search

nmikhailov / Validity90

Reverse engineering of Validity/Synaptics 138a:0090, 138a:0094, 138a:0097, 06cb:0081, 06cb:009a fingerprint readers protocol
GNU Lesser General Public License v2.1
1.85k stars 113 forks source link

138a:0090: Failed using system seed for ECDSA key generation, trying with a VirtualBox one #91

Closed kangear closed 5 years ago

kangear commented 5 years ago

OS: Ubuntu 16.04 64bit

osboxes@osboxes:~/Desktop/2/libfprint/builddir_dbg/examples$ sudo ./enroll 
[sudo] password for osboxes: 
This program will enroll your right index finger, unconditionally overwriting any right-index print that was enrolled previously. If you want to continue, press enter, otherwise hit Ctrl+C

(process:10337): libfprint-DEBUG: 02:48:40.000: 105598535726: ../libfprint/fpi-core.c:793
(process:10337): libfprint-DEBUG: 02:48:40.009: registered driver upekts
(process:10337): libfprint-DEBUG: 02:48:40.009: registered driver upektc
(process:10337): libfprint-DEBUG: 02:48:40.009: registered driver upeksonly
(process:10337): libfprint-DEBUG: 02:48:40.009: registered driver vcom5s
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver uru4000
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver aes1610
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver aes1660
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver aes2501
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver aes2550
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver aes2660
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver aes3500
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver aes4000
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver vfs101
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver vfs301
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver vfs5011
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver upektc_img
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver etes603
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver vfs0050
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver vfs0090
(process:10337): libfprint-DEBUG: 02:48:40.010: registered driver elan
(process:10337): libfprint-DEBUG: 02:48:40.010: driver vfs0090 supports USB device 138a:0090
(process:10337): libfprint-DEBUG: 02:48:40.010: selected driver vfs0090 supports USB device 138a:0090
Found device claimed by Validity VFS0090 driver
(process:10337): libfprint-sync-DEBUG: 02:48:40.011: 105598546588: ../libfprint/fpi-sync.c:57
(process:10337): libfprint-async-DEBUG: 02:48:40.011: 105598546653: ../libfprint/fpi-async.c:77
(process:10337): libfprint-drv-DEBUG: 02:48:41.190: 0x55d2996190f0 entering state 0
(process:10337): libfprint-drv-DEBUG: 02:48:41.191: 0x55d2996190f0 entering state 1
(process:10337): libfprint-drv-DEBUG: 02:48:41.193: 0x55d2996190f0 entering state 2
(process:10337): libfprint-drv-DEBUG: 02:48:41.195: 0x55d2996190f0 entering state 3
(process:10337): libfprint-drv-DEBUG: 02:48:41.273: 0x55d2996190f0 entering state 4
(process:10337): libfprint-drv-DEBUG: 02:48:41.288: 0x55d2996190f0 entering state 5
(process:10337): libfprint-drv-DEBUG: 02:48:41.290: 0x55d2996190f0 entering state 6
(process:10337): libfprint-drv-DEBUG: 02:48:41.296: 0x55d2996190f0 entering state 7
(process:10337): libfprint-drv-DEBUG: 02:48:41.296: 0x55d2996190f0 entering state 8

(process:10337): libfprint-vfs0090-WARNING **: 02:48:41.296: Failed using system seed for ECDSA key generation, trying with a VirtualBox one
(process:10337): libfprint-drv-DEBUG: 02:48:41.296: 0x55d2996190f0 entering state 7
(process:10337): libfprint-drv-DEBUG: 02:48:41.297: 0x55d2996190f0 entering state 8

(process:10337): libfprint-vfs0090-WARNING **: 02:48:41.297: Initialization failed at state 8, ECDSA key generation
(process:10337): libfprint-DEBUG: 02:48:41.297: error -5

(process:10337): libfprint-WARNING **: 02:48:41.297: unhandled action 0
(process:10337): libfprint-drv-DEBUG: 02:48:41.297: error -5 from state 8
(process:10337): libfprint-drv-DEBUG: 02:48:41.297: 0x55d2996190f0 completed with status -5
(process:10337): libfprint-DEBUG: 02:48:41.297: error -5

(process:10337): libfprint-WARNING **: 02:48:41.297: unhandled action 0
(process:10337): libfprint-async-DEBUG: 02:48:41.297: status -5
(process:10337): libfprint-sync-DEBUG: 02:48:41.297: status -5
(process:10337): libfprint-sync-DEBUG: 02:48:41.297: 105599832719: ../libfprint/fpi-sync.c:97
(process:10337): libfprint-async-DEBUG: 02:48:41.297: 105599833071: ../libfprint/fpi-async.c:111
(process:10337): libfprint-sync-DEBUG: 02:48:41.297: 105599833138: ../libfprint/fpi-sync.c:78
Could not open device.
(process:10337): libfprint-DEBUG: 02:48:41.297: 105599833168: ../libfprint/fpi-core.c:813
kangear commented 5 years ago

I tried to debug it. It failed on EVP_DecryptFinal. tlen2 is zero.

    if (!EVP_DecryptFinal(context, res + tlen1, &tlen2)) {
        fp_err("EVP Final decrypt failed, error: %lu, %s",
               ERR_peek_last_error(), ERR_error_string(ERR_peek_last_error(), NULL));
        goto out;
    }

then the check_pad failed also. I can not understand why tlen2 get zero from EVP_DecryptFinal.

kangear commented 5 years ago 
masterkey_aes:
48 78 02 70 5e 5a c4 a9 93 1c 44 aa 4d 32 25 22 39 e0 bf 8f 0c 85 4d de 49 0c cc f6 87 ef ad 9c 
res:112
3a c1 13 74 e6 37 8d cb a1 f2 7d c6 44 87 f3 40 47 ae cb 59 a8 37 f2 b2 37 d3 8a 48 ec 97 b6 45 d7 b6 3e c4 36 a5 53 5a bd 8a 91 61 49 13 98 e3 07 7c ad 95 df 62 3f 12 8e d6 b1 00 27 6b d0 2f 52 64 9e cc 5a 45 09 fb 70 a0 ea 99 cc ce a6 d0 a2 70 68 e5 0a 27 18 03 51 01 30 43 07 7c 65 d4 5e 8f 8c 27 5e 0c 2a ae 30 e6 91 57 3b 0d 58 1f 
EVP_DecryptFinal tlen2: 0
cipher end
check_pad: 112
45 b6 97 ec 48 8a d3 37 b2 f2 37 a8 59 cb ae 47 40 f3 87 44 c6 7d f2 a1 cb 8d 37 e6 74 13 c1 3a 2f d0 6b 27 00 b1 d6 8e 12 3f 62 df 95 ad 7c 07 e3 98 13 49 61 91 8a bd 5a 53 a5 36 c4 3e b6 d7 d4 65 7c 07 43 30 01 51 03 18 27 0a e5 68 70 a2 d0 a6 ce cc 99 ea a0 70 fb 09 45 5a cc 9e 64 52 5e 8f 8c 27 5e 0c 2a ae 30 e6 91 57 3b 0d 58 1f 
check_pad 0035
pad_size: 1f some: 1f
pad_size: 1f some: 58
kangear commented 5 years ago

EVP_DecryptFinal is okay, because 112/16=7, which has no dot. so tlen2 = 0. but I want to know check_pad fail. My result has no padding. if you force check padding, error will occur for true.

kangear commented 5 years ago

ok, it works fine now. I try to init with VirtualBox, then everything is okay.

about init:

1. install VirtualBox in Ubuntu 18.04;
2. Open Win10 in VirtualBox, install 138a:0090 driver in Win10; does not need encroll;
3. And then with this driver, everything works fine.