ELAN 04f3:0c4c communication PoC

This repository hosts a PoC implementing the communication for the fingerprint sensor found in the 2020 HP Spectre x360 14".

The protocol so far seems to be very similar to that of 04f4:0c7e, already supported by libfprint: elanmoc.c

However there seem to be some differences.

A merge request has been opened to add support for this sensor to libfprint: https://gitlab.freedesktop.org/libfprint/libfprint/-/merge_requests/330

Dissection parser

wireshark_parser.py parses a WireShark dissection of the communication with the sensor, output as JSON.

In case there are any differences between platforms, since I was not able to make the sensor run in a VM, I collected all captures from Windows with USBPcap.

To output the dissection, first make sure there are no URB_BULK packets that are reported as "malformed". Disable all incriminated dissector as needed from Analyze > Enabled Protocols.... IPPUSB seems to be the culprit.

Then, after making sure all packets referring to the device are not filtered, export the JSON from File > Export Packet Dissections > As JSON....

Wireshark dissector

A simple WireShark dissector is also provided. It's very basic.

It can be dropped into the Lua plugins directory, then you can right-click a packet and select "Decode as..." > ELANMOC.

PoC

You can use uv to run the PoC:

git clone https://github.com/depau/elanpoc.git
cd elanpoc
uv run elanfp --help

ELAN 04F3:0C4C Match-on-Chip fingerprint reader driver PoC.

Usage:
    elanfp -h | --help
    elanfp info
    elanfp soft_reset
    elanfp hard_reset
    elanfp finger_info <id>
    elanfp verify
    elanfp enrolled_count
    elanfp enroll (-u UD)
    elanfp delete <id>
    elanfp finger_info_all
    elanfp delete_all
    elanfp wipe_all
    elanfp fw_ver
    elanfp capture <png>
    elanfp read_reg <reg>
    elanfp dump_regs
    elanfp raw (-e EP) <hex>...

Options:
-h, --help         Show help
-e EP, --ep-in EP  Input endpoint for raw commands
-u UD. --user UD   User data for enroll command

Commands:
info               Get device info
soft_reset         Reset sensor (via libusb)
hard_reset         Reset sensor (via hardware - disconnect and reconnect)
finger_info <id>   Get finger info
verify             Verify finger
enrolled_count     Get number of fingers currently enrolled
enroll             Enroll a new finger
delete <id>        Delete finger
delete_all         Delete all enrolled fingers (one by one)
wipe_all           Wipe all enrolled fingers (using special command)
fw_ver             Get firmware version
capture            Capture image into a PNG file
read_reg <reg>     Read register
dump_regs          Read all registers
raw                Send raw command

License

MIT