Bought a cheap standalone USB fingerprint dongle (Focal-systems FT9201, 2808:93a9) that's marketed as Windows Hello only. libfprint's built-in matcher does a poor job on the tiny 96×96 sensor, and the device is "match-on-host" - the actual matching lives in a vendor Windows DLL, not on the chip.
So instead of reimplementing the matcher, the driver loads the vendor's Windows matching engine (ftWbioEngineAdapter.dll) in-process on Linux and calls its WinBio interface for enroll/verify. It's a small PE loader with ~90 kernel32 shims and a fake TEB. Getting there also meant reverse-engineering the sensor's firmware-boot sequence (the MCU wouldn't run its firmware without a specific register-config dance).
The loader maps code read-execute and data read-write from an in-memory file, so no page is ever writable+executable - meaning it runs under fprintd's default MemoryDenyWriteExecute hardening without disabling anything. It enrolls and verifies through fprintd / KDE now.
Packaged as an out-of-tree libfprint driver - no proprietary binaries committed (the DLL and firmware are fetched/extracted from public sources at build time).
I also wrote up the method, since it should generalize to other match-on-host "Windows Hello only" readers.
*Edit: This project would not have been possible without the help of agentic coding. I'm personally responsible for research, testing, ideation and pushing this goal forward. Claude Code and my development stack handled the majority of code, testing and writing tasks. I am not looking for kudos on being an amazing developer or am looking for clout. I just wanted to share a method of actualizing something into existence that I know will help solve for an underserved gap in Linux hardware parity.
[link] [comments]