Attempting to port for Synaptics USB052 device/driver (06cb:0082 and others)

[todorz]

Hi @Popax21 and thank you for your work!

I forked your synaTudor repo to https://github.com/todorz/synaTudor-USB052 and I've been attempting to use a PQI branded reader (06cb:0082) with your library.

Tried:

1. Using the original driver DLLs (synaFpAdapter104 and synaWudfBioUsb104) supplied with amended PID (00be->0082), the tudor device cannot be opened so it seems the driver has issues using this hardware

# ./tudor_cli temp1
>>>>> WARNING <<<<<
Even though the CLI employs sandboxing, its security is in no way comparable to the one found in the libfprint integration.
A malicious driver could take over your local user account!
This CLI is only intended to be used for debugging and/or small scale tests.
Press 'y' to continue, any key to exit: y
[INF] Initializing libcrypto...
[INF] Initializing libusb...
[INF] Found sensor USB device [bus 3 addr 94 vid 0x06cb pid 0x0082]
[INF] Opening sensor USB device...
[INF] Dropping root privileges... [new uid=1000 new gid=1000]
[INF] Initializing tudor driver...
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[INF] Loaded driver DLL 'synaFpAdapter104.dll' [186656 bytes]
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[WRN] Data directory 4 has invalid bounds! [end 0x17ebe0 > image end 0x17e000]
[INF] Loaded driver DLL 'synaWudfBioUsb104.dll' [1567712 bytes]
[INF] Initializing driver DLL 'synaFpAdapter104.dll'...
[INF] Initializing driver DLL 'synaWudfBioUsb104.dll'...
[INF] Loading data from data store '/tmp/temp1'...
[INF] Opening tudor device...
[WRN] GetModuleHandleExW called with unsupported flag GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS! [addr=0x72eef62ed710]
[ERR] Sensor didn't return ready status! [status 0x0]
[ERR] Error opening tudor device!

2. Modified the downloader to use the driver supplied by Microsoft and libtutor references to use the appropriate(?) drivers for this device (synaBscAdapter52/synaWudfBioUsb52), however I receive unresolved import error regarding EncodePointer@KERNEL32.dll so it seems something is missing or incompatible

   #  ./tudor_cli temp1
   >>>>> WARNING <<<<<
   Even though the CLI employs sandboxing, its security is in no way comparable to the one found in the libfprint integration.
   A malicious driver could take over your local user account!
   This CLI is only intended to be used for debugging and/or small scale tests.
   Press 'y' to continue, any key to exit: y
   [INF] Initializing libcrypto...
   [INF] Initializing libusb...
   [INF] Found sensor USB device [bus 3 addr 95 vid 0x06cb pid 0x0082]
   [INF] Opening sensor USB device...
   [INF] Dropping root privileges... [new uid=1000 new gid=1000]
   [INF] Initializing tudor driver...
   [WRN] PE file contains unsupported resource data directory!
   [WRN] PE file contains unsupported exception data directory!
   [WRN] Data directory 4 has invalid bounds! [end 0x57668 > image end 0x57000]
   [INF] Loaded driver DLL 'synaBscAdapter52.dll' [357992 bytes]
   [WRN] PE file contains unsupported resource data directory!
   [WRN] PE file contains unsupported exception data directory!
   [WRN] Data directory 4 has invalid bounds! [end 0x27e050 > image end 0x27e000]
   [INF] Loaded driver DLL 'synaWudfBioUsb52.dll' [2613328 bytes]
   [INF] Initializing driver DLL 'synaBscAdapter52.dll'...
   [ERR] Unresolved import EncodePointer@KERNEL32.dll called!
   Aborted

Any pointers to get this to work? If possible, please be as speciffic as possible as I'm a bit rusty on the matter. Thanks in advance!

[Popax21]

Some Windows APIs required by your driver are currently not implemented (in general, this project only implements functions on an as-needed basis, so swapping the driver is likely to result in this outcome). You will have to implement them yourself based on the Win32 docs (you'll want to look into libtudor/src/winapi for how to implement them in synaTudor itself). EncodePointer / DecodePointer seems to be mainly for pointer obfuscation, so you should be able to just stub them out to do nothing, i.e. something like:

__winfnc PVOID EncodePointer(PVOID ptr) {
    return ptr;
}
WINAPI(EncodePointer)

__winfnc PVOID DecodePointer(PVOID ptr) {
    return ptr;
}
WINAPI(DecodePointer)

[todorz]

Thanks for the quick reply! There might be more to it or I'm doing something wrong as it seems to get further now but it segfaults :(

[INF] Initializing libcrypto...
[INF] Initializing libusb...
[New Thread 0x7ffff7200640 (LWP 4033457)]
[INF] Found sensor USB device [bus 3 addr 97 vid 0x06cb pid 0x0082]
[INF] Opening sensor USB device...
[INF] Dropping root privileges... [new uid=1000 new gid=1000]
[New Thread 0x7ffff6800640 (LWP 4033458)]
[INF] Initializing tudor driver...
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[WRN] Data directory 4 has invalid bounds! [end 0x57668 > image end 0x57000]
[INF] Loaded driver DLL 'synaBscAdapter52.dll' [357992 bytes]
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[WRN] Data directory 4 has invalid bounds! [end 0x27e050 > image end 0x27e000]
[INF] Loaded driver DLL 'synaWudfBioUsb52.dll' [2613328 bytes]
[INF] Initializing driver DLL 'synaBscAdapter52.dll'...

Thread 1 "tudor_cli" received signal SIGSEGV, Segmentation fault.
0x00007ffff7cace67 in GetProcAddress (handle=0x0, name=0x7ffff77b9f18 "FlsAlloc") at ../libtudor/src/winapi/module.c:171
171     struct winmodule *module = (struct winmodule*) handle->data;
(gdb) backtrace
#0  0x00007ffff7cace67 in GetProcAddress (handle=0x0, name=0x7ffff77b9f18 "FlsAlloc") at ../libtudor/src/winapi/module.c:171
#1  0x00007ffff778dc1a in ?? ()
#2  0x0000000000000000 in ?? ()

[Popax21]

Thanks for the quick reply! There might be more to it or I'm doing something wrong as it seems to get further now but it segfaults :(

[INF] Initializing libcrypto...
[INF] Initializing libusb...
[New Thread 0x7ffff7200640 (LWP 4033457)]
[INF] Found sensor USB device [bus 3 addr 97 vid 0x06cb pid 0x0082]
[INF] Opening sensor USB device...
[INF] Dropping root privileges... [new uid=1000 new gid=1000]
[New Thread 0x7ffff6800640 (LWP 4033458)]
[INF] Initializing tudor driver...
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[WRN] Data directory 4 has invalid bounds! [end 0x57668 > image end 0x57000]
[INF] Loaded driver DLL 'synaBscAdapter52.dll' [357992 bytes]
[WRN] PE file contains unsupported resource data directory!
[WRN] PE file contains unsupported exception data directory!
[WRN] Data directory 4 has invalid bounds! [end 0x27e050 > image end 0x27e000]
[INF] Loaded driver DLL 'synaWudfBioUsb52.dll' [2613328 bytes]
[INF] Initializing driver DLL 'synaBscAdapter52.dll'...

Thread 1 "tudor_cli" received signal SIGSEGV, Segmentation fault.
0x00007ffff7cace67 in GetProcAddress (handle=0x0, name=0x7ffff77b9f18 "FlsAlloc") at ../libtudor/src/winapi/module.c:171
171       struct winmodule *module = (struct winmodule*) handle->data;
(gdb) backtrace
#0  0x00007ffff7cace67 in GetProcAddress (handle=0x0, name=0x7ffff77b9f18 "FlsAlloc") at ../libtudor/src/winapi/module.c:171
#1  0x00007ffff778dc1a in ?? ()
#2  0x0000000000000000 in ?? ()

Seems like it passes in a NULL module handle (while trying to access some fiber TLS APIs, going of the backtrace). Sadly this is where it gets tricky; you'll probably have to disassemble / reverse engineer the relevant driver code to figure out why it does that, and fix the underlying issue in synaTudor.