From 2a1bbdc1ca7fdea6d0d8fc2c74d18617189e1e5b Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Tue, 26 Jul 2022 12:23:50 -0600
Subject: [PATCH 01/26] nfc: MFUL minor cleanup

---
 lib/nfc/protocols/mifare_ultralight.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index ffabe88ab..d53b4d2e0 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -1201,6 +1201,8 @@ static void mf_ul_emulate_write(
 }
 
 void mf_ul_reset_emulation(MfUltralightEmulator* emulator, bool is_power_cycle) {
+    emulator->comp_write_cmd_started = false;
+    emulator->sector_select_cmd_started = false;
     emulator->curr_sector = 0;
     emulator->ntag_i2c_plus_sector3_lockout = false;
     emulator->auth_success = false;
@@ -1244,8 +1246,6 @@ void mf_ul_prepare_emulation(MfUltralightEmulator* emulator, MfUltralightData* d
     emulator->config = mf_ultralight_get_config_pages(&emulator->data);
     emulator->page_num = emulator->data.data_size / 4;
     emulator->data_changed = false;
-    emulator->comp_write_cmd_started = false;
-    emulator->sector_select_cmd_started = false;
     mf_ul_reset_emulation(emulator, true);
 }
 

From 299ec9643e00005a9bd1b41fb77866cc09857222 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Tue, 26 Jul 2022 12:26:00 -0600
Subject: [PATCH 02/26] nfc: Add mechanism to pass event data

---
 lib/nfc/nfc_worker.c   | 5 +++++
 lib/nfc/nfc_worker.h   | 2 ++
 lib/nfc/nfc_worker_i.h | 1 +
 3 files changed, 8 insertions(+)

diff --git a/lib/nfc/nfc_worker.c b/lib/nfc/nfc_worker.c
index c61ad444c..aa81e55c2 100644
--- a/lib/nfc/nfc_worker.c
+++ b/lib/nfc/nfc_worker.c
@@ -20,6 +20,7 @@ NfcWorker* nfc_worker_alloc() {
 
     nfc_worker->callback = NULL;
     nfc_worker->context = NULL;
+    nfc_worker->event_data = NULL;
     nfc_worker->storage = furi_record_open(RECORD_STORAGE);
 
     // Initialize rfal
@@ -49,6 +50,10 @@ NfcWorkerState nfc_worker_get_state(NfcWorker* nfc_worker) {
     return nfc_worker->state;
 }
 
+void* nfc_worker_get_event_data(NfcWorker* nfc_worker) {
+    return nfc_worker->event_data;
+}
+
 void nfc_worker_start(
     NfcWorker* nfc_worker,
     NfcWorkerState state,
diff --git a/lib/nfc/nfc_worker.h b/lib/nfc/nfc_worker.h
index 84615f5d8..1f4ed7eb6 100644
--- a/lib/nfc/nfc_worker.h
+++ b/lib/nfc/nfc_worker.h
@@ -71,6 +71,8 @@ NfcWorker* nfc_worker_alloc();
 
 NfcWorkerState nfc_worker_get_state(NfcWorker* nfc_worker);
 
+void* nfc_worker_get_event_data(NfcWorker* nfc_worker);
+
 void nfc_worker_free(NfcWorker* nfc_worker);
 
 void nfc_worker_start(
diff --git a/lib/nfc/nfc_worker_i.h b/lib/nfc/nfc_worker_i.h
index 526182f9a..5c7592833 100644
--- a/lib/nfc/nfc_worker_i.h
+++ b/lib/nfc/nfc_worker_i.h
@@ -23,6 +23,7 @@ struct NfcWorker {
 
     NfcWorkerCallback callback;
     void* context;
+    void* event_data;
 
     NfcWorkerState state;
 

From 71035dc3ae84aaa9b77a0860c384e2f8945dea5a Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Tue, 26 Jul 2022 12:29:17 -0600
Subject: [PATCH 03/26] nfc: Add NTAG authentication event to emulation

---
 lib/nfc/nfc_worker.c                  | 9 +++++++++
 lib/nfc/nfc_worker.h                  | 2 +-
 lib/nfc/protocols/mifare_ultralight.c | 8 ++++++++
 lib/nfc/protocols/mifare_ultralight.h | 2 ++
 4 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/lib/nfc/nfc_worker.c b/lib/nfc/nfc_worker.c
index aa81e55c2..c33f2fa2a 100644
--- a/lib/nfc/nfc_worker.c
+++ b/lib/nfc/nfc_worker.c
@@ -447,6 +447,15 @@ void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
             mf_ul_prepare_emulation_response,
             &emulator,
             5000);
+        // Check if there was an auth attempt
+        if(emulator.auth_attempted) {
+            nfc_worker->event_data = &emulator.auth_attempt;
+            if(nfc_worker->callback) {
+                nfc_worker->callback(NfcWorkerEventPwdAuth, nfc_worker->context);
+            }
+            emulator.auth_attempted = false;
+            nfc_worker->event_data = NULL;
+        }
         // Check if data was modified
         if(emulator.data_changed) {
             nfc_worker->dev_data->mf_ul_data = emulator.data;
diff --git a/lib/nfc/nfc_worker.h b/lib/nfc/nfc_worker.h
index 1f4ed7eb6..ef5213ad7 100644
--- a/lib/nfc/nfc_worker.h
+++ b/lib/nfc/nfc_worker.h
@@ -62,7 +62,7 @@ typedef enum {
 
     // Mifare Ultralight events
     NfcWorkerEventMfUltralightPassKey,
-
+    NfcWorkerEventPwdAuth,
 } NfcWorkerEvent;
 
 typedef bool (*NfcWorkerCallback)(NfcWorkerEvent event, void* context);
diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index d53b4d2e0..c11ebf77c 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -1246,6 +1246,7 @@ void mf_ul_prepare_emulation(MfUltralightEmulator* emulator, MfUltralightData* d
     emulator->config = mf_ultralight_get_config_pages(&emulator->data);
     emulator->page_num = emulator->data.data_size / 4;
     emulator->data_changed = false;
+    memset(&emulator->auth_attempt, 0, sizeof(MfUltralightAuth));
     mf_ul_reset_emulation(emulator, true);
 }
 
@@ -1706,6 +1707,13 @@ bool mf_ul_prepare_emulation_response(
         } else if(cmd == MF_UL_AUTH) {
             if(emulator->supported_features & MfUltralightSupportAuth) {
                 if(buff_rx_len == (1 + 4) * 8) {
+                    // Record password sent by PCD
+                    memcpy(
+                        emulator->auth_attempt.pwd.raw,
+                        &buff_rx[1],
+                        sizeof(emulator->auth_attempt.pwd.raw));
+                    emulator->auth_attempted = true;
+                    
                     uint16_t scaled_authlim = mf_ultralight_calc_auth_count(&emulator->data);
                     if(scaled_authlim != 0 && emulator->data.curr_authlim >= scaled_authlim) {
                         if(emulator->data.curr_authlim != UINT16_MAX) {
diff --git a/lib/nfc/protocols/mifare_ultralight.h b/lib/nfc/protocols/mifare_ultralight.h
index 9642824f7..957d5f9d5 100644
--- a/lib/nfc/protocols/mifare_ultralight.h
+++ b/lib/nfc/protocols/mifare_ultralight.h
@@ -185,6 +185,8 @@ typedef struct {
     bool sector_select_cmd_started;
     bool ntag_i2c_plus_sector3_lockout;
     bool read_counter_incremented;
+    bool auth_attempted;
+    MfUltralightAuth auth_attempt;
 } MfUltralightEmulator;
 
 void mf_ul_reset(MfUltralightData* data);

From 674706279ae954e81b1feb631a62de3178bbaf66 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Mon, 8 Aug 2022 15:19:24 -0600
Subject: [PATCH 04/26] nfc: Rename enum member to align with existing
 convention

---
 lib/nfc/nfc_worker.c                  | 2 +-
 lib/nfc/nfc_worker.h                  | 4 ++--
 lib/nfc/protocols/mifare_ultralight.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/nfc/nfc_worker.c b/lib/nfc/nfc_worker.c
index c33f2fa2a..10494193f 100644
--- a/lib/nfc/nfc_worker.c
+++ b/lib/nfc/nfc_worker.c
@@ -451,7 +451,7 @@ void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
         if(emulator.auth_attempted) {
             nfc_worker->event_data = &emulator.auth_attempt;
             if(nfc_worker->callback) {
-                nfc_worker->callback(NfcWorkerEventPwdAuth, nfc_worker->context);
+                nfc_worker->callback(NfcWorkerEventMfUltralightPwdAuth, nfc_worker->context);
             }
             emulator.auth_attempted = false;
             nfc_worker->event_data = NULL;
diff --git a/lib/nfc/nfc_worker.h b/lib/nfc/nfc_worker.h
index ef5213ad7..290d3d741 100644
--- a/lib/nfc/nfc_worker.h
+++ b/lib/nfc/nfc_worker.h
@@ -61,8 +61,8 @@ typedef enum {
     NfcWorkerEventDetectReaderMfkeyCollected,
 
     // Mifare Ultralight events
-    NfcWorkerEventMfUltralightPassKey,
-    NfcWorkerEventPwdAuth,
+    NfcWorkerEventMfUltralightPassKey, // NFC worker requesting manual key
+    NfcWorkerEventMfUltralightPwdAuth, // Reader sent auth command
 } NfcWorkerEvent;
 
 typedef bool (*NfcWorkerCallback)(NfcWorkerEvent event, void* context);
diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index c11ebf77c..034ea4f74 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -1713,7 +1713,7 @@ bool mf_ul_prepare_emulation_response(
                         &buff_rx[1],
                         sizeof(emulator->auth_attempt.pwd.raw));
                     emulator->auth_attempted = true;
-                    
+
                     uint16_t scaled_authlim = mf_ultralight_calc_auth_count(&emulator->data);
                     if(scaled_authlim != 0 && emulator->data.curr_authlim >= scaled_authlim) {
                         if(emulator->data.curr_authlim != UINT16_MAX) {

From a227b63ba5a4400d50fb18513b4ae4217bcf3bb3 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 00:23:34 -0600
Subject: [PATCH 05/26] nfc: Add function to determine whether MFUL is fully
 captured

---
 lib/nfc/protocols/mifare_ultralight.c | 11 +++++++++++
 lib/nfc/protocols/mifare_ultralight.h |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index 034ea4f74..f0ffa226c 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -1871,3 +1871,14 @@ bool mf_ul_prepare_emulation_response(
 
     return tx_bits > 0;
 }
+
+bool mf_ul_is_full_capture(MfUltralightData* data) {
+    if(data->data_read != data->data_size) return false;
+
+    // Having read all the pages doesn't mean that we've got everything.
+    // By default PWD is 0xFFFFFFFF, but if read back it is always 0x00000000,
+    // so a default read on an auth-supported NTAG is never complete.
+    if(!(mf_ul_get_features(data->type) & MfUltralightSupportAuth)) return true;
+    MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
+    return config->auth_data.pwd.value != 0 || config->auth_data.pack.value != 0;
+}
diff --git a/lib/nfc/protocols/mifare_ultralight.h b/lib/nfc/protocols/mifare_ultralight.h
index 957d5f9d5..b3d4fb55f 100644
--- a/lib/nfc/protocols/mifare_ultralight.h
+++ b/lib/nfc/protocols/mifare_ultralight.h
@@ -243,3 +243,5 @@ bool mf_ul_prepare_emulation_response(
 uint32_t mf_ul_pwdgen_amiibo(FuriHalNfcDevData* data);
 
 uint32_t mf_ul_pwdgen_xiaomi(FuriHalNfcDevData* data);
+
+bool mf_ul_is_full_capture(MfUltralightData* data);

From 58b9844025698cd2e9b7231757a00cbd3e29371c Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 00:29:39 -0600
Subject: [PATCH 06/26] nfc: Fix emulation of incompletely-read
 password-protected MFUL

---
 lib/nfc/protocols/mifare_ultralight.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index f0ffa226c..b57ce684c 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -758,6 +758,17 @@ bool mf_ul_read_card(
         data->curr_authlim = 0;
     }
 
+    if(reader->pages_read != reader->pages_to_read) {
+        if(reader->supported_features & MfUltralightSupportAuth) {
+            // Probably password protected, fix AUTH0 and PROT so before AUTH0
+            // can be written and since AUTH0 won't be readable, like on the
+            // original card
+            MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
+            config->auth0 = reader->pages_read;
+            config->access.prot = true;
+        }
+    }
+
     return card_read;
 }
 

From 716d6e3940df7e2e3ff88c652f57e76c3d36ef3b Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 00:30:45 -0600
Subject: [PATCH 07/26] nfc: Add reader password capture scene

---
 .../main/nfc/scenes/nfc_scene_config.h        |  1 +
 .../nfc/scenes/nfc_scene_mf_ultralight_menu.c | 19 +++++--
 .../nfc_scene_mf_ultralight_unlock_auto.c     | 57 +++++++++++++++++++
 3 files changed, 73 insertions(+), 4 deletions(-)
 create mode 100644 applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c

diff --git a/applications/main/nfc/scenes/nfc_scene_config.h b/applications/main/nfc/scenes/nfc_scene_config.h
index a25850c84..9e7bcb3ac 100644
--- a/applications/main/nfc/scenes/nfc_scene_config.h
+++ b/applications/main/nfc/scenes/nfc_scene_config.h
@@ -21,6 +21,7 @@ ADD_SCENE(nfc, mf_ultralight_emulate, MfUltralightEmulate)
 ADD_SCENE(nfc, mf_ultralight_read_auth, MfUltralightReadAuth)
 ADD_SCENE(nfc, mf_ultralight_read_auth_result, MfUltralightReadAuthResult)
 ADD_SCENE(nfc, mf_ultralight_key_input, MfUltralightKeyInput)
+ADD_SCENE(nfc, mf_ultralight_unlock_auto, MfUltralightUnlockAuto)
 ADD_SCENE(nfc, mf_ultralight_unlock_menu, MfUltralightUnlockMenu)
 ADD_SCENE(nfc, mf_ultralight_unlock_warn, MfUltralightUnlockWarn)
 ADD_SCENE(nfc, mf_desfire_read_success, MfDesfireReadSuccess)
diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
index ba9f22338..8bd0cf0e7 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
@@ -1,7 +1,9 @@
+#include <lib/nfc/protocols/mifare_ultralight.h>
 #include "../nfc_i.h"
 
 enum SubmenuIndex {
-    SubmenuIndexUnlock,
+    SubmenuIndexUnlockByReader,
+    SubmenuIndexUnlockByPassword,
     SubmenuIndexSave,
     SubmenuIndexEmulate,
     SubmenuIndexInfo,
@@ -18,11 +20,17 @@ void nfc_scene_mf_ultralight_menu_on_enter(void* context) {
     Submenu* submenu = nfc->submenu;
     MfUltralightData* data = &nfc->dev->dev_data.mf_ul_data;
 
-    if(data->data_read != data->data_size) {
+    if(!mf_ul_is_full_capture(data)) {
+        submenu_add_item(
+            submenu,
+            "Unlock With Reader",
+            SubmenuIndexUnlockByReader,
+            nfc_scene_mf_ultralight_menu_submenu_callback,
+            nfc);
         submenu_add_item(
             submenu,
             "Unlock With Password",
-            SubmenuIndexUnlock,
+            SubmenuIndexUnlockByPassword,
             nfc_scene_mf_ultralight_menu_submenu_callback,
             nfc);
     }
@@ -57,7 +65,10 @@ bool nfc_scene_mf_ultralight_menu_on_event(void* context, SceneManagerEvent even
         } else if(event.event == SubmenuIndexEmulate) {
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightEmulate);
             consumed = true;
-        } else if(event.event == SubmenuIndexUnlock) {
+        } else if(event.event == SubmenuIndexUnlockByReader) {
+            scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockAuto);
+            consumed = true;
+        } else if(event.event == SubmenuIndexUnlockByPassword) {
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
             consumed = true;
         } else if(event.event == SubmenuIndexInfo) {
diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
new file mode 100644
index 000000000..eafbacc72
--- /dev/null
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
@@ -0,0 +1,57 @@
+#include "../nfc_i.h"
+
+bool nfc_scene_mf_ultralight_unlock_auto_worker_callback(NfcWorkerEvent event, void* context) {
+    Nfc* nfc = context;
+
+    if(event == NfcWorkerEventMfUltralightPwdAuth) {
+        MfUltralightAuth* auth = nfc_worker_get_event_data(nfc->worker);
+        memcpy(nfc->byte_input_store, auth->pwd.raw, sizeof(auth->pwd.raw));
+    }
+
+    view_dispatcher_send_custom_event(nfc->view_dispatcher, event);
+    return true;
+}
+
+void nfc_scene_mf_ultralight_unlock_auto_on_enter(void* context) {
+    Nfc* nfc = context;
+
+    // Setup view
+    popup_set_text(nfc->popup, "Touch the reader", 44, 31, AlignLeft, AlignCenter);
+    popup_set_icon(nfc->popup, 0, 16, &I_Tap_reader_36x38);
+    view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewPopup);
+
+    // Start worker
+    nfc_worker_start(
+        nfc->worker,
+        NfcWorkerStateMfUltralightEmulate,
+        &nfc->dev->dev_data,
+        nfc_scene_mf_ultralight_unlock_auto_worker_callback,
+        nfc);
+
+    nfc_blink_emulate_start(nfc);
+}
+
+bool nfc_scene_mf_ultralight_unlock_auto_on_event(void* context, SceneManagerEvent event) {
+    Nfc* nfc = context;
+    bool consumed = false;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if((event.event == NfcWorkerEventMfUltralightPwdAuth)) {
+            notification_message(nfc->notifications, &sequence_success);
+            scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockWarn);
+            consumed = true;
+        }
+    }
+    return consumed;
+}
+
+void nfc_scene_mf_ultralight_unlock_auto_on_exit(void* context) {
+    Nfc* nfc = context;
+
+    // Stop worker
+    nfc_worker_stop(nfc->worker);
+    // Clear view
+    popup_reset(nfc->popup);
+
+    nfc_blink_stop(nfc);
+}

From 145aef96ac4236661786638a171bcfb7206e9376 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 00:31:05 -0600
Subject: [PATCH 08/26] nfc: Set default MFUL password input to 0xFFFFFFFF

---
 applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c
index 089187d5b..3b040fa16 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c
@@ -9,6 +9,7 @@ void nfc_scene_mf_ultralight_key_input_byte_input_callback(void* context) {
 void nfc_scene_mf_ultralight_key_input_on_enter(void* context) {
     Nfc* nfc = context;
 
+    memset(nfc->byte_input_store, 0xFF, 4); // Default to 0xFFFFFFFF
     // Setup view
     ByteInput* byte_input = nfc->byte_input;
     byte_input_set_header_text(byte_input, "Enter the password in hex");

From 1c2e35d93003566aa8b764c99a75d29ba74b2996 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 00:57:32 -0600
Subject: [PATCH 09/26] nfc: Fix MFUL auth counter loading

---
 lib/nfc/nfc_device.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/nfc/nfc_device.c b/lib/nfc/nfc_device.c
index f28d4d5bd..aa91f8766 100644
--- a/lib/nfc/nfc_device.c
+++ b/lib/nfc/nfc_device.c
@@ -213,6 +213,8 @@ bool nfc_device_load_mifare_ul_data(FlipperFormat* file, NfcDevice* dev) {
         uint32_t auth_counter;
         if(!flipper_format_read_uint32(file, "Failed authentication attempts", &auth_counter, 1))
             auth_counter = 0;
+        data->curr_authlim = auth_counter;
+
 
         parsed = true;
     } while(false);

From f1b2327b8a6cfd05d29e28d359ee875ce7e317d2 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 00:58:05 -0600
Subject: [PATCH 10/26] nfc: Be explicit about using manual auth method when
 using auto unlock

---
 .../main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c        | 1 +
 1 file changed, 1 insertion(+)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
index eafbacc72..0369afcbd 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
@@ -6,6 +6,7 @@ bool nfc_scene_mf_ultralight_unlock_auto_worker_callback(NfcWorkerEvent event, v
     if(event == NfcWorkerEventMfUltralightPwdAuth) {
         MfUltralightAuth* auth = nfc_worker_get_event_data(nfc->worker);
         memcpy(nfc->byte_input_store, auth->pwd.raw, sizeof(auth->pwd.raw));
+        nfc->dev->dev_data.mf_ul_data.auth_method = MfUltralightAuthMethodManual;
     }
 
     view_dispatcher_send_custom_event(nfc->view_dispatcher, event);

From 2e93c6268eab14b769265258eb393eddb5908aca Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 00:58:31 -0600
Subject: [PATCH 11/26] nfc: Fill in MFUL has_auth when loading file

---
 lib/nfc/nfc_device.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/nfc/nfc_device.c b/lib/nfc/nfc_device.c
index aa91f8766..a88bb5f89 100644
--- a/lib/nfc/nfc_device.c
+++ b/lib/nfc/nfc_device.c
@@ -215,6 +215,7 @@ bool nfc_device_load_mifare_ul_data(FlipperFormat* file, NfcDevice* dev) {
             auth_counter = 0;
         data->curr_authlim = auth_counter;
 
+        data->has_auth = mf_ul_is_full_capture(data);
 
         parsed = true;
     } while(false);

From b839566f3e9ecc7bb56da4f2cb54fd43c7e4be3f Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 01:11:03 -0600
Subject: [PATCH 12/26] nfc: Fix MFUL auth success usage, remove unused
 variable

---
 lib/nfc/nfc_device.c                  | 2 +-
 lib/nfc/protocols/mifare_ultralight.c | 2 +-
 lib/nfc/protocols/mifare_ultralight.h | 1 -
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/nfc/nfc_device.c b/lib/nfc/nfc_device.c
index a88bb5f89..e286807e7 100644
--- a/lib/nfc/nfc_device.c
+++ b/lib/nfc/nfc_device.c
@@ -215,7 +215,7 @@ bool nfc_device_load_mifare_ul_data(FlipperFormat* file, NfcDevice* dev) {
             auth_counter = 0;
         data->curr_authlim = auth_counter;
 
-        data->has_auth = mf_ul_is_full_capture(data);
+        data->auth_success = mf_ul_is_full_capture(data);
 
         parsed = true;
     } while(false);
diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index b57ce684c..e9278d6e2 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -51,7 +51,7 @@ void mf_ul_reset(MfUltralightData* data) {
     data->data_size = 0;
     data->data_read = 0;
     data->curr_authlim = 0;
-    data->has_auth = false;
+    data->auth_success = false;
 }
 
 static MfUltralightFeatures mf_ul_get_features(MfUltralightType type) {
diff --git a/lib/nfc/protocols/mifare_ultralight.h b/lib/nfc/protocols/mifare_ultralight.h
index b3d4fb55f..fdd471ac1 100644
--- a/lib/nfc/protocols/mifare_ultralight.h
+++ b/lib/nfc/protocols/mifare_ultralight.h
@@ -110,7 +110,6 @@ typedef struct {
     uint8_t signature[32];
     uint32_t counter[3];
     uint8_t tearing[3];
-    bool has_auth;
     MfUltralightAuthMethod auth_method;
     uint8_t auth_key[4];
     bool auth_success;

From 6c135eebf7e7dd2634eb355a56e8ba2eae0c4389 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 01:11:27 -0600
Subject: [PATCH 13/26] nfc: Display PWD and PACK in MFUL info if available

---
 .../main/nfc/scenes/nfc_scene_nfc_data_info.c      | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/applications/main/nfc/scenes/nfc_scene_nfc_data_info.c b/applications/main/nfc/scenes/nfc_scene_nfc_data_info.c
index bb7d58f7c..158b1d2c1 100644
--- a/applications/main/nfc/scenes/nfc_scene_nfc_data_info.c
+++ b/applications/main/nfc/scenes/nfc_scene_nfc_data_info.c
@@ -87,6 +87,20 @@ void nfc_scene_nfc_data_info_on_enter(void* context) {
             temp_str, "\nPages Read %d/%d", data->data_read / 4, data->data_size / 4);
         if(data->data_size > data->data_read) {
             furi_string_cat_printf(temp_str, "\nPassword-protected");
+        } else if(data->auth_success) {
+            MfUltralightConfigPages* config_pages = mf_ultralight_get_config_pages(data);
+            furi_string_cat_printf(
+                temp_str,
+                "\nPassword: %02X %02X %02X %02X",
+                config_pages->auth_data.pwd.raw[0],
+                config_pages->auth_data.pwd.raw[1],
+                config_pages->auth_data.pwd.raw[2],
+                config_pages->auth_data.pwd.raw[3]);
+            furi_string_cat_printf(
+                temp_str,
+                "\nPACK: %02X %02X",
+                config_pages->auth_data.pack.raw[0],
+                config_pages->auth_data.pack.raw[1]);
         }
     } else if(protocol == NfcDeviceProtocolMifareClassic) {
         MfClassicData* data = &dev_data->mf_classic_data;

From 0f68025d94a8195bfec93d7bab0b04dec31b1b10 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 01:43:09 -0600
Subject: [PATCH 14/26] nfc: Remove unnecessary include

---
 applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
index 8bd0cf0e7..ee56fa1cf 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
@@ -1,4 +1,3 @@
-#include <lib/nfc/protocols/mifare_ultralight.h>
 #include "../nfc_i.h"
 
 enum SubmenuIndex {

From 5aadfcd20a625e425555e573f6bb6c5bf5d466d4 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 01:43:23 -0600
Subject: [PATCH 15/26] nfc: Add unlock options to loaded MFUL menu

---
 .../main/nfc/scenes/nfc_scene_saved_menu.c    | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/applications/main/nfc/scenes/nfc_scene_saved_menu.c b/applications/main/nfc/scenes/nfc_scene_saved_menu.c
index fe65b5b8a..fdc9fd5f3 100644
--- a/applications/main/nfc/scenes/nfc_scene_saved_menu.c
+++ b/applications/main/nfc/scenes/nfc_scene_saved_menu.c
@@ -7,6 +7,8 @@ enum SubmenuIndex {
     SubmenuIndexDelete,
     SubmenuIndexInfo,
     SubmenuIndexRestoreOriginal,
+    SubmenuIndexMfUlUnlockByReader,
+    SubmenuIndexMfUlUnlockByPassword,
 };
 
 void nfc_scene_saved_menu_submenu_callback(void* context, uint32_t index) {
@@ -43,6 +45,21 @@ void nfc_scene_saved_menu_on_enter(void* context) {
     }
     submenu_add_item(
         submenu, "Info", SubmenuIndexInfo, nfc_scene_saved_menu_submenu_callback, nfc);
+    if(nfc->dev->format == NfcDeviceSaveFormatMifareUl &&
+       !mf_ul_is_full_capture(&nfc->dev->dev_data.mf_ul_data)) {
+        submenu_add_item(
+            submenu,
+            "Unlock With Reader",
+            SubmenuIndexMfUlUnlockByReader,
+            nfc_scene_saved_menu_submenu_callback,
+            nfc);
+        submenu_add_item(
+            submenu,
+            "Unlock With Password",
+            SubmenuIndexMfUlUnlockByPassword,
+            nfc_scene_saved_menu_submenu_callback,
+            nfc);
+    }
     if(nfc->dev->shadow_file_exist) {
         submenu_add_item(
             submenu,
@@ -105,6 +122,12 @@ bool nfc_scene_saved_menu_on_event(void* context, SceneManagerEvent event) {
         } else if(event.event == SubmenuIndexRestoreOriginal) {
             scene_manager_next_scene(nfc->scene_manager, NfcSceneRestoreOriginalConfirm);
             consumed = true;
+        } else if(event.event == SubmenuIndexMfUlUnlockByReader) {
+            scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockAuto);
+            consumed = true;
+        } else if(event.event == SubmenuIndexMfUlUnlockByPassword) {
+            scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
+            consumed = true;
         }
     }
 

From b5859acf9c3bcd36fb0da2535ecbf8bab3102233 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Fri, 7 Oct 2022 02:18:13 -0600
Subject: [PATCH 16/26] nfc: Move set default MFUL password

This way it can be edited if needed instead of reentered
---
 .../main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c         | 1 -
 applications/main/nfc/scenes/nfc_scene_read.c                   | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c
index 3b040fa16..089187d5b 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_key_input.c
@@ -9,7 +9,6 @@ void nfc_scene_mf_ultralight_key_input_byte_input_callback(void* context) {
 void nfc_scene_mf_ultralight_key_input_on_enter(void* context) {
     Nfc* nfc = context;
 
-    memset(nfc->byte_input_store, 0xFF, 4); // Default to 0xFFFFFFFF
     // Setup view
     ByteInput* byte_input = nfc->byte_input;
     byte_input_set_header_text(byte_input, "Enter the password in hex");
diff --git a/applications/main/nfc/scenes/nfc_scene_read.c b/applications/main/nfc/scenes/nfc_scene_read.c
index e6df476f0..e9ba098bc 100644
--- a/applications/main/nfc/scenes/nfc_scene_read.c
+++ b/applications/main/nfc/scenes/nfc_scene_read.c
@@ -69,6 +69,8 @@ bool nfc_scene_read_on_event(void* context, SceneManagerEvent event) {
             consumed = true;
         } else if(event.event == NfcWorkerEventReadMfUltralight) {
             notification_message(nfc->notifications, &sequence_success);
+            // Set unlock password input to 0xFFFFFFFF only on fresh read
+            memset(nfc->byte_input_store, 0xFF, 4);
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightReadSuccess);
             consumed = true;
         } else if(event.event == NfcWorkerEventReadMfClassicDone) {

From 60c08224ebe17519c2f752222a7b62a476a4a834 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Sun, 9 Oct 2022 16:20:20 -0600
Subject: [PATCH 17/26] nfc: Fix unlock menu not maintaining selection index

---
 .../main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c      | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
index 648aa31dc..95bbb7b10 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
@@ -58,7 +58,8 @@ bool nfc_scene_mf_ultralight_unlock_menu_on_event(void* context, SceneManagerEve
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockWarn);
             consumed = true;
         }
-        scene_manager_set_scene_state(nfc->scene_manager, NfcSceneExtraActions, event.event);
+        scene_manager_set_scene_state(
+            nfc->scene_manager, NfcSceneMfUltralightUnlockMenu, event.event);
     }
     return consumed;
 }

From e89741e434b8a32bfd6cdfb2689a18f278bf7939 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Mon, 10 Oct 2022 22:25:42 -0600
Subject: [PATCH 18/26] nfc: Move captured MFUL auth data from worker to device
 data

---
 .../main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c | 2 +-
 lib/nfc/nfc_device.h                                      | 1 +
 lib/nfc/nfc_worker.c                                      | 8 +-------
 lib/nfc/nfc_worker.h                                      | 2 --
 lib/nfc/nfc_worker_i.h                                    | 1 -
 5 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
index 0369afcbd..e94c97f3c 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
@@ -4,7 +4,7 @@ bool nfc_scene_mf_ultralight_unlock_auto_worker_callback(NfcWorkerEvent event, v
     Nfc* nfc = context;
 
     if(event == NfcWorkerEventMfUltralightPwdAuth) {
-        MfUltralightAuth* auth = nfc_worker_get_event_data(nfc->worker);
+        MfUltralightAuth* auth = &nfc->dev->dev_data.mf_ul_auth;
         memcpy(nfc->byte_input_store, auth->pwd.raw, sizeof(auth->pwd.raw));
         nfc->dev->dev_data.mf_ul_data.auth_method = MfUltralightAuthMethodManual;
     }
diff --git a/lib/nfc/nfc_device.h b/lib/nfc/nfc_device.h
index 6cac72c6b..76b2f5a01 100644
--- a/lib/nfc/nfc_device.h
+++ b/lib/nfc/nfc_device.h
@@ -53,6 +53,7 @@ typedef struct {
     union {
         NfcReaderRequestData reader_data;
         NfcMfClassicDictAttackData mf_classic_dict_attack_data;
+        MfUltralightAuth mf_ul_auth;
     };
     union {
         EmvData emv_data;
diff --git a/lib/nfc/nfc_worker.c b/lib/nfc/nfc_worker.c
index fc05b8264..7d1ff34dc 100644
--- a/lib/nfc/nfc_worker.c
+++ b/lib/nfc/nfc_worker.c
@@ -20,7 +20,6 @@ NfcWorker* nfc_worker_alloc() {
 
     nfc_worker->callback = NULL;
     nfc_worker->context = NULL;
-    nfc_worker->event_data = NULL;
     nfc_worker->storage = furi_record_open(RECORD_STORAGE);
 
     // Initialize rfal
@@ -50,10 +49,6 @@ NfcWorkerState nfc_worker_get_state(NfcWorker* nfc_worker) {
     return nfc_worker->state;
 }
 
-void* nfc_worker_get_event_data(NfcWorker* nfc_worker) {
-    return nfc_worker->event_data;
-}
-
 void nfc_worker_start(
     NfcWorker* nfc_worker,
     NfcWorkerState state,
@@ -449,12 +444,11 @@ void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
             5000);
         // Check if there was an auth attempt
         if(emulator.auth_attempted) {
-            nfc_worker->event_data = &emulator.auth_attempt;
+            nfc_worker->dev_data->mf_ul_auth = emulator.auth_attempt; // Make copy
             if(nfc_worker->callback) {
                 nfc_worker->callback(NfcWorkerEventMfUltralightPwdAuth, nfc_worker->context);
             }
             emulator.auth_attempted = false;
-            nfc_worker->event_data = NULL;
         }
         // Check if data was modified
         if(emulator.data_changed) {
diff --git a/lib/nfc/nfc_worker.h b/lib/nfc/nfc_worker.h
index 290d3d741..002b0f1da 100644
--- a/lib/nfc/nfc_worker.h
+++ b/lib/nfc/nfc_worker.h
@@ -71,8 +71,6 @@ NfcWorker* nfc_worker_alloc();
 
 NfcWorkerState nfc_worker_get_state(NfcWorker* nfc_worker);
 
-void* nfc_worker_get_event_data(NfcWorker* nfc_worker);
-
 void nfc_worker_free(NfcWorker* nfc_worker);
 
 void nfc_worker_start(
diff --git a/lib/nfc/nfc_worker_i.h b/lib/nfc/nfc_worker_i.h
index 5c7592833..526182f9a 100644
--- a/lib/nfc/nfc_worker_i.h
+++ b/lib/nfc/nfc_worker_i.h
@@ -23,7 +23,6 @@ struct NfcWorker {
 
     NfcWorkerCallback callback;
     void* context;
-    void* event_data;
 
     NfcWorkerState state;
 

From 0d0f66bceaf8a2e7b2e51517ae4e83e07a246b45 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Thu, 13 Oct 2022 08:51:02 -0600
Subject: [PATCH 19/26] nfc: Attempt to authenticate with default PWD when
 possible when reading NTAG

---
 lib/nfc/protocols/mifare_ultralight.c | 17 +++++++++++++++++
 lib/nfc/protocols/mifare_ultralight.h |  2 ++
 2 files changed, 19 insertions(+)

diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index 4ea14b38c..0f97a8440 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -756,6 +756,23 @@ bool mf_ul_read_card(
             mf_ultralight_read_tearing_flags(tx_rx, data);
         }
         data->curr_authlim = 0;
+
+        if(reader->pages_read == reader->pages_to_read &&
+           reader->supported_features & MfUltralightSupportAuth) {
+            MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
+            if(config->access.authlim == 0) {
+                // Attempt to auth with default PWD
+                uint16_t pack;
+                data->auth_success = mf_ultralight_authenticate(tx_rx, MF_UL_DEFAULT_PWD, &pack);
+                if(data->auth_success) {
+                    config->auth_data.pwd.value = MF_UL_DEFAULT_PWD;
+                    config->auth_data.pack.value = pack;
+                } else {
+                    furi_hal_nfc_sleep();
+                    furi_hal_nfc_activate_nfca(300, NULL);
+                }
+            }
+        }
     }
 
     if(reader->pages_read != reader->pages_to_read) {
diff --git a/lib/nfc/protocols/mifare_ultralight.h b/lib/nfc/protocols/mifare_ultralight.h
index fdd471ac1..c05a4a066 100644
--- a/lib/nfc/protocols/mifare_ultralight.h
+++ b/lib/nfc/protocols/mifare_ultralight.h
@@ -28,6 +28,8 @@
 
 #define MF_UL_NTAG203_COUNTER_PAGE (41)
 
+#define MF_UL_DEFAULT_PWD (0xFFFFFFFF)
+
 typedef enum {
     MfUltralightAuthMethodManual,
     MfUltralightAuthMethodAmeebo,

From 8648967468f2601839fd6beb01a2a67c8852cc29 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Thu, 13 Oct 2022 10:07:06 -0600
Subject: [PATCH 20/26] nfc: Don't try to auth NTAG on read if we already
 authed

---
 lib/nfc/protocols/mifare_ultralight.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index 0f97a8440..fbe12bded 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -758,7 +758,7 @@ bool mf_ul_read_card(
         data->curr_authlim = 0;
 
         if(reader->pages_read == reader->pages_to_read &&
-           reader->supported_features & MfUltralightSupportAuth) {
+           reader->supported_features & MfUltralightSupportAuth && !data->auth_success) {
             MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
             if(config->access.authlim == 0) {
                 // Attempt to auth with default PWD

From dd2d8d383de0ad2d1f2c93bae7d819609057729c Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Thu, 13 Oct 2022 10:12:08 -0600
Subject: [PATCH 21/26] nfc: Add title for all pages read but failed auth for
 NTAG auth

---
 .../scenes/nfc_scene_mf_ultralight_read_auth_result.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c
index 5a690a213..564c536dd 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c
@@ -20,16 +20,19 @@ void nfc_scene_mf_ultralight_read_auth_result_on_enter(void* context) {
     MfUltralightData* mf_ul_data = &nfc->dev->dev_data.mf_ul_data;
     MfUltralightConfigPages* config_pages = mf_ultralight_get_config_pages(mf_ul_data);
     Widget* widget = nfc->widget;
+    const char* title;
     FuriString* temp_str;
     temp_str = furi_string_alloc();
 
     if((mf_ul_data->data_read == mf_ul_data->data_size) && (mf_ul_data->data_read > 0)) {
-        widget_add_string_element(
-            widget, 64, 0, AlignCenter, AlignTop, FontPrimary, "All pages are unlocked!");
+        if(mf_ul_data->auth_success)
+            title = "All pages are unlocked!";
+        else
+            title = "All unlocked but failed auth!";
     } else {
-        widget_add_string_element(
-            widget, 64, 0, AlignCenter, AlignTop, FontPrimary, "Not all pages unlocked!");
+        title = "Not all pages unlocked!";
     }
+    widget_add_string_element(widget, 64, 0, AlignCenter, AlignTop, FontPrimary, title);
     furi_string_set(temp_str, "UID:");
     for(size_t i = 0; i < nfc_data->uid_len; i++) {
         furi_string_cat_printf(temp_str, " %02X", nfc_data->uid[i]);

From 508f52b1c0a7e274fdd3676489c955923d37cc5b Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Mon, 14 Nov 2022 10:26:30 -0700
Subject: [PATCH 22/26] nfc: Add faster auth callback patch

---
 .../nfc_scene_mf_ultralight_unlock_auto.c     | 10 ++++----
 lib/nfc/nfc_worker.c                          | 23 ++++++++++++-------
 lib/nfc/protocols/mifare_ultralight.c         |  4 ++++
 lib/nfc/protocols/mifare_ultralight.h         |  7 ++++++
 lib/scons                                     |  1 +
 5 files changed, 31 insertions(+), 14 deletions(-)
 create mode 160000 lib/scons

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
index e94c97f3c..70a06091f 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
@@ -3,12 +3,6 @@
 bool nfc_scene_mf_ultralight_unlock_auto_worker_callback(NfcWorkerEvent event, void* context) {
     Nfc* nfc = context;
 
-    if(event == NfcWorkerEventMfUltralightPwdAuth) {
-        MfUltralightAuth* auth = &nfc->dev->dev_data.mf_ul_auth;
-        memcpy(nfc->byte_input_store, auth->pwd.raw, sizeof(auth->pwd.raw));
-        nfc->dev->dev_data.mf_ul_data.auth_method = MfUltralightAuthMethodManual;
-    }
-
     view_dispatcher_send_custom_event(nfc->view_dispatcher, event);
     return true;
 }
@@ -38,6 +32,10 @@ bool nfc_scene_mf_ultralight_unlock_auto_on_event(void* context, SceneManagerEve
 
     if(event.type == SceneManagerEventTypeCustom) {
         if((event.event == NfcWorkerEventMfUltralightPwdAuth)) {
+            MfUltralightAuth* auth = &nfc->dev->dev_data.mf_ul_auth;
+            memcpy(nfc->byte_input_store, auth->pwd.raw, sizeof(auth->pwd.raw));
+            nfc->dev->dev_data.mf_ul_data.auth_method = MfUltralightAuthMethodManual;
+            nfc_worker_stop(nfc->worker);
             notification_message(nfc->notifications, &sequence_success);
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockWarn);
             consumed = true;
diff --git a/lib/nfc/nfc_worker.c b/lib/nfc/nfc_worker.c
index e7b893f8e..a0cc7abd3 100644
--- a/lib/nfc/nfc_worker.c
+++ b/lib/nfc/nfc_worker.c
@@ -531,10 +531,25 @@ void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
     }
 }
 
+void nfc_worker_mf_ultralight_auth_received_callback(MfUltralightAuth auth, void* context) {
+    furi_assert(context);
+
+    NfcWorker* nfc_worker = context;
+    nfc_worker->dev_data->mf_ul_auth = auth;
+    if(nfc_worker->callback) {
+        nfc_worker->callback(NfcWorkerEventMfUltralightPwdAuth, nfc_worker->context);
+    }
+}
+
 void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
     FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
     MfUltralightEmulator emulator = {};
     mf_ul_prepare_emulation(&emulator, &nfc_worker->dev_data->mf_ul_data);
+
+    // TODO rework with reader analyzer
+    emulator.auth_received_callback = nfc_worker_mf_ultralight_auth_received_callback;
+    emulator.context = nfc_worker;
+
     while(nfc_worker->state == NfcWorkerStateMfUltralightEmulate) {
         mf_ul_reset_emulation(&emulator, true);
         furi_hal_nfc_emulate_nfca(
@@ -545,14 +560,6 @@ void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
             mf_ul_prepare_emulation_response,
             &emulator,
             5000);
-        // Check if there was an auth attempt
-        if(emulator.auth_attempted) {
-            nfc_worker->dev_data->mf_ul_auth = emulator.auth_attempt; // Make copy
-            if(nfc_worker->callback) {
-                nfc_worker->callback(NfcWorkerEventMfUltralightPwdAuth, nfc_worker->context);
-            }
-            emulator.auth_attempted = false;
-        }
         // Check if data was modified
         if(emulator.data_changed) {
             nfc_worker->dev_data->mf_ul_data = emulator.data;
diff --git a/lib/nfc/protocols/mifare_ultralight.c b/lib/nfc/protocols/mifare_ultralight.c
index fbe12bded..85e234bd9 100644
--- a/lib/nfc/protocols/mifare_ultralight.c
+++ b/lib/nfc/protocols/mifare_ultralight.c
@@ -1741,6 +1741,10 @@ bool mf_ul_prepare_emulation_response(
                         &buff_rx[1],
                         sizeof(emulator->auth_attempt.pwd.raw));
                     emulator->auth_attempted = true;
+                    if(emulator->auth_received_callback) {
+                        emulator->auth_received_callback(
+                            emulator->auth_attempt, emulator->context);
+                    }
 
                     uint16_t scaled_authlim = mf_ultralight_calc_auth_count(&emulator->data);
                     if(scaled_authlim != 0 && emulator->data.curr_authlim >= scaled_authlim) {
diff --git a/lib/nfc/protocols/mifare_ultralight.h b/lib/nfc/protocols/mifare_ultralight.h
index c05a4a066..8f5c80fff 100644
--- a/lib/nfc/protocols/mifare_ultralight.h
+++ b/lib/nfc/protocols/mifare_ultralight.h
@@ -170,6 +170,9 @@ typedef struct {
     MfUltralightFeatures supported_features;
 } MfUltralightReader;
 
+// TODO rework with reader analyzer
+typedef void (*MfUltralightAuthReceivedCallback)(MfUltralightAuth auth, void* context);
+
 typedef struct {
     MfUltralightData data;
     MfUltralightConfigPages* config;
@@ -188,6 +191,10 @@ typedef struct {
     bool read_counter_incremented;
     bool auth_attempted;
     MfUltralightAuth auth_attempt;
+
+    // TODO rework with reader analyzer
+    MfUltralightAuthReceivedCallback auth_received_callback;
+    void* context;
 } MfUltralightEmulator;
 
 void mf_ul_reset(MfUltralightData* data);
diff --git a/lib/scons b/lib/scons
new file mode 160000
index 000000000..c2d1f09f6
--- /dev/null
+++ b/lib/scons
@@ -0,0 +1 @@
+Subproject commit c2d1f09f615a9ef3fb5497a7e8e5ee2c900d21a7

From dc2c5ddf1a388f55533c3260e10dbe47f0480690 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Mon, 14 Nov 2022 21:57:02 -0700
Subject: [PATCH 23/26] lib: Remove scons submodule from index

---
 lib/scons | 1 -
 1 file changed, 1 deletion(-)
 delete mode 160000 lib/scons

diff --git a/lib/scons b/lib/scons
deleted file mode 160000
index c2d1f09f6..000000000
--- a/lib/scons
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit c2d1f09f615a9ef3fb5497a7e8e5ee2c900d21a7

From 3624ebf6435ec02077a19eceabe081e582d8f962 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Tue, 15 Nov 2022 00:44:11 -0700
Subject: [PATCH 24/26] nfc: Revise MFUL unlock UI flow

---
 .../nfc/scenes/nfc_scene_mf_ultralight_menu.c | 18 ++---
 .../nfc_scene_mf_ultralight_read_auth.c       | 25 +++++--
 ...nfc_scene_mf_ultralight_read_auth_result.c | 19 ++++-
 .../nfc_scene_mf_ultralight_unlock_auto.c     | 20 ++++--
 .../nfc_scene_mf_ultralight_unlock_menu.c     | 22 ++++--
 .../nfc_scene_mf_ultralight_unlock_warn.c     | 71 ++++++++++++++++---
 lib/nfc/nfc_worker.c                          |  3 +-
 lib/nfc/protocols/mifare_ultralight.h         |  1 +
 8 files changed, 135 insertions(+), 44 deletions(-)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
index ddf30c54a..c511e9dcb 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_menu.c
@@ -2,8 +2,7 @@
 #include <dolphin/dolphin.h>
 
 enum SubmenuIndex {
-    SubmenuIndexUnlockByReader,
-    SubmenuIndexUnlockByPassword,
+    SubmenuIndexUnlock,
     SubmenuIndexSave,
     SubmenuIndexEmulate,
     SubmenuIndexInfo,
@@ -23,14 +22,8 @@ void nfc_scene_mf_ultralight_menu_on_enter(void* context) {
     if(!mf_ul_is_full_capture(data)) {
         submenu_add_item(
             submenu,
-            "Unlock With Reader",
-            SubmenuIndexUnlockByReader,
-            nfc_scene_mf_ultralight_menu_submenu_callback,
-            nfc);
-        submenu_add_item(
-            submenu,
-            "Unlock With Password",
-            SubmenuIndexUnlockByPassword,
+            "Unlock",
+            SubmenuIndexUnlock,
             nfc_scene_mf_ultralight_menu_submenu_callback,
             nfc);
     }
@@ -70,10 +63,7 @@ bool nfc_scene_mf_ultralight_menu_on_event(void* context, SceneManagerEvent even
                 DOLPHIN_DEED(DolphinDeedNfcEmulate);
             }
             consumed = true;
-        } else if(event.event == SubmenuIndexUnlockByReader) {
-            scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockAuto);
-            consumed = true;
-        } else if(event.event == SubmenuIndexUnlockByPassword) {
+        } else if(event.event == SubmenuIndexUnlock) {
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
             consumed = true;
         } else if(event.event == SubmenuIndexInfo) {
diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth.c
index 5dbb0c18a..2ab5e3f3f 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth.c
@@ -24,25 +24,29 @@ void nfc_scene_mf_ultralight_read_auth_set_state(Nfc* nfc, NfcSceneMfUlReadState
     if(curr_state != state) {
         if(state == NfcSceneMfUlReadStateDetecting) {
             popup_reset(nfc->popup);
-            popup_set_text(
-                nfc->popup, "Apply card to\nFlipper's back", 97, 24, AlignCenter, AlignTop);
+            popup_set_text(nfc->popup, "Apply the\ntarget card", 97, 24, AlignCenter, AlignTop);
             popup_set_icon(nfc->popup, 0, 8, &I_NFC_manual_60x50);
+            nfc_blink_read_start(nfc);
         } else if(state == NfcSceneMfUlReadStateReading) {
             popup_reset(nfc->popup);
             popup_set_header(
                 nfc->popup, "Reading card\nDon't move...", 85, 24, AlignCenter, AlignTop);
             popup_set_icon(nfc->popup, 12, 23, &A_Loading_24);
+            nfc_blink_detect_start(nfc);
         } else if(state == NfcSceneMfUlReadStateNotSupportedCard) {
             popup_reset(nfc->popup);
             popup_set_header(nfc->popup, "Wrong type of card!", 64, 3, AlignCenter, AlignTop);
             popup_set_text(
                 nfc->popup,
-                "Only MIFARE\nUltralight & NTAG\n are supported",
+                "Only MIFARE\nUltralight & NTAG\nare supported",
                 4,
                 22,
                 AlignLeft,
                 AlignTop);
             popup_set_icon(nfc->popup, 73, 20, &I_DolphinCommon_56x48);
+            nfc_blink_stop(nfc);
+            notification_message(nfc->notifications, &sequence_error);
+            notification_message(nfc->notifications, &sequence_set_red_255);
         }
         scene_manager_set_scene_state(nfc->scene_manager, NfcSceneMfUltralightReadAuth, state);
     }
@@ -62,8 +66,6 @@ void nfc_scene_mf_ultralight_read_auth_on_enter(void* context) {
         &nfc->dev->dev_data,
         nfc_scene_mf_ultralight_read_auth_worker_callback,
         nfc);
-
-    nfc_blink_read_start(nfc);
 }
 
 bool nfc_scene_mf_ultralight_read_auth_on_event(void* context, SceneManagerEvent event) {
@@ -86,8 +88,17 @@ bool nfc_scene_mf_ultralight_read_auth_on_event(void* context, SceneManagerEvent
                 nfc, NfcSceneMfUlReadStateNotSupportedCard);
         }
     } else if(event.type == SceneManagerEventTypeBack) {
-        consumed = scene_manager_search_and_switch_to_previous_scene(
-            nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
+        MfUltralightData* mf_ul_data = &nfc->dev->dev_data.mf_ul_data;
+        NfcScene next_scene;
+        if(mf_ul_data->auth_method == MfUltralightAuthMethodManual) {
+            next_scene = NfcSceneMfUltralightKeyInput;
+        } else if(mf_ul_data->auth_method == MfUltralightAuthMethodAuto) {
+            next_scene = NfcSceneMfUltralightUnlockAuto;
+        } else {
+            next_scene = NfcSceneMfUltralightUnlockMenu;
+        }
+        consumed =
+            scene_manager_search_and_switch_to_previous_scene(nfc->scene_manager, next_scene);
     }
     return consumed;
 }
diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c
index ac2eea182..86d670cbf 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_read_auth_result.c
@@ -68,6 +68,7 @@ void nfc_scene_mf_ultralight_read_auth_result_on_enter(void* context) {
         nfc);
 
     furi_string_free(temp_str);
+    notification_message(nfc->notifications, &sequence_set_green_255);
     view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewWidget);
 }
 
@@ -84,8 +85,20 @@ bool nfc_scene_mf_ultralight_read_auth_result_on_event(void* context, SceneManag
             consumed = true;
         }
     } else if(event.type == SceneManagerEventTypeBack) {
-        consumed = scene_manager_search_and_switch_to_previous_scene(
-            nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
+        MfUltralightData* mf_ul_data = &nfc->dev->dev_data.mf_ul_data;
+        if(mf_ul_data->auth_method == MfUltralightAuthMethodManual ||
+           mf_ul_data->auth_method == MfUltralightAuthMethodAuto) {
+            consumed = scene_manager_previous_scene(nfc->scene_manager);
+        } else {
+            NfcScene next_scene;
+            if((mf_ul_data->data_read == mf_ul_data->data_size) && (mf_ul_data->data_read > 0))
+                next_scene = NfcSceneMfUltralightMenu;
+            else
+                next_scene = NfcSceneMfUltralightUnlockMenu;
+
+            consumed =
+                scene_manager_search_and_switch_to_previous_scene(nfc->scene_manager, next_scene);
+        }
     }
 
     return consumed;
@@ -96,4 +109,6 @@ void nfc_scene_mf_ultralight_read_auth_result_on_exit(void* context) {
 
     // Clean views
     widget_reset(nfc->widget);
+
+    notification_message_block(nfc->notifications, &sequence_reset_green);
 }
diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
index 70a06091f..c59fe3a7d 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_auto.c
@@ -11,9 +11,17 @@ void nfc_scene_mf_ultralight_unlock_auto_on_enter(void* context) {
     Nfc* nfc = context;
 
     // Setup view
-    popup_set_text(nfc->popup, "Touch the reader", 44, 31, AlignLeft, AlignCenter);
-    popup_set_icon(nfc->popup, 0, 16, &I_Tap_reader_36x38);
-    view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewPopup);
+    widget_add_string_multiline_element(
+        nfc->widget,
+        54,
+        30,
+        AlignLeft,
+        AlignCenter,
+        FontPrimary,
+        "Touch the\nreader to get\npassword...");
+    widget_add_icon_element(nfc->widget, 0, 15, &I_Modern_reader_18x34);
+    widget_add_icon_element(nfc->widget, 20, 12, &I_Move_flipper_26x39);
+    view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewWidget);
 
     // Start worker
     nfc_worker_start(
@@ -23,7 +31,7 @@ void nfc_scene_mf_ultralight_unlock_auto_on_enter(void* context) {
         nfc_scene_mf_ultralight_unlock_auto_worker_callback,
         nfc);
 
-    nfc_blink_emulate_start(nfc);
+    nfc_blink_read_start(nfc);
 }
 
 bool nfc_scene_mf_ultralight_unlock_auto_on_event(void* context, SceneManagerEvent event) {
@@ -34,7 +42,7 @@ bool nfc_scene_mf_ultralight_unlock_auto_on_event(void* context, SceneManagerEve
         if((event.event == NfcWorkerEventMfUltralightPwdAuth)) {
             MfUltralightAuth* auth = &nfc->dev->dev_data.mf_ul_auth;
             memcpy(nfc->byte_input_store, auth->pwd.raw, sizeof(auth->pwd.raw));
-            nfc->dev->dev_data.mf_ul_data.auth_method = MfUltralightAuthMethodManual;
+            nfc->dev->dev_data.mf_ul_data.auth_method = MfUltralightAuthMethodAuto;
             nfc_worker_stop(nfc->worker);
             notification_message(nfc->notifications, &sequence_success);
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockWarn);
@@ -50,7 +58,7 @@ void nfc_scene_mf_ultralight_unlock_auto_on_exit(void* context) {
     // Stop worker
     nfc_worker_stop(nfc->worker);
     // Clear view
-    popup_reset(nfc->popup);
+    widget_reset(nfc->widget);
 
     nfc_blink_stop(nfc);
 }
diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
index 95bbb7b10..26c8c718f 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
@@ -1,9 +1,10 @@
 #include "../nfc_i.h"
 
 enum SubmenuIndex {
-    SubmenuIndexMfUlUnlockMenuManual,
+    SubmenuIndexMfUlUnlockMenuAuto,
     SubmenuIndexMfUlUnlockMenuAmeebo,
     SubmenuIndexMfUlUnlockMenuXiaomi,
+    SubmenuIndexMfUlUnlockMenuManual,
 };
 
 void nfc_scene_mf_ultralight_unlock_menu_submenu_callback(void* context, uint32_t index) {
@@ -20,8 +21,8 @@ void nfc_scene_mf_ultralight_unlock_menu_on_enter(void* context) {
         scene_manager_get_scene_state(nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
     submenu_add_item(
         submenu,
-        "Enter Password Manually",
-        SubmenuIndexMfUlUnlockMenuManual,
+        "Unlock With Reader",
+        SubmenuIndexMfUlUnlockMenuAuto,
         nfc_scene_mf_ultralight_unlock_menu_submenu_callback,
         nfc);
     submenu_add_item(
@@ -32,10 +33,16 @@ void nfc_scene_mf_ultralight_unlock_menu_on_enter(void* context) {
         nfc);
     submenu_add_item(
         submenu,
-        "Auth As Xiaomi",
+        "Auth As Xiaomi Air Purifier",
         SubmenuIndexMfUlUnlockMenuXiaomi,
         nfc_scene_mf_ultralight_unlock_menu_submenu_callback,
         nfc);
+    submenu_add_item(
+        submenu,
+        "Enter Password Manually",
+        SubmenuIndexMfUlUnlockMenuManual,
+        nfc_scene_mf_ultralight_unlock_menu_submenu_callback,
+        nfc);
     submenu_set_selected_item(submenu, state);
     view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewMenu);
 }
@@ -57,6 +64,13 @@ bool nfc_scene_mf_ultralight_unlock_menu_on_event(void* context, SceneManagerEve
             nfc->dev->dev_data.mf_ul_data.auth_method = MfUltralightAuthMethodXiaomi;
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockWarn);
             consumed = true;
+        } else if(event.event == SubmenuIndexMfUlUnlockMenuAuto) {
+            if(nfc->dev->dev_data.protocol == NfcDeviceProtocolMifareUl) {
+                scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockAuto);
+            } else {
+                // TODO: go to read scene and read card first
+            }
+            consumed = true;
         }
         scene_manager_set_scene_state(
             nfc->scene_manager, NfcSceneMfUltralightUnlockMenu, event.event);
diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_warn.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_warn.c
index 514cd4e98..16efae9de 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_warn.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_warn.c
@@ -10,15 +10,43 @@ void nfc_scene_mf_ultralight_unlock_warn_dialog_callback(DialogExResult result,
 void nfc_scene_mf_ultralight_unlock_warn_on_enter(void* context) {
     Nfc* nfc = context;
     DialogEx* dialog_ex = nfc->dialog_ex;
+    MfUltralightAuthMethod auth_method = nfc->dev->dev_data.mf_ul_data.auth_method;
 
     dialog_ex_set_context(dialog_ex, nfc);
     dialog_ex_set_result_callback(dialog_ex, nfc_scene_mf_ultralight_unlock_warn_dialog_callback);
 
-    dialog_ex_set_header(dialog_ex, "Risky function!", 64, 4, AlignCenter, AlignTop);
-    dialog_ex_set_text(
-        dialog_ex, "Wrong password\ncan block your\ncard.", 4, 18, AlignLeft, AlignTop);
-    dialog_ex_set_icon(dialog_ex, 73, 20, &I_DolphinCommon_56x48);
-    dialog_ex_set_center_button_text(dialog_ex, "OK");
+    if(auth_method == MfUltralightAuthMethodManual || auth_method == MfUltralightAuthMethodAuto) {
+        // Build dialog text
+        MfUltralightAuth* auth = &nfc->dev->dev_data.mf_ul_auth;
+        FuriString* password_str =
+            furi_string_alloc_set_str("Try to unlock the card with\npassword: ");
+        for(size_t i = 0; i < sizeof(auth->pwd.raw); ++i) {
+            furi_string_cat_printf(password_str, "%02X ", nfc->byte_input_store[i]);
+        }
+        furi_string_cat_str(password_str, "?\nCaution, a wrong password\ncan block the card!");
+        nfc_text_store_set(nfc, furi_string_get_cstr(password_str));
+        furi_string_free(password_str);
+
+        dialog_ex_set_header(
+            dialog_ex,
+            auth_method == MfUltralightAuthMethodAuto ? "Password captured!" : "Risky function!",
+            64,
+            0,
+            AlignCenter,
+            AlignTop);
+        dialog_ex_set_text(dialog_ex, nfc->text_store, 64, 12, AlignCenter, AlignTop);
+        dialog_ex_set_left_button_text(dialog_ex, "Cancel");
+        dialog_ex_set_right_button_text(dialog_ex, "Continue");
+
+        if(auth_method == MfUltralightAuthMethodAuto)
+            notification_message(nfc->notifications, &sequence_set_green_255);
+    } else {
+        dialog_ex_set_header(dialog_ex, "Risky function!", 64, 4, AlignCenter, AlignTop);
+        dialog_ex_set_text(
+            dialog_ex, "Wrong password\ncan block your\ncard.", 4, 18, AlignLeft, AlignTop);
+        dialog_ex_set_icon(dialog_ex, 73, 20, &I_DolphinCommon_56x48);
+        dialog_ex_set_center_button_text(dialog_ex, "OK");
+    }
 
     view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewDialogEx);
 }
@@ -28,12 +56,33 @@ bool nfc_scene_mf_ultralight_unlock_warn_on_event(void* context, SceneManagerEve
 
     bool consumed = false;
 
-    if(event.type == SceneManagerEventTypeCustom) {
-        if(event.event == DialogExResultCenter) {
-            scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightReadAuth);
-            DOLPHIN_DEED(DolphinDeedNfcRead);
+    MfUltralightAuthMethod auth_method = nfc->dev->dev_data.mf_ul_data.auth_method;
+    if(auth_method == MfUltralightAuthMethodManual || auth_method == MfUltralightAuthMethodAuto) {
+        if(event.type == SceneManagerEventTypeCustom) {
+            if(event.event == DialogExResultRight) {
+                scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightReadAuth);
+                DOLPHIN_DEED(DolphinDeedNfcRead);
+                consumed = true;
+            } else if(event.event == DialogExResultLeft) {
+                if(auth_method == MfUltralightAuthMethodAuto) {
+                    consumed = scene_manager_search_and_switch_to_previous_scene(
+                        nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
+                } else {
+                    consumed = scene_manager_previous_scene(nfc->scene_manager);
+                }
+            }
+        } else if(event.type == SceneManagerEventTypeBack) {
+            // Cannot press back
             consumed = true;
         }
+    } else {
+        if(event.type == SceneManagerEventTypeCustom) {
+            if(event.event == DialogExResultCenter) {
+                scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightReadAuth);
+                DOLPHIN_DEED(DolphinDeedNfcRead);
+                consumed = true;
+            }
+        }
     }
 
     return consumed;
@@ -43,5 +92,7 @@ void nfc_scene_mf_ultralight_unlock_warn_on_exit(void* context) {
     Nfc* nfc = context;
 
     dialog_ex_reset(nfc->dialog_ex);
-    submenu_reset(nfc->submenu);
+    nfc_text_store_clear(nfc);
+
+    notification_message_block(nfc->notifications, &sequence_reset_green);
 }
diff --git a/lib/nfc/nfc_worker.c b/lib/nfc/nfc_worker.c
index a0cc7abd3..6a5df5791 100644
--- a/lib/nfc/nfc_worker.c
+++ b/lib/nfc/nfc_worker.c
@@ -924,7 +924,8 @@ void nfc_worker_mf_ultralight_read_auth(NfcWorker* nfc_worker) {
         if(furi_hal_nfc_detect(nfc_data, 300) && nfc_data->type == FuriHalNfcTypeA) {
             if(mf_ul_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
                 nfc_worker->callback(NfcWorkerEventCardDetected, nfc_worker->context);
-                if(data->auth_method == MfUltralightAuthMethodManual) {
+                if(data->auth_method == MfUltralightAuthMethodManual ||
+                   data->auth_method == MfUltralightAuthMethodAuto) {
                     nfc_worker->callback(NfcWorkerEventMfUltralightPassKey, nfc_worker->context);
                     key = nfc_util_bytes2num(data->auth_key, 4);
                 } else if(data->auth_method == MfUltralightAuthMethodAmeebo) {
diff --git a/lib/nfc/protocols/mifare_ultralight.h b/lib/nfc/protocols/mifare_ultralight.h
index 8f5c80fff..4ab22e89c 100644
--- a/lib/nfc/protocols/mifare_ultralight.h
+++ b/lib/nfc/protocols/mifare_ultralight.h
@@ -34,6 +34,7 @@ typedef enum {
     MfUltralightAuthMethodManual,
     MfUltralightAuthMethodAmeebo,
     MfUltralightAuthMethodXiaomi,
+    MfUltralightAuthMethodAuto,
 } MfUltralightAuthMethod;
 
 // Important: order matters; some features are based on positioning in this enum

From 90c362708e2b1503233898853d3e2f7934a60f93 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Tue, 15 Nov 2022 01:17:54 -0700
Subject: [PATCH 25/26] nfc: Disallow MFUL unlock with reader if card not read
 yet

Trying to read first results in either needing to make a new scene or
badly jury rigging other scenes, so let's just not do that
---
 .../nfc_scene_mf_ultralight_unlock_menu.c     | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
index 26c8c718f..484629b0b 100644
--- a/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
+++ b/applications/main/nfc/scenes/nfc_scene_mf_ultralight_unlock_menu.c
@@ -19,12 +19,14 @@ void nfc_scene_mf_ultralight_unlock_menu_on_enter(void* context) {
 
     uint32_t state =
         scene_manager_get_scene_state(nfc->scene_manager, NfcSceneMfUltralightUnlockMenu);
-    submenu_add_item(
-        submenu,
-        "Unlock With Reader",
-        SubmenuIndexMfUlUnlockMenuAuto,
-        nfc_scene_mf_ultralight_unlock_menu_submenu_callback,
-        nfc);
+    if(nfc->dev->dev_data.protocol == NfcDeviceProtocolMifareUl) {
+        submenu_add_item(
+            submenu,
+            "Unlock With Reader",
+            SubmenuIndexMfUlUnlockMenuAuto,
+            nfc_scene_mf_ultralight_unlock_menu_submenu_callback,
+            nfc);
+    }
     submenu_add_item(
         submenu,
         "Auth As Ameebo",
@@ -65,11 +67,7 @@ bool nfc_scene_mf_ultralight_unlock_menu_on_event(void* context, SceneManagerEve
             scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockWarn);
             consumed = true;
         } else if(event.event == SubmenuIndexMfUlUnlockMenuAuto) {
-            if(nfc->dev->dev_data.protocol == NfcDeviceProtocolMifareUl) {
-                scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockAuto);
-            } else {
-                // TODO: go to read scene and read card first
-            }
+            scene_manager_next_scene(nfc->scene_manager, NfcSceneMfUltralightUnlockAuto);
             consumed = true;
         }
         scene_manager_set_scene_state(

From d568975059489e10d839a748afaa1c8ec5472594 Mon Sep 17 00:00:00 2001
From: Yukai Li <yukaili.geek@gmail.com>
Date: Tue, 15 Nov 2022 01:18:52 -0700
Subject: [PATCH 26/26] f7: Bump API symbols

---
 firmware/targets/f7/api_symbols.csv | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/firmware/targets/f7/api_symbols.csv b/firmware/targets/f7/api_symbols.csv
index 1ad5efa72..5c66c70db 100644
--- a/firmware/targets/f7/api_symbols.csv
+++ b/firmware/targets/f7/api_symbols.csv
@@ -1,5 +1,5 @@
 entry,status,name,type,params
-Version,+,7.5,,
+Version,+,7.6,,
 Header,+,applications/services/bt/bt_service/bt.h,,
 Header,+,applications/services/cli/cli.h,,
 Header,+,applications/services/cli/cli_vcp.h,,
@@ -1899,6 +1899,7 @@ Function,-,mf_df_prepare_read_records,uint16_t,"uint8_t*, uint8_t, uint32_t, uin
 Function,-,mf_df_prepare_select_application,uint16_t,"uint8_t*, uint8_t[3]"
 Function,-,mf_df_read_card,_Bool,"FuriHalNfcTxRxContext*, MifareDesfireData*"
 Function,-,mf_ul_check_card_type,_Bool,"uint8_t, uint8_t, uint8_t"
+Function,-,mf_ul_is_full_capture,_Bool,MfUltralightData*
 Function,-,mf_ul_prepare_emulation,void,"MfUltralightEmulator*, MfUltralightData*"
 Function,-,mf_ul_prepare_emulation_response,_Bool,"uint8_t*, uint16_t, uint8_t*, uint16_t*, uint32_t*, void*"
 Function,-,mf_ul_pwdgen_amiibo,uint32_t,FuriHalNfcDevData*