[fprint] Advice on reversing and supporting a new fingerprint reader

[Vasily Khoruzhick]

On 18 August 2014 06:48:27 Jaša Bartelj wrote:
> Hi!

Hi Jaša,

> I'm working on a student project where we are using SBCs (think
> Raspberry Pi) with various devices. My assignment are fingerprint
> readers and one of those is an Anviz U-Bio, formerly apparently also
> known as OA99 (http://former.anviz.com/en/products/view.html?id=15).
> 
> The unit is a desktop device with a USB interface. The optical sensor
> within is called AFOS307, judging by their website it is also used in
> many other of their devices. The SOC inside is STM32F105 R8T6
> (http://www.st.com/web/catalog/mmc/FM141/SC1169/SS1031/LN1564/PF221021).
> 
> Here's the Linux kernel messages at attachment:
> [415414.469030] usb 6-1: new full-speed USB device number 6 using uhci_hcd
> [415414.843056] usb 6-1: New USB device found, idVendor=0483, idProduct=5720
> [415414.843062] usb 6-1: New USB device strings: Mfr=1, Product=2,
> SerialNumber=3
> [415414.843066] usb 6-1: Product: Mass Storage in FS Mode
> [415414.843069] usb 6-1: Manufacturer: STMicroelectronics
> [415414.843072] usb 6-1: SerialNumber: 00000000001B
> [415414.852106] usb-storage 6-1:1.0: USB Mass Storage device detected
> [415414.852407] scsi16 : usb-storage 6-1:1.0
> [415415.859110] scsi 16:0:0:0: CD-ROM            ANVIZ    Smart
>     1.00 PQ: 0 ANSI: 0 CCS
> [415415.864082] sr1: scsi3-mmc drive: 0x/0x caddy
> [415415.864577] sr 16:0:0:0: Attached scsi CD-ROM sr1
> [415415.864819] sr 16:0:0:0: Attached scsi generic sg5 type 5
> 
> At first I had quite a bit of problems getting the reader to work with
> their software but in the end found a Windows desktop application
> which displayed an image. With USB capture I identified that the
> device:
> * class is 0x08 (USB Mass Storage),
> * subclass is 0x06 (SCSI transparent command set) and
> * the protocol is 0x50 (Bulk-Only Transport (BBB))
> The SCSI INQUIRY returns a SCSI Device Type 0x05. This is common for
> CD-ROM Devices, and these use SCSI MMC commands.
> 
> Here's the SCSI command reading loop that returns an image (numbers in hex):
> 86000000000800020000    # 1) host sends SCSI CDB 0x86 Access Control In
> f6002400000125f6    #    SCSI Payload (8 B Request Data for CDB 0x86) #   
> device returns SCSI Status Good 0x00 for SCSI CDB 0x86
> 85000000000800020000    # 2) host sends SCSI CDB 0x85
>     f6002494005eeef6    #    SCSI Payload (8 B Response Data for CDB 0x85)
>                         #    device returns SCSI Status Good 0x00 for
> SCSI CDB 0x86
> 85000000940100020000    # 3) host sends SCSI CDB 0x85
>     [ 37889 B ]         #    SCSI Payload (37889 B Response Data for CDB
> 0x85) #    device returns SCSI Status Good 0x00 for SCSI CDB 0x86
> 85000000940200020000    # 4) host sends SCSI CDB 0x85
>     [ 37890 B ]         #    SCSI Payload (37890 B Response Data for CDB
> 0x85) #    device returns SCSI Status Good 0x00 for SCSI CDB 0x86
> 
> The returned payload always has the first byte set to 0xF6, the rest
> is image data, a 256x296 matrix of uint8.
> 
> Here are my questions:
> 1) Do you have any advice on how to figure out the meaning of the
> neaning of the SCSI Payload of the first command? I have tried
> analyzing the library the desktop app uses for access in IDA Pro Free
> but I haven't gotten far yet.

I'm afraid you have no other options than guess.

> 2) My prototype reader script uses sg3_utils. For adding support to
> libfprint I would ideally need a SCSI library to communicate with the
> device. The only suitable seems to be the abandoned libusal
> (http://web.archive.org/web/20140714024716/http://www.cdrkit.org/). Is
> it possible to add a dependency to libfprint or should I support the
> device with only libsusb?

You can add another dependency, it would be an overkill to implement mass 
storage support with libusb.

> Thanks for your response, other advice is also welcome!
> 
> Jaša

Regards
Vasily

> _______________________________________________
> fprint mailing list
> fprint at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/fprint
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.freedesktop.org/archives/fprint/attachments/20140822/dbe57c2c/attachment.sig>