diff --git a/lib/nfc/protocols/mf_classic/mf_classic_poller.c b/lib/nfc/protocols/mf_classic/mf_classic_poller.c index c99e54dc1..7234cc65c 100644 --- a/lib/nfc/protocols/mf_classic/mf_classic_poller.c +++ b/lib/nfc/protocols/mf_classic/mf_classic_poller.c @@ -1770,13 +1770,20 @@ NfcCommand mf_classic_poller_handler_nested_controller(MfClassicPoller* instance // TODO: Need to think about how this works for NXP/Fudan backdoored tags. // We could reset the .calibration field every sector to re-calibrate. Calibration function handles backdoor calibration too. // Calibration + bool initial_collect_nt_enc_iter = false; if(!(dict_attack_ctx->calibrated)) { if(dict_attack_ctx->prng_type == MfClassicPrngTypeWeak) { instance->state = MfClassicPollerStateNestedCalibrate; return command; } + initial_collect_nt_enc_iter = true; + dict_attack_ctx->auth_passed = true; + dict_attack_ctx->current_key_checked = false; dict_attack_ctx->nested_phase = MfClassicNestedPhaseCollectNtEnc; } else if(dict_attack_ctx->nested_phase == MfClassicNestedPhaseCalibrate) { + initial_collect_nt_enc_iter = true; + dict_attack_ctx->auth_passed = true; + dict_attack_ctx->current_key_checked = false; dict_attack_ctx->nested_phase = MfClassicNestedPhaseCollectNtEnc; } // Collect and log nonces @@ -1807,7 +1814,7 @@ NfcCommand mf_classic_poller_handler_nested_controller(MfClassicPoller* instance if(!(dict_attack_ctx->auth_passed)) { dict_attack_ctx->attempt_count++; } else { - if(is_weak) { + if(is_weak && !(initial_collect_nt_enc_iter)) { dict_attack_ctx->nested_target_key++; if(dict_attack_ctx->nested_target_key % 2 == 0) { dict_attack_ctx->current_key_checked = false; @@ -1850,6 +1857,7 @@ NfcCommand mf_classic_poller_handler_nested_controller(MfClassicPoller* instance } dict_attack_ctx->attempt_count = 0; } + dict_attack_ctx->auth_passed = false; instance->state = MfClassicPollerStateNestedCollectNtEnc; return command; } diff --git a/lib/nfc/protocols/mf_classic/mf_classic_poller_i.h b/lib/nfc/protocols/mf_classic/mf_classic_poller_i.h index 9e4cfd728..4726aa5bc 100644 --- a/lib/nfc/protocols/mf_classic/mf_classic_poller_i.h +++ b/lib/nfc/protocols/mf_classic/mf_classic_poller_i.h @@ -19,7 +19,7 @@ extern "C" { #define NFC_ASSETS_FOLDER EXT_PATH("nfc/assets") #define MF_CLASSIC_NESTED_ANALYZE_NT_COUNT (5) #define MF_CLASSIC_NESTED_NT_HARD_MINIMUM (3) -#define MF_CLASSIC_NESTED_RETRY_MAXIMUM (20) +#define MF_CLASSIC_NESTED_RETRY_MAXIMUM (60) #define MF_CLASSIC_NESTED_HARD_RETRY_MAXIMUM (3) #define MF_CLASSIC_NESTED_CALIBRATION_COUNT (21) #define MF_CLASSIC_NESTED_LOGS_FILE_NAME ".nested.log"