[Galaxy Note 4 Android Development (Snapdragon)] gekkehenkie11:
BTW, here my notes that I made from reverse engineering the fingerprint stuff, before my phone broke down, maybe somebody like [MENTION=3041959]fattire[/MENTION] can use it:

JAVA <-> JNI (libvcsfp.so, in logs: "vfmjni") <-> libvfmClient.so (in logs: ValidityLIB"). And that lib seems to call the service /bin/vcsFPService, which does the QSEECOM communication to the Trusted Zone

"VFMAuthQSEE" = libvfmtztransport.so. Gets called by libvalAuth.so. Gets called by vcsFPService !!

So: vcsFPService => libvalAuth.so => libvfmtztransport.so => libQSEEComAPI.so

1) The JNI. This exposes a set of functions to JAVA. What these functions mainly do is call vcsClientInterface::Executecommand(int cmd, void * args). There are 21 case statements inside

this executecommand handler. And this handler basically just calls the handler for the specific command, inside libvfmClient.so.

QSEEcommands:

0x1 = vfmProvision

0x2 = vfmInitialize

0x3 = vfmUninitialize

0x4 = vfmDeviceInitialize

0x5 = vfmDeviceCalibrate

0x6 = vfmAuthSessionBegin

0x7 = vfmAuthSessionEnd

0x8 = vfmCaptureStart

0x9 = vfmCaptureReadData

0xA = vfmCaptureProcessData

0xB = vfmCaptureAbort

0xC = vfmCaptureGetStatus

0xD = UNUSED

0xE = vfmCaptureFlushImage

0xF = vfmEnrollBegin

0x10 = vfmEnrollAddImage

0x11 = vfmEnrollFinish

0x12 = vfmEnrollmentPasswordSet

0x13 = vfmEnrollmentPasswordVerify

0x14 = vfmMatchImageToTemplates

0x15 = vfmPayloadBind

0x16 = vfmPayloadRelease

0x17 = vfmVendorDefinedOperation

---------------------------------------------------

2) Ioctl's to manage the hardware, coming from which libs:

* libvcsfp.so: NO

* libvfmtztransport.so: NO

* libvfmClient.so: YES, to /dev/validity 0x5401 en 0x5402

* vcsFPService: YES, to /dev/validity 0x5401 en 0x5402

* libvalAuth.so: YES, to /dev/vfsspi 0x5401 en 0x5402

and:

0x6B02 resetSPISensor

0x40046B03 (resetSPISensor ) -> set baud rate, so thats 0x4004, indeed is an unsigned int.

0x40046B05 register DRDY signal. Used in registerSpiDrdySignalHandler

0x40046B08 Enable/disable DRDY interrupt handling in the SPI driver

0x6B09 Put device in Low power mode

0x6B0D palCfgEnableDevice /* Turn on the power to the sensor */

0x6B0E /* Turn off the power to the sensor */

0x6B0F /* To disable spi core clock */

0x6B10 To set SPI configurations like gpio, clks

0x6B11 /* To reset SPI configurations */

0x80046B12 /* get sensor orienation from the SPI driver*/

0x6B13

0x80046B14

Explanation: ioclt = 'k'+ code = 0x6b + code

See vfs61xx.c: vfsspi_ioctl this is the handler.So there are 18: 1 to 18 (=0x12) in our kernel handler

-----------------------

Log of commands:

9

A

14

7 vfmAuthSessionEnd

17

6 vfmAuthSessionBegin

8 vfmCaptureStart

17

B vfmCaptureAbort

7 vfmAuthSessionEnd

17

6 vfmAuthSessionBegin

8 vfmCaptureStart

17

B vfmCaptureAbort

7 vfmAuthSessionEnd

17

6 vfmAuthSessionBegin

8 vfmCaptureStart

17

9 vfmCaptureReadData (meerdere keren)

A vfmCaptureProcessData

14 vfmMatchImageToTemplates

16 vfmPayloadRelease

17 (2x)

3 vfmUninitialize

2 vfmUninitialize

17

4 vfmDeviceInitialize

5 vfmDeviceCalibrate

0x7 = vfmAuthSessionEnd

0x6 = vfmAuthSessionBegin