mirror of
https://github.com/Next-Flip/Momentum-Firmware.git
synced 2026-07-28 01:58:11 -07:00
Merge branch 'dev' into nfcf
This commit is contained in:
+62
-2
@@ -56,6 +56,8 @@ void nfc_worker_start(
|
||||
while(furi_hal_nfc_is_busy()) {
|
||||
furi_delay_ms(10);
|
||||
}
|
||||
furi_hal_nfc_deinit();
|
||||
furi_hal_nfc_init();
|
||||
|
||||
nfc_worker->callback = callback;
|
||||
nfc_worker->context = context;
|
||||
@@ -628,6 +630,32 @@ void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
|
||||
}
|
||||
}
|
||||
|
||||
static bool nfc_worker_mf_get_b_key_from_sector_trailer(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
uint16_t sector,
|
||||
uint64_t key,
|
||||
uint64_t* found_key) {
|
||||
// Some access conditions allow reading B key via A key
|
||||
|
||||
uint8_t block = mf_classic_get_sector_trailer_block_num_by_sector(sector);
|
||||
|
||||
Crypto1 crypto = {};
|
||||
MfClassicBlock block_tmp = {};
|
||||
MfClassicAuthContext auth_context = {.sector = sector, .key_a = MF_CLASSIC_NO_KEY, .key_b = 0};
|
||||
|
||||
furi_hal_nfc_sleep();
|
||||
|
||||
if(mf_classic_auth_attempt(tx_rx, &crypto, &auth_context, key)) {
|
||||
if(mf_classic_read_block(tx_rx, &crypto, block, &block_tmp)) {
|
||||
*found_key = nfc_util_bytes2num(&block_tmp.value[10], sizeof(uint8_t) * 6);
|
||||
|
||||
return *found_key;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
static void nfc_worker_mf_classic_key_attack(
|
||||
NfcWorker* nfc_worker,
|
||||
uint64_t key,
|
||||
@@ -673,6 +701,16 @@ static void nfc_worker_mf_classic_key_attack(
|
||||
mf_classic_set_key_found(data, i, MfClassicKeyA, key);
|
||||
FURI_LOG_D(TAG, "Key found");
|
||||
nfc_worker->callback(NfcWorkerEventFoundKeyA, nfc_worker->context);
|
||||
|
||||
uint64_t found_key;
|
||||
if(nfc_worker_mf_get_b_key_from_sector_trailer(tx_rx, i, key, &found_key)) {
|
||||
FURI_LOG_D(TAG, "Found B key via reading sector %d", i);
|
||||
mf_classic_set_key_found(data, i, MfClassicKeyB, found_key);
|
||||
|
||||
if(nfc_worker->state == NfcWorkerStateMfClassicDictAttack) {
|
||||
nfc_worker->callback(NfcWorkerEventFoundKeyB, nfc_worker->context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if(!mf_classic_is_key_found(data, i, MfClassicKeyB)) {
|
||||
@@ -762,23 +800,45 @@ void nfc_worker_mf_classic_dict_attack(NfcWorker* nfc_worker) {
|
||||
if(mf_classic_authenticate_skip_activate(
|
||||
&tx_rx, block_num, key, MfClassicKeyA, !deactivated, cuid)) {
|
||||
mf_classic_set_key_found(data, i, MfClassicKeyA, key);
|
||||
FURI_LOG_D(TAG, "Key found");
|
||||
FURI_LOG_D(TAG, "Key A found");
|
||||
nfc_worker->callback(NfcWorkerEventFoundKeyA, nfc_worker->context);
|
||||
|
||||
uint64_t found_key;
|
||||
if(nfc_worker_mf_get_b_key_from_sector_trailer(
|
||||
&tx_rx, i, key, &found_key)) {
|
||||
FURI_LOG_D(TAG, "Found B key via reading sector %d", i);
|
||||
mf_classic_set_key_found(data, i, MfClassicKeyB, found_key);
|
||||
|
||||
if(nfc_worker->state == NfcWorkerStateMfClassicDictAttack) {
|
||||
nfc_worker->callback(NfcWorkerEventFoundKeyB, nfc_worker->context);
|
||||
}
|
||||
|
||||
nfc_worker_mf_classic_key_attack(nfc_worker, found_key, &tx_rx, i + 1);
|
||||
break;
|
||||
}
|
||||
nfc_worker_mf_classic_key_attack(nfc_worker, key, &tx_rx, i + 1);
|
||||
}
|
||||
furi_hal_nfc_sleep();
|
||||
deactivated = true;
|
||||
} else {
|
||||
mf_classic_set_key_not_found(data, i, MfClassicKeyA);
|
||||
is_key_a_found = false;
|
||||
FURI_LOG_D(TAG, "Key %dA not found in attack", i);
|
||||
}
|
||||
if(!is_key_b_found) {
|
||||
is_key_b_found = mf_classic_is_key_found(data, i, MfClassicKeyB);
|
||||
if(mf_classic_authenticate_skip_activate(
|
||||
&tx_rx, block_num, key, MfClassicKeyB, !deactivated, cuid)) {
|
||||
FURI_LOG_D(TAG, "Key found");
|
||||
FURI_LOG_D(TAG, "Key B found");
|
||||
mf_classic_set_key_found(data, i, MfClassicKeyB, key);
|
||||
nfc_worker->callback(NfcWorkerEventFoundKeyB, nfc_worker->context);
|
||||
nfc_worker_mf_classic_key_attack(nfc_worker, key, &tx_rx, i + 1);
|
||||
}
|
||||
deactivated = true;
|
||||
} else {
|
||||
mf_classic_set_key_not_found(data, i, MfClassicKeyB);
|
||||
is_key_b_found = false;
|
||||
FURI_LOG_D(TAG, "Key %dB not found in attack", i);
|
||||
}
|
||||
if(is_key_a_found && is_key_b_found) break;
|
||||
if(nfc_worker->state != NfcWorkerStateMfClassicDictAttack) break;
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#include <gui/modules/widget.h>
|
||||
#include <nfc_worker_i.h>
|
||||
|
||||
#include "furi_hal.h"
|
||||
#include <furi_hal.h>
|
||||
|
||||
#define ALL_IN_ONE_LAYOUT_UNKNOWN 0
|
||||
#define ALL_IN_ONE_LAYOUT_A 1
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
#include <gui/modules/widget.h>
|
||||
#include <nfc_worker_i.h>
|
||||
|
||||
#include "furi_hal.h"
|
||||
#include <furi_hal.h>
|
||||
|
||||
static const MfClassicAuthContext plantain_keys_4k[] = {
|
||||
{.sector = 0, .key_a = 0xFFFFFFFFFFFF, .key_b = 0xFFFFFFFFFFFF},
|
||||
@@ -118,7 +118,7 @@ bool plantain_4k_parser_parse(NfcDeviceData* dev_data) {
|
||||
}
|
||||
|
||||
furi_string_printf(
|
||||
dev_data->parsed_data, "\e#Plantain\nN:%llu-\nBalance:%ld\n", card_number, balance);
|
||||
dev_data->parsed_data, "\e#Plantain\nN:%llu-\nBalance:%lu\n", card_number, balance);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
#include <gui/modules/widget.h>
|
||||
#include <nfc_worker_i.h>
|
||||
|
||||
#include "furi_hal.h"
|
||||
#include <furi_hal.h>
|
||||
|
||||
static const MfClassicAuthContext plantain_keys[] = {
|
||||
{.sector = 0, .key_a = 0xffffffffffff, .key_b = 0xffffffffffff},
|
||||
@@ -91,7 +91,7 @@ bool plantain_parser_parse(NfcDeviceData* dev_data) {
|
||||
}
|
||||
|
||||
furi_string_printf(
|
||||
dev_data->parsed_data, "\e#Plantain\nN:%llu-\nBalance:%ld\n", card_number, balance);
|
||||
dev_data->parsed_data, "\e#Plantain\nN:%llu-\nBalance:%lu\n", card_number, balance);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -99,7 +99,7 @@ bool troika_4k_parser_parse(NfcDeviceData* dev_data) {
|
||||
number >>= 4;
|
||||
|
||||
furi_string_printf(
|
||||
dev_data->parsed_data, "\e#Troika\nNum: %ld\nBalance: %d rur.", number, balance);
|
||||
dev_data->parsed_data, "\e#Troika\nNum: %lu\nBalance: %u rur.", number, balance);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -79,7 +79,7 @@ bool troika_parser_parse(NfcDeviceData* dev_data) {
|
||||
number >>= 4;
|
||||
|
||||
furi_string_printf(
|
||||
dev_data->parsed_data, "\e#Troika\nNum: %ld\nBalance: %d rur.", number, balance);
|
||||
dev_data->parsed_data, "\e#Troika\nNum: %lu\nBalance: %u rur.", number, balance);
|
||||
troika_parsed = true;
|
||||
} while(false);
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#include <gui/modules/widget.h>
|
||||
#include <nfc_worker_i.h>
|
||||
|
||||
#include "furi_hal.h"
|
||||
#include <furi_hal.h>
|
||||
|
||||
static const MfClassicAuthContext two_cities_keys_4k[] = {
|
||||
{.sector = 0, .key_a = 0xffffffffffff, .key_b = 0xffffffffffff},
|
||||
@@ -136,7 +136,7 @@ bool two_cities_parser_parse(NfcDeviceData* dev_data) {
|
||||
|
||||
furi_string_printf(
|
||||
dev_data->parsed_data,
|
||||
"\e#Troika+Plantain\nPN: %llu-\nPB: %ld rur.\nTN: %ld\nTB: %d rur.\n",
|
||||
"\e#Troika+Plantain\nPN: %llu-\nPB: %lu rur.\nTN: %lu\nTB: %u rur.\n",
|
||||
card_number,
|
||||
balance,
|
||||
troika_number,
|
||||
|
||||
@@ -7,10 +7,17 @@
|
||||
|
||||
#define TAG "MfClassic"
|
||||
|
||||
#define MF_CLASSIC_AUTH_KEY_A_CMD (0x60U)
|
||||
#define MF_CLASSIC_AUTH_KEY_B_CMD (0x61U)
|
||||
#define MF_CLASSIC_READ_BLOCK_CMD (0x30)
|
||||
#define MF_CLASSIC_WRITE_BLOCK_CMD (0xA0)
|
||||
#define MF_CLASSIC_ACK_CMD 0xAU
|
||||
#define MF_CLASSIC_NACK_BUF_VALID_CMD 0x0U
|
||||
#define MF_CLASSIC_NACK_BUF_INVALID_CMD 0x4U
|
||||
#define MF_CLASSIC_AUTH_KEY_A_CMD 0x60U
|
||||
#define MF_CLASSIC_AUTH_KEY_B_CMD 0x61U
|
||||
#define MF_CLASSIC_READ_BLOCK_CMD 0x30U
|
||||
#define MF_CLASSIC_WRITE_BLOCK_CMD 0xA0U
|
||||
#define MF_CLASSIC_TRANSFER_CMD 0xB0U
|
||||
#define MF_CLASSIC_DECREMENT_CMD 0xC0U
|
||||
#define MF_CLASSIC_INCREMENT_CMD 0xC1U
|
||||
#define MF_CLASSIC_RESTORE_CMD 0xC2U
|
||||
|
||||
const char* mf_classic_get_type_str(MfClassicType type) {
|
||||
if(type == MfClassicTypeMini) {
|
||||
@@ -217,8 +224,8 @@ void mf_classic_get_read_sectors_and_keys(
|
||||
uint8_t first_block = mf_classic_get_first_block_num_of_sector(i);
|
||||
uint8_t total_blocks_in_sec = mf_classic_get_blocks_num_in_sector(i);
|
||||
bool blocks_read = true;
|
||||
for(size_t i = first_block; i < first_block + total_blocks_in_sec; i++) {
|
||||
blocks_read = mf_classic_is_block_read(data, i);
|
||||
for(size_t j = first_block; j < first_block + total_blocks_in_sec; j++) {
|
||||
blocks_read = mf_classic_is_block_read(data, j);
|
||||
if(!blocks_read) break;
|
||||
}
|
||||
if(blocks_read) {
|
||||
@@ -284,6 +291,10 @@ bool mf_classic_is_allowed_access_data_block(
|
||||
uint8_t* sector_trailer =
|
||||
data->block[mf_classic_get_sector_trailer_num_by_block(block_num)].value;
|
||||
|
||||
if(block_num == 0 && action == MfClassicActionDataWrite) {
|
||||
return false;
|
||||
}
|
||||
|
||||
uint8_t sector_block;
|
||||
if(block_num <= 128) {
|
||||
sector_block = block_num & 0x03;
|
||||
@@ -353,6 +364,16 @@ static bool mf_classic_is_allowed_access(
|
||||
}
|
||||
}
|
||||
|
||||
bool mf_classic_is_value_block(MfClassicData* data, uint8_t block_num) {
|
||||
// Check if key A can write, if it can, it's transport configuration, not data block
|
||||
return !mf_classic_is_allowed_access_data_block(
|
||||
data, block_num, MfClassicKeyA, MfClassicActionDataWrite) &&
|
||||
(mf_classic_is_allowed_access_data_block(
|
||||
data, block_num, MfClassicKeyB, MfClassicActionDataInc) ||
|
||||
mf_classic_is_allowed_access_data_block(
|
||||
data, block_num, MfClassicKeyB, MfClassicActionDataDec));
|
||||
}
|
||||
|
||||
bool mf_classic_check_card_type(FuriHalNfcADevData* data) {
|
||||
uint8_t ATQA0 = data->atqa[0];
|
||||
uint8_t ATQA1 = data->atqa[1];
|
||||
@@ -405,6 +426,36 @@ void mf_classic_reader_add_sector(
|
||||
}
|
||||
}
|
||||
|
||||
bool mf_classic_block_to_value(const uint8_t* block, int32_t* value, uint8_t* addr) {
|
||||
uint32_t v = *(uint32_t*)&block[0];
|
||||
uint32_t v_inv = *(uint32_t*)&block[4];
|
||||
uint32_t v1 = *(uint32_t*)&block[8];
|
||||
|
||||
bool val_checks =
|
||||
((v == v1) && (v == ~v_inv) && (block[12] == (~block[13] & 0xFF)) &&
|
||||
(block[14] == (~block[15] & 0xFF)) && (block[12] == block[14]));
|
||||
if(value) {
|
||||
*value = (int32_t)v;
|
||||
}
|
||||
if(addr) {
|
||||
*addr = block[12];
|
||||
}
|
||||
return val_checks;
|
||||
}
|
||||
|
||||
void mf_classic_value_to_block(int32_t value, uint8_t addr, uint8_t* block) {
|
||||
uint32_t v_inv = ~((uint32_t)value);
|
||||
|
||||
memcpy(block, &value, 4); //-V1086
|
||||
memcpy(block + 4, &v_inv, 4); //-V1086
|
||||
memcpy(block + 8, &value, 4); //-V1086
|
||||
|
||||
block[12] = addr;
|
||||
block[13] = ~addr & 0xFF;
|
||||
block[14] = addr;
|
||||
block[15] = ~addr & 0xFF;
|
||||
}
|
||||
|
||||
void mf_classic_auth_init_context(MfClassicAuthContext* auth_ctx, uint8_t sector) {
|
||||
furi_assert(auth_ctx);
|
||||
auth_ctx->sector = sector;
|
||||
@@ -498,6 +549,7 @@ bool mf_classic_authenticate_skip_activate(
|
||||
|
||||
bool mf_classic_auth_attempt(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
Crypto1* crypto,
|
||||
MfClassicAuthContext* auth_ctx,
|
||||
uint64_t key) {
|
||||
furi_assert(tx_rx);
|
||||
@@ -506,15 +558,14 @@ bool mf_classic_auth_attempt(
|
||||
bool need_halt = (auth_ctx->key_a == MF_CLASSIC_NO_KEY) &&
|
||||
(auth_ctx->key_b == MF_CLASSIC_NO_KEY);
|
||||
|
||||
Crypto1 crypto;
|
||||
if(auth_ctx->key_a == MF_CLASSIC_NO_KEY) {
|
||||
// Try AUTH with key A
|
||||
if(mf_classic_auth(
|
||||
tx_rx,
|
||||
mf_classic_get_first_block_num_of_sector(auth_ctx->sector),
|
||||
mf_classic_get_sector_trailer_block_num_by_sector(auth_ctx->sector),
|
||||
key,
|
||||
MfClassicKeyA,
|
||||
&crypto,
|
||||
crypto,
|
||||
false,
|
||||
0)) {
|
||||
auth_ctx->key_a = key;
|
||||
@@ -530,10 +581,10 @@ bool mf_classic_auth_attempt(
|
||||
// Try AUTH with key B
|
||||
if(mf_classic_auth(
|
||||
tx_rx,
|
||||
mf_classic_get_first_block_num_of_sector(auth_ctx->sector),
|
||||
mf_classic_get_sector_trailer_block_num_by_sector(auth_ctx->sector),
|
||||
key,
|
||||
MfClassicKeyB,
|
||||
&crypto,
|
||||
crypto,
|
||||
false,
|
||||
0)) {
|
||||
auth_ctx->key_b = key;
|
||||
@@ -557,8 +608,9 @@ bool mf_classic_read_block(
|
||||
uint8_t plain_cmd[4] = {MF_CLASSIC_READ_BLOCK_CMD, block_num, 0x00, 0x00};
|
||||
nfca_append_crc16(plain_cmd, 2);
|
||||
|
||||
crypto1_encrypt(crypto, NULL, plain_cmd, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = 4 * 9;
|
||||
crypto1_encrypt(
|
||||
crypto, NULL, plain_cmd, sizeof(plain_cmd) * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = sizeof(plain_cmd) * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
|
||||
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
||||
@@ -603,7 +655,12 @@ void mf_classic_read_sector(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data, u
|
||||
if(!key_a_found) break;
|
||||
FURI_LOG_D(TAG, "Try to read blocks with key A");
|
||||
key = nfc_util_bytes2num(sec_tr->key_a, sizeof(sec_tr->key_a));
|
||||
if(!mf_classic_auth(tx_rx, start_block, key, MfClassicKeyA, &crypto, false, 0)) break;
|
||||
if(!mf_classic_auth(tx_rx, start_block, key, MfClassicKeyA, &crypto, false, 0)) {
|
||||
mf_classic_set_key_not_found(data, sec_num, MfClassicKeyA);
|
||||
FURI_LOG_D(TAG, "Key %dA not found in read", sec_num);
|
||||
break;
|
||||
}
|
||||
|
||||
for(size_t i = start_block; i < start_block + total_blocks; i++) {
|
||||
if(!mf_classic_is_block_read(data, i)) {
|
||||
if(mf_classic_read_block(tx_rx, &crypto, i, &block_tmp)) {
|
||||
@@ -612,7 +669,11 @@ void mf_classic_read_sector(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data, u
|
||||
} else if(i > start_block) {
|
||||
// Try to re-auth to read block in case prevous block was protected from read
|
||||
furi_hal_nfc_sleep();
|
||||
if(!mf_classic_auth(tx_rx, i, key, MfClassicKeyA, &crypto, false, 0)) break;
|
||||
if(!mf_classic_auth(tx_rx, i, key, MfClassicKeyA, &crypto, false, 0)) {
|
||||
mf_classic_set_key_not_found(data, sec_num, MfClassicKeyA);
|
||||
FURI_LOG_D(TAG, "Key %dA not found in read", sec_num);
|
||||
break;
|
||||
}
|
||||
if(mf_classic_read_block(tx_rx, &crypto, i, &block_tmp)) {
|
||||
mf_classic_set_block_read(data, i, &block_tmp);
|
||||
blocks_read++;
|
||||
@@ -627,9 +688,17 @@ void mf_classic_read_sector(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data, u
|
||||
do {
|
||||
if(blocks_read == total_blocks) break;
|
||||
if(!key_b_found) break;
|
||||
if(key_a_found) {
|
||||
furi_hal_nfc_sleep();
|
||||
}
|
||||
FURI_LOG_D(TAG, "Try to read blocks with key B");
|
||||
key = nfc_util_bytes2num(sec_tr->key_b, sizeof(sec_tr->key_b));
|
||||
if(!mf_classic_auth(tx_rx, start_block, key, MfClassicKeyB, &crypto, false, 0)) break;
|
||||
if(!mf_classic_auth(tx_rx, start_block, key, MfClassicKeyB, &crypto, false, 0)) {
|
||||
mf_classic_set_key_not_found(data, sec_num, MfClassicKeyB);
|
||||
FURI_LOG_D(TAG, "Key %dB not found in read", sec_num);
|
||||
break;
|
||||
}
|
||||
|
||||
for(size_t i = start_block; i < start_block + total_blocks; i++) {
|
||||
if(!mf_classic_is_block_read(data, i)) {
|
||||
if(mf_classic_read_block(tx_rx, &crypto, i, &block_tmp)) {
|
||||
@@ -638,7 +707,11 @@ void mf_classic_read_sector(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data, u
|
||||
} else if(i > start_block) {
|
||||
// Try to re-auth to read block in case prevous block was protected from read
|
||||
furi_hal_nfc_sleep();
|
||||
if(!mf_classic_auth(tx_rx, i, key, MfClassicKeyB, &crypto, false, 0)) break;
|
||||
if(!mf_classic_auth(tx_rx, i, key, MfClassicKeyB, &crypto, false, 0)) {
|
||||
mf_classic_set_key_not_found(data, sec_num, MfClassicKeyB);
|
||||
FURI_LOG_D(TAG, "Key %dB not found in read", sec_num);
|
||||
break;
|
||||
}
|
||||
if(mf_classic_read_block(tx_rx, &crypto, i, &block_tmp)) {
|
||||
mf_classic_set_block_read(data, i, &block_tmp);
|
||||
blocks_read++;
|
||||
@@ -783,6 +856,9 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
bool is_encrypted = false;
|
||||
uint8_t plain_data[MF_CLASSIC_MAX_DATA_SIZE];
|
||||
MfClassicKey access_key = MfClassicKeyA;
|
||||
// Used for decrement and increment - copy to block on transfer
|
||||
uint8_t transfer_buf[MF_CLASSIC_BLOCK_SIZE] = {};
|
||||
bool transfer_buf_valid = false;
|
||||
|
||||
// Read command
|
||||
while(!command_processed) { //-V654
|
||||
@@ -801,18 +877,25 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
|
||||
}
|
||||
|
||||
if(plain_data[0] == 0x50 && plain_data[1] == 0x00) {
|
||||
// After increment, decrement or restore the only allowed command is transfer
|
||||
uint8_t cmd = plain_data[0];
|
||||
if(transfer_buf_valid && cmd != MF_CLASSIC_TRANSFER_CMD) {
|
||||
break;
|
||||
}
|
||||
|
||||
if(cmd == 0x50 && plain_data[1] == 0x00) {
|
||||
FURI_LOG_T(TAG, "Halt received");
|
||||
furi_hal_nfc_listen_sleep();
|
||||
command_processed = true;
|
||||
break;
|
||||
} else if(plain_data[0] == 0x60 || plain_data[0] == 0x61) {
|
||||
}
|
||||
if(cmd == MF_CLASSIC_AUTH_KEY_A_CMD || cmd == MF_CLASSIC_AUTH_KEY_B_CMD) {
|
||||
uint8_t block = plain_data[1];
|
||||
uint64_t key = 0;
|
||||
uint8_t sector_trailer_block = mf_classic_get_sector_trailer_num_by_block(block);
|
||||
MfClassicSectorTrailer* sector_trailer =
|
||||
(MfClassicSectorTrailer*)emulator->data.block[sector_trailer_block].value;
|
||||
if(plain_data[0] == 0x60) {
|
||||
if(cmd == MF_CLASSIC_AUTH_KEY_A_CMD) {
|
||||
key = nfc_util_bytes2num(sector_trailer->key_a, 6);
|
||||
access_key = MfClassicKeyA;
|
||||
} else {
|
||||
@@ -830,9 +913,7 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
crypto1_word(&emulator->crypto, emulator->cuid ^ nonce, 0);
|
||||
memcpy(tx_rx->tx_data, nt, sizeof(nt));
|
||||
tx_rx->tx_parity[0] = 0;
|
||||
for(size_t i = 0; i < sizeof(nt); i++) {
|
||||
tx_rx->tx_parity[0] |= nfc_util_odd_parity8(nt[i]) << (7 - i);
|
||||
}
|
||||
nfc_util_odd_parity(tx_rx->tx_data, tx_rx->tx_parity, sizeof(nt));
|
||||
tx_rx->tx_bits = sizeof(nt) * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
|
||||
} else {
|
||||
@@ -853,7 +934,7 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
}
|
||||
|
||||
if(tx_rx->rx_bits != 64) {
|
||||
FURI_LOG_W(TAG, "Incorrect nr + ar");
|
||||
FURI_LOG_W(TAG, "Incorrect nr + ar length: %d", tx_rx->rx_bits);
|
||||
command_processed = true;
|
||||
break;
|
||||
}
|
||||
@@ -861,16 +942,6 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
uint32_t nr = nfc_util_bytes2num(tx_rx->rx_data, 4);
|
||||
uint32_t ar = nfc_util_bytes2num(&tx_rx->rx_data[4], 4);
|
||||
|
||||
FURI_LOG_D(
|
||||
TAG,
|
||||
"%08lx key%c block %d nt/nr/ar: %08lx %08lx %08lx",
|
||||
emulator->cuid,
|
||||
access_key == MfClassicKeyA ? 'A' : 'B',
|
||||
sector_trailer_block,
|
||||
nonce,
|
||||
nr,
|
||||
ar);
|
||||
|
||||
crypto1_word(&emulator->crypto, nr, 1);
|
||||
uint32_t cardRr = ar ^ crypto1_word(&emulator->crypto, 0, 0);
|
||||
if(cardRr != prng_successor(nonce, 64)) {
|
||||
@@ -881,22 +952,30 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
}
|
||||
|
||||
uint32_t ans = prng_successor(nonce, 96);
|
||||
uint8_t responce[4] = {};
|
||||
nfc_util_num2bytes(ans, 4, responce);
|
||||
uint8_t response[4] = {};
|
||||
nfc_util_num2bytes(ans, 4, response);
|
||||
crypto1_encrypt(
|
||||
&emulator->crypto,
|
||||
NULL,
|
||||
responce,
|
||||
sizeof(responce) * 8,
|
||||
response,
|
||||
sizeof(response) * 8,
|
||||
tx_rx->tx_data,
|
||||
tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = sizeof(responce) * 8;
|
||||
tx_rx->tx_bits = sizeof(response) * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
|
||||
|
||||
is_encrypted = true;
|
||||
} else if(is_encrypted && plain_data[0] == 0x30) {
|
||||
continue;
|
||||
}
|
||||
|
||||
if(!is_encrypted) {
|
||||
FURI_LOG_T(TAG, "Invalid command before auth session established: %02X", cmd);
|
||||
break;
|
||||
}
|
||||
|
||||
if(cmd == MF_CLASSIC_READ_BLOCK_CMD) {
|
||||
uint8_t block = plain_data[1];
|
||||
uint8_t block_data[18] = {};
|
||||
uint8_t block_data[MF_CLASSIC_BLOCK_SIZE + 2] = {};
|
||||
memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
|
||||
if(mf_classic_is_sector_trailer(block)) {
|
||||
if(!mf_classic_is_allowed_access(
|
||||
@@ -931,24 +1010,24 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
sizeof(block_data) * 8,
|
||||
tx_rx->tx_data,
|
||||
tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = 18 * 8;
|
||||
tx_rx->tx_bits = (MF_CLASSIC_BLOCK_SIZE + 2) * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
|
||||
} else if(is_encrypted && plain_data[0] == 0xA0) {
|
||||
} else if(cmd == MF_CLASSIC_WRITE_BLOCK_CMD) {
|
||||
uint8_t block = plain_data[1];
|
||||
if(block > mf_classic_get_total_block_num(emulator->data.type)) {
|
||||
break;
|
||||
}
|
||||
// Send ACK
|
||||
uint8_t ack = 0x0A;
|
||||
uint8_t ack = MF_CLASSIC_ACK_CMD;
|
||||
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
|
||||
tx_rx->tx_bits = 4;
|
||||
|
||||
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
|
||||
if(tx_rx->rx_bits != 18 * 8) break;
|
||||
if(tx_rx->rx_bits != (MF_CLASSIC_BLOCK_SIZE + 2) * 8) break;
|
||||
|
||||
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
|
||||
uint8_t block_data[16] = {};
|
||||
uint8_t block_data[MF_CLASSIC_BLOCK_SIZE] = {};
|
||||
memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
|
||||
if(mf_classic_is_sector_trailer(block)) {
|
||||
if(mf_classic_is_allowed_access(
|
||||
@@ -967,6 +1046,8 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
if(mf_classic_is_allowed_access(
|
||||
emulator, block, access_key, MfClassicActionDataWrite)) {
|
||||
memcpy(block_data, plain_data, MF_CLASSIC_BLOCK_SIZE);
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
if(memcmp(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) != 0) {
|
||||
@@ -974,19 +1055,83 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
emulator->data_changed = true;
|
||||
}
|
||||
// Send ACK
|
||||
ack = 0x0A;
|
||||
ack = MF_CLASSIC_ACK_CMD;
|
||||
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
|
||||
tx_rx->tx_bits = 4;
|
||||
} else if(
|
||||
cmd == MF_CLASSIC_DECREMENT_CMD || cmd == MF_CLASSIC_INCREMENT_CMD ||
|
||||
cmd == MF_CLASSIC_RESTORE_CMD) {
|
||||
uint8_t block = plain_data[1];
|
||||
|
||||
if(block > mf_classic_get_total_block_num(emulator->data.type)) {
|
||||
break;
|
||||
}
|
||||
|
||||
MfClassicAction action = MfClassicActionDataDec;
|
||||
if(cmd == MF_CLASSIC_INCREMENT_CMD) {
|
||||
action = MfClassicActionDataInc;
|
||||
}
|
||||
if(!mf_classic_is_allowed_access(emulator, block, access_key, action)) {
|
||||
break;
|
||||
}
|
||||
|
||||
int32_t prev_value;
|
||||
uint8_t addr;
|
||||
if(!mf_classic_block_to_value(emulator->data.block[block].value, &prev_value, &addr)) {
|
||||
break;
|
||||
}
|
||||
|
||||
// Send ACK
|
||||
uint8_t ack = MF_CLASSIC_ACK_CMD;
|
||||
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
|
||||
tx_rx->tx_bits = 4;
|
||||
|
||||
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
|
||||
if(tx_rx->rx_bits != (sizeof(int32_t) + 2) * 8) break;
|
||||
|
||||
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
|
||||
int32_t value = *(int32_t*)&plain_data[0];
|
||||
if(value < 0) {
|
||||
value = -value;
|
||||
}
|
||||
if(cmd == MF_CLASSIC_DECREMENT_CMD) {
|
||||
value = -value;
|
||||
} else if(cmd == MF_CLASSIC_RESTORE_CMD) {
|
||||
value = 0;
|
||||
}
|
||||
|
||||
mf_classic_value_to_block(prev_value + value, addr, transfer_buf);
|
||||
transfer_buf_valid = true;
|
||||
// Commands do not ACK
|
||||
tx_rx->tx_bits = 0;
|
||||
} else if(cmd == MF_CLASSIC_TRANSFER_CMD) {
|
||||
uint8_t block = plain_data[1];
|
||||
if(!mf_classic_is_allowed_access(emulator, block, access_key, MfClassicActionDataDec)) {
|
||||
break;
|
||||
}
|
||||
if(memcmp(transfer_buf, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) !=
|
||||
0) {
|
||||
memcpy(emulator->data.block[block].value, transfer_buf, MF_CLASSIC_BLOCK_SIZE);
|
||||
emulator->data_changed = true;
|
||||
}
|
||||
transfer_buf_valid = false;
|
||||
|
||||
uint8_t ack = MF_CLASSIC_ACK_CMD;
|
||||
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
|
||||
tx_rx->tx_bits = 4;
|
||||
} else {
|
||||
// Unknown command
|
||||
FURI_LOG_T(TAG, "Unknown command: %02X", cmd);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if(!command_processed) {
|
||||
// Send NACK
|
||||
uint8_t nack = 0x04;
|
||||
uint8_t nack = transfer_buf_valid ? MF_CLASSIC_NACK_BUF_VALID_CMD :
|
||||
MF_CLASSIC_NACK_BUF_INVALID_CMD;
|
||||
if(is_encrypted) {
|
||||
crypto1_encrypt(&emulator->crypto, NULL, &nack, 4, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
} else {
|
||||
@@ -1000,37 +1145,50 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
|
||||
return true;
|
||||
}
|
||||
|
||||
void mf_classic_halt(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto) {
|
||||
furi_assert(tx_rx);
|
||||
|
||||
uint8_t plain_data[4] = {0x50, 0x00, 0x00, 0x00};
|
||||
|
||||
nfca_append_crc16(plain_data, 2);
|
||||
if(crypto) {
|
||||
crypto1_encrypt(
|
||||
crypto, NULL, plain_data, sizeof(plain_data) * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
} else {
|
||||
memcpy(tx_rx->tx_data, plain_data, sizeof(plain_data));
|
||||
nfc_util_odd_parity(tx_rx->tx_data, tx_rx->tx_parity, sizeof(plain_data));
|
||||
}
|
||||
|
||||
tx_rx->tx_bits = sizeof(plain_data) * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
furi_hal_nfc_tx_rx(tx_rx, 50);
|
||||
}
|
||||
|
||||
bool mf_classic_write_block(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
MfClassicBlock* src_block,
|
||||
Crypto1* crypto,
|
||||
uint8_t block_num,
|
||||
MfClassicKey key_type,
|
||||
uint64_t key) {
|
||||
MfClassicBlock* src_block) {
|
||||
furi_assert(tx_rx);
|
||||
furi_assert(crypto);
|
||||
furi_assert(src_block);
|
||||
|
||||
Crypto1 crypto = {};
|
||||
uint8_t plain_data[18] = {};
|
||||
uint8_t resp = 0;
|
||||
bool write_success = false;
|
||||
uint8_t plain_data[MF_CLASSIC_BLOCK_SIZE + 2] = {};
|
||||
uint8_t resp;
|
||||
|
||||
do {
|
||||
furi_hal_nfc_sleep();
|
||||
if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
|
||||
FURI_LOG_D(TAG, "Auth fail");
|
||||
break;
|
||||
}
|
||||
// Send write command
|
||||
plain_data[0] = MF_CLASSIC_WRITE_BLOCK_CMD;
|
||||
plain_data[1] = block_num;
|
||||
nfca_append_crc16(plain_data, 2);
|
||||
crypto1_encrypt(&crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
crypto1_encrypt(crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = 4 * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
|
||||
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
||||
if(tx_rx->rx_bits == 4) {
|
||||
crypto1_decrypt(&crypto, tx_rx->rx_data, 4, &resp);
|
||||
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
|
||||
if(resp != 0x0A) {
|
||||
FURI_LOG_D(TAG, "NACK received on write cmd: %02X", resp);
|
||||
break;
|
||||
@@ -1048,7 +1206,7 @@ bool mf_classic_write_block(
|
||||
memcpy(plain_data, src_block->value, MF_CLASSIC_BLOCK_SIZE);
|
||||
nfca_append_crc16(plain_data, MF_CLASSIC_BLOCK_SIZE);
|
||||
crypto1_encrypt(
|
||||
&crypto,
|
||||
crypto,
|
||||
NULL,
|
||||
plain_data,
|
||||
(MF_CLASSIC_BLOCK_SIZE + 2) * 8,
|
||||
@@ -1058,8 +1216,8 @@ bool mf_classic_write_block(
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
||||
if(tx_rx->rx_bits == 4) {
|
||||
crypto1_decrypt(&crypto, tx_rx->rx_data, 4, &resp);
|
||||
if(resp != 0x0A) {
|
||||
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
|
||||
if(resp != MF_CLASSIC_ACK_CMD) {
|
||||
FURI_LOG_D(TAG, "NACK received on sending data");
|
||||
break;
|
||||
}
|
||||
@@ -1071,22 +1229,200 @@ bool mf_classic_write_block(
|
||||
FURI_LOG_D(TAG, "Failed to send data");
|
||||
break;
|
||||
}
|
||||
write_success = true;
|
||||
|
||||
// Send Halt
|
||||
plain_data[0] = 0x50;
|
||||
plain_data[1] = 0x00;
|
||||
nfca_append_crc16(plain_data, 2);
|
||||
crypto1_encrypt(&crypto, NULL, plain_data, 2 * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = 2 * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
// No response is expected
|
||||
furi_hal_nfc_tx_rx(tx_rx, 50);
|
||||
write_success = true;
|
||||
} while(false);
|
||||
|
||||
return write_success;
|
||||
}
|
||||
|
||||
bool mf_classic_auth_write_block(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
MfClassicBlock* src_block,
|
||||
uint8_t block_num,
|
||||
MfClassicKey key_type,
|
||||
uint64_t key) {
|
||||
furi_assert(tx_rx);
|
||||
furi_assert(src_block);
|
||||
|
||||
Crypto1 crypto = {};
|
||||
bool write_success = false;
|
||||
|
||||
do {
|
||||
furi_hal_nfc_sleep();
|
||||
if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
|
||||
FURI_LOG_D(TAG, "Auth fail");
|
||||
break;
|
||||
}
|
||||
|
||||
if(!mf_classic_write_block(tx_rx, &crypto, block_num, src_block)) {
|
||||
FURI_LOG_D(TAG, "Write fail");
|
||||
break;
|
||||
}
|
||||
write_success = true;
|
||||
|
||||
mf_classic_halt(tx_rx, &crypto);
|
||||
} while(false);
|
||||
|
||||
return write_success;
|
||||
}
|
||||
|
||||
bool mf_classic_transfer(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto, uint8_t block_num) {
|
||||
furi_assert(tx_rx);
|
||||
furi_assert(crypto);
|
||||
|
||||
// Send transfer command
|
||||
uint8_t plain_data[4] = {MF_CLASSIC_TRANSFER_CMD, block_num, 0, 0};
|
||||
uint8_t resp = 0;
|
||||
bool transfer_success = false;
|
||||
|
||||
nfca_append_crc16(plain_data, 2);
|
||||
crypto1_encrypt(
|
||||
crypto, NULL, plain_data, sizeof(plain_data) * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = sizeof(plain_data) * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
|
||||
do {
|
||||
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
||||
if(tx_rx->rx_bits == 4) {
|
||||
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
|
||||
if(resp != 0x0A) {
|
||||
FURI_LOG_D(TAG, "NACK received on transfer cmd: %02X", resp);
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_D(TAG, "Not ACK received");
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_D(TAG, "Failed to send transfer cmd");
|
||||
break;
|
||||
}
|
||||
|
||||
transfer_success = true;
|
||||
} while(false);
|
||||
|
||||
return transfer_success;
|
||||
}
|
||||
|
||||
bool mf_classic_value_cmd(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
Crypto1* crypto,
|
||||
uint8_t block_num,
|
||||
uint8_t cmd,
|
||||
int32_t d_value) {
|
||||
furi_assert(tx_rx);
|
||||
furi_assert(crypto);
|
||||
furi_assert(
|
||||
cmd == MF_CLASSIC_INCREMENT_CMD || cmd == MF_CLASSIC_DECREMENT_CMD ||
|
||||
cmd == MF_CLASSIC_RESTORE_CMD);
|
||||
furi_assert(d_value >= 0);
|
||||
|
||||
uint8_t plain_data[sizeof(d_value) + 2] = {};
|
||||
uint8_t resp = 0;
|
||||
bool success = false;
|
||||
|
||||
do {
|
||||
// Send cmd
|
||||
plain_data[0] = cmd;
|
||||
plain_data[1] = block_num;
|
||||
nfca_append_crc16(plain_data, 2);
|
||||
crypto1_encrypt(crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = 4 * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
|
||||
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
||||
if(tx_rx->rx_bits == 4) {
|
||||
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
|
||||
if(resp != 0x0A) {
|
||||
FURI_LOG_D(TAG, "NACK received on write cmd: %02X", resp);
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_D(TAG, "Not ACK received");
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_D(TAG, "Failed to send write cmd");
|
||||
break;
|
||||
}
|
||||
|
||||
// Send data
|
||||
memcpy(plain_data, &d_value, sizeof(d_value));
|
||||
nfca_append_crc16(plain_data, sizeof(d_value));
|
||||
crypto1_encrypt(
|
||||
crypto, NULL, plain_data, (sizeof(d_value) + 2) * 8, tx_rx->tx_data, tx_rx->tx_parity);
|
||||
tx_rx->tx_bits = (sizeof(d_value) + 2) * 8;
|
||||
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
|
||||
// inc, dec, restore do not ACK, but they do NACK
|
||||
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
||||
if(tx_rx->rx_bits == 4) {
|
||||
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
|
||||
if(resp != 0x0A) {
|
||||
FURI_LOG_D(TAG, "NACK received on transfer cmd: %02X", resp);
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_D(TAG, "Not NACK received");
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
success = true;
|
||||
|
||||
} while(false);
|
||||
|
||||
return success;
|
||||
}
|
||||
|
||||
bool mf_classic_value_cmd_full(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
MfClassicBlock* src_block,
|
||||
uint8_t block_num,
|
||||
MfClassicKey key_type,
|
||||
uint64_t key,
|
||||
int32_t d_value) {
|
||||
furi_assert(tx_rx);
|
||||
furi_assert(src_block);
|
||||
|
||||
Crypto1 crypto = {};
|
||||
uint8_t cmd;
|
||||
bool success = false;
|
||||
|
||||
if(d_value > 0) {
|
||||
cmd = MF_CLASSIC_INCREMENT_CMD;
|
||||
} else if(d_value < 0) {
|
||||
cmd = MF_CLASSIC_DECREMENT_CMD;
|
||||
d_value = -d_value;
|
||||
} else {
|
||||
cmd = MF_CLASSIC_RESTORE_CMD;
|
||||
}
|
||||
|
||||
do {
|
||||
furi_hal_nfc_sleep();
|
||||
if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
|
||||
FURI_LOG_D(TAG, "Value cmd auth fail");
|
||||
break;
|
||||
}
|
||||
if(!mf_classic_value_cmd(tx_rx, &crypto, block_num, cmd, d_value)) {
|
||||
FURI_LOG_D(TAG, "Value cmd inc/dec/res fail");
|
||||
break;
|
||||
}
|
||||
|
||||
if(!mf_classic_transfer(tx_rx, &crypto, block_num)) {
|
||||
FURI_LOG_D(TAG, "Value cmd transfer fail");
|
||||
break;
|
||||
}
|
||||
|
||||
success = true;
|
||||
|
||||
// Send Halt
|
||||
mf_classic_halt(tx_rx, &crypto);
|
||||
} while(false);
|
||||
|
||||
return success;
|
||||
}
|
||||
|
||||
bool mf_classic_write_sector(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
MfClassicData* dest_data,
|
||||
@@ -1107,31 +1443,99 @@ bool mf_classic_write_sector(
|
||||
// Compare blocks
|
||||
if(memcmp(dest_data->block[i].value, src_data->block[i].value, MF_CLASSIC_BLOCK_SIZE) !=
|
||||
0) {
|
||||
bool key_a_write_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyA, MfClassicActionDataWrite);
|
||||
bool key_b_write_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyB, MfClassicActionDataWrite);
|
||||
if(mf_classic_is_value_block(dest_data, i)) {
|
||||
bool key_a_inc_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyA, MfClassicActionDataInc);
|
||||
bool key_b_inc_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyB, MfClassicActionDataInc);
|
||||
bool key_a_dec_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyA, MfClassicActionDataDec);
|
||||
bool key_b_dec_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyB, MfClassicActionDataDec);
|
||||
|
||||
if(key_a_found && key_a_write_allowed) {
|
||||
FURI_LOG_I(TAG, "Writing block %d with key A", i);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
|
||||
if(!mf_classic_write_block(tx_rx, &src_data->block[i], i, MfClassicKeyA, key)) {
|
||||
FURI_LOG_E(TAG, "Failed to write block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
} else if(key_b_found && key_b_write_allowed) {
|
||||
FURI_LOG_I(TAG, "Writing block %d with key A", i);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
|
||||
if(!mf_classic_write_block(tx_rx, &src_data->block[i], i, MfClassicKeyB, key)) {
|
||||
FURI_LOG_E(TAG, "Failed to write block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
int32_t src_value, dst_value;
|
||||
|
||||
mf_classic_block_to_value(src_data->block[i].value, &src_value, NULL);
|
||||
mf_classic_block_to_value(dest_data->block[i].value, &dst_value, NULL);
|
||||
|
||||
int32_t diff = src_value - dst_value;
|
||||
|
||||
if(diff > 0) {
|
||||
if(key_a_found && key_a_inc_allowed) {
|
||||
FURI_LOG_I(TAG, "Incrementing block %d with key A by %ld", i, diff);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
|
||||
if(!mf_classic_value_cmd_full(
|
||||
tx_rx, &src_data->block[i], i, MfClassicKeyA, key, diff)) {
|
||||
FURI_LOG_E(TAG, "Failed to increment block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
} else if(key_b_found && key_b_inc_allowed) {
|
||||
FURI_LOG_I(TAG, "Incrementing block %d with key B by %ld", i, diff);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
|
||||
if(!mf_classic_value_cmd_full(
|
||||
tx_rx, &src_data->block[i], i, MfClassicKeyB, key, diff)) {
|
||||
FURI_LOG_E(TAG, "Failed to increment block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_E(TAG, "Failed to increment block %d", i);
|
||||
}
|
||||
} else if(diff < 0) {
|
||||
if(key_a_found && key_a_dec_allowed) {
|
||||
FURI_LOG_I(TAG, "Decrementing block %d with key A by %ld", i, -diff);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
|
||||
if(!mf_classic_value_cmd_full(
|
||||
tx_rx, &src_data->block[i], i, MfClassicKeyA, key, diff)) {
|
||||
FURI_LOG_E(TAG, "Failed to decrement block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
} else if(key_b_found && key_b_dec_allowed) {
|
||||
FURI_LOG_I(TAG, "Decrementing block %d with key B by %ld", i, diff);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
|
||||
if(!mf_classic_value_cmd_full(
|
||||
tx_rx, &src_data->block[i], i, MfClassicKeyB, key, diff)) {
|
||||
FURI_LOG_E(TAG, "Failed to decrement block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_E(TAG, "Failed to decrement block %d", i);
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_E(TAG, "Value block %d address changed, cannot write it", i);
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_E(TAG, "Failed to find key with write access");
|
||||
write_success = false;
|
||||
break;
|
||||
bool key_a_write_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyA, MfClassicActionDataWrite);
|
||||
bool key_b_write_allowed = mf_classic_is_allowed_access_data_block(
|
||||
dest_data, i, MfClassicKeyB, MfClassicActionDataWrite);
|
||||
|
||||
if(key_a_found && key_a_write_allowed) {
|
||||
FURI_LOG_I(TAG, "Writing block %d with key A", i);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
|
||||
if(!mf_classic_auth_write_block(
|
||||
tx_rx, &src_data->block[i], i, MfClassicKeyA, key)) {
|
||||
FURI_LOG_E(TAG, "Failed to write block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
} else if(key_b_found && key_b_write_allowed) {
|
||||
FURI_LOG_I(TAG, "Writing block %d with key A", i);
|
||||
uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
|
||||
if(!mf_classic_auth_write_block(
|
||||
tx_rx, &src_data->block[i], i, MfClassicKeyB, key)) {
|
||||
FURI_LOG_E(TAG, "Failed to write block %d", i);
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_E(TAG, "Failed to find key with write access");
|
||||
write_success = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_D(TAG, "Blocks %d are equal", i);
|
||||
|
||||
@@ -120,6 +120,12 @@ bool mf_classic_is_allowed_access_data_block(
|
||||
MfClassicKey key,
|
||||
MfClassicAction action);
|
||||
|
||||
bool mf_classic_is_value_block(MfClassicData* data, uint8_t block_num);
|
||||
|
||||
bool mf_classic_block_to_value(const uint8_t* block, int32_t* value, uint8_t* addr);
|
||||
|
||||
void mf_classic_value_to_block(int32_t value, uint8_t addr, uint8_t* block);
|
||||
|
||||
bool mf_classic_is_key_found(MfClassicData* data, uint8_t sector_num, MfClassicKey key_type);
|
||||
|
||||
void mf_classic_set_key_found(
|
||||
@@ -168,6 +174,7 @@ bool mf_classic_authenticate_skip_activate(
|
||||
|
||||
bool mf_classic_auth_attempt(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
Crypto1* crypto,
|
||||
MfClassicAuthContext* auth_ctx,
|
||||
uint64_t key);
|
||||
|
||||
@@ -177,6 +184,12 @@ void mf_classic_reader_add_sector(
|
||||
uint64_t key_a,
|
||||
uint64_t key_b);
|
||||
|
||||
bool mf_classic_read_block(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
Crypto1* crypto,
|
||||
uint8_t block_num,
|
||||
MfClassicBlock* block);
|
||||
|
||||
void mf_classic_read_sector(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data, uint8_t sec_num);
|
||||
|
||||
uint8_t mf_classic_read_card(
|
||||
@@ -188,13 +201,38 @@ uint8_t mf_classic_update_card(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data
|
||||
|
||||
bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_rx);
|
||||
|
||||
void mf_classic_halt(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto);
|
||||
|
||||
bool mf_classic_write_block(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
Crypto1* crypto,
|
||||
uint8_t block_num,
|
||||
MfClassicBlock* src_block);
|
||||
|
||||
bool mf_classic_auth_write_block(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
MfClassicBlock* src_block,
|
||||
uint8_t block_num,
|
||||
MfClassicKey key_type,
|
||||
uint64_t key);
|
||||
|
||||
bool mf_classic_transfer(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto, uint8_t block_num);
|
||||
|
||||
bool mf_classic_value_cmd(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
Crypto1* crypto,
|
||||
uint8_t block_num,
|
||||
uint8_t cmd,
|
||||
int32_t d_value);
|
||||
|
||||
bool mf_classic_value_cmd_full(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
MfClassicBlock* src_block,
|
||||
uint8_t block_num,
|
||||
MfClassicKey key_type,
|
||||
uint64_t key,
|
||||
int32_t d_value);
|
||||
|
||||
bool mf_classic_write_sector(
|
||||
FuriHalNfcTxRxContext* tx_rx,
|
||||
MfClassicData* dest_data,
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
#include "mifare_ultralight.h"
|
||||
#include "nfc_util.h"
|
||||
#include <furi.h>
|
||||
#include "furi_hal_nfc.h"
|
||||
#include <furi_hal_nfc.h>
|
||||
|
||||
#define TAG "MfUltralight"
|
||||
|
||||
|
||||
@@ -23,7 +23,7 @@ void nfc_util_num2bytes(uint64_t src, uint8_t len, uint8_t* dest) {
|
||||
}
|
||||
}
|
||||
|
||||
uint64_t nfc_util_bytes2num(uint8_t* src, uint8_t len) {
|
||||
uint64_t nfc_util_bytes2num(const uint8_t* src, uint8_t len) {
|
||||
furi_assert(src);
|
||||
furi_assert(len <= 8);
|
||||
|
||||
@@ -45,3 +45,26 @@ uint8_t nfc_util_even_parity32(uint32_t data) {
|
||||
uint8_t nfc_util_odd_parity8(uint8_t data) {
|
||||
return nfc_util_odd_byte_parity[data];
|
||||
}
|
||||
|
||||
void nfc_util_odd_parity(const uint8_t* src, uint8_t* dst, uint8_t len) {
|
||||
furi_assert(src);
|
||||
furi_assert(dst);
|
||||
|
||||
uint8_t parity = 0;
|
||||
uint8_t bit = 0;
|
||||
while(len--) {
|
||||
parity |= nfc_util_odd_parity8(*src) << (7 - bit); // parity is MSB first
|
||||
bit++;
|
||||
if(bit == 8) {
|
||||
*dst = parity;
|
||||
dst++;
|
||||
parity = 0;
|
||||
bit = 0;
|
||||
}
|
||||
src++;
|
||||
}
|
||||
|
||||
if(bit) {
|
||||
*dst = parity;
|
||||
}
|
||||
}
|
||||
@@ -4,8 +4,10 @@
|
||||
|
||||
void nfc_util_num2bytes(uint64_t src, uint8_t len, uint8_t* dest);
|
||||
|
||||
uint64_t nfc_util_bytes2num(uint8_t* src, uint8_t len);
|
||||
uint64_t nfc_util_bytes2num(const uint8_t* src, uint8_t len);
|
||||
|
||||
uint8_t nfc_util_even_parity32(uint32_t data);
|
||||
|
||||
uint8_t nfc_util_odd_parity8(uint8_t data);
|
||||
|
||||
void nfc_util_odd_parity(const uint8_t* src, uint8_t* dst, uint8_t len);
|
||||
|
||||
Reference in New Issue
Block a user