Case study

Validity90: reverse engineering a Validity/Synaptics fingerprint-reader protocol

Reverse engineers the USB protocol of the Validity/Synaptics laptop fingerprint readers 138a:0090, 138a:0094, 138a:0097, 06cb:0081 and 06cb:009a, aiming at a written specification and a free libfprint driver. The repository holds a draft specification of the initialization sequence and of the modified TLS 1.2 handshake the readers use, a Wireshark Lua dissector that decrypts traffic after the key exchange, and a standalone C prototype that talks to a reader over libusb. The README calls the prototype extremely ugly code to be rewritten for the driver, and marks the integrated libfprint driver as not ready.

Targets: Protocol
Category: Independent reconstruction cases
Relationship: Independent reconstruction project
Sources reviewed: 2026-10-20

Stars: 1.9k
Last commit: 2019-02-25
Language: C
License (GitHub): LGPL-2.1

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

The README reports prototype scanning and image output for 138a:0090, scanning for 138a:0097, and initialization and LEDs without scanning for 06cb:009a. The integrated libfprint driver is not ready; configuration, pre-TLS key exchange, device operations and image format remain in progress.
The prototype needs a listed USB reader and read access to the machine DMI product serial for its session key. Its Makefile permissions target uses sudo. On Linux it builds against NSS, OpenSSL, libgcrypt, libusb-1.0, libpng and GLib. The dissector needs Wireshark Lua and lua-lockbox.
make test checks utility functions and one initialization-response parse. Device results are recorded in the README status table and prototype logs.
License: LGPL-2.1-or-later for the project code; the libfprint copy and submodule retain their own notices. The published specification and prototype contain recovered keys and byte sequences.

Cite

BibTeX

@misc{validity90-fingerprint-protocol-case,
  title = {{Validity90: reverse engineering a Validity/Synaptics fingerprint-reader protocol}},
  howpublished = {\url{https://github.com/nmikhailov/Validity90}},
  url = {https://github.com/nmikhailov/Validity90},
  urldate = {2026-10-20},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/validity90-fingerprint-protocol-case/}}
}

Plain text

Validity90: reverse engineering a Validity/Synaptics fingerprint-reader protocol. https://github.com/nmikhailov/Validity90 (accessed 2026-10-20). Awesome REA entry: https://awesomerea.org/resources/validity90-fingerprint-protocol-case/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · nmikhailov/Validity90 · Revision 8b80cfe
spec.md GitHub · nmikhailov/Validity90 · Revision 8b80cfe
prototype/README.md GitHub · nmikhailov/Validity90 · Revision 8b80cfe
prototype/Makefile GitHub · nmikhailov/Validity90 · Revision 8b80cfe
prototype/main.c GitHub · nmikhailov/Validity90 · Revision 8b80cfe
prototype/test GitHub · nmikhailov/Validity90 · Revision 8b80cfe
prototype/logs GitHub · nmikhailov/Validity90 · Revision 8b80cfe
dissector.lua GitHub · nmikhailov/Validity90 · Revision 8b80cfe
dbg/attach.sh GitHub · nmikhailov/Validity90 · Revision 8b80cfe
.gitmodules GitHub · nmikhailov/Validity90 · Revision 8b80cfe
libfprint/.gitrepo GitHub · nmikhailov/Validity90 · Revision 8b80cfe
COPYING GitHub · nmikhailov/Validity90 · Revision 8b80cfe