening sensor USB device...
[INF] Dropping root privileges... [new uid=1000 new gid=1000]
[INF] Initializing tudor driver...
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaFpAdapter111.dll' [190472 bytes]
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaWudfBioUsb111.dll' [1807344 bytes]
[INF] Initializing driver DLL 'synaFpAdapter111.dll'...
[INF] Initializing driver DLL 'synaWudfBioUsb111.dll'...
[INF] Loading data from data store 'temp2'...
[INF] Opening tudor device...
[ERR] Unresolved WDF function 33 called!
Aborted

It's blocked from here and I don't know what to do.

Popax21 commented 1 year ago

That error means that it hit an unimplemented WDF function dispatch table index (I can try to cram out the table and send it here later). However, there's a chance the old driver works as well for this sensor, with all that's required is to add the USB PID to the list (the different number might just be a version number).

EDIT: looks like index 33 is WdfDeviceSetPnpCapabilities, which would have to be implemented for the new driver to work (it should probably be fine to just stub it out though).

vixalien commented 1 year ago

I tried using the default driver and just adding the PID to the list. It fails with the following logs:

sudo ./tudor_cli temp1 -P00c9
>>>>> WARNING <<<<<
Even though the CLI employs sandboxing, its security is in no way comparable to the one found in the libfprint integration.
A malicious driver could take over your local user account!
This CLI is only intended to be used for debugging and/or small scale tests.
Press 'y' to continue, any key to exit: y
[INF] Initializing libcrypto...
[INF] Initializing libusb...
[INF] Found sensor USB device [bus 3 addr 5 vid 0x06cb pid 0x00c9]
[INF] Opening sensor USB device...
[INF] Dropping root privileges... [new uid=1000 new gid=1000]
[INF] Initializing tudor driver...
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaFpAdapter104.dll' [186656 bytes]
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[WRN] Data directory 4 has invalid bounds! [end 0x17ebe0 > image end 0x17e000]
[INF] Loaded driver DLL 'synaWudfBioUsb104.dll' [1567712 bytes]
[INF] Initializing driver DLL 'synaFpAdapter104.dll'...
[INF] Initializing driver DLL 'synaWudfBioUsb104.dll'...
[INF] Loading data from data store 'temp1'...
[INF] Opening tudor device...
[WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7f1d4f0be710]
[INF] Loading device records...

Commands:
  e - enroll finger
  v - verify finger
  i - identify finger
  q - query information about enrolled fingers
  w - wipe enrolled finger(s)
  s - shutdown driver
> e
Enter identity index: test
Enter finger index (1-5 = right hand thumb - little finger | 6-10 = left hand thumb - little finger): 2
Put your finger on the sensor
[ERR] Error starting capture: 0x80098036!
[ERR] Error capturing sample for enrollment!
[INF] Discarding enrollment of guid=00000000... finger=2

Commands:
  e - enroll finger
  v - verify finger
  i - identify finger
  q - query information about enrolled fingers
  w - wipe enrolled finger(s)
  s - shutdown driver
>

However, it actually waits until I tap on the sensor before logging out the [ERR] lines.

Popax21 commented 1 year ago

Considering that error code refers to WINBIO_E_DEVICE_FAILURE, this new driver might not actually work - you'll have to implement WdfDeviceSetPnpCapabilities then and continue with your driver.

vixalien commented 1 year ago

okay. I've stubbed out WdfDeviceSetPnpCapabilities and now I get that the function 50 is unresolved.

Maybe you can indeed show me the WDF function dispatch table or maybe explain how I can get it.

Popax21 commented 1 year ago

Maybe you can indeed show me the WDF function dispatch table or maybe explain how I can get it.

Its Indices are defined in the UMDF wdffuncenum.h header, which is part of the Windows driver SDK - you should be able to find it here on GitHub.

vixalien commented 1 year ago

welp. I don't really know what I'm doing but let me share with you some progress. I stubbed out a lot of functions (you can checkout the code if you like at my fork) and I can now get on the enroll stage but however it fails with the following error:

Commands:
  e - enroll finger
  v - verify finger
  i - identify finger
  q - query information about enrolled fingers
  w - wipe enrolled finger(s)
  s - shutdown driver
> i
Put your finger on the sensor
[ERR] 'pthread_join(thread->thread, NULL)' failed: 3 [No such process]
Aborted

I believe the correct thing to do is first of all use the newer driver (111 instead of 104) and make sure it works with 06cb:00be then continue implementing with support for this other reader. If you could update the driver I would be forever grateful.

Thank you for your time. I'm not a C programmer and don't really know what I'm doing. I'm just enthusiastic about supporting this reader.

Popax21 commented 1 year ago

Sorry for the late response, I've been (and still am) fairly busy for the last while. I think I can push a fix for that bug you encountered, but outside of that I sadly won't be able to do much.

vixalien commented 1 year ago

hi. thanks for your work and don't stress yourself out!

On Thu, 12 Oct 2023, 08:02 Popax21, @.***> wrote:

Sorry for the late response, I've been (and still am) fairly busy for the last while. I think I can push a fix for that bug you encountered, but outside of that I sadly won't be able to do much.

— Reply to this email directly, view it on GitHub https://github.com/Popax21/synaTudor/issues/20#issuecomment-1758960629, or unsubscribe https://github.com/notifications/unsubscribe-auth/AJB5FCP4TO2Y7INHK2ZW4HLX66BYPANCNFSM6AAAAAA5C63HJQ . You are receiving this because you authored the thread.Message ID: @.***>

Popax21 commented 1 year ago

Sorry for the late response, I've been (and still am) fairly busy for the last while. I think I can push a fix for that bug you encountered, but outside of that I sadly won't be able to do much.

@vixalien Pushed the mentioned bugfix, if you want to you can try running it again now.

vixalien commented 1 year ago

Hi. I'm sure you're busy but you can take a look at this when you get less busy.

I've tried the bugfix, and now I'm getting yet another error. It seems the fingerprint gets scanned, but refuse to get enrolled.

sudo ./tudor_cli d
>>>>> WARNING <<<<<
Even though the CLI employs sandboxing, its security is in no way comparable to the one found in the libfprint integration.
A malicious driver could take over your local user account!
This CLI is only intended to be used for debugging and/or small scale tests.
Press 'y' to continue, any key to exit: y
[INF] Initializing libcrypto...
[INF] Initializing libusb...
[INF] Found sensor USB device [bus 3 addr 4 vid 0x06cb pid 0x00c9]
[INF] Opening sensor USB device...
[INF] Dropping root privileges... [new uid=1000 new gid=1000]
[INF] Initializing tudor driver...
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaFpAdapter111.dll' [190472 bytes]
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaWudfBioUsb111.dll' [1807344 bytes]
[INF] Initializing driver DLL 'synaFpAdapter111.dll'...
[INF] Initializing driver DLL 'synaWudfBioUsb111.dll'...
[INF] Loading data from data store 'd'...
[INF] Opening tudor device...
[WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7f6a24cc9120]
[INF] Loading device records...

Commands:
  e - enroll finger
  v - verify finger
  i - identify finger
  q - query information about enrolled fingers
  w - wipe enrolled finger(s)
  s - shutdown driver
> e
Enter identity index: 2
Enter finger index (1-5 = right hand thumb - little finger | 6-10 = left hand thumb - little finger): 2
Put your finger on the sensor
Driver requested more samples
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
Driver requested more samples
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
Driver requested more samples
Driver requested more samples
Driver requested more samples
Driver requested more samples
Driver requested more samples
[ERR] Unresolved import CryptAcquireContextW@ADVAPI32.dll called!
Aborted

Based on my limited understanding, the hres seems to be WINBIO_E_BAD_CAPTURE and the reject detail is WINBIO_FP_TOO_LOW.

I don't even understand what too low means.

The problem 2 is that CryptAcquireContextW seems unimplemented, but it looks fairly similar to CryptAcquireContextA, I'll try reusing some of the code.

thanks for the help as always.

Popax21 commented 1 year ago

Hi. I'm sure you're busy but you can take a look at this when you get less busy.

I've tried the bugfix, and now I'm getting yet another error. It seems the fingerprint gets scanned, but refuse to get enrolled.

sudo ./tudor_cli d
>>>>> WARNING <<<<<
Even though the CLI employs sandboxing, its security is in no way comparable to the one found in the libfprint integration.
A malicious driver could take over your local user account!
This CLI is only intended to be used for debugging and/or small scale tests.
Press 'y' to continue, any key to exit: y
[INF] Initializing libcrypto...
[INF] Initializing libusb...
[INF] Found sensor USB device [bus 3 addr 4 vid 0x06cb pid 0x00c9]
[INF] Opening sensor USB device...
[INF] Dropping root privileges... [new uid=1000 new gid=1000]
[INF] Initializing tudor driver...
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaFpAdapter111.dll' [190472 bytes]
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaWudfBioUsb111.dll' [1807344 bytes]
[INF] Initializing driver DLL 'synaFpAdapter111.dll'...
[INF] Initializing driver DLL 'synaWudfBioUsb111.dll'...
[INF] Loading data from data store 'd'...
[INF] Opening tudor device...
[WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x7f6a24cc9120]
[INF] Loading device records...

Commands:
  e - enroll finger
  v - verify finger
  i - identify finger
  q - query information about enrolled fingers
  w - wipe enrolled finger(s)
  s - shutdown driver
> e
Enter identity index: 2
Enter finger index (1-5 = right hand thumb - little finger | 6-10 = left hand thumb - little finger): 2
Put your finger on the sensor
Driver requested more samples
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
Driver requested more samples
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
Driver requested more samples
Driver requested more samples
Driver requested more samples
Driver requested more samples
Driver requested more samples
[ERR] Unresolved import CryptAcquireContextW@ADVAPI32.dll called!
Aborted

Based on my limited understanding, the hres seems to be WINBIO_E_BAD_CAPTURE and the reject detail is WINBIO_FP_TOO_LOW.

I don't even understand what too low means.

The problem 2 is that CryptAcquireContextW seems unimplemented, but it looks fairly similar to CryptAcquireContextA, I'll try reusing some of the code.

thanks for the help as always.

Those errors look correct (the driver is telling you that the part of your finger on the sensor is too low down). As for the import error: CryptAcquireContextW is the same as CryptAcquireContextA but taking a UTF-16 string instead. You probably just want to convert the string to a usual char* using the winstr_ set of functions (don't forget to free it afterwards!), then proxy to the ASCII variant.

vixalien commented 1 year ago

hi. I just implemented the missing function. I hope it's correct.

but I'm not sure what it means too low. does it mean that I'm putting my finger too down or what? I've tried many times with the same result but sometimes it works.

However, I can't verify my finger.

[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
Driver requested more samples
Driver requested more samples
Driver requested more samples
Successfully enrolled finger

Commands:
  e - enroll finger
  v - verify finger
  i - identify finger
  q - query information about enrolled fingers
  w - wipe enrolled finger(s)
  s - shutdown driver
> v
Enter identity index: left
Put your finger on the sensor
[ERR] Error verifying sample: 0x80098008! [reject detail 0x0]
[WRN] Retrying verify capture...
Put your finger on the sensor
[ERR] Error verifying sample: 0x80098008! [reject detail 0x0]
[WRN] Retrying verify capture...
Put your finger on the sensor
[ERR] Error verifying sample: 0x80098008! [reject detail 0x0]
[WRN] Retrying verify capture...
Put your finger on the sensor
Popax21 commented 1 year ago

hi. I just implemented the missing function. I hope it's correct.

but I'm not sure what it means too low. does it mean that I'm putting my finger too down or what? I've tried many times with the same result but sometimes it works.

However, I can't verify my finger.

[ERR] Error updating enrollment: 0x80098008! [reject detail 0x2]
[WRN] Retrying enrollment update...
Driver requested more samples
Driver requested more samples
Driver requested more samples
Successfully enrolled finger

Commands:
  e - enroll finger
  v - verify finger
  i - identify finger
  q - query information about enrolled fingers
  w - wipe enrolled finger(s)
  s - shutdown driver
> v
Enter identity index: left
Put your finger on the sensor
[ERR] Error verifying sample: 0x80098008! [reject detail 0x0]
[WRN] Retrying verify capture...
Put your finger on the sensor
[ERR] Error verifying sample: 0x80098008! [reject detail 0x0]
[WRN] Retrying verify capture...
Put your finger on the sensor
[ERR] Error verifying sample: 0x80098008! [reject detail 0x0]
[WRN] Retrying verify capture...
Put your finger on the sensor

It seems to work, however it rejects all captures taken. Maybe try cleaning the sensor, and try to center your finger as much as possible, then retry. If that still doesn't work then it probably is a much more stubborn bug which will be really tricky to debug.

vixalien commented 1 year ago

I've tried clearing the sensor and centring my finger as much as possible. In windows, it works so it's possibly a stubborn bug as you say. Is it because of the functions I stubbed out?

I understand you're busy and may be unable to help me with this. Thanks for the help anyways.

Popax21 commented 12 months ago

Sorry for the rather late response, I only just had time to take a look again. If this is caused by stubbed functions, it would probably be WdfDeviceAssignInterfaceProperty + WdfDeviceAllocAndQueryInterfaceProperty, it looks like the driver might be able to attach custom data to the WDF device that way. It is probably at least worth looking at which properties are assigned / queried to check if that's the case, and if it is to implement a simple linked list store of property values.

tomjschwanke commented 7 months ago

Chiming in here: The inf file supplied with the driver contains

[Synaptics.NTamd64]
; TODO: Change the VendorID (VID) and ProductID (PID) to match your device
%WBDIUsbDeviceName%=Biometric_Install, USB\VID_06CB&PID_00C9
%WBDIUsbDeviceName%=Biometric_Install, USB\VID_06CB&PID_00D1
%WBDIUsbDeviceName%=Biometric_Install, USB\VID_06CB&PID_00E7

So all three sensors, C9, D1 and E7 use the same synaWudfBioUsb111 driver

I have a device with an E7 sensor, so I'm also stuck here for now

Edit: it contains even more, FF and 0124 are included in the newer version

Your fork works for my 00E7 sensor and I'm running into exactly the same issue as you: I can enroll fingers, but not verify or identify them

vixalien commented 7 months ago

Interestingly, we have the same issues. Unfortunately, I'm unfamiliar with drivers enough to write implementations for WdfDeviceAssignInterfaceProperty and WdfDeviceAllocAndQueryInterfaceProperty.

Maybe someone more knowledgeable could help :)