diff --git a/driver_53xc.py b/driver_53xc.py
new file mode 100644
index 0000000..e8ac8dc
--- /dev/null
+++ b/driver_53xc.py
@@ -0,0 +1,316 @@
+"""Driver for Goodix 27c6:533c -- GF5288 silicon on the wrapped protocol.
+
+533c is the same GF5288 as the 53x5 family (chip 0x220ca1) but pairs it with a
+GM168SEC secure element and speaks the wrapped framing from goodix.py rather
+than the direct framing driver_53x5.py uses. So it is 53x5's device logic on
+51x7's transport.
+
+Unlike the other drivers here it never writes a PSK or touches firmware. 533c
+ships with the all-zero PSK already provisioned, and read_firmware returns
+nothing in APP mode -- there is no image to flash back, so mcu_erase_app would
+be a one-way trip. If the PSK is not the expected one this driver refuses to
+run rather than provisioning.
+
+Sensor is 108x88, 12 bpp. Raw frames are dominated by fixed-pattern noise; a
+reference frame captured with no finger is subtracted with a least-squares
+scale and offset, which also absorbs the gain difference between captures.
+"""
+import hashlib
+import hmac
+import re
+import socket
+import statistics
+import struct
+import subprocess
+import time
+
+import usb.core
+
+from Crypto.Cipher import AES
+
+import goodix
+import protocol
+import tool
+
+TARGET_FIRMWARE = "GF5288_GM168SEC_APP_13016"
+VALID_FIRMWARE = r"GF5288_GM168SEC_APP_1[0-9]{4}"
+
+PSK = bytes(32)
+PSK_HASH = hashlib.sha256(PSK).digest()
+PSK_FLAGS, PSK_LENGTH = 0xbb020001, 32
+
+SENSOR_WIDTH, SENSOR_HEIGHT = 108, 88
+IMAGE_BYTES = SENSOR_WIDTH * SENSOR_HEIGHT * 3 // 2
+
+# captured from the vendor driver on an XPS 13 9310
+DEVICE_CONFIG = bytes.fromhex(
+    "40116c7d28a528cd1ce910f900f900f9"
+    "000402000008001111ba000180ca0007"
+    "008400beb28600c5b98800b5ad8a009d"
+    "958c0000be8e0000c5900000b5920000"
+    "9d940000af960000bf980000b69a0000"
+    "a730006c1c50000105d0000000700000"
+    "00720078567400341226000012200010"
+    "4012000304020216212c020a032a0102"
+    "002200012024003200800005045c0000"
+    "01560028205800010032002402820080"
+    "0c2002880d2a01920722000120240014"
+    "00800005045c00940056000820580003"
+    "0032000804820080112002280c2a0118"
+    "045c0094005400000162000903640018"
+    "008200800c2002280c2a0118045c0094"
+    "00520008005400000100000000005113")
+
+CAPTURE_REGISTER = 0x022c        # toggled around every capture
+CAPTURE_ON, CAPTURE_OFF = b"\x0a\x03", b"\x0a\x02"
+
+FDT_MODE_IDLE = b"\x0d\x01"      # measure baseline, do not arm
+FDT_MODE_ARMED = b"\x8d\x01"
+FDT_DOWN_ARMED = b"\x0c\x01"
+FDT_UP_ARMED = b"\x0e\x01"
+
+
+def init_device(product: int):
+    device = goodix.Device(product, protocol.USBProtocol)
+
+    device.nop()
+    firmware = device.firmware_version()
+    print(f"Firmware: {firmware}")
+
+    if not re.fullmatch(VALID_FIRMWARE, firmware):
+        raise ValueError(f"Unsupported firmware: {firmware}")
+
+    success, _, psk_hash = device.preset_psk_read(PSK_FLAGS, PSK_LENGTH, 0)
+    if not success or psk_hash != PSK_HASH:
+        raise ValueError(
+            "Sensor does not hold the all-zero PSK. This driver will not "
+            "provision one: read_firmware returns nothing in APP mode, so a "
+            "failed write could not be recovered from.")
+    print("PSK: all-zero, as expected")
+
+    return device
+
+
+def fdt_template(baseline: bytes):
+    """Build an FDT threshold template from a measured baseline.
+
+    The baseline reply is a 4-byte header then 12-bit samples as 16-bit LE
+    words. The vendor driver halves each sample and emits it twice, which is
+    what the sensor expects back as the finger-detect threshold.
+    """
+    samples = [
+        struct.unpack("<H", baseline[i:i + 2])[0]
+        for i in range(4, len(baseline) - 1, 2)
+    ]
+
+    template = b""
+    for sample in samples:
+        template += struct.pack("<B", sample >> 1) * 2
+
+    return template
+
+
+def measure_baseline(device: goodix.Device, mode: bytes = FDT_MODE_IDLE):
+    reply = device.mcu_switch_to_fdt_mode(mode + bytes(24), True)
+    return fdt_template(reply)
+
+
+def prf(secret: bytes, label: bytes, seed: bytes, length: int):
+    """TLS 1.2 PRF with SHA-256."""
+    out, a = b"", label + seed
+    while len(out) < length:
+        a = hmac.new(secret, a, hashlib.sha256).digest()
+        out += hmac.new(secret, a + label + seed, hashlib.sha256).digest()
+    return out[:length]
+
+
+def session_keys(client_random: bytes, server_random: bytes):
+    """Derive the TLS-PSK session keys for suite 0x00AE.
+
+    RFC 4279 premaster for a pure-PSK suite is len||zeros||len||psk. The key
+    block for TLS_PSK_WITH_AES_128_CBC_SHA256 is two 32-byte MAC keys then two
+    16-byte cipher keys; TLS 1.2 carries the IV explicitly per record.
+    """
+    n = len(PSK)
+    premaster = (struct.pack(">H", n) + bytes(n) + struct.pack(">H", n) + PSK)
+
+    master = prf(premaster, b"master secret", client_random + server_random, 48)
+    block = prf(master, b"key expansion", server_random + client_random, 96)
+
+    return block[64:80], block[80:96]      # client_write_key, server_write_key
+
+
+def tls_random(record: bytes, handshake_type: int):
+    """Pull the 32-byte random out of a ClientHello/ServerHello record."""
+    if record[0] != 0x16 or record[5] != handshake_type:
+        raise ValueError(f"Not handshake type {handshake_type}: {record[:8].hex()}")
+
+    return record[11:43]
+
+
+def establish_tls(device: goodix.Device, tls_client: socket.socket):
+    """Relay the handshake through openssl, keeping the randoms.
+
+    openssl is only the TLS server here; application data is decrypted in
+    process from the session keys instead of being read back from the
+    subprocess's stdout. That avoids depending on how openssl frames what it
+    echoes, and keeps the image bytes on one code path we can test offline.
+    """
+    hello = device.request_tls_connection()
+    client_random = tls_random(hello, 0x01)
+    tls_client.sendall(hello)
+
+    server_hello = tls_client.recv(4096)
+    server_random = tls_random(server_hello, 0x02)
+    device.protocol.write(
+        goodix.encode_message_pack(server_hello,
+                                   goodix.FLAGS_TRANSPORT_LAYER_SECURITY))
+
+    for _ in range(3):                       # ClientKeyExchange, CCS, Finished
+        tls_client.sendall(
+            goodix.check_message_pack(device.read(),
+                                      goodix.FLAGS_TRANSPORT_LAYER_SECURITY))
+
+    device.protocol.write(
+        goodix.encode_message_pack(tls_client.recv(4096),
+                                   goodix.FLAGS_TRANSPORT_LAYER_SECURITY))
+
+    return session_keys(client_random, server_random)
+
+
+def decrypt_record(record: bytes, key: bytes):
+    """AES-128-CBC with an explicit IV, then strip padding and the MAC."""
+    if record[0] != 0x17:
+        raise ValueError(f"Not application data: {record[0]:#04x}")
+
+    body = record[5:]
+    plain = AES.new(key, AES.MODE_CBC, body[:16]).decrypt(body[16:])
+
+    pad = plain[-1]
+    if pad + 1 > len(plain) or any(b != pad for b in plain[-(pad + 1):]):
+        raise ValueError("Bad CBC padding -- wrong key?")
+
+    return plain[:-(pad + 1)][:-32]         # drop padding, then HMAC-SHA256
+
+
+def wait_for_finger(device: goodix.Device, template: bytes, timeout: float = 30):
+    """Arm finger detection and block until the sensor reports a touch.
+
+    The sensor answers fdt_down only once a finger lands, which is well past
+    the 5 s default USB read timeout, so poll instead of waiting in one read.
+    """
+    device.mcu_switch_to_fdt_down(template, False)
+
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            return goodix.check_message_protocol(
+                goodix.check_message_pack(device.read(timeout=2)),
+                goodix.COMMAND_MCU_SWITCH_TO_FDT_DOWN)
+        except usb.core.USBTimeoutError:
+            continue
+
+    raise TimeoutError("No finger detected")
+
+
+def capture(device: goodix.Device, key: bytes, flags: int, gain: int):
+    """One frame: enable capture, request an image, disable capture."""
+    device.write_sensor_register(CAPTURE_REGISTER, CAPTURE_ON)
+
+    frame = device.mcu_get_image(
+        struct.pack("<BBBB", flags, 0x06, gain, 0x00),
+        goodix.FLAGS_TRANSPORT_LAYER_SECURITY_DATA)
+
+    device.write_sensor_register(CAPTURE_REGISTER, CAPTURE_OFF)
+
+    # a 9-byte header then one TLS application-data record
+    plain = decrypt_record(frame[9:], key)
+    print(f"  gain {gain:#04x}: {len(frame)} B encrypted -> {len(plain)} B plain")
+    if len(plain) < IMAGE_BYTES:
+        raise ValueError(f"Short decrypt: {len(plain)} < {IMAGE_BYTES}")
+
+    return tool.decode_image(plain[:IMAGE_BYTES])
+
+
+def flat_field(frame: list[int], reference: list[int]):
+    """Subtract a*reference+b, a and b by least squares.
+
+    Fitting the scale absorbs the gain difference between the reference and
+    the live capture, so one reference frame serves every exposure.
+    """
+    mean_frame = statistics.mean(frame)
+    mean_reference = statistics.mean(reference)
+    variance = sum((v - mean_reference)**2 for v in reference) or 1
+
+    a = sum((frame[i] - mean_frame) * (reference[i] - mean_reference)
+            for i in range(len(frame))) / variance
+    b = mean_frame - a * mean_reference
+
+    return [int(frame[i] - (a * reference[i] + b)) for i in range(len(frame))]
+
+
+def run_driver(device: goodix.Device):
+    errors = open("/tmp/openssl-53xc.log", "w+b")
+    tls_server = subprocess.Popen([
+        "openssl", "s_server", "-nocert", "-psk",
+        PSK.hex(), "-port", "4433", "-quiet"
+    ],
+                                  stdout=subprocess.PIPE,
+                                  stderr=errors)
+
+    try:
+        success, number = device.reset(True, False, 20)
+        if not success:
+            raise ValueError("Reset failed")
+        print(f"Reset OK, number {number}")
+
+        chip_id = device.read_sensor_register(0x0000, 4)
+        print(f"Chip ID: {chip_id.hex(' ')}")
+
+        otp = device.read_otp()
+        if len(otp) < 32:
+            raise ValueError("Invalid OTP")
+        print(f"OTP: {otp.hex(' ')}")
+
+        tls_client = socket.socket()
+        tls_client.connect(("localhost", 4433))
+
+        try:
+            client_write_key, _ = establish_tls(device, tls_client)
+            device.tls_successfully_established()
+            print("TLS established")
+
+            if not device.upload_config_mcu(DEVICE_CONFIG):
+                raise ValueError("Failed to upload config")
+
+            template = measure_baseline(device)
+            print(f"FDT template: {template.hex(' ')}")
+
+            print("Capturing reference frame (no finger)...")
+            reference = capture(device, client_write_key, 0x01, 0xc2)
+
+            device.mcu_switch_to_sleep_mode()
+            device.query_mcu_state(b"\x01\x00\x01", False)
+
+            print("Waiting for finger -- touch the sensor...")
+            wait_for_finger(device, FDT_DOWN_ARMED + template)
+            device.mcu_switch_to_fdt_mode(FDT_MODE_ARMED + template, True)
+
+            image = capture(device, client_write_key, 0x41, 0x86)
+
+            device.mcu_switch_to_fdt_up(FDT_UP_ARMED + template)
+
+            corrected = flat_field(image, reference)
+            tool.write_pgm(corrected, SENSOR_WIDTH, SENSOR_HEIGHT,
+                           "fingerprint.pgm")
+            print("Wrote fingerprint.pgm")
+
+        finally:
+            tls_client.close()
+    finally:
+        tls_server.terminate()
+
+
+def main(product: int):
+    device = init_device(product)
+    run_driver(device)
diff --git a/goodix.py b/goodix.py
index b98009d..37c355e 100644
--- a/goodix.py
+++ b/goodix.py
@@ -152,18 +152,52 @@ def __init__(self,
         print(f"__init__({product}, {proto}, {timeout})")
 
         self.protocol: protocol.Protocol = proto(0x27c6, product, timeout)
+        self._pending: bytes | None = None
 
         # FIXME Empty device's reply buffer
         # (Current patch while waiting for a fix)
         if isinstance(self.protocol, protocol.USBProtocol):
             self.empty_buffer()
 
+    def read(self, size: int = 0x10000, timeout: float | None = 5):
+        """Read a frame, returning any frame put back by _expect_ack() first."""
+        if self._pending is not None:
+            frame, self._pending = self._pending, None
+            return frame
+
+        return self.protocol.read(size, timeout)
+
+    def _expect_ack(self, command: int):
+        """Consume the ACK for `command`, if this sensor sends one.
+
+        Not every sensor ACKs every command. 27c6:533c (GF5288_GM168SEC) ACKs
+        reset and read_sensor_register but answers firmware_version and
+        enable_chip with the reply alone. Requiring an ACK unconditionally
+        consumes that reply and then fails to parse it as an ACK, so those
+        commands error out on a perfectly healthy device. When the frame we
+        get is not an ACK, put it back for the caller to read.
+        """
+        if not isinstance(self.protocol, protocol.USBProtocol):
+            return
+
+        frame = self.read()
+        message = check_message_pack(frame)
+        payload, reply_command, _ = decode_message_protocol(message)
+
+        if reply_command != COMMAND_ACK:
+            self._pending = frame
+            return
+
+        check_ack(payload, command)
+
     def empty_buffer(self):
         print("empty_buffer()")
 
+        self._pending = None
+
         try:
             while True:
-                self.protocol.read(timeout=0.1)
+                self.read(timeout=0.1)
 
         except usb.core.USBTimeoutError as error:
             if error.backend_error_code == -7:
@@ -186,7 +220,8 @@ def nop(self):
                                         checksum=False)))
 
         try:
-            message = self.protocol.read(timeout=0.1)
+            # some sensors do not answer NOP at all; a timeout here is fine
+            self._pending = self.read(timeout=0.1)
 
         except usb.core.USBTimeoutError as error:
             if error.backend_error_code == -7:
@@ -194,10 +229,7 @@ def nop(self):
 
             raise error
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(check_message_pack(message),
-                                       COMMAND_ACK), COMMAND_NOP)
+        self._expect_ack(COMMAND_NOP)
 
     def mcu_get_image(self, payload: bytes, flags: int):
         print("mcu_get_image()")
@@ -206,13 +238,9 @@ def mcu_get_image(self, payload: bytes, flags: int):
             encode_message_pack(
                 encode_message_protocol(payload, COMMAND_MCU_GET_IMAGE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_GET_IMAGE)
+        self._expect_ack(COMMAND_MCU_GET_IMAGE)
 
-        return check_message_pack(self.protocol.read(), flags)
+        return check_message_pack(self.read(), flags)
 
     def mcu_switch_to_fdt_down(self, mode: bytes, reply: bool):
         print(f"mcu_switch_to_fdt_down({mode}, {reply})")
@@ -221,17 +249,13 @@ def mcu_switch_to_fdt_down(self, mode: bytes, reply: bool):
             encode_message_pack(
                 encode_message_protocol(mode, COMMAND_MCU_SWITCH_TO_FDT_DOWN)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_SWITCH_TO_FDT_DOWN)
+        self._expect_ack(COMMAND_MCU_SWITCH_TO_FDT_DOWN)
 
         if not reply:
             return None
 
         return check_message_protocol(
-            check_message_pack(self.protocol.read(timeout=None)),
+            check_message_pack(self.read(timeout=None)),
             COMMAND_MCU_SWITCH_TO_FDT_DOWN)
 
     def mcu_switch_to_fdt_up(self, mode: bytes):
@@ -241,14 +265,10 @@ def mcu_switch_to_fdt_up(self, mode: bytes):
             encode_message_pack(
                 encode_message_protocol(mode, COMMAND_MCU_SWITCH_TO_FDT_UP)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_SWITCH_TO_FDT_UP)
+        self._expect_ack(COMMAND_MCU_SWITCH_TO_FDT_UP)
 
         return check_message_protocol(
-            check_message_pack(self.protocol.read(timeout=None)),
+            check_message_pack(self.read(timeout=None)),
             COMMAND_MCU_SWITCH_TO_FDT_UP)
 
     def mcu_switch_to_fdt_mode(self, mode: bytes, reply: bool):
@@ -258,16 +278,12 @@ def mcu_switch_to_fdt_mode(self, mode: bytes, reply: bool):
             encode_message_pack(
                 encode_message_protocol(mode, COMMAND_MCU_SWITCH_TO_FDT_MODE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_SWITCH_TO_FDT_MODE)
+        self._expect_ack(COMMAND_MCU_SWITCH_TO_FDT_MODE)
 
         if not reply:
             return None
 
-        return check_message_protocol(check_message_pack(self.protocol.read()),
+        return check_message_protocol(check_message_pack(self.read()),
                                       COMMAND_MCU_SWITCH_TO_FDT_MODE)
 
     def nav(self):
@@ -277,13 +293,9 @@ def nav(self):
             encode_message_pack(
                 encode_message_protocol(b"\x01\x00", COMMAND_NAV)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_NAV)
+        self._expect_ack(COMMAND_NAV)
 
-        return check_message_protocol(check_message_pack(self.protocol.read()),
+        return check_message_protocol(check_message_pack(self.read()),
                                       COMMAND_NAV, False)
 
     def mcu_switch_to_sleep_mode(self):
@@ -294,11 +306,7 @@ def mcu_switch_to_sleep_mode(self):
                 encode_message_protocol(b"\x01\x00",
                                         COMMAND_MCU_SWITCH_TO_SLEEP_MODE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_SWITCH_TO_SLEEP_MODE)
+        self._expect_ack(COMMAND_MCU_SWITCH_TO_SLEEP_MODE)
 
     def mcu_switch_to_idle_mode(self, sleep_time: int):
         print(f"mcu_switch_to_idle_mode({sleep_time})")
@@ -309,11 +317,7 @@ def mcu_switch_to_idle_mode(self, sleep_time: int):
                     struct.pack("<B", sleep_time) + b"\x00",
                     COMMAND_MCU_SWITCH_TO_IDLE_MODE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_SWITCH_TO_IDLE_MODE)
+        self._expect_ack(COMMAND_MCU_SWITCH_TO_IDLE_MODE)
 
     def write_sensor_register(self, address: int | list[int],
                               value: bytes | list[bytes]):
@@ -346,11 +350,7 @@ def write_sensor_register(self, address: int | list[int],
                 encode_message_protocol(message,
                                         COMMAND_WRITE_SENSOR_REGISTER)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_WRITE_SENSOR_REGISTER)
+        self._expect_ack(COMMAND_WRITE_SENSOR_REGISTER)
 
     def read_sensor_register(self, address: int | list[int], length: int):
         print(f"read_sensor_register({address}, {length})")
@@ -374,14 +374,10 @@ def read_sensor_register(self, address: int | list[int], length: int):
                 encode_message_protocol(message,
                                         COMMAND_READ_SENSOR_REGISTER)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_READ_SENSOR_REGISTER)
+        self._expect_ack(COMMAND_READ_SENSOR_REGISTER)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_READ_SENSOR_REGISTER)
 
         if isinstance(address, int):
@@ -403,14 +399,10 @@ def upload_config_mcu(self, config: bytes):
             encode_message_pack(
                 encode_message_protocol(config, COMMAND_UPLOAD_CONFIG_MCU)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_UPLOAD_CONFIG_MCU)
+        self._expect_ack(COMMAND_UPLOAD_CONFIG_MCU)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_UPLOAD_CONFIG_MCU)
 
         if len(message) < 1:
@@ -426,14 +418,10 @@ def switch_to_sleep_mode(self, number: int):
                 encode_message_protocol(struct.pack("<B", number),
                                         COMMAND_SWITCH_TO_SLEEP_MODE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_SWITCH_TO_SLEEP_MODE)
+        self._expect_ack(COMMAND_SWITCH_TO_SLEEP_MODE)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_SWITCH_TO_SLEEP_MODE)
 
         if len(message) < 1:
@@ -450,14 +438,10 @@ def set_powerdown_scan_frequency(self, powerdown_scan_frequency: int):
                     struct.pack("<H", powerdown_scan_frequency),
                     COMMAND_SET_POWERDOWN_SCAN_FREQUENCY)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_SET_POWERDOWN_SCAN_FREQUENCY)
+        self._expect_ack(COMMAND_SET_POWERDOWN_SCAN_FREQUENCY)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_SET_POWERDOWN_SCAN_FREQUENCY)
 
         if len(message) < 1:
@@ -474,11 +458,7 @@ def enable_chip(self, enable: bool):
                     struct.pack("<B", 0x1 if enable else 0x0) + b"\x00",
                     COMMAND_ENABLE_CHIP)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_ENABLE_CHIP)
+        self._expect_ack(COMMAND_ENABLE_CHIP)
 
     def reset(self, reset_sensor: bool, soft_reset_mcu: bool, sleep_time: int):
         print(f"reset({reset_sensor}, {soft_reset_mcu}, {sleep_time})")
@@ -491,17 +471,13 @@ def reset(self, reset_sensor: bool, soft_reset_mcu: bool, sleep_time: int):
                                 (0x1 if reset_sensor else 0x0) << 2) +
                     struct.pack("<B", sleep_time), COMMAND_RESET)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_RESET)
+        self._expect_ack(COMMAND_RESET)
 
         if soft_reset_mcu:
             return None
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()), COMMAND_RESET)
+            check_message_pack(self.read()), COMMAND_RESET)
 
         length = len(message)
         if length < 1:
@@ -525,17 +501,13 @@ def mcu_erase_app(self, sleep_time: int, reply: bool):
                     b"\x00" + struct.pack("<B", sleep_time),
                     COMMAND_MCU_ERASE_APP)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_ERASE_APP)
+        self._expect_ack(COMMAND_MCU_ERASE_APP)
 
         if not reply:
             return None
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()), COMMAND_MCU_ERASE_APP)
+            check_message_pack(self.read()), COMMAND_MCU_ERASE_APP)
 
         if len(message) < 1:
             raise SystemError("Invalid response length")
@@ -549,13 +521,9 @@ def read_otp(self):
             encode_message_pack(
                 encode_message_protocol(b"\x00\x00", COMMAND_READ_OTP)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_READ_OTP)
+        self._expect_ack(COMMAND_READ_OTP)
 
-        return check_message_protocol(check_message_pack(self.protocol.read()),
+        return check_message_protocol(check_message_pack(self.read()),
                                       COMMAND_READ_OTP)
 
     def firmware_version(self):
@@ -566,14 +534,10 @@ def firmware_version(self):
                 encode_message_protocol(b"\x00\x00",
                                         COMMAND_FIRMWARE_VERSION)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_FIRMWARE_VERSION)
+        self._expect_ack(COMMAND_FIRMWARE_VERSION)
 
         return check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_FIRMWARE_VERSION).split(b"\x00")[0].decode()
 
     def set_pov_config(self, config: bytes):
@@ -583,11 +547,7 @@ def set_pov_config(self, config: bytes):
             encode_message_pack(
                 encode_message_protocol(config, COMMAND_SET_POV_CONFIG)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_SET_POV_CONFIG)
+        self._expect_ack(COMMAND_SET_POV_CONFIG)
 
     def query_mcu_state(self, payload: bytes, reply: bool):
         print(f"query_mcu_state({payload}, {reply})")
@@ -596,16 +556,12 @@ def query_mcu_state(self, payload: bytes, reply: bool):
             encode_message_pack(
                 encode_message_protocol(payload, COMMAND_QUERY_MCU_STATE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_QUERY_MCU_STATE)
+        self._expect_ack(COMMAND_QUERY_MCU_STATE)
 
         if not reply:
             return None
 
-        return check_message_protocol(check_message_pack(self.protocol.read()),
+        return check_message_protocol(check_message_pack(self.read()),
                                       COMMAND_QUERY_MCU_STATE)
 
     def set_drv_state(self):
@@ -615,11 +571,7 @@ def set_drv_state(self):
             encode_message_pack(
                 encode_message_protocol(b"\x01\x00", COMMAND_SET_DRV_STATE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_SET_DRV_STATE)
+        self._expect_ack(COMMAND_SET_DRV_STATE)
 
     def request_tls_connection(self):
         print("request_tls_connection()")
@@ -629,13 +581,9 @@ def request_tls_connection(self):
                 encode_message_protocol(b"\x00\x00",
                                         COMMAND_REQUEST_TLS_CONNECTION)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_REQUEST_TLS_CONNECTION)
+        self._expect_ack(COMMAND_REQUEST_TLS_CONNECTION)
 
-        return check_message_pack(self.protocol.read(),
+        return check_message_pack(self.read(),
                                   FLAGS_TRANSPORT_LAYER_SECURITY)
 
     def mcu_get_pov_image(self):
@@ -646,14 +594,10 @@ def mcu_get_pov_image(self):
                 encode_message_protocol(b"\x00\x00",
                                         COMMAND_MCU_GET_POV_IMAGE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_MCU_GET_POV_IMAGE)
+        self._expect_ack(COMMAND_MCU_GET_POV_IMAGE)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_MCU_GET_POV_IMAGE)
 
         if len(message) < 1:
@@ -669,11 +613,7 @@ def tls_successfully_established(self):
                 encode_message_protocol(b"\x00\x00",
                                         COMMAND_TLS_SUCCESSFULLY_ESTABLISHED)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_TLS_SUCCESSFULLY_ESTABLISHED)
+        self._expect_ack(COMMAND_TLS_SUCCESSFULLY_ESTABLISHED)
 
     def pov_image_check(self):
         print("pov_image_check()")
@@ -682,14 +622,10 @@ def pov_image_check(self):
             encode_message_pack(
                 encode_message_protocol(b"\x00\x00", COMMAND_POV_IMAGE_CHECK)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_POV_IMAGE_CHECK)
+        self._expect_ack(COMMAND_POV_IMAGE_CHECK)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()), COMMAND_POV_IMAGE_CHECK)
+            check_message_pack(self.read()), COMMAND_POV_IMAGE_CHECK)
 
         if len(message) < 1:
             raise SystemError("Invalid response length")
@@ -725,14 +661,10 @@ def preset_psk_write(self,
             encode_message_pack(
                 encode_message_protocol(data, COMMAND_PRESET_PSK_WRITE_R)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_PRESET_PSK_WRITE_R)
+        self._expect_ack(COMMAND_PRESET_PSK_WRITE_R)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_PRESET_PSK_WRITE_R)
 
         if len(message) < 1:
@@ -758,14 +690,10 @@ def preset_psk_read(self,
                     struct.pack("<I", flags) + struct.pack("<I", 0),
                     COMMAND_PRESET_PSK_READ_R)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_PRESET_PSK_READ_R)
+        self._expect_ack(COMMAND_PRESET_PSK_READ_R)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()),
+            check_message_pack(self.read()),
             COMMAND_PRESET_PSK_READ_R)
 
         message_length = len(message)
@@ -799,14 +727,10 @@ def write_firmware(self,
                     (b"" if number is None else struct.pack("<I", number)) +
                     payload, COMMAND_WRITE_FIRMWARE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_WRITE_FIRMWARE)
+        self._expect_ack(COMMAND_WRITE_FIRMWARE)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()), COMMAND_WRITE_FIRMWARE)
+            check_message_pack(self.read()), COMMAND_WRITE_FIRMWARE)
 
         if len(message) < 1:
             raise SystemError("Invalid response length")
@@ -822,14 +746,10 @@ def read_firmware(self, offset: int, length: int):
                     struct.pack("<I", offset) + struct.pack("<I", length),
                     COMMAND_READ_FIRMWARE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_READ_FIRMWARE)
+        self._expect_ack(COMMAND_READ_FIRMWARE)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()), COMMAND_READ_FIRMWARE)
+            check_message_pack(self.read()), COMMAND_READ_FIRMWARE)
         if len(message) < length:
             raise SystemError("Invalid response length")
 
@@ -856,14 +776,10 @@ def check_firmware(self,
                      struct.pack("<I", length) + struct.pack("<I", checksum)) +
                     (b"" if hmac is None else hmac), COMMAND_CHECK_FIRMWARE)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_CHECK_FIRMWARE)
+        self._expect_ack(COMMAND_CHECK_FIRMWARE)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()), COMMAND_CHECK_FIRMWARE)
+            check_message_pack(self.read()), COMMAND_CHECK_FIRMWARE)
 
         if len(message) < 1:
             raise SystemError("Invalid response length")
@@ -879,14 +795,10 @@ def get_iap_version(self, length: int):
                     struct.pack("<B", length) + b"\x00",
                     COMMAND_GET_IAP_VERSION)))
 
-        if isinstance(self.protocol, protocol.USBProtocol):
-            check_ack(
-                check_message_protocol(
-                    check_message_pack(self.protocol.read()), COMMAND_ACK),
-                COMMAND_GET_IAP_VERSION)
+        self._expect_ack(COMMAND_GET_IAP_VERSION)
 
         message = check_message_protocol(
-            check_message_pack(self.protocol.read()), COMMAND_GET_IAP_VERSION)
+            check_message_pack(self.read()), COMMAND_GET_IAP_VERSION)
 
         if len(message) < length:
             raise SystemError("Invalid response length")
diff --git a/identifier.py b/identifier.py
new file mode 100644
index 0000000..3713957
--- /dev/null
+++ b/identifier.py
@@ -0,0 +1,55 @@
+import logging
+
+import usb.util
+
+import goodix
+import protocol
+import wrapless
+
+
+def identify_wrapless(product: int):
+    device = wrapless.Device(product, protocol.USBProtocol)
+    try:
+        device.ping()
+        print(f"Firmware version: {device.read_firmware_version()}")
+
+        device.reset(0, False)
+        chip_id = wrapless.decode_u32(device.read_data(0, 4, 0.2))
+        print(f"Chip ID: {chip_id:#x}")
+
+    finally:
+        usb.util.dispose_resources(device.protocol.device)
+
+
+def identify_wrapped(product: int):
+    device = goodix.Device(product, protocol.USBProtocol)
+    try:
+        device.nop()
+        print(f"Firmware version: {device.firmware_version()}")
+
+        device.reset(True, False, 20)
+        chip_id = wrapless.decode_u32(device.read_sensor_register(0x0000, 4))
+        print(f"Chip ID: {chip_id:#x}")
+
+    finally:
+        usb.util.dispose_resources(device.protocol.device)
+
+
+def main(product: int):
+    """Report which message framing a sensor speaks, and its firmware version.
+
+    Read-only: ping, firmware version and register reads only. Nothing here
+    erases firmware or writes a PSK.
+    """
+    logging.basicConfig(level=logging.INFO, format="%(message)s")
+
+    for name, identify in (("wrapless", identify_wrapless),
+                           ("wrapped", identify_wrapped)):
+        print(f"\nTrying {name} protocol...")
+
+        try:
+            identify(product)
+            print(f"Sensor speaks the {name} protocol")
+
+        except Exception as exception:
+            print(f"Not {name}: {type(exception).__name__}: {exception}")
diff --git a/identify_533c.py b/identify_533c.py
new file mode 100644
index 0000000..96e52f4
--- /dev/null
+++ b/identify_533c.py
@@ -0,0 +1,3 @@
+import identifier
+
+identifier.main(0x533C)
diff --git a/recon.py b/recon.py
new file mode 100644
index 0000000..eb36f3f
--- /dev/null
+++ b/recon.py
@@ -0,0 +1,96 @@
+import hashlib
+
+import goodix
+import protocol
+
+# what preset_psk_read reports when the sensor holds the all-zero PSK that
+# driver_51x7 / driver_55x4 provision -- worth knowing before writing one
+ALL_ZERO_PSK_HASH = hashlib.sha256(bytes(32)).digest()
+
+
+def dump_firmware(device: goodix.Device, chunk: int = 256, limit: int = 0x80000):
+    """Read the running firmware back off the sensor, until it stops replying.
+
+    This is the prerequisite for any provisioning work: mcu_erase_app is
+    irreversible without an image to flash back, and upstream ships none
+    (firmware/ is empty, *.bin is gitignored).
+    """
+    data = b""
+    while len(data) < limit:
+        try:
+            block = device.read_firmware(len(data), chunk)
+        except Exception as exception:
+            print(f"  stopped at {len(data):#x}: "
+                  f"{type(exception).__name__}: {exception}")
+            break
+
+        if not block:
+            break
+
+        data += block
+
+    return data
+
+
+def attempt(label: str, function):
+    try:
+        return function()
+    except Exception as exception:
+        print(f"{label}: FAILED {type(exception).__name__}: {exception}")
+        return None
+
+
+def main(product: int):
+    """Read-only reconnaissance: firmware, PSK state, OTP, firmware readback.
+
+    No firmware erase and no PSK write -- nothing here can brick the sensor.
+    """
+    device = goodix.Device(product, protocol.USBProtocol)
+
+    device.nop()
+    attempt("Enable chip", lambda: device.enable_chip(True))
+    device.nop()
+
+    firmware = attempt("Firmware", device.firmware_version)
+    print(f"Firmware: {firmware}")
+
+    # preset_psk_read needs length and offset: without them goodix.py sends the
+    # short form and the sensor answers "not present" even when a PSK is there.
+    # Slots differ per sensor; 533c answers 0xbb020001 (hash) and 0xbb010002.
+    for flags, length in ((0xbb020001, 32), (0xbb010002, 102),
+                          (0xbb020003, 32), (0xbb020007, 32)):
+        result = attempt(f"PSK {flags:#x}",
+                         lambda: device.preset_psk_read(flags, length, 0))
+        if result is None:
+            continue
+
+        success, reply_flags, data = result
+        if not success:
+            print(f"PSK {flags:#x}: not present")
+            continue
+
+        note = ""
+        if data == ALL_ZERO_PSK_HASH:
+            note = "  <- sha256 of 32 zero bytes: sensor holds the all-zero PSK"
+        print(f"PSK {flags:#x}: flags={reply_flags:#x} "
+              f"data({len(data)})={data.hex()}{note}")
+
+    attempt("Reset", lambda: device.reset(True, False, 20))
+
+    chip_id = attempt("Chip ID", lambda: device.read_sensor_register(0x0000, 4))
+    if chip_id is not None:
+        print(f"Chip ID: {chip_id.hex(' ')}")
+
+    otp = attempt("OTP", device.read_otp)
+    if otp is not None:
+        print(f"OTP ({len(otp)} bytes): {otp.hex(' ')}")
+
+    print("Dumping firmware...")
+    image = dump_firmware(device)
+    print(f"Firmware dumped: {len(image)} bytes")
+
+    if image:
+        path = f"firmware/{firmware}.bin"
+        with open(path, "wb") as file:
+            file.write(image)
+        print(f"Wrote {path}")
diff --git a/recon_533c.py b/recon_533c.py
new file mode 100644
index 0000000..5506866
--- /dev/null
+++ b/recon_533c.py
@@ -0,0 +1,3 @@
+import recon
+
+recon.main(0x533C)
diff --git a/run_533c.py b/run_533c.py
new file mode 100644
index 0000000..03d3f63
--- /dev/null
+++ b/run_533c.py
@@ -0,0 +1,3 @@
+import driver_53xc
+
+driver_53xc.main(0x533C)