Mirror/Momentum-Firmware
1
0
Fork 0
mirror of https://github.com/Next-Flip/Momentum-Firmware.git synced 2026-07-28 01:58:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ofw-dev' into dev

Browse Source
This commit is contained in:
MX
2023-07-12 21:19:16 +03:00
parent 4a2cae23ca 92c0baa461
commit c4b04a06bb
68 changed files with 431 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/nfc/protocols/mifare_classic.c
+108 -50
View File
@@ -852,16 +852,20 @@ bool mf_classic_emulator(
bool is_reader_analyzer) {
furi_assert(emulator);
furi_assert(tx_rx);
bool command_processed = false;
bool is_encrypted = false;
uint8_t plain_data[MF_CLASSIC_MAX_DATA_SIZE];
MfClassicKey access_key = MfClassicKeyA;
bool need_reset = false;
bool need_nack = false;
bool is_encrypted = false;
uint8_t sector = 0;
// Used for decrement and increment - copy to block on transfer
uint8_t transfer_buf[MF_CLASSIC_BLOCK_SIZE] = {};
uint8_t transfer_buf[MF_CLASSIC_BLOCK_SIZE];
bool transfer_buf_valid = false;
// Read command
while(!command_processed) { //-V654
// Process commands
while(!need_reset && !need_nack) { //-V654
memset(plain_data, 0, MF_CLASSIC_MAX_DATA_SIZE);
if(!is_encrypted) {
crypto1_reset(&emulator->crypto);
memcpy(plain_data, tx_rx->rx_data, tx_rx->rx_bits / 8);
@@ -872,6 +876,7 @@ bool mf_classic_emulator(
"Error in tx rx. Tx: %d bits, Rx: %d bits",
tx_rx->tx_bits,
tx_rx->rx_bits);
need_reset = true;
break;
}
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
@@ -880,17 +885,20 @@ bool mf_classic_emulator(
// After increment, decrement or restore the only allowed command is transfer
uint8_t cmd = plain_data[0];
if(transfer_buf_valid && cmd != MF_CLASSIC_TRANSFER_CMD) {
need_nack = true;
break;
}
if(cmd == NFCA_CMD_HALT && plain_data[1] == 0x00) {
FURI_LOG_T(TAG, "Halt received");
return false;
need_reset = true;
break;
}
if(cmd == NFCA_CMD_RATS && !is_encrypted) {
if(cmd == NFCA_CMD_RATS) {
// Mifare Classic doesn't support ATS, NACK it and start listening again
FURI_LOG_T(TAG, "RATS received");
need_nack = true;
break;
}
@@ -898,6 +906,7 @@ bool mf_classic_emulator(
uint8_t block = plain_data[1];
uint64_t key = 0;
uint8_t sector_trailer_block = mf_classic_get_sector_trailer_num_by_block(block);
sector = mf_classic_get_sector_by_block(block);
MfClassicSectorTrailer* sector_trailer =
(MfClassicSectorTrailer*)emulator->data.block[sector_trailer_block].value;
if(cmd == MF_CLASSIC_AUTH_KEY_A_CMD) {
@@ -908,7 +917,8 @@ bool mf_classic_emulator(
access_key = MfClassicKeyA;
} else {
FURI_LOG_D(TAG, "Key not known");
return false;
need_nack = true;
break;
}
} else {
if(mf_classic_is_key_found(
@@ -918,7 +928,8 @@ bool mf_classic_emulator(
access_key = MfClassicKeyB;
} else {
FURI_LOG_D(TAG, "Key not known");
return false;
need_nack = true;
break;
}
}
@@ -949,11 +960,13 @@ bool mf_classic_emulator(
if(!furi_hal_nfc_tx_rx(tx_rx, 500)) {
FURI_LOG_E(TAG, "Error in NT exchange");
return false;
need_reset = true;
break;
}
if(tx_rx->rx_bits != 64) {
return false;
need_reset = true;
break;
}
uint32_t nr = nfc_util_bytes2num(tx_rx->rx_data, 4);
@@ -962,9 +975,15 @@ bool mf_classic_emulator(
crypto1_word(&emulator->crypto, nr, 1);
uint32_t cardRr = ar ^ crypto1_word(&emulator->crypto, 0, 0);
if(cardRr != prng_successor(nonce, 64)) {
FURI_LOG_T(TAG, "Wrong AUTH! %08lX != %08lX", cardRr, prng_successor(nonce, 64));
FURI_LOG_T(
TAG,
"Wrong AUTH on block %u! %08lX != %08lX",
block,
cardRr,
prng_successor(nonce, 64));
// Don't send NACK, as the tag doesn't send it
return false;
need_reset = true;
break;
}
uint32_t ans = prng_successor(nonce, 96);
@@ -986,11 +1005,25 @@ bool mf_classic_emulator(
if(!is_encrypted) {
FURI_LOG_T(TAG, "Invalid command before auth session established: %02X", cmd);
need_nack = true;
break;
}
if(cmd == MF_CLASSIC_READ_BLOCK_CMD) {
uint8_t block = plain_data[1];
// Mifare Classic commands always have block number after command
uint8_t block = plain_data[1];
if(mf_classic_get_sector_by_block(block) != sector) {
// Don't allow access to sectors other than authorized
FURI_LOG_T(
TAG,
"Trying to access block %u from not authorized sector (command: %02X)",
block,
cmd);
need_nack = true;
break;
}
switch(cmd) {
case MF_CLASSIC_READ_BLOCK_CMD: {
uint8_t block_data[MF_CLASSIC_BLOCK_SIZE + 2] = {};
memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
if(mf_classic_is_sector_trailer(block)) {
@@ -1006,17 +1039,14 @@ bool mf_classic_emulator(
emulator, block, access_key, MfClassicActionACRead)) {
memset(&block_data[6], 0, 4);
}
} else if(!mf_classic_is_allowed_access(
emulator, block, access_key, MfClassicActionDataRead)) {
// Send NACK
uint8_t nack = 0x04;
crypto1_encrypt(
&emulator->crypto, NULL, &nack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
furi_hal_nfc_tx_rx(tx_rx, 300);
} else if(
!mf_classic_is_allowed_access(
emulator, block, access_key, MfClassicActionDataRead) ||
!mf_classic_is_block_read(&emulator->data, block)) {
need_nack = true;
break;
}
nfca_append_crc16(block_data, 16);
crypto1_encrypt(
@@ -1028,23 +1058,36 @@ bool mf_classic_emulator(
tx_rx->tx_parity);
tx_rx->tx_bits = (MF_CLASSIC_BLOCK_SIZE + 2) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
} else if(cmd == MF_CLASSIC_WRITE_BLOCK_CMD) {
uint8_t block = plain_data[1];
if(block > mf_classic_get_total_block_num(emulator->data.type)) {
break;
}
break;
}
case MF_CLASSIC_WRITE_BLOCK_CMD: {
// Send ACK
uint8_t ack = MF_CLASSIC_ACK_CMD;
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
if(tx_rx->rx_bits != (MF_CLASSIC_BLOCK_SIZE + 2) * 8) break;
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) {
need_reset = true;
break;
}
if(tx_rx->rx_bits != (MF_CLASSIC_BLOCK_SIZE + 2) * 8) {
need_reset = true;
break;
}
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
uint8_t block_data[MF_CLASSIC_BLOCK_SIZE] = {};
memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
if(!mf_classic_is_block_read(&emulator->data, block)) {
// Don't allow writing to the block for which we haven't read data yet
need_nack = true;
break;
}
if(mf_classic_is_sector_trailer(block)) {
if(mf_classic_is_allowed_access(
emulator, block, access_key, MfClassicActionKeyAWrite)) {
@@ -1063,38 +1106,39 @@ bool mf_classic_emulator(
emulator, block, access_key, MfClassicActionDataWrite)) {
memcpy(block_data, plain_data, MF_CLASSIC_BLOCK_SIZE);
} else {
need_nack = true;
break;
}
}
if(memcmp(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) != 0) {
memcpy(emulator->data.block[block].value, block_data, MF_CLASSIC_BLOCK_SIZE);
emulator->data_changed = true;
}
// Send ACK
ack = MF_CLASSIC_ACK_CMD;
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
} else if(
cmd == MF_CLASSIC_DECREMENT_CMD || cmd == MF_CLASSIC_INCREMENT_CMD ||
cmd == MF_CLASSIC_RESTORE_CMD) {
uint8_t block = plain_data[1];
break;
}
if(block > mf_classic_get_total_block_num(emulator->data.type)) {
break;
}
case MF_CLASSIC_DECREMENT_CMD:
case MF_CLASSIC_INCREMENT_CMD:
case MF_CLASSIC_RESTORE_CMD: {
MfClassicAction action = (cmd == MF_CLASSIC_INCREMENT_CMD) ? MfClassicActionDataInc :
MfClassicActionDataDec;
MfClassicAction action = MfClassicActionDataDec;
if(cmd == MF_CLASSIC_INCREMENT_CMD) {
action = MfClassicActionDataInc;
}
if(!mf_classic_is_allowed_access(emulator, block, access_key, action)) {
need_nack = true;
break;
}
int32_t prev_value;
uint8_t addr;
if(!mf_classic_block_to_value(emulator->data.block[block].value, &prev_value, &addr)) {
need_nack = true;
break;
}
@@ -1104,8 +1148,15 @@ bool mf_classic_emulator(
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
if(tx_rx->rx_bits != (sizeof(int32_t) + 2) * 8) break;
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) {
need_reset = true;
break;
}
if(tx_rx->rx_bits != (sizeof(int32_t) + 2) * 8) {
need_reset = true;
break;
}
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
int32_t value = *(int32_t*)&plain_data[0];
@@ -1122,9 +1173,12 @@ bool mf_classic_emulator(
transfer_buf_valid = true;
// Commands do not ACK
tx_rx->tx_bits = 0;
} else if(cmd == MF_CLASSIC_TRANSFER_CMD) {
uint8_t block = plain_data[1];
break;
}
case MF_CLASSIC_TRANSFER_CMD: {
if(!mf_classic_is_allowed_access(emulator, block, access_key, MfClassicActionDataDec)) {
need_nack = true;
break;
}
if(memcmp(transfer_buf, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) !=
@@ -1138,13 +1192,17 @@ bool mf_classic_emulator(
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
} else {
break;
}
default:
FURI_LOG_T(TAG, "Unknown command: %02X", cmd);
need_nack = true;
break;
}
}
if(!command_processed) {
if(need_nack && !need_reset) {
// Send NACK
uint8_t nack = transfer_buf_valid ? MF_CLASSIC_NACK_BUF_VALID_CMD :
MF_CLASSIC_NACK_BUF_INVALID_CMD;
@@ -1156,10 +1214,10 @@ bool mf_classic_emulator(
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
furi_hal_nfc_tx_rx(tx_rx, 300);
return false;
need_reset = true;
}
return true;
return !need_reset;
}
void mf_classic_halt(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto) {