# SYNA8002: reconstructing a ThinkPad fingerprint reader's SPI protocol

> The SYNA8002 investigation reconstructs the SPI transport, secure-channel setup and image capture path of the fingerprint reader in a ThinkPad X1 Tablet Gen 3. It includes a Python userspace driver and fprintd-compatible adapter; the author reports successful GDM login on one tablet, with a correlation matcher and an existing Windows-derived pairing key.

- Type: Case study
- Targets: Protocol
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-08
- Original resource: <https://github.com/sandbranch/x1-tablet-gen3-fingerprint>
- Primary source: <https://github.com/sandbranch/x1-tablet-gen3-fingerprint/blob/f1fbd64480985f2ac298a780d55ad5d05b6de7ea/README.md>
- Catalog page: <https://awesomerea.org/resources/x1-tablet-gen3-fingerprint-case/>
- Record JSON: <https://awesomerea.org/resources/x1-tablet-gen3-fingerprint-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/x1-tablet-gen3-fingerprint-case/index.md)

## Requirements & limits

- **Prerequisites:** ThinkPad X1 Tablet Gen 3 with a SYNA8002 SPI sensor, a python-validity checkout, and the sensor's host private key and session config blob extracted from the user's own Windows installation.
- **Limits:** Virgin-sensor pairing is unimplemented; the matcher is not authentication-grade, based on the author's small impostor sample.
- **License:** MIT License.

## Primary sources

1. <https://github.com/sandbranch/x1-tablet-gen3-fingerprint/blob/f1fbd64480985f2ac298a780d55ad5d05b6de7ea/README.md>
2. <https://github.com/sandbranch/x1-tablet-gen3-fingerprint/blob/f1fbd64480985f2ac298a780d55ad5d05b6de7ea/PROTOCOL.md>

## More in Protocols

- [fx_lcd_software: reconstructing ID-COOLING FX display transfers](https://awesomerea.org/resources/fx-lcd-software-case/index.md) · Case study
- [ti83-link: reconstructing TI-83 Plus link-port transfers](https://awesomerea.org/resources/ti83-link-case/index.md) · Case study
- [catbus99: reconstructing Epomaker TH99 Pro screen control over USB-HID](https://awesomerea.org/resources/catbus99-case/index.md) · Case study
- [OpenWatch: reconstructing the LJ736/LY736D smartwatch BLE client](https://awesomerea.org/resources/openwatch-ly736d-case/index.md) · Case study
- [Quntis Monitor Light for ESPHome: reconstructing RF control](https://awesomerea.org/resources/quntis-monitor-light-esphome-case/index.md) · Case study
- [Bosch Smart System: BLE diagnostic and live data protocol map](https://awesomerea.org/resources/bosch-smart-system-ble-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.