Mirror/Momentum-Firmware
1
0
Fork 0
mirror of https://github.com/Next-Flip/Momentum-Firmware.git synced 2026-07-30 02:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

added ISO15693 (NfcV) reading, saving, emulating and revealing from privacy mode (unlock) (#2316)

Browse Source 
* added support for ISO15693 (NfcV) emulation, added support for reading SLIX tags
* SLIX: fixed crash situation when an invalid password was requested
* ISO15693: show emulate menu when opening file
* rename NfcV emulate scene to match other NfcV names
* optimize allocation size for signals
* ISO15693: further optimizations of allocation and free code
* ISO15693: reduce latency on state machine reset
* respond with block security status when option flag is set
* increased maximum memory size to match standard
  added security status handling/load/save
  added SELECT/QUIET handling
  more fine grained allocation routines and checks
  fix memset sizes
* added "Listen NfcV Reader" to sniff traffic from reader to card
* added correct description to delete menu
* also added DSFID/AFI handling and locking
* increase sniff log size
* scale NfcV frequency a bit, add echo mode, fix signal level at the end
* use symbolic modulated/unmodulated GPIO levels
* honor AFI field, decrease verbosity and removed debug code
* refactor defines for less namespace pollution by using NFCV_ prefixes
* correct an oversight that original cards return an generic error when addressing outside block range
* use inverse modulation, increasing readable range significantly
* rework and better document nfc chip initialization
* nfcv code review fixes
* Disable accidentally left on signal debug gpio output
* Improve NFCV Read/Info GUIs. Authored by @xMasterX, committed by @nvx
* Fix crash that occurs when you exit from NFCV emulation and start it again. Authored by @xMasterX, committed by @nvx
* Remove delay from emulation loop. This improves compatibility when the reader is Android.
* Lib: digital signal debug output pin info

Co-authored-by: Tiernan Messmer <tiernan.messmer@gmail.com>
Co-authored-by: MX <10697207+xMasterX@users.noreply.github.com>
Co-authored-by: gornekich <n.gorbadey@gmail.com>
Co-authored-by: あく <alleteam@gmail.com>
This commit is contained in:
g3gg0.de
2023-06-08 07:30:53 +02:00
committed by GitHub
parent 436194e6c7
commit c186d2b0cc
27 changed files with 3737 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/digital_signal/digital_signal.c
+7 -6
View File
@@ -9,7 +9,7 @@
#include <stm32wbxx_ll_tim.h>
/* must be on bank B */
#define DEBUG_OUTPUT gpio_ext_pb3
// For debugging purposes use `--extra-define=DIGITAL_SIGNAL_DEBUG_OUTPUT_PIN=gpio_ext_pb3` fbt option
struct ReloadBuffer {
uint32_t* buffer; /* DMA ringbuffer */
@@ -194,9 +194,9 @@ void digital_signal_prepare_arr(DigitalSignal* signal) {
uint32_t bit_set = internals->gpio->pin;
uint32_t bit_reset = internals->gpio->pin << 16;
#ifdef DEBUG_OUTPUT
bit_set |= DEBUG_OUTPUT.pin;
bit_reset |= DEBUG_OUTPUT.pin << 16;
#ifdef DIGITAL_SIGNAL_DEBUG_OUTPUT_PIN
bit_set |= DIGITAL_SIGNAL_DEBUG_OUTPUT_PIN.pin;
bit_reset |= DIGITAL_SIGNAL_DEBUG_OUTPUT_PIN.pin << 16;
#endif
if(signal->start_level) {
@@ -540,8 +540,9 @@ bool digital_sequence_send(DigitalSequence* sequence) {
struct ReloadBuffer* dma_buffer = sequence->dma_buffer;
furi_hal_gpio_init(sequence->gpio, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
#ifdef DEBUG_OUTPUT
furi_hal_gpio_init(&DEBUG_OUTPUT, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
#ifdef DIGITAL_SIGNAL_DEBUG_OUTPUT_PIN
furi_hal_gpio_init(
&DIGITAL_SIGNAL_DEBUG_OUTPUT_PIN, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
#endif
if(sequence->bake) {
lib/nfc/nfc_device.c
+358 -18
View File
@@ -58,6 +58,8 @@ static void nfc_device_prepare_format_string(NfcDevice* dev, FuriString* format_
furi_string_set(format_string, "Mifare Classic");
} else if(dev->format == NfcDeviceSaveFormatMifareDesfire) {
furi_string_set(format_string, "Mifare DESFire");
} else if(dev->format == NfcDeviceSaveFormatNfcV) {
furi_string_set(format_string, "ISO15693");
} else {
furi_string_set(format_string, "Unknown");
}
@@ -93,6 +95,11 @@ static bool nfc_device_parse_format_string(NfcDevice* dev, FuriString* format_st
dev->dev_data.protocol = NfcDeviceProtocolMifareDesfire;
return true;
}
if(furi_string_start_with_str(format_string, "ISO15693")) {
dev->format = NfcDeviceSaveFormatNfcV;
dev->dev_data.protocol = NfcDeviceProtocolNfcV;
return true;
}
return false;
}
@@ -650,7 +657,327 @@ bool nfc_device_load_mifare_df_data(FlipperFormat* file, NfcDevice* dev) {
return parsed;
}
// Leave for backward compatibility
static bool nfc_device_save_slix_data(FlipperFormat* file, NfcDevice* dev) {
bool saved = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
do {
if(!flipper_format_write_comment_cstr(file, "SLIX specific data")) break;
if(!flipper_format_write_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
saved = true;
} while(false);
return saved;
}
bool nfc_device_load_slix_data(FlipperFormat* file, NfcDevice* dev) {
bool parsed = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
memset(data, 0, sizeof(NfcVSlixData));
do {
if(!flipper_format_read_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
parsed = true;
} while(false);
return parsed;
}
static bool nfc_device_save_slix_s_data(FlipperFormat* file, NfcDevice* dev) {
bool saved = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
do {
if(!flipper_format_write_comment_cstr(file, "SLIX-S specific data")) break;
if(!flipper_format_write_hex(file, "Password Read", data->key_read, sizeof(data->key_read)))
break;
if(!flipper_format_write_hex(
file, "Password Write", data->key_write, sizeof(data->key_write)))
break;
if(!flipper_format_write_hex(
file, "Password Privacy", data->key_privacy, sizeof(data->key_privacy)))
break;
if(!flipper_format_write_hex(
file, "Password Destroy", data->key_destroy, sizeof(data->key_destroy)))
break;
if(!flipper_format_write_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
if(!flipper_format_write_bool(file, "Privacy Mode", &data->privacy, 1)) break;
saved = true;
} while(false);
return saved;
}
bool nfc_device_load_slix_s_data(FlipperFormat* file, NfcDevice* dev) {
bool parsed = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
memset(data, 0, sizeof(NfcVSlixData));
do {
if(!flipper_format_read_hex(file, "Password Read", data->key_read, sizeof(data->key_read)))
break;
if(!flipper_format_read_hex(
file, "Password Write", data->key_write, sizeof(data->key_write)))
break;
if(!flipper_format_read_hex(
file, "Password Privacy", data->key_privacy, sizeof(data->key_privacy)))
break;
if(!flipper_format_read_hex(
file, "Password Destroy", data->key_destroy, sizeof(data->key_destroy)))
break;
if(!flipper_format_read_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
if(!flipper_format_read_bool(file, "Privacy Mode", &data->privacy, 1)) break;
parsed = true;
} while(false);
return parsed;
}
static bool nfc_device_save_slix_l_data(FlipperFormat* file, NfcDevice* dev) {
bool saved = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
do {
if(!flipper_format_write_comment_cstr(file, "SLIX-L specific data")) break;
if(!flipper_format_write_hex(
file, "Password Privacy", data->key_privacy, sizeof(data->key_privacy)))
break;
if(!flipper_format_write_hex(
file, "Password Destroy", data->key_destroy, sizeof(data->key_destroy)))
break;
if(!flipper_format_write_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
if(!flipper_format_write_bool(file, "Privacy Mode", &data->privacy, 1)) break;
saved = true;
} while(false);
return saved;
}
bool nfc_device_load_slix_l_data(FlipperFormat* file, NfcDevice* dev) {
bool parsed = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
memset(data, 0, sizeof(NfcVSlixData));
do {
if(!flipper_format_read_hex(
file, "Password Privacy", data->key_privacy, sizeof(data->key_privacy)))
break;
if(!flipper_format_read_hex(
file, "Password Destroy", data->key_destroy, sizeof(data->key_destroy)))
break;
if(!flipper_format_read_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
if(!flipper_format_read_bool(file, "Privacy Mode", &data->privacy, 1)) break;
parsed = true;
} while(false);
return parsed;
}
static bool nfc_device_save_slix2_data(FlipperFormat* file, NfcDevice* dev) {
bool saved = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
do {
if(!flipper_format_write_comment_cstr(file, "SLIX2 specific data")) break;
if(!flipper_format_write_hex(file, "Password Read", data->key_read, sizeof(data->key_read)))
break;
if(!flipper_format_write_hex(
file, "Password Write", data->key_write, sizeof(data->key_write)))
break;
if(!flipper_format_write_hex(
file, "Password Privacy", data->key_privacy, sizeof(data->key_privacy)))
break;
if(!flipper_format_write_hex(
file, "Password Destroy", data->key_destroy, sizeof(data->key_destroy)))
break;
if(!flipper_format_write_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
if(!flipper_format_write_bool(file, "Privacy Mode", &data->privacy, 1)) break;
saved = true;
} while(false);
return saved;
}
bool nfc_device_load_slix2_data(FlipperFormat* file, NfcDevice* dev) {
bool parsed = false;
NfcVSlixData* data = &dev->dev_data.nfcv_data.sub_data.slix;
memset(data, 0, sizeof(NfcVSlixData));
do {
if(!flipper_format_read_hex(file, "Password Read", data->key_read, sizeof(data->key_read)))
break;
if(!flipper_format_read_hex(
file, "Password Write", data->key_write, sizeof(data->key_write)))
break;
if(!flipper_format_read_hex(
file, "Password Privacy", data->key_privacy, sizeof(data->key_privacy)))
break;
if(!flipper_format_read_hex(
file, "Password Destroy", data->key_destroy, sizeof(data->key_destroy)))
break;
if(!flipper_format_read_hex(file, "Password EAS", data->key_eas, sizeof(data->key_eas)))
break;
if(!flipper_format_read_bool(file, "Privacy Mode", &data->privacy, 1)) break;
parsed = true;
} while(false);
return parsed;
}
static bool nfc_device_save_nfcv_data(FlipperFormat* file, NfcDevice* dev) {
bool saved = false;
NfcVData* data = &dev->dev_data.nfcv_data;
do {
uint32_t temp_uint32 = 0;
uint8_t temp_uint8 = 0;
if(!flipper_format_write_comment_cstr(file, "Data Storage Format Identifier")) break;
if(!flipper_format_write_hex(file, "DSFID", &(data->dsfid), 1)) break;
if(!flipper_format_write_comment_cstr(file, "Application Family Identifier")) break;
if(!flipper_format_write_hex(file, "AFI", &(data->afi), 1)) break;
if(!flipper_format_write_hex(file, "IC Reference", &(data->ic_ref), 1)) break;
temp_uint32 = data->block_num;
if(!flipper_format_write_comment_cstr(file, "Number of memory blocks, usually 0 to 256"))
break;
if(!flipper_format_write_uint32(file, "Block Count", &temp_uint32, 1)) break;
if(!flipper_format_write_comment_cstr(file, "Size of a single memory block, usually 4"))
break;
if(!flipper_format_write_hex(file, "Block Size", &(data->block_size), 1)) break;
if(!flipper_format_write_hex(
file, "Data Content", data->data, data->block_num * data->block_size))
break;
if(!flipper_format_write_comment_cstr(
file, "First byte: DSFID (0x01) / AFI (0x02) lock info, others: block lock info"))
break;
if(!flipper_format_write_hex(
file, "Security Status", data->security_status, 1 + data->block_num))
break;
if(!flipper_format_write_comment_cstr(
file,
"Subtype of this card (0 = ISO15693, 1 = SLIX, 2 = SLIX-S, 3 = SLIX-L, 4 = SLIX2)"))
break;
temp_uint8 = (uint8_t)data->sub_type;
if(!flipper_format_write_hex(file, "Subtype", &temp_uint8, 1)) break;
switch(data->sub_type) {
case NfcVTypePlain:
if(!flipper_format_write_comment_cstr(file, "End of ISO15693 parameters")) break;
saved = true;
break;
case NfcVTypeSlix:
saved = nfc_device_save_slix_data(file, dev);
break;
case NfcVTypeSlixS:
saved = nfc_device_save_slix_s_data(file, dev);
break;
case NfcVTypeSlixL:
saved = nfc_device_save_slix_l_data(file, dev);
break;
case NfcVTypeSlix2:
saved = nfc_device_save_slix2_data(file, dev);
break;
default:
break;
}
} while(false);
return saved;
}
bool nfc_device_load_nfcv_data(FlipperFormat* file, NfcDevice* dev) {
bool parsed = false;
NfcVData* data = &dev->dev_data.nfcv_data;
memset(data, 0x00, sizeof(NfcVData));
do {
uint32_t temp_uint32 = 0;
uint8_t temp_value = 0;
if(!flipper_format_read_hex(file, "DSFID", &(data->dsfid), 1)) break;
if(!flipper_format_read_hex(file, "AFI", &(data->afi), 1)) break;
if(!flipper_format_read_hex(file, "IC Reference", &(data->ic_ref), 1)) break;
if(!flipper_format_read_uint32(file, "Block Count", &temp_uint32, 1)) break;
data->block_num = temp_uint32;
if(!flipper_format_read_hex(file, "Block Size", &(data->block_size), 1)) break;
if(!flipper_format_read_hex(
file, "Data Content", data->data, data->block_num * data->block_size))
break;
/* optional, as added later */
if(flipper_format_key_exist(file, "Security Status")) {
if(!flipper_format_read_hex(
file, "Security Status", data->security_status, 1 + data->block_num))
break;
}
if(!flipper_format_read_hex(file, "Subtype", &temp_value, 1)) break;
data->sub_type = temp_value;
switch(data->sub_type) {
case NfcVTypePlain:
parsed = true;
break;
case NfcVTypeSlix:
parsed = nfc_device_load_slix_data(file, dev);
break;
case NfcVTypeSlixS:
parsed = nfc_device_load_slix_s_data(file, dev);
break;
case NfcVTypeSlixL:
parsed = nfc_device_load_slix_l_data(file, dev);
break;
case NfcVTypeSlix2:
parsed = nfc_device_load_slix2_data(file, dev);
break;
default:
break;
}
} while(false);
return parsed;
}
static bool nfc_device_save_bank_card_data(FlipperFormat* file, NfcDevice* dev) {
bool saved = false;
EmvData* data = &dev->dev_data.emv_data;
uint32_t data_temp = 0;
do {
// Write Bank card specific data
if(!flipper_format_write_comment_cstr(file, "Bank card specific data")) break;
if(!flipper_format_write_hex(file, "AID", data->aid, data->aid_len)) break;
if(!flipper_format_write_string_cstr(file, "Name", data->name)) break;
if(!flipper_format_write_hex(file, "Number", data->number, data->number_len)) break;
if(data->exp_mon) {
uint8_t exp_data[2] = {data->exp_mon, data->exp_year};
if(!flipper_format_write_hex(file, "Exp data", exp_data, sizeof(exp_data))) break;
}
if(data->country_code) {
data_temp = data->country_code;
if(!flipper_format_write_uint32(file, "Country code", &data_temp, 1)) break;
}
if(data->currency_code) {
data_temp = data->currency_code;
if(!flipper_format_write_uint32(file, "Currency code", &data_temp, 1)) break;
}
saved = true;
} while(false);
return saved;
}
bool nfc_device_load_bank_card_data(FlipperFormat* file, NfcDevice* dev) {
bool parsed = false;
EmvData* data = &dev->dev_data.emv_data;
@@ -1069,23 +1396,32 @@ bool nfc_device_save(NfcDevice* dev, const char* dev_name) {
if(!flipper_format_write_header_cstr(file, nfc_file_header, nfc_file_version)) break;
// Write nfc device type
if(!flipper_format_write_comment_cstr(
file, "Nfc device type can be UID, Mifare Ultralight, Mifare Classic"))
file, "Nfc device type can be UID, Mifare Ultralight, Mifare Classic or ISO15693"))
break;
nfc_device_prepare_format_string(dev, temp_str);
if(!flipper_format_write_string(file, "Device type", temp_str)) break;
// Write UID, ATQA, SAK
if(!flipper_format_write_comment_cstr(file, "UID, ATQA and SAK are common for all formats"))
break;
// Write UID
if(!flipper_format_write_comment_cstr(file, "UID is common for all formats")) break;
if(!flipper_format_write_hex(file, "UID", data->uid, data->uid_len)) break;
// Save ATQA in MSB order for correct companion apps display
uint8_t atqa[2] = {data->atqa[1], data->atqa[0]};
if(!flipper_format_write_hex(file, "ATQA", atqa, 2)) break;
if(!flipper_format_write_hex(file, "SAK", &data->sak, 1)) break;
if(dev->format != NfcDeviceSaveFormatNfcV) {
// Write ATQA, SAK
if(!flipper_format_write_comment_cstr(file, "ISO14443 specific fields")) break;
// Save ATQA in MSB order for correct companion apps display
uint8_t atqa[2] = {data->atqa[1], data->atqa[0]};
if(!flipper_format_write_hex(file, "ATQA", atqa, 2)) break;
if(!flipper_format_write_hex(file, "SAK", &data->sak, 1)) break;
}
// Save more data if necessary
if(dev->format == NfcDeviceSaveFormatMifareUl) {
if(!nfc_device_save_mifare_ul_data(file, dev)) break;
} else if(dev->format == NfcDeviceSaveFormatMifareDesfire) {
if(!nfc_device_save_mifare_df_data(file, dev)) break;
} else if(dev->format == NfcDeviceSaveFormatNfcV) {
if(!nfc_device_save_nfcv_data(file, dev)) break;
} else if(dev->format == NfcDeviceSaveFormatBankCard) {
if(!nfc_device_save_bank_card_data(file, dev)) break;
} else if(dev->format == NfcDeviceSaveFormatMifareClassic) {
// Save data
if(!nfc_device_save_mifare_classic_data(file, dev)) break;
@@ -1160,18 +1496,20 @@ static bool nfc_device_load_data(NfcDevice* dev, FuriString* path, bool show_dia
if(!nfc_device_parse_format_string(dev, temp_str)) break;
// Read and parse UID, ATQA and SAK
if(!flipper_format_get_value_count(file, "UID", &data_cnt)) break;
if(!(data_cnt == 4 || data_cnt == 7)) break;
if(!(data_cnt == 4 || data_cnt == 7 || data_cnt == 8)) break;
data->uid_len = data_cnt;
if(!flipper_format_read_hex(file, "UID", data->uid, data->uid_len)) break;
if(version == version_with_lsb_atqa) {
if(!flipper_format_read_hex(file, "ATQA", data->atqa, 2)) break;
} else {
uint8_t atqa[2] = {};
if(!flipper_format_read_hex(file, "ATQA", atqa, 2)) break;
data->atqa[0] = atqa[1];
data->atqa[1] = atqa[0];
if(dev->format != NfcDeviceSaveFormatNfcV) {
if(version == version_with_lsb_atqa) {
if(!flipper_format_read_hex(file, "ATQA", data->atqa, 2)) break;
} else {
uint8_t atqa[2] = {};
if(!flipper_format_read_hex(file, "ATQA", atqa, 2)) break;
data->atqa[0] = atqa[1];
data->atqa[1] = atqa[0];
}
if(!flipper_format_read_hex(file, "SAK", &data->sak, 1)) break;
}
if(!flipper_format_read_hex(file, "SAK", &data->sak, 1)) break;
// Load CUID
uint8_t* cuid_start = data->uid;
if(data->uid_len == 7) {
@@ -1186,6 +1524,8 @@ static bool nfc_device_load_data(NfcDevice* dev, FuriString* path, bool show_dia
if(!nfc_device_load_mifare_classic_data(file, dev)) break;
} else if(dev->format == NfcDeviceSaveFormatMifareDesfire) {
if(!nfc_device_load_mifare_df_data(file, dev)) break;
} else if(dev->format == NfcDeviceSaveFormatNfcV) {
if(!nfc_device_load_nfcv_data(file, dev)) break;
} else if(dev->format == NfcDeviceSaveFormatBankCard) {
if(!nfc_device_load_bank_card_data(file, dev)) break;
}
lib/nfc/nfc_device.h
+4
View File
@@ -11,6 +11,7 @@
#include <lib/nfc/protocols/mifare_ultralight.h>
#include <lib/nfc/protocols/mifare_classic.h>
#include <lib/nfc/protocols/mifare_desfire.h>
#include <lib/nfc/protocols/nfcv.h>
#ifdef __cplusplus
extern "C" {
@@ -31,6 +32,7 @@ typedef enum {
NfcDeviceProtocolMifareUl,
NfcDeviceProtocolMifareClassic,
NfcDeviceProtocolMifareDesfire,
NfcDeviceProtocolNfcV
} NfcProtocol;
typedef enum {
@@ -39,6 +41,7 @@ typedef enum {
NfcDeviceSaveFormatMifareUl,
NfcDeviceSaveFormatMifareClassic,
NfcDeviceSaveFormatMifareDesfire,
NfcDeviceSaveFormatNfcV,
} NfcDeviceSaveFormat;
typedef struct {
@@ -73,6 +76,7 @@ typedef struct {
MfUltralightData mf_ul_data;
MfClassicData mf_classic_data;
MifareDesfireData mf_df_data;
NfcVData nfcv_data;
};
FuriString* parsed_data;
} NfcDeviceData;
lib/nfc/nfc_worker.c
+244 -1
View File
@@ -111,6 +111,14 @@ int32_t nfc_worker_task(void* context) {
nfc_worker_mf_classic_dict_attack(nfc_worker);
} else if(nfc_worker->state == NfcWorkerStateAnalyzeReader) {
nfc_worker_analyze_reader(nfc_worker);
} else if(nfc_worker->state == NfcWorkerStateNfcVEmulate) {
nfc_worker_nfcv_emulate(nfc_worker);
} else if(nfc_worker->state == NfcWorkerStateNfcVSniff) {
nfc_worker_nfcv_sniff(nfc_worker);
} else if(nfc_worker->state == NfcWorkerStateNfcVUnlock) {
nfc_worker_nfcv_unlock(nfc_worker);
} else if(nfc_worker->state == NfcWorkerStateNfcVUnlockAndSave) {
nfc_worker_nfcv_unlock(nfc_worker);
}
furi_hal_nfc_sleep();
nfc_worker_change_state(nfc_worker, NfcWorkerStateReady);
@@ -118,6 +126,236 @@ int32_t nfc_worker_task(void* context) {
return 0;
}
static bool nfc_worker_read_nfcv(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
bool read_success = false;
NfcVReader reader = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
NfcVData* nfcv_data = &nfc_worker->dev_data->nfcv_data;
furi_hal_nfc_sleep();
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_prepare_tx_rx(nfc_worker->reader_analyzer, tx_rx, false);
reader_analyzer_start(nfc_worker->reader_analyzer, ReaderAnalyzerModeDebugLog);
}
do {
if(!furi_hal_nfc_detect(&nfc_worker->dev_data->nfc_data, 200)) break;
if(!nfcv_read_card(&reader, nfc_data, nfcv_data)) break;
read_success = true;
} while(false);
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_stop(nfc_worker->reader_analyzer);
}
return read_success;
}
void nfc_worker_nfcv_emulate(NfcWorker* nfc_worker) {
FuriHalNfcTxRxContext tx_rx = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
NfcVData* nfcv_data = &nfc_worker->dev_data->nfcv_data;
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_prepare_tx_rx(nfc_worker->reader_analyzer, &tx_rx, true);
reader_analyzer_start(nfc_worker->reader_analyzer, ReaderAnalyzerModeDebugLog);
}
nfcv_emu_init(nfc_data, nfcv_data);
while(nfc_worker->state == NfcWorkerStateNfcVEmulate) {
if(nfcv_emu_loop(&tx_rx, nfc_data, nfcv_data, 100)) {
if(nfc_worker->callback) {
nfc_worker->callback(NfcWorkerEventNfcVCommandExecuted, nfc_worker->context);
if(nfcv_data->modified) {
nfc_worker->callback(NfcWorkerEventNfcVContentChanged, nfc_worker->context);
nfcv_data->modified = false;
}
}
}
}
nfcv_emu_deinit(nfcv_data);
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_stop(nfc_worker->reader_analyzer);
}
}
void nfc_worker_nfcv_sniff(NfcWorker* nfc_worker) {
FuriHalNfcTxRxContext tx_rx = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
NfcVData* nfcv_data = &nfc_worker->dev_data->nfcv_data;
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_prepare_tx_rx(nfc_worker->reader_analyzer, &tx_rx, true);
reader_analyzer_start(nfc_worker->reader_analyzer, ReaderAnalyzerModeDebugLog);
}
nfcv_data->sub_type = NfcVTypeSniff;
nfcv_emu_init(nfc_data, nfcv_data);
while(nfc_worker->state == NfcWorkerStateNfcVSniff) {
if(nfcv_emu_loop(&tx_rx, nfc_data, nfcv_data, 100)) {
if(nfc_worker->callback) {
nfc_worker->callback(NfcWorkerEventNfcVCommandExecuted, nfc_worker->context);
}
}
}
nfcv_emu_deinit(nfcv_data);
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_stop(nfc_worker->reader_analyzer);
}
}
void nfc_worker_nfcv_unlock(NfcWorker* nfc_worker) {
furi_assert(nfc_worker);
furi_assert(nfc_worker->callback);
NfcVData* nfcv_data = &nfc_worker->dev_data->nfcv_data;
FuriHalNfcTxRxContext tx_rx = {};
uint8_t* key_data = nfcv_data->sub_data.slix.key_privacy;
uint32_t key = 0;
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_prepare_tx_rx(nfc_worker->reader_analyzer, &tx_rx, true);
reader_analyzer_start(nfc_worker->reader_analyzer, ReaderAnalyzerModeDebugLog);
}
furi_hal_nfc_sleep();
while((nfc_worker->state == NfcWorkerStateNfcVUnlock) ||
(nfc_worker->state == NfcWorkerStateNfcVUnlockAndSave)) {
furi_hal_nfc_exit_sleep();
furi_hal_nfc_ll_txrx_on();
furi_hal_nfc_ll_poll();
if(furi_hal_nfc_ll_set_mode(
FuriHalNfcModePollNfcv, FuriHalNfcBitrate26p48, FuriHalNfcBitrate26p48) !=
FuriHalNfcReturnOk) {
break;
}
furi_hal_nfc_ll_set_fdt_listen(FURI_HAL_NFC_LL_FDT_LISTEN_NFCV_POLLER);
furi_hal_nfc_ll_set_fdt_poll(FURI_HAL_NFC_LL_FDT_POLL_NFCV_POLLER);
furi_hal_nfc_ll_set_error_handling(FuriHalNfcErrorHandlingNfc);
furi_hal_nfc_ll_set_guard_time(FURI_HAL_NFC_LL_GT_NFCV);
FURI_LOG_D(TAG, "Detect presence");
ReturnCode ret = slix_get_random(nfcv_data);
if(ret == ERR_NONE) {
/* there is some chip, responding with a RAND */
nfc_worker->dev_data->protocol = NfcDeviceProtocolNfcV;
FURI_LOG_D(TAG, " Chip detected. In privacy?");
ret = nfcv_inventory(NULL);
if(ret == ERR_NONE) {
/* chip is also visible, so no action required, just save */
if(nfc_worker->state == NfcWorkerStateNfcVUnlockAndSave) {
NfcVReader reader = {};
if(!nfcv_read_card(&reader, &nfc_worker->dev_data->nfc_data, nfcv_data)) {
FURI_LOG_D(TAG, " => failed, wait for chip to disappear.");
snprintf(nfcv_data->error, sizeof(nfcv_data->error), "Read card\nfailed");
nfc_worker->callback(NfcWorkerEventWrongCardDetected, nfc_worker->context);
} else {
FURI_LOG_D(TAG, " => success, wait for chip to disappear.");
nfc_worker->callback(NfcWorkerEventCardDetected, nfc_worker->context);
}
} else {
FURI_LOG_D(TAG, " => success, wait for chip to disappear.");
nfc_worker->callback(NfcWorkerEventCardDetected, nfc_worker->context);
}
while(slix_get_random(NULL) == ERR_NONE) {
furi_delay_ms(100);
}
FURI_LOG_D(TAG, " => chip is already visible, wait for chip to disappear.\r\n");
nfc_worker->callback(NfcWorkerEventAborted, nfc_worker->context);
while(slix_get_random(NULL) == ERR_NONE) {
furi_delay_ms(100);
}
key_data[0] = 0;
key_data[1] = 0;
key_data[2] = 0;
key_data[3] = 0;
} else {
/* chip is invisible, try to unlock */
FURI_LOG_D(TAG, " chip is invisible, unlocking");
if(nfcv_data->auth_method == NfcVAuthMethodManual) {
key |= key_data[0] << 24;
key |= key_data[1] << 16;
key |= key_data[2] << 8;
key |= key_data[3] << 0;
ret = slix_unlock(nfcv_data, 4);
} else {
key = 0x7FFD6E5B;
key_data[0] = key >> 24;
key_data[1] = key >> 16;
key_data[2] = key >> 8;
key_data[3] = key >> 0;
ret = slix_unlock(nfcv_data, 4);
if(ret != ERR_NONE) {
/* main key failed, trying second one */
FURI_LOG_D(TAG, " trying second key after resetting");
/* reset chip */
furi_hal_nfc_ll_txrx_off();
furi_delay_ms(20);
furi_hal_nfc_ll_txrx_on();
if(slix_get_random(nfcv_data) != ERR_NONE) {
FURI_LOG_D(TAG, " reset failed");
}
key = 0x0F0F0F0F;
key_data[0] = key >> 24;
key_data[1] = key >> 16;
key_data[2] = key >> 8;
key_data[3] = key >> 0;
ret = slix_unlock(nfcv_data, 4);
}
}
if(ret != ERR_NONE) {
/* unlock failed */
FURI_LOG_D(TAG, " => failed, wait for chip to disappear.");
snprintf(
nfcv_data->error, sizeof(nfcv_data->error), "Passwords not\naccepted");
nfc_worker->callback(NfcWorkerEventWrongCardDetected, nfc_worker->context);
/* reset chip */
furi_hal_nfc_ll_txrx_off();
furi_delay_ms(20);
furi_hal_nfc_ll_txrx_on();
/* wait for disappearing */
while(slix_get_random(NULL) == ERR_NONE) {
furi_delay_ms(100);
}
}
}
} else {
nfc_worker->callback(NfcWorkerEventNoCardDetected, nfc_worker->context);
}
furi_hal_nfc_ll_txrx_off();
furi_hal_nfc_sleep();
furi_delay_ms(100);
}
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_stop(nfc_worker->reader_analyzer);
}
}
static bool nfc_worker_read_mf_ultralight(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
bool read_success = false;
MfUltralightReader reader = {};
@@ -317,7 +555,12 @@ void nfc_worker_read(NfcWorker* nfc_worker) {
event = NfcWorkerEventReadUidNfcF;
break;
} else if(nfc_data->type == FuriHalNfcTypeV) {
event = NfcWorkerEventReadUidNfcV;
FURI_LOG_I(TAG, "NfcV detected");
nfc_worker->dev_data->protocol = NfcDeviceProtocolNfcV;
if(nfc_worker_read_nfcv(nfc_worker, &tx_rx)) {
FURI_LOG_I(TAG, "nfc_worker_read_nfcv success");
}
event = NfcWorkerEventReadNfcV;
break;
}
} else {
lib/nfc/nfc_worker.h
+11
View File
@@ -18,6 +18,10 @@ typedef enum {
NfcWorkerStateReadMfUltralightReadAuth,
NfcWorkerStateMfClassicDictAttack,
NfcWorkerStateAnalyzeReader,
NfcWorkerStateNfcVEmulate,
NfcWorkerStateNfcVUnlock,
NfcWorkerStateNfcVUnlockAndSave,
NfcWorkerStateNfcVSniff,
// Debug
NfcWorkerStateEmulateApdu,
NfcWorkerStateField,
@@ -39,6 +43,7 @@ typedef enum {
NfcWorkerEventReadMfClassicDone,
NfcWorkerEventReadMfClassicLoadKeyCache,
NfcWorkerEventReadMfClassicDictAttackRequired,
NfcWorkerEventReadNfcV,
// Nfc worker common events
NfcWorkerEventSuccess,
@@ -69,6 +74,9 @@ typedef enum {
// Mifare Ultralight events
NfcWorkerEventMfUltralightPassKey, // NFC worker requesting manual key
NfcWorkerEventMfUltralightPwdAuth, // Reader sent auth command
NfcWorkerEventNfcVPassKey, // NFC worker requesting manual key
NfcWorkerEventNfcVCommandExecuted,
NfcWorkerEventNfcVContentChanged,
} NfcWorkerEvent;
typedef bool (*NfcWorkerCallback)(NfcWorkerEvent event, void* context);
@@ -87,3 +95,6 @@ void nfc_worker_start(
void* context);
void nfc_worker_stop(NfcWorker* nfc_worker);
void nfc_worker_nfcv_unlock(NfcWorker* nfc_worker);
void nfc_worker_nfcv_emulate(NfcWorker* nfc_worker);
void nfc_worker_nfcv_sniff(NfcWorker* nfc_worker);
lib/nfc/nfc_worker_i.h
+2
View File
@@ -11,6 +11,8 @@
#include <lib/nfc/protocols/mifare_classic.h>
#include <lib/nfc/protocols/mifare_desfire.h>
#include <lib/nfc/protocols/nfca.h>
#include <lib/nfc/protocols/nfcv.h>
#include <lib/nfc/protocols/slix.h>
#include <lib/nfc/helpers/reader_analyzer.h>
struct NfcWorker {
lib/nfc/protocols/nfcv.c
+1398
View File
File diff suppressed because it is too large Load Diff
lib/nfc/protocols/nfcv.h
+291
View File
@@ -0,0 +1,291 @@
#pragma once
#include <stdint.h>
#include <stdbool.h>
#include <lib/digital_signal/digital_signal.h>
#include <lib/pulse_reader/pulse_reader.h>
#include "nfc_util.h"
#include <furi_hal_nfc.h>
#ifdef __cplusplus
extern "C" {
#endif
/* true: modulating releases load, false: modulating adds load resistor to field coil */
#define NFCV_LOAD_MODULATION_POLARITY (false)
#define NFCV_FC (13560000.0f) /* MHz */
#define NFCV_RESP_SUBC1_PULSE_32 (1.0f / (NFCV_FC / 32) / 2.0f) /* 1.1799 µs */
#define NFCV_RESP_SUBC1_UNMOD_256 (256.0f / NFCV_FC) /* 18.8791 µs */
#define NFCV_PULSE_DURATION_NS (128.0f * 1000000000.0f / NFCV_FC)
/* ISO/IEC 15693-3:2019(E) 10.4.12: maximum number of blocks is defined as 256 */
#define NFCV_BLOCKS_MAX 256
/* ISO/IEC 15693-3:2019(E) 10.4.12: maximum size of blocks is defined as 32 */
#define NFCV_BLOCKSIZE_MAX 32
/* the resulting memory size a card can have */
#define NFCV_MEMSIZE_MAX (NFCV_BLOCKS_MAX * NFCV_BLOCKSIZE_MAX)
/* ISO/IEC 15693-3:2019(E) 7.1b: standard allows up to 8192, the maxium frame length that we are expected to receive/send is less */
#define NFCV_FRAMESIZE_MAX (1 + NFCV_MEMSIZE_MAX + NFCV_BLOCKS_MAX)
/* maximum string length for log messages */
#define NFCV_LOG_STR_LEN 128
/* maximum of pulses to be buffered by pulse reader */
#define NFCV_PULSE_BUFFER 512
//#define NFCV_DIAGNOSTIC_DUMPS
//#define NFCV_DIAGNOSTIC_DUMP_SIZE 256
//#define NFCV_VERBOSE
/* helpers to calculate the send time based on DWT->CYCCNT */
#define NFCV_FDT_USEC(usec) ((usec)*64)
#define NFCV_FDT_FC(ticks) ((ticks)*6400 / 1356)
/* state machine when receiving frame bits */
#define NFCV_FRAME_STATE_SOF1 0
#define NFCV_FRAME_STATE_SOF2 1
#define NFCV_FRAME_STATE_CODING_4 2
#define NFCV_FRAME_STATE_CODING_256 3
#define NFCV_FRAME_STATE_EOF 4
#define NFCV_FRAME_STATE_RESET 5
/* sequences for every section of a frame */
#define NFCV_SIG_SOF 0
#define NFCV_SIG_BIT0 1
#define NFCV_SIG_BIT1 2
#define NFCV_SIG_EOF 3
#define NFCV_SIG_LOW_SOF 4
#define NFCV_SIG_LOW_BIT0 5
#define NFCV_SIG_LOW_BIT1 6
#define NFCV_SIG_LOW_EOF 7
/* various constants */
#define NFCV_COMMAND_RETRIES 5
#define NFCV_UID_LENGTH 8
/* ISO15693 protocol flags */
typedef enum {
/* ISO15693 protocol flags when INVENTORY is NOT set */
NFCV_REQ_FLAG_SUB_CARRIER = (1 << 0),
NFCV_REQ_FLAG_DATA_RATE = (1 << 1),
NFCV_REQ_FLAG_INVENTORY = (1 << 2),
NFCV_REQ_FLAG_PROTOCOL_EXT = (1 << 3),
NFCV_REQ_FLAG_SELECT = (1 << 4),
NFCV_REQ_FLAG_ADDRESS = (1 << 5),
NFCV_REQ_FLAG_OPTION = (1 << 6),
/* ISO15693 protocol flags when INVENTORY flag is set */
NFCV_REQ_FLAG_AFI = (1 << 4),
NFCV_REQ_FLAG_NB_SLOTS = (1 << 5)
} NfcVRequestFlags;
/* ISO15693 protocol flags */
typedef enum {
NFCV_RES_FLAG_ERROR = (1 << 0),
NFCV_RES_FLAG_VALIDITY = (1 << 1),
NFCV_RES_FLAG_FINAL = (1 << 2),
NFCV_RES_FLAG_PROTOCOL_EXT = (1 << 3),
NFCV_RES_FLAG_SEC_LEN1 = (1 << 4),
NFCV_RES_FLAG_SEC_LEN2 = (1 << 5),
NFCV_RES_FLAG_WAIT_EXT = (1 << 6),
} NfcVRsponseFlags;
/* flags for SYSINFO response */
typedef enum {
NFCV_SYSINFO_FLAG_DSFID = (1 << 0),
NFCV_SYSINFO_FLAG_AFI = (1 << 1),
NFCV_SYSINFO_FLAG_MEMSIZE = (1 << 2),
NFCV_SYSINFO_FLAG_ICREF = (1 << 3)
} NfcVSysinfoFlags;
/* ISO15693 command codes */
typedef enum {
/* mandatory command codes */
NFCV_CMD_INVENTORY = 0x01,
NFCV_CMD_STAY_QUIET = 0x02,
/* optional command codes */
NFCV_CMD_READ_BLOCK = 0x20,
NFCV_CMD_WRITE_BLOCK = 0x21,
NFCV_CMD_LOCK_BLOCK = 0x22,
NFCV_CMD_READ_MULTI_BLOCK = 0x23,
NFCV_CMD_WRITE_MULTI_BLOCK = 0x24,
NFCV_CMD_SELECT = 0x25,
NFCV_CMD_RESET_TO_READY = 0x26,
NFCV_CMD_WRITE_AFI = 0x27,
NFCV_CMD_LOCK_AFI = 0x28,
NFCV_CMD_WRITE_DSFID = 0x29,
NFCV_CMD_LOCK_DSFID = 0x2A,
NFCV_CMD_GET_SYSTEM_INFO = 0x2B,
NFCV_CMD_READ_MULTI_SECSTATUS = 0x2C,
/* advanced command codes */
NFCV_CMD_ADVANCED = 0xA0,
/* flipper zero custom command codes */
NFCV_CMD_CUST_ECHO_MODE = 0xDE,
NFCV_CMD_CUST_ECHO_DATA = 0xDF
} NfcVCommands;
/* ISO15693 Response error codes */
typedef enum {
NFCV_NOERROR = 0x00,
NFCV_ERROR_CMD_NOT_SUP = 0x01, // Command not supported
NFCV_ERROR_CMD_NOT_REC = 0x02, // Command not recognized (eg. parameter error)
NFCV_ERROR_CMD_OPTION = 0x03, // Command option not supported
NFCV_ERROR_GENERIC = 0x0F, // No additional Info about this error
NFCV_ERROR_BLOCK_UNAVAILABLE = 0x10,
NFCV_ERROR_BLOCK_LOCKED_ALREADY = 0x11, // cannot lock again
NFCV_ERROR_BLOCK_LOCKED = 0x12, // cannot be changed
NFCV_ERROR_BLOCK_WRITE = 0x13, // Writing was unsuccessful
NFCV_ERROR_BLOCL_WRITELOCK = 0x14 // Locking was unsuccessful
} NfcVErrorcodes;
typedef enum {
NfcVLockBitDsfid = 1,
NfcVLockBitAfi = 2,
} NfcVLockBits;
typedef enum {
NfcVAuthMethodManual,
NfcVAuthMethodTonieBox,
} NfcVAuthMethod;
typedef enum {
NfcVTypePlain = 0,
NfcVTypeSlix = 1,
NfcVTypeSlixS = 2,
NfcVTypeSlixL = 3,
NfcVTypeSlix2 = 4,
NfcVTypeSniff = 255,
} NfcVSubtype;
typedef enum {
NfcVSendFlagsNormal = 0,
NfcVSendFlagsSof = 1 << 0,
NfcVSendFlagsCrc = 1 << 1,
NfcVSendFlagsEof = 1 << 2,
NfcVSendFlagsOneSubcarrier = 0,
NfcVSendFlagsTwoSubcarrier = 1 << 3,
NfcVSendFlagsLowRate = 0,
NfcVSendFlagsHighRate = 1 << 4
} NfcVSendFlags;
typedef struct {
uint8_t key_read[4];
uint8_t key_write[4];
uint8_t key_privacy[4];
uint8_t key_destroy[4];
uint8_t key_eas[4];
uint8_t rand[2];
bool privacy;
} NfcVSlixData;
typedef union {
NfcVSlixData slix;
} NfcVSubtypeData;
typedef struct {
DigitalSignal* nfcv_resp_sof;
DigitalSignal* nfcv_resp_one;
DigitalSignal* nfcv_resp_zero;
DigitalSignal* nfcv_resp_eof;
} NfcVEmuAirSignals;
typedef struct {
PulseReader* reader_signal;
DigitalSignal* nfcv_resp_pulse; /* pulse length, fc/32 */
DigitalSignal* nfcv_resp_half_pulse; /* half pulse length, fc/32 */
DigitalSignal* nfcv_resp_unmod; /* unmodulated length 256/fc */
NfcVEmuAirSignals signals_high;
NfcVEmuAirSignals signals_low;
DigitalSequence* nfcv_signal;
} NfcVEmuAir;
typedef void (*NfcVEmuProtocolHandler)(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
void* nfcv_data);
typedef bool (*NfcVEmuProtocolFilter)(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
void* nfcv_data);
/* the default ISO15693 handler context */
typedef struct {
uint8_t flags; /* ISO15693-3 flags of the header as specified */
uint8_t command; /* ISO15693-3 command at offset 1 as specified */
bool selected; /* ISO15693-3 flags: selected frame */
bool addressed; /* ISO15693-3 flags: addressed frame */
bool advanced; /* ISO15693-3 command: advanced command */
uint8_t address_offset; /* ISO15693-3 offset of the address in frame, if addressed is set */
uint8_t payload_offset; /* ISO15693-3 offset of the payload in frame */
uint8_t response_buffer[NFCV_FRAMESIZE_MAX]; /* pre-allocated response buffer */
NfcVSendFlags response_flags; /* flags to use when sending response */
uint32_t send_time; /* timestamp when to send the response */
NfcVEmuProtocolFilter emu_protocol_filter;
} NfcVEmuProtocolCtx;
typedef struct {
/* common ISO15693 fields, being specified in ISO15693-3 */
uint8_t dsfid;
uint8_t afi;
uint8_t ic_ref;
uint16_t block_num;
uint8_t block_size;
uint8_t data[NFCV_MEMSIZE_MAX];
uint8_t security_status[1 + NFCV_BLOCKS_MAX];
bool selected;
bool quiet;
bool modified;
bool ready;
bool echo_mode;
/* specfic variant infos */
NfcVSubtype sub_type;
NfcVSubtypeData sub_data;
NfcVAuthMethod auth_method;
/* precalced air level data */
NfcVEmuAir emu_air;
uint8_t* frame; /* [NFCV_FRAMESIZE_MAX] ISO15693-2 incoming raw data from air layer */
uint8_t frame_length; /* ISO15693-2 length of incoming data */
uint32_t eof_timestamp; /* ISO15693-2 EOF timestamp, read from DWT->CYCCNT */
/* handler for the protocol layer as specified in ISO15693-3 */
NfcVEmuProtocolHandler emu_protocol_handler;
void* emu_protocol_ctx;
/* runtime data */
char last_command[NFCV_LOG_STR_LEN];
char error[NFCV_LOG_STR_LEN];
} NfcVData;
typedef struct {
uint16_t blocks_to_read;
int16_t blocks_read;
} NfcVReader;
ReturnCode nfcv_read_blocks(NfcVReader* reader, NfcVData* data);
ReturnCode nfcv_read_sysinfo(FuriHalNfcDevData* nfc_data, NfcVData* data);
ReturnCode nfcv_inventory(uint8_t* uid);
bool nfcv_read_card(NfcVReader* reader, FuriHalNfcDevData* nfc_data, NfcVData* data);
void nfcv_emu_init(FuriHalNfcDevData* nfc_data, NfcVData* nfcv_data);
void nfcv_emu_deinit(NfcVData* nfcv_data);
bool nfcv_emu_loop(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
NfcVData* nfcv_data,
uint32_t timeout_ms);
void nfcv_emu_send(
FuriHalNfcTxRxContext* tx_rx,
NfcVData* nfcv,
uint8_t* data,
uint8_t length,
NfcVSendFlags flags,
uint32_t send_time);
#ifdef __cplusplus
}
#endif
lib/nfc/protocols/slix.c
+412
View File
@@ -0,0 +1,412 @@
#include <limits.h>
#include "nfcv.h"
#include "slix.h"
#include "nfc_util.h"
#include <furi.h>
#include "furi_hal_nfc.h"
#include <furi_hal_random.h>
#define TAG "SLIX"
static uint32_t slix_read_be(uint8_t* data, uint32_t length) {
uint32_t value = 0;
for(uint32_t pos = 0; pos < length; pos++) {
value <<= 8;
value |= data[pos];
}
return value;
}
uint8_t slix_get_ti(FuriHalNfcDevData* nfc_data) {
return (nfc_data->uid[3] >> 3) & 3;
}
bool slix_check_card_type(FuriHalNfcDevData* nfc_data) {
if((nfc_data->uid[0] == 0xE0) && (nfc_data->uid[1] == 0x04) && (nfc_data->uid[2] == 0x01) &&
slix_get_ti(nfc_data) == 2) {
return true;
}
return false;
}
bool slix2_check_card_type(FuriHalNfcDevData* nfc_data) {
if((nfc_data->uid[0] == 0xE0) && (nfc_data->uid[1] == 0x04) && (nfc_data->uid[2] == 0x01) &&
slix_get_ti(nfc_data) == 1) {
return true;
}
return false;
}
bool slix_s_check_card_type(FuriHalNfcDevData* nfc_data) {
if((nfc_data->uid[0] == 0xE0) && (nfc_data->uid[1] == 0x04) && (nfc_data->uid[2] == 0x02)) {
return true;
}
return false;
}
bool slix_l_check_card_type(FuriHalNfcDevData* nfc_data) {
if((nfc_data->uid[0] == 0xE0) && (nfc_data->uid[1] == 0x04) && (nfc_data->uid[2] == 0x03)) {
return true;
}
return false;
}
ReturnCode slix_get_random(NfcVData* data) {
uint16_t received = 0;
uint8_t rxBuf[32];
ReturnCode ret = rfalNfcvPollerTransceiveReq(
NFCV_CMD_NXP_GET_RANDOM_NUMBER,
RFAL_NFCV_REQ_FLAG_DEFAULT,
NFCV_MANUFACTURER_NXP,
NULL,
NULL,
0,
rxBuf,
sizeof(rxBuf),
&received);
if(ret == ERR_NONE) {
if(received != 3) {
return ERR_PROTO;
}
if(data != NULL) {
data->sub_data.slix.rand[0] = rxBuf[2];
data->sub_data.slix.rand[1] = rxBuf[1];
}
}
return ret;
}
ReturnCode slix_unlock(NfcVData* data, uint32_t password_id) {
furi_assert(rand);
uint16_t received = 0;
uint8_t rxBuf[32];
uint8_t cmd_set_pass[] = {
password_id,
data->sub_data.slix.rand[1],
data->sub_data.slix.rand[0],
data->sub_data.slix.rand[1],
data->sub_data.slix.rand[0]};
uint8_t* password = NULL;
switch(password_id) {
case SLIX_PASS_READ:
password = data->sub_data.slix.key_read;
break;
case SLIX_PASS_WRITE:
password = data->sub_data.slix.key_write;
break;
case SLIX_PASS_PRIVACY:
password = data->sub_data.slix.key_privacy;
break;
case SLIX_PASS_DESTROY:
password = data->sub_data.slix.key_destroy;
break;
case SLIX_PASS_EASAFI:
password = data->sub_data.slix.key_eas;
break;
default:
break;
}
if(!password) {
return ERR_NOTSUPP;
}
for(int pos = 0; pos < 4; pos++) {
cmd_set_pass[1 + pos] ^= password[3 - pos];
}
ReturnCode ret = rfalNfcvPollerTransceiveReq(
NFCV_CMD_NXP_SET_PASSWORD,
RFAL_NFCV_REQ_FLAG_DATA_RATE,
NFCV_MANUFACTURER_NXP,
NULL,
cmd_set_pass,
sizeof(cmd_set_pass),
rxBuf,
sizeof(rxBuf),
&received);
return ret;
}
bool slix_generic_protocol_filter(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
void* nfcv_data_in,
uint32_t password_supported) {
furi_assert(tx_rx);
furi_assert(nfc_data);
furi_assert(nfcv_data_in);
NfcVData* nfcv_data = (NfcVData*)nfcv_data_in;
NfcVEmuProtocolCtx* ctx = nfcv_data->emu_protocol_ctx;
NfcVSlixData* slix = &nfcv_data->sub_data.slix;
if(slix->privacy && ctx->command != NFCV_CMD_NXP_GET_RANDOM_NUMBER &&
ctx->command != NFCV_CMD_NXP_SET_PASSWORD) {
snprintf(
nfcv_data->last_command,
sizeof(nfcv_data->last_command),
"command 0x%02X ignored, privacy mode",
ctx->command);
FURI_LOG_D(TAG, "%s", nfcv_data->last_command);
return true;
}
bool handled = false;
switch(ctx->command) {
case NFCV_CMD_NXP_GET_RANDOM_NUMBER: {
slix->rand[0] = furi_hal_random_get();
slix->rand[1] = furi_hal_random_get();
ctx->response_buffer[0] = NFCV_NOERROR;
ctx->response_buffer[1] = slix->rand[1];
ctx->response_buffer[2] = slix->rand[0];
nfcv_emu_send(
tx_rx, nfcv_data, ctx->response_buffer, 3, ctx->response_flags, ctx->send_time);
snprintf(
nfcv_data->last_command,
sizeof(nfcv_data->last_command),
"GET_RANDOM_NUMBER -> 0x%02X%02X",
slix->rand[0],
slix->rand[1]);
handled = true;
break;
}
case NFCV_CMD_NXP_SET_PASSWORD: {
uint8_t password_id = nfcv_data->frame[ctx->payload_offset];
if(!(password_id & password_supported)) {
break;
}
uint8_t* password_xored = &nfcv_data->frame[ctx->payload_offset + 1];
uint8_t* rand = slix->rand;
uint8_t* password = NULL;
uint8_t password_rcv[4];
switch(password_id) {
case SLIX_PASS_READ:
password = slix->key_read;
break;
case SLIX_PASS_WRITE:
password = slix->key_write;
break;
case SLIX_PASS_PRIVACY:
password = slix->key_privacy;
break;
case SLIX_PASS_DESTROY:
password = slix->key_destroy;
break;
case SLIX_PASS_EASAFI:
password = slix->key_eas;
break;
default:
break;
}
if(!password) {
break;
}
for(int pos = 0; pos < 4; pos++) {
password_rcv[pos] = password_xored[3 - pos] ^ rand[pos % 2];
}
uint32_t pass_expect = slix_read_be(password, 4);
uint32_t pass_received = slix_read_be(password_rcv, 4);
/* if the password is all-zeroes, just accept any password*/
if(!pass_expect || pass_expect == pass_received) {
switch(password_id) {
case SLIX_PASS_READ:
break;
case SLIX_PASS_WRITE:
break;
case SLIX_PASS_PRIVACY:
slix->privacy = false;
nfcv_data->modified = true;
break;
case SLIX_PASS_DESTROY:
FURI_LOG_D(TAG, "Pooof! Got destroyed");
break;
case SLIX_PASS_EASAFI:
break;
default:
break;
}
ctx->response_buffer[0] = NFCV_NOERROR;
nfcv_emu_send(
tx_rx, nfcv_data, ctx->response_buffer, 1, ctx->response_flags, ctx->send_time);
snprintf(
nfcv_data->last_command,
sizeof(nfcv_data->last_command),
"SET_PASSWORD #%02X 0x%08lX OK",
password_id,
pass_received);
} else {
snprintf(
nfcv_data->last_command,
sizeof(nfcv_data->last_command),
"SET_PASSWORD #%02X 0x%08lX/%08lX FAIL",
password_id,
pass_received,
pass_expect);
}
handled = true;
break;
}
case NFCV_CMD_NXP_ENABLE_PRIVACY: {
ctx->response_buffer[0] = NFCV_NOERROR;
nfcv_emu_send(
tx_rx, nfcv_data, ctx->response_buffer, 1, ctx->response_flags, ctx->send_time);
snprintf(
nfcv_data->last_command,
sizeof(nfcv_data->last_command),
"NFCV_CMD_NXP_ENABLE_PRIVACY");
slix->privacy = true;
handled = true;
break;
}
}
return handled;
}
bool slix_l_protocol_filter(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
void* nfcv_data_in) {
furi_assert(tx_rx);
furi_assert(nfc_data);
furi_assert(nfcv_data_in);
bool handled = false;
/* many SLIX share some of the functions, place that in a generic handler */
if(slix_generic_protocol_filter(
tx_rx,
nfc_data,
nfcv_data_in,
SLIX_PASS_PRIVACY | SLIX_PASS_DESTROY | SLIX_PASS_EASAFI)) {
return true;
}
return handled;
}
void slix_l_prepare(NfcVData* nfcv_data) {
FURI_LOG_D(
TAG, " Privacy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_privacy, 4));
FURI_LOG_D(
TAG, " Destroy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_destroy, 4));
FURI_LOG_D(TAG, " EAS pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_eas, 4));
FURI_LOG_D(TAG, " Privacy mode: %s", nfcv_data->sub_data.slix.privacy ? "ON" : "OFF");
NfcVEmuProtocolCtx* ctx = nfcv_data->emu_protocol_ctx;
ctx->emu_protocol_filter = &slix_l_protocol_filter;
}
bool slix_s_protocol_filter(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
void* nfcv_data_in) {
furi_assert(tx_rx);
furi_assert(nfc_data);
furi_assert(nfcv_data_in);
bool handled = false;
/* many SLIX share some of the functions, place that in a generic handler */
if(slix_generic_protocol_filter(tx_rx, nfc_data, nfcv_data_in, SLIX_PASS_ALL)) {
return true;
}
return handled;
}
void slix_s_prepare(NfcVData* nfcv_data) {
FURI_LOG_D(
TAG, " Privacy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_privacy, 4));
FURI_LOG_D(
TAG, " Destroy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_destroy, 4));
FURI_LOG_D(TAG, " EAS pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_eas, 4));
FURI_LOG_D(TAG, " Privacy mode: %s", nfcv_data->sub_data.slix.privacy ? "ON" : "OFF");
NfcVEmuProtocolCtx* ctx = nfcv_data->emu_protocol_ctx;
ctx->emu_protocol_filter = &slix_s_protocol_filter;
}
bool slix_protocol_filter(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
void* nfcv_data_in) {
furi_assert(tx_rx);
furi_assert(nfc_data);
furi_assert(nfcv_data_in);
bool handled = false;
/* many SLIX share some of the functions, place that in a generic handler */
if(slix_generic_protocol_filter(tx_rx, nfc_data, nfcv_data_in, SLIX_PASS_EASAFI)) {
return true;
}
return handled;
}
void slix_prepare(NfcVData* nfcv_data) {
FURI_LOG_D(
TAG, " Privacy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_privacy, 4));
FURI_LOG_D(
TAG, " Destroy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_destroy, 4));
FURI_LOG_D(TAG, " EAS pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_eas, 4));
FURI_LOG_D(TAG, " Privacy mode: %s", nfcv_data->sub_data.slix.privacy ? "ON" : "OFF");
NfcVEmuProtocolCtx* ctx = nfcv_data->emu_protocol_ctx;
ctx->emu_protocol_filter = &slix_protocol_filter;
}
bool slix2_protocol_filter(
FuriHalNfcTxRxContext* tx_rx,
FuriHalNfcDevData* nfc_data,
void* nfcv_data_in) {
furi_assert(tx_rx);
furi_assert(nfc_data);
furi_assert(nfcv_data_in);
bool handled = false;
/* many SLIX share some of the functions, place that in a generic handler */
if(slix_generic_protocol_filter(tx_rx, nfc_data, nfcv_data_in, SLIX_PASS_ALL)) {
return true;
}
return handled;
}
void slix2_prepare(NfcVData* nfcv_data) {
FURI_LOG_D(
TAG, " Privacy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_privacy, 4));
FURI_LOG_D(
TAG, " Destroy pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_destroy, 4));
FURI_LOG_D(TAG, " EAS pass: 0x%08lX", slix_read_be(nfcv_data->sub_data.slix.key_eas, 4));
FURI_LOG_D(TAG, " Privacy mode: %s", nfcv_data->sub_data.slix.privacy ? "ON" : "OFF");
NfcVEmuProtocolCtx* ctx = nfcv_data->emu_protocol_ctx;
ctx->emu_protocol_filter = &slix2_protocol_filter;
}
lib/nfc/protocols/slix.h
+46
View File
@@ -0,0 +1,46 @@
#pragma once
#include <stdint.h>
#include <stdbool.h>
#include "nfc_util.h"
#include <furi_hal_nfc.h>
#define NFCV_MANUFACTURER_NXP 0x04
/* ISO15693-3 CUSTOM NXP COMMANDS */
#define NFCV_CMD_NXP_SET_EAS 0xA2
#define NFCV_CMD_NXP_RESET_EAS 0xA3
#define NFCV_CMD_NXP_LOCK_EAS 0xA4
#define NFCV_CMD_NXP_EAS_ALARM 0xA5
#define NFCV_CMD_NXP_PASSWORD_PROTECT_EAS_AFI 0xA6
#define NFCV_CMD_NXP_WRITE_EAS_ID 0xA7
#define NFCV_CMD_NXP_INVENTORY_PAGE_READ 0xB0
#define NFCV_CMD_NXP_INVENTORY_PAGE_READ_FAST 0xB1
#define NFCV_CMD_NXP_GET_RANDOM_NUMBER 0xB2
#define NFCV_CMD_NXP_SET_PASSWORD 0xB3
#define NFCV_CMD_NXP_WRITE_PASSWORD 0xB4
#define NFCV_CMD_NXP_DESTROY 0xB9
#define NFCV_CMD_NXP_ENABLE_PRIVACY 0xBA
/* available passwords */
#define SLIX_PASS_READ 0x01
#define SLIX_PASS_WRITE 0x02
#define SLIX_PASS_PRIVACY 0x04
#define SLIX_PASS_DESTROY 0x08
#define SLIX_PASS_EASAFI 0x10
#define SLIX_PASS_ALL \
(SLIX_PASS_READ | SLIX_PASS_WRITE | SLIX_PASS_PRIVACY | SLIX_PASS_DESTROY | SLIX_PASS_EASAFI)
bool slix_check_card_type(FuriHalNfcDevData* nfc_data);
bool slix2_check_card_type(FuriHalNfcDevData* nfc_data);
bool slix_s_check_card_type(FuriHalNfcDevData* nfc_data);
bool slix_l_check_card_type(FuriHalNfcDevData* nfc_data);
ReturnCode slix_get_random(NfcVData* data);
ReturnCode slix_unlock(NfcVData* data, uint32_t password_id);
void slix_prepare(NfcVData* nfcv_data);
void slix_s_prepare(NfcVData* nfcv_data);
void slix_l_prepare(NfcVData* nfcv_data);
void slix2_prepare(NfcVData* nfcv_data);