Skip to content

v6.0:** Biometric data exfiltration vector identified in Goodix fingerprint factory tool.

Choose a tag to compare

View all tags
@lexs201992-gif lexs201992-gif released this 20 Oct 04:54
· 7 commits to main since this release
Immutable release. Only release title and notes can be modified.
v6.0
6867721
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v6.0 — Fingerprint Subsystem: Goodix Factory Tool (com.goodix.gftest)

Release date: 2026-10-20

2,068 clones · 669 unique researchers · 14 days

This repository has reached significant traction in the security research community. The Goodix fingerprint vector documented here is the first biometric data exfiltration path identified in Longcheer/Unisoc ODM builds — completing the picture of total ODM control across radio, WiFi, baseband, and now biometrics.

What's New in v6.0

🆕 GoodixFingerprint/ — Biometric Data Exfiltration Vector

The Goodix fingerprint factory tool (com.goodix.gftest) is a dual-purpose priv-app that:

  1. Hosts the production fingerprint service (every biometric operation routes through it)
  2. Contains a factory QA tool with exported activities (no permission) on production builds

The IPC chain exposes:

  • cameraCapture() — raw fingerprint image extraction (no HIDL-level access control)
  • setSafeClass(int) — security level downgrade (bypasses token verification)
  • testCmd(int, byte[]) — arbitrary opcode + payload to native daemon
  • Dump templates — fingerprint template extraction from TEE (confirmed via resource strings)
  • Download FW — firmware flash to sensor chip (stored on /sdcard/)

Re-signed by Longcheer with a 28-year platform certificate (2023–2051). Original Goodix signature absent. Provenance chain broken at ODM level.

No root. No 0-day. No user interaction. Exported activities are launchable by any installed app.

Assets attached:

  • GoodixFingerprint_AIDL.zip — 13 AIDL interface definitions
  • GoodixFingerprint_Smali.zip — 10 decompiled smali files (Manager, TestCmdClient, DaemonProxy, Checker, OTP)
  • GoodixFingerprint_Resources.zip — resources.arsc + XML configs + signature cert

Repository Status — v6.0

Component Folder Status
Build infrastructure (4 hosts, 2 cities) Reports/ ✅ Documented
Radio control (WiFi) UniWifiApp/ ✅ Documented
Radio control (Cellular/Baseband) UniTelephonyApp/ ✅ Documented
Radio interaction layer RadioInteractorApp/ ✅ Documented
IMS / VoIP unisoc-services.jar/ ✅ Documented
SystemUI Ad layer SystemUi/ ✅ Documented
Taboola ad injection Taboola/ ✅ Documented
InMobi installer com.inmobi.installer/ ✅ Documented
Moto Setup Wizard MotoSetupWizard/ ✅ Documented
Glance lockscreen Glance/ ✅ Documented
APE testbed Ape-Project/ ✅ Documented
Chrome homepage provider providers.chromehomepage/ ✅ Documented
SharedStorageBackup com.android.sharedstoragebackup/ ✅ Documented
STK (SIM Toolkit) com.android.stk/ ✅ Documented
Android Virtualization com.android.virt/ ✅ Documented
GMS integration com.longcheer.android.gmsintegration/ ✅ Documented
certinstaller certinstaller/ ✅ Documented
Fingerprint (Goodix) GoodixFingerprint/ 🆕 v6.0
SELinux policy analysis Reports/ ✅ Documented

The Complete Picture

┌─────────────────────────────────────────────────────────────────┐
│           LONGCHEER/UNISOC ODM CONTROL ARCHITECTURE             │
│                                                                 │
│  RADIO (system_server, UID 1000)                                │
│    ├── UniWifiApp          → WiFi control                       │
│    ├── UniTelephonyApp     → Cellular + Baseband                │
│    └── RadioInteractorApp  → Radio interaction                  │
│                                                                 │
│  TELEPHONY (com.android.phone, UID 1001)                        │
│    └── UniTelephonyApp     → Total radio control                │
│                                                                 │
│  SYSTEM UI (system_server)                                      │
│    ├── SystemUi            → Ad layer injection                 │
│    ├── Taboola             → Ad SDK                             │
│    └── InMobi              → Ad installer                       │
│                                                                 │
│  BIOMETRICS (com.goodix.gftest, priv-app)  ← NEW IN v6.0        │
│    ├── AutoTestActivity    → Exported, no permission            │
│    ├── cameraCapture()     → Raw image extraction               │
│    ├── Dump templates      → TEE template extraction            │
│    └── Download FW         → Sensor firmware flash              │
│                                                                 │
│  C2 CHANNEL                                                     │
│    └── tun0 → 10.215.173.x (active)                             │
│                                                                 │
│  BUILD INFRASTRUCTURE                                           │
│    ├── sh-16-52.rnd.longcheer.net  (Moto G04s)                  │
│    ├── sh-48-205.rnd.longcheer.net (Moto e13)                   │
│    ├── sh-16-201.rnd.longcheer.net (HTC Desire 12s)             │
│    └── sz-103.rnd.longcheer.net    (Nokia 5.3/CAP)              │
└─────────────────────────────────────────────────────────────────┘

v6.0 completes the biometric layer. Every subsystem that touches user data or device control now has a documented ODM control path.

NOT a CVE. NOT an exploit.

This is an architecture of ODM control that enables the attack vector without 0-days. The components ship in production firmware, signed by the ODM, with no patch available because there is no "vulnerability" to patch — it's the design.

For Researchers

If you're working on:

  • Supply-chain security for Android ODMs
  • Biometric data protection in emerging-market devices
  • Unisoc/Spreadtrum platform analysis
  • Longcheer build pipeline forensics

This repository is your starting point. Every folder is self-contained with README, evidence, and IOCs.

Device tested: Motorola Moto G04s (XT2421-7), Unisoc T606, Android 14, build ULAS34.89-209-4, security patch 2026-04-05.

Reproduce: All findings are reproducible from a stock firmware dump. No root required for the Goodix vector (exported activities + am start).

Changelog

v6.0 (2026-10-20)

  • Added: GoodixFingerprint/ — Full forensic analysis of Goodix factory tool
    • 13 AIDL interface definitions
    • 10 smali files (Manager, TestCmdClient, DaemonProxy, Checker, OTP, HIDL)
    • resources.arsc + XML configs (pre-extracted)
    • Signature cert analysis (Longcheer, 2023–2051)
    • Forensic report: IOCs, architecture, exploitation path, assessment
  • Confirmed: TEE component (TA) in fingerprint stack — templates stored in TrustZone
  • Confirmed: Firmware stored on /sdcard/fw — flashable without root
  • Confirmed: Dump templates capability in factory tool

Full Changelog: v5.0...v6.0

Assets 10
Loading