Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Port the trustlet command surface, and pin the counting rule to recorded runs

Browse source 
Fingerprintd:Ta is the second core module: request payloads, response fields,
the error table, and the rule that decides what a frame meant. Payload building
and response reading only -- no TEE, no transport.

Very little of this is guessable, so each constant carries where it came from.
Three were found only because QTEE recorded a fault naming the instruction that
read them:

  * the event context's scan-slot count at +712, which do_enroll branches on to
    skip the entire slot loop -- an all-zero payload logged "groups->,
    results->" and read exactly like a gate failing deep in the trustlet, when
    it was zero iterations;
  * CAPTURE_IMAGE's flags at payload+0x18, without which preprocessing, the
    classifier and the enrol grouper never run at all, whatever is on the
    sensor;
  * SYNC_STATISTICS, whose absence leaves g_statistics NULL so the first enrol
    frame that gets far enough takes a data abort and every later command
    answers -90.

The verdict rule gets the most attention because it was mislabelled three times
before the comparison producing it was read. A frame is one of three things and
only the third is a verdict: the poison intact means the matcher never ran,
rc=-11 means not identified yet with attempts remaining, and only rc=0 carries
a match or a rejection. The poison exists because a zero-initialised buffer
cannot tell a released finger from a rejected one.

The tests are in two halves that cannot prop each other up. Explicit wire
conditions pin the classifier; three recorded runs pin the counting policy,
which is what actually went wrong. In the stock-budget run 31 of 48 frames
answered "not identified yet" and every frame that carried an image matched --
counting those 31 as attempts turns 8-for-8 into 8-of-39 and reads as a flaky
sensor. The wrong-finger control pins zero false accepts.

Fixtures are verdict-line excerpts, not the 40 KB transcripts, which are thick
with the device's SFS container names the test has no use for.

Verified by mutation: classifying -11 as a rejection, dropping SYNC_STATISTICS
from the init chain, and forgetting the +0x10 response payload offset each fail
the suite.
This commit is contained in:
Jorijn van der Graaf 2026-09-02 16:46:00 +02:00
commit ffad29ba4e
8 changed files with 719 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

23
tests/Ta/fixtures/auth-wrong-finger.txt Normal file
View file

@ -0,0 +1,23 @@
# Verdict lines excerpted from 2026-09-02-auth-wrong-finger-0-of-19.txt
# fp6 journal: journal/fingerprint/captures/2026-09-02-auth-wrong-finger-0-of-19.txt
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH matcher never ran gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH REJECTED gid=0 fid=0 (rc=0)
AUTH matcher never ran gid=0 fid=0 (rc=0)