Factory reset research for 06cb:00b7 alias: 0x969 - PR:256 SimpleX-T development

[Karloss1234]

Current progress:

• Lifecycle support for 0x969/0xd51 has been integrated into SimpleX-T's PR Add support for sensor type 0xd51 (138a:00ab HP 840 G5, 06cb:00b7 HP G6) #256 branch.

• Fingerprint verification works:

  • successful matches
  • wrong finger handling
  • suspend/resume
  • service restart lifecycle tests

• My HP ZBook 17 G6 sensor is confirmed:
  USB: 06cb:00b7
  Sensor type: 0x969
  Name: 57K0 FM-3439-002

• Sensor capture works using the 0x199 profile alias.

Remaining problem:

The sensor is already provisioned, so the normal path works. However, after a factory reset / zero-partition state the existing reset_blob is rejected:

reset_blob rejected with status 0404

The remaining research task is to identify the correct family-specific bootstrap/reset payload for 0x969 silicon.

Firmware investigation

The Windows driver identified so far:

HP Synaptics VFS7552 WBF Touch Fingerprint Driver
Version: 5.5.28.1099 Rev.A
SoftPaq: sp135736.exe (Specific to laptop product number)

Extracted firmware from HP support site (sp135736.exe) references:

• 6_07f_hp_cmit_mis_qm.xpfwext

The remaining question is whether factory-reset/bootstrap data should follow:

1. The existing 06cb:00b7 path:
   • USB PID used by HP G6 / ZBook variants
   • historically associated with 0xd51 handling

or

2. The newer 06cb:00cb path:
   • identified by other HP 57K0 devices
   • confirmed by research from Windows driver extraction
   • contains a sensor-specific reset_blob

Next steps:

1. Preserve the working lifecycle state.
2. Avoid further factory-reset attempts on the main machine.
3. Analyse Windows driver blobs/firmware from the correct Synaptics WBF package.
4. Determine whether the required reset_blob is:
   • identical to another 0x969 family device,
   • contained in the HP driver package,
   • or requires extraction from Windows behaviour.

[Karloss1234]

From clean-slate-probe.py:

USB:
VID:PID = 06cb:00b7

Flash:
JEDEC = 00ef:0040
partitions = 5

ROM:
major = 6
minor = 7
build = 164

Sensor:
type = 0x969
name = 57K0 FM-3439-002

[Karloss1234]

Running factory-reset.py with current SimpleX-T code:

factory_reset failed: reset_blob rejected with status 0404

[Karloss1234]

Reference testing from another contributor confirms that a 06cb:00cb type 0x969 device can complete factory reset with blobs_00cb.py.

My device is 06cb:00b7, type 0x969, but with sensor identity 57K0 FM-3439-002. Testing blobs_b7.py or blobs_00cb.py advances past reset_blob loading, but the subsequent format/reset command (0x10 + 0x61-byte payload) returns status 0404.

My device is 06cb:00b7, type 0x969, using current SimpleX-T default blobs_9a,py, is rejected immediately (0404).

This indicates that 0x969 support is possible, but the FM-3439 / 06cb:00b7 firmware path likely requires a different reset sequence, blob set, or command parameters.

My device:
Probe identity:
sensor_type: 0x969
sensor_name: 57K0 FM-3439-002
ROM: 6.7
Firmware: 1.2 (Tue Jan 21 14:49:25 2020)

[Karloss1234]

BIOS finger sensor reset was tested on 06cb:00b7 / FM-3439-002. The operation successfully reduced flash partition count from 5 to 0 while preserving ROM communication. This confirms the BIOS erase path can clear the device state. Further testing will determine whether python-validity can initialise a clean 0x969 device using existing blobs or whether a device-specific reset/init sequence is required.

[Karloss1234]

After BIOS sensor reset,

BIOS "Erase fingerprint sensor on boot" successfully cleared 06cb:00b7 FM-3439-002 flash from 5 partitions to 0. After unmasking python-validity, the driver attempted clean-device initialisation but failed before sensor registration because the required firmware extension file 6_07f_hp_cmit_mis_qm.xpfwext was not present in /var/lib/python-validity/firmware/. This confirms the clean-state path reaches firmware restoration before any reset_blob/factory-reset issue. After manually copying 6_07f_hp_cmit_mis_qm.xpfwext into correct location, device initialises, configures and works normally.

After BIOS sensor reset, python-validity was left unmasked and /scripts/factory-reset.py was executed. factory-reset.py reaches the post-reset format command, which returns 0404. However, the sensor remains in a clean state (partition_count=0). 0404 error continues to occur at assert_status(usb.cmd(b'\x10' + b'\0' * 0x61)). /scripts/clean-slate-probe.py was run before and after factory-reset attempt. "unknown" changed from 0 to 3, suggesting that the B7/cb reset blob is doing something meaningful.

"Unknown" = 0 is normal.
"Unknown" changes to 3 when factory-reset() crashes at assert_status(usb.cmd(b'\x10' + b'\0' * 0x61)) and returns 0404.
"Unknown" changes back to 0 after sensor reboot().

@kelexine blobs_b7.py (device: 06cb:00b7 0xd51) and @ggiesen blobs_00cb.py (device: 06cb:00cb 0x969) reset blobs look to be identical.

[Karloss1234]

Firmware handling note: 06cb:00b7 (DEV_B7) firmware support already exists in python-validity. firmware_tables.py maps DEV_B7 to HP SoftPaq sp135736.exe and extracts 6_07f_hp_cmit_mis_qm.xpfwext. The initial missing firmware error occurred because validity-sensors-firmware had not been run. Manually copying the firmware extension from the Windows driver partition allowed python-validity initialization to proceed successfully.