Hi!
Validity90 and python-validity are what made this possible, so it seems only right to point back at them.
I have recovered the protocol for the Synaptics SYNA8002, which is an SPI part rather than USB, in the ThinkPad X1 Tablet Gen 3, and have a working driver:
https://github.com/sandbranch/x1-tablet-gen3-fingerprint
It reuses your TLS and command layer over an SPI transport, and the certificate the sensor demands turns out to be exactly python-validity's
make_cert format. The parts that are new:
- SPI framing: opcode 0x01 status / 0x02 write / 0x03 read, with the status word at RX[2..5] and no CRC anywhere;
- image readout is a separate opcode 0x05 whose id byte comes from rx[2] of the status word — 0x03 returns all-0xFF for image data, and the response-available bit is never set for it, which cost me a while;
- product 0x33 uses a third line-update builder that python-validity does not have (it has type_1 and type_2);
- this part has no flash IC at all — 0x3e succeeds and reports JEDEC ff:ff with zero partitions — so the pairing lives host-side, in the Windows
registry, rather than encrypted in sensor flash.
That last point may be the interesting one for you: it means "0x04af" from a flash read on these parts can mean "there is no flash", not "denied". I spent a week reading it the other way.
No ask attached — just closing the loop, in case it is useful to anyone looking at the SPI variants.
Thank you!
David Sandquist
Hi!
Validity90 and python-validity are what made this possible, so it seems only right to point back at them.
I have recovered the protocol for the Synaptics SYNA8002, which is an SPI part rather than USB, in the ThinkPad X1 Tablet Gen 3, and have a working driver:
https://github.com/sandbranch/x1-tablet-gen3-fingerprint
It reuses your TLS and command layer over an SPI transport, and the certificate the sensor demands turns out to be exactly python-validity's
make_cert format. The parts that are new:
registry, rather than encrypted in sensor flash.
That last point may be the interesting one for you: it means "0x04af" from a flash read on these parts can mean "there is no flash", not "denied". I spent a week reading it the other way.
No ask attached — just closing the loop, in case it is useful to anyone looking at the SPI variants.
Thank you!
David Sandquist