This repository hosts a PoC implementing the communication for the fingerprint sensor found in the 2020 HP Spectre x360 14".
The protocol so far seems to be very similar to that of 04f4:0c7e, already supported by
libfprint: elanmoc.c
However there seem to be some differences.
wireshark_parser.py parses a WireShark dissection of the communication with the sensor,
output as JSON.
In case there are any differences between platforms, since I was not able to make the sensor run in a VM, I collected all captures from Windows with USBPcap.
To output the dissection, first make sure there are no URB_BULK packets that are reported as
"malformed". Disable all incriminated dissector as needed from Analyze > Enabled Protocols....
IPPUSB seems to be the culprit.
Then, after making sure all packets referring to the device are not filtered, export
the JSON from File > Export Packet Dissections > As JSON....
A simple WireShark dissector is also provided. It's very basic.
It can be dropped into the Lua plugins directory, then you can right-click a packet and select "Decode as..." > ELANMOC.
RE still ongoing, an initial PoC is available:
ELAN 04F3:0C4C Match-on-Chip fingerprint reader driver PoC.
Usage:
./elanfp.py -h | --help
./elanfp.py reset
./elanfp.py finger_info <id>
./elanfp.py verify
./elanfp.py enrolled_count
./elanfp.py enroll
./elanfp.py delete_all
./elanfp.py fw_ver
./elanfp.py raw (-e EP) <hex>...
Options:
-h, --help Show help
-e EP, --ep-in EP Input endpoint for raw commands
Commands:
reset Reset sensor
finger_info <id> Get finger info
verify Verify finger
enrolled_count Get number of fingers currently enrolled
enroll Enroll a new finger
delete_all Delete all enrolled fingers
fw_ver Get firmware version
raw Send raw command
MIT