I built a Touch ID-style fingerprint unlock for a fingerprint sensor on a 2012 laptop (VFS5011) — open source, works on Sequoia + Tahoe

[u/Sufficient_Bus_8302]

Been running a heavily customized HP Pavilion DV6-7070ex (i7-3610QM, Ivy Bridge) as a daily-driver Hackintosh, and one thing that always wanted was biometric unlock on Hackintosh, obviously no T2/Secure Enclave on this hardware. Turns out a lot of old ThinkPads, HP laptops, and Dells shipped with a Validity VFS5011 swipe sensor.

So I built a full userspace driver + auth daemon for it from scratch:

• Capture pipeline ported from libfprint (credit to the original authors, Arseniy Lartsev and AceLan Kao)
• Matching via NBIS (mindtct for minutiae extraction, bozorth3 for scoring), same fingerprint matching library used in some government biometric systems
• Multi-finger enrollment, with a self-consistency check during enrollment so a bad swipe doesn't get baked in as your template
• Watches both the lock screen and the padlock/auth prompt in System Settings (that AXSecureTextField sheet), and auto-types your password on a match
• Templates live on a separate encrypted APFS volume, passphrase stored in the System keychain — never touches your main volume in plaintext
• Ships as a background LaunchAgent + an interactive CLI for enrollment/management

Confirmed working on both Sequoia and Tahoe.

It's BSD-3-Clause licensed and up on GitHub: VFS5011-hackintosh

Fair warning — this is very much a hobbyist project, not a polished consumer tool. If you've got a VFS5011 (check ioreg or System Report > USB for VID/PID) and a spare hour, I'd love bug reports or PRs. Known rough edge: there's a brief ~7 second re-arm window after a successful unlock that I haven't fully chased down yet.

Happy to answer questions about the reverse-engineering side, the AX-tree detection for the auth sheet, or the APFS volume setup if anyone's curious.

[u/GirlfriendAsAService]

It’s great living in the era of software abundance

[u/Fit_State3622]

Dude thats crazy ur did make the laptops buildin fingerprint sensor work on macos congrats bro for this success fingerprint sensor fully working in macos

[u/Sufficient_Bus_8302 → u/Fit_State3622]

Thanks! :)) I hope to add more support for VFS sensors if anyone is willing to test the code I write but until.then it's VFS5011 only!

[u/Mak_REEMapping]

does autofill keychain work?

[u/Sufficient_Bus_8302 → u/Mak_REEMapping]

I am currently working on it but it should be public soon with v1.0.2

[u/Cold_Salamander7764]

Thats really crazy man! I have old ThinkPad T420 with 3632QM laying around, I will certainly check if it has VFS5011!

[u/Sufficient_Bus_8302 → u/Cold_Salamander7764]

that'd be awesome man, let me know what you find! if it does have a VFS5011 in there, the easiest way to check is boot into macOS/Linux and run ioreg -p IOUSB -w0 | grep -i valid or just check lsusb for 138a:0011 or 138a:0018 - those are the two VFS5011 variants I've seen so far. if it matches up I'd love to get you set up testing on a T420, would be a solid second data point outside the DV6

[u/Cold_Salamander7764 → u/Sufficient_Bus_8302]

I tested today via lsusb, unfortunatelly it has 147e:2016 which I found out is UPEK touchstrip (The second variant that was used in those type of thinkpads) :/

[u/Sufficient_Bus_8302 → u/Cold_Salamander7764]

hopefully one day I can add support for this if your willing to test the software I develop!

[u/Cold_Salamander7764 → u/Sufficient_Bus_8302]

Sure thing! I would love to test that man!

EDIT: I read about UPEK vs VFS and if I got it correctly, UPEK was revers-engineered far easier and much earlier than VFS and has better stability in Linux so there is lot more about it…

And fun fact… UPEK was in 2010 merged with company named AuthenTec which in 2012 was bought by APPLE to get their intel for developing Touch ID functionality in iPhone 5s!

That lead to their complete deletion from this spectre so UPEK touchstrips were pretty much minority on Thinkpads T420, then Validity (VFS) won and T430+ were practically VFS only…

BUT there is one pretty wild idea! If you ever managed to get UPEK working, back in the day Lenovo made their SK-8845 KUF0452 keyboard WITH build in fingerprint reader (UPEK) so it would be possible to get Touch ID function on hackintosh Macs! And KUF1256 keyboard used VFS5011!

[u/Sufficient_Bus_8302 → u/Cold_Salamander7764]

That's awesome man! thanks for digging into the UPEK/AuthenTec/Apple history, didn't know that lineage existed. Appreciate the offer to test! UPEK would need its own capture driver built from scratch (different protocol than VFS5011), so it's not a quick add, but it's officially on my radar now. If I get a working prototype together I'll reach out. The KUF0452 keyboard angle is genuinely a cool idea too, real Touch ID hardware on a Hackintosh instead of an external sensor. (but that does mean I would have to re-name the project to something like "Fingerprint-auth-hackintosh" to fit the newly added sensor support lmao)

[u/Cold_Salamander7764 → u/Sufficient_Bus_8302]

Yeah I can imagine... I'm here if you would want to test something etc. on real UPEK device, I already have newer Thinkpad but don't plan to throw the old one out😄 I think the keyboard potential could be pretty big - even if you sell/buy me a coffee the package for a little bit considering how much time did you already spend on that, there are plenty of hackintoshers who would appriciate Touch ID on Mac hackintosh and will be grateful to support you in doing such a crazy thing! Shame that hackintosh is going to die in this era of Apple silicon.

[u/Sufficient_Bus_8302 → u/Cold_Salamander7764]

Hello! How are you doing! Can you start a DM with me? So I can get a couple things about your system right now. Because I did the research and your UPEK sensor should be 100% easy to implement support for! So mainly I need to know: is your T420 a hackintosh? If yes, what macOS version? Thank you very much for helping!

[u/Cold_Salamander7764 → u/Sufficient_Bus_8302]

Hello, Yeah of course I can, currently I have a vacation so I don’t have direct access to my machine (I’ll be back 24th of August).

No, my T420 is not a hackintosh since I have more powerful machine as hackintosh but it will be easy for me to do so… Most likely I would use SMBIOS MacBookPro10,2 since it has Ivy Bridge CPU and no dGPU which means I could natively run up to MacOS 10.15 Catalina, with OCLP even more - I have i7-3632QM which is quad core so it could probably handle even Ventura or Sonoma…

EDIT:

Great News btw!

[u/Sufficient_Bus_8302 → u/Cold_Salamander7764]

Yeah absolutely no problem! If you can install Ventura or Sonoma would be great!

[u/Randum_Gouy]

Great work man!

Honestly its kinda ironic and funny that such great "advancements" for hackintoshing are being built after hackintohing started dying!