Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity

task 44: the command protocol is recovered

Browse source
This commit is contained in:
Fimeg 2026-08-09 09:21:58 -04:00
commit 5134b4e19f
1 changed files with 18 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/tasks/44-fingerprint-fpc1020.md
View file

@ -1,14 +1,23 @@
# TASK 44 — Fingerprint (FPC1020) as a capability factor
**Status:** **the TrustZone wall is down** (2026-08-01 evening). The kernel
loads and authenticates a signed TA, `fpctzappfingerprint` runs, and its SPI
traffic **clears the interrupt latch that killed piece 1** — the sensor now
sits armed with the line idle-low. One question remains open and it is the
whole question: *does a finger raise an edge.* Raised 2026-07-28 (Casey: "a
huge win possible"). **Size:** two separable pieces — one was a session, the
other is a research frontier. Do not scope them as one thing. **Repos:**
`Pixel3Arch` (kernel + DT), `souveraine` (the factor, if the second piece
lands).
**Status:** **the TrustZone wall is down** (2026-08-01 evening) and **the
command protocol is recovered** (2026-08-09). The kernel loads and
authenticates a signed TA, `fpctzappfingerprint` runs, and its SPI traffic
**clears the interrupt latch that killed piece 1** — the sensor now sits armed
with the line idle-low. The open question — *does a finger raise an edge* — now
has a direct instrument instead of a correlational one: **target 10 command 1
is `fpc_ta_check_finger_lost`**. Raised 2026-07-28 (Casey: "a huge win
possible"). **Size:** two separable pieces — one was a session, the other is a
research frontier. Do not scope them as one thing. **Repos:** `Pixel3Arch`
(kernel + DT), `souveraine` (the factor, if the second piece lands).
> **The protocol is in `Pixel3Arch/docs/fpc-ta-protocol.md`.** The application
> is not stripped, so its dispatch tables resolve to real function names —
> eight targets, and the full bio lifecycle (`begin_enrol`, `enrol`,
> `end_enrol`, `identify`, `get_template_ids`, `delete_template`) at target 11.
> Recovered statically from the vendor image on disk: no device, no Android, no
> Frida. Two names below are wrong and the doc corrects them — sensor command 3
> is `wakeup_setup` and command 5 is **`deep_sleep`**, not "idle".
**Read the 18:5x section below before the 16:0x one.** The earlier measurement
concluded piece 1 "does not exist on this hardware"; that conclusion was