Skip to content

Navigation Menu

Sign in
Sign up

Add Goodix 27c6:5f10 (GF3206 / MilanG) support - #65

Open
gilberg-vrn wants to merge 1 commit into
goodix-fp-linux-dev:master from
gilberg-vrn:goodix-5f10
Open

Add Goodix 27c6:5f10 (GF3206 / MilanG) support #65
gilberg-vrn wants to merge 1 commit into
goodix-fp-linux-dev:master from
gilberg-vrn:goodix-5f10

Conversation

@gilberg-vrn

@gilberg-vrn gilberg-vrn commented Jun 5, 2026

Copy link
Copy Markdown

Adds run_5f10.py / driver_5f10.py for the Goodix GF3206 ("MilanG") sensor, USB 27c6:5f10 — e.g. the power-button reader in the Honor MagicBook X16 Pro (firmware family GF_ST411SEC_APP_).

What it does, following the repo conventions:

  • driver_5f10.py — init, PSK check/provision, TLS-PSK handshake (OpenSSL bridge), capture of a clear frame and a fingerprint frame, descramble, PGM output.
  • run_5f10.py — the usual 3-line entry point.
  • wb_pure.py — pure-Python white-box PSK encoder. fw127xx does not accept a raw PSK for preset_psk_write; it expects a white-box blob from which it re-derives the PMK. The KDF constants were recovered from gfusb.dll and verified bit for bit, so no DLL is needed.
  • config_5f10.bin — the MCU config captured from the wire.

The 56x176 raw frame is 12-bit packed per 84-byte row and transposed into a 176x54 image; the descramble matches tlambertz/goodix-fingerprint-reversing bit for bit. fdt-down uses dedicated (higher) thresholds so the command blocks until a finger actually touches.

The driver never flashes firmware — it only provisions the all-zero PSK when the stored PMK does not match. Tested on the MagicBook X16 Pro: clear.pgm and fingerprint.pgm are produced with real contrast. Uses pycryptodome (already in requirements.txt) and OpenSSL.

jorlyf and TonyTarakan reacted with thumbs up emoji
run_5f10.py / driver_5f10.py capture a clear frame and a fingerprint frame
from the Goodix GF3206 ("MilanG") sensor (e.g. the Honor MagicBook X16 Pro
power button). The sensor speaks standard TLS-PSK; the 56x176 raw frame is
12-bit packed per 84-byte row and transposed into a 176x54 image, a
descramble derived from gfusb.dll that matches tlambertz/goodix-fingerprint-
reversing bit for bit.
fw127xx does not accept a raw PSK for provisioning; wb_pure.py builds the
white-box blob it expects (KDF constants recovered from gfusb.dll, pure
Python, no DLL). The MCU config is embedded as a hex string (as in the other
drivers) and matches the config captured from the wire.
The driver never flashes firmware; it only provisions the all-zero PSK when
needed. fdt-down uses dedicated thresholds so it blocks until contact.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

AltStyle によって変換されたページ (->オリジナル) /