Mirror/Momentum-Firmware
1
0
Fork 0
mirror of https://github.com/Next-Flip/Momentum-Firmware.git synced 2026-06-19 20:34:19 -07:00
Code Issues Packages Projects Releases Wiki Activity

NFC: initial support for NFC-F (FeliCa)

Browse Source
This commit is contained in:
nullableVoidPtr
2022-12-06 02:31:25 +08:00
parent e40376bc63
commit eaa2dea075
27 changed files with 1074 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/main/nfc/helpers/nfc_generators.c
+11 -11
View File
@@ -63,9 +63,9 @@ static void nfc_generate_mf_ul_common(NfcDeviceData* data) {
data->nfc_data.interface = FuriHalNfcInterfaceRf;
data->nfc_data.uid_len = 7;
nfc_generate_mf_ul_uid(data->nfc_data.uid);
data->nfc_data.atqa[0] = 0x44;
data->nfc_data.atqa[1] = 0x00;
data->nfc_data.sak = 0x00;
data->nfc_data.a_data.atqa[0] = 0x44;
data->nfc_data.a_data.atqa[1] = 0x00;
data->nfc_data.a_data.sak = 0x00;
data->protocol = NfcDeviceProtocolMifareUl;
}
@@ -75,9 +75,9 @@ static void
data->nfc_data.interface = FuriHalNfcInterfaceRf;
data->nfc_data.uid_len = uid_len;
nfc_generate_mf_classic_block_0(data->mf_classic_data.block[0].value, uid_len);
data->nfc_data.atqa[0] = 0x44;
data->nfc_data.atqa[1] = 0x00;
data->nfc_data.sak = 0x08;
data->nfc_data.a_data.atqa[0] = 0x44;
data->nfc_data.a_data.atqa[1] = 0x00;
data->nfc_data.a_data.sak = 0x08;
data->protocol = NfcDeviceProtocolMifareClassic;
data->mf_classic_data.type = type;
}
@@ -231,9 +231,9 @@ static void
mful->data_size = num_pages * 4;
mful->data_read = mful->data_size;
memcpy(mful->data, data->nfc_data.uid, data->nfc_data.uid_len);
mful->data[7] = data->nfc_data.sak;
mful->data[8] = data->nfc_data.atqa[0];
mful->data[9] = data->nfc_data.atqa[1];
mful->data[7] = data->nfc_data.a_data.sak;
mful->data[8] = data->nfc_data.a_data.atqa[0];
mful->data[9] = data->nfc_data.a_data.atqa[1];
uint16_t config_register_page;
uint16_t session_register_page;
@@ -338,7 +338,7 @@ void nfc_generate_mf_classic(NfcDeviceData* data, uint8_t uid_len, MfClassicType
mf_classic_set_block_read(mfc, i, &mfc->block[i]);
}
// Set SAK to 18
data->nfc_data.sak = 0x18;
data->nfc_data.a_data.sak = 0x18;
} else if(type == MfClassicType1k) {
// Set every block to 0xFF
@@ -351,7 +351,7 @@ void nfc_generate_mf_classic(NfcDeviceData* data, uint8_t uid_len, MfClassicType
mf_classic_set_block_read(mfc, i, &mfc->block[i]);
}
// Set SAK to 08
data->nfc_data.sak = 0x08;
data->nfc_data.a_data.sak = 0x08;
}
mfc->type = type;
applications/main/nfc/nfc_cli.c
+23 -8
View File
@@ -33,12 +33,25 @@ static void nfc_cli_detect(Cli* cli, FuriString* args) {
cmd_exit |= cli_cmd_interrupt_received(cli);
if(furi_hal_nfc_detect(&dev_data, 400)) {
printf("found: %s ", nfc_get_dev_type(dev_data.type));
printf("UID length: %d, UID:", dev_data.uid_len);
for(size_t i = 0; i < dev_data.uid_len; i++) {
printf("%02X", dev_data.uid[i]);
if(dev_data.type == FuriHalNfcTypeA) {
printf("UID length: %d, UID:", dev_data.uid_len);
for(size_t i = 0; i < dev_data.uid_len; i++) {
printf("%02X", dev_data.uid[i]);
}
printf("\r\n");
break;
} else if(dev_data.type == FuriHalNfcTypeF) {
printf("IDm:");
for(size_t i = 0; i < 8; i++) {
printf("%02X", dev_data.uid[i]);
}
printf("\r\nPMm:");
for(size_t i = 0; i < 8; i++) {
printf("%02X", dev_data.f_data.pmm[i]);
}
printf("\r\n");
break;
}
printf("\r\n");
break;
}
furi_hal_nfc_sleep();
furi_delay_ms(50);
@@ -61,13 +74,15 @@ static void nfc_cli_emulate(Cli* cli, FuriString* args) {
FuriHalNfcDevData params = {
.uid = {0x36, 0x9C, 0xe7, 0xb1, 0x0A, 0xC1, 0x34},
.uid_len = 7,
.atqa = {0x44, 0x00},
.sak = 0x00,
.a_data = {
.atqa = {0x44, 0x00},
.sak = 0x00,
},
.type = FuriHalNfcTypeA,
};
while(!cli_cmd_interrupt_received(cli)) {
if(furi_hal_nfc_listen(params.uid, params.uid_len, params.atqa, params.sak, false, 100)) {
if(furi_hal_nfc_listen(params.uid, params.uid_len, params.a_data.atqa, params.a_data.sak, false, 100)) {
printf("Reader detected\r\n");
furi_hal_nfc_sleep();
}
applications/main/nfc/scenes/nfc_scene_config.h
+1
View File
@@ -45,6 +45,7 @@ ADD_SCENE(nfc, mf_classic_update_success, MfClassicUpdateSuccess)
ADD_SCENE(nfc, mf_classic_wrong_card, MfClassicWrongCard)
ADD_SCENE(nfc, emv_read_success, EmvReadSuccess)
ADD_SCENE(nfc, emv_menu, EmvMenu)
ADD_SCENE(nfc, felica_read_success, FelicaReadSuccess)
ADD_SCENE(nfc, emulate_apdu_sequence, EmulateApduSequence)
ADD_SCENE(nfc, device_info, DeviceInfo)
ADD_SCENE(nfc, delete, Delete)
applications/main/nfc/scenes/nfc_scene_felica_read_success.c
+80
View File
@@ -0,0 +1,80 @@
#include "../nfc_i.h"
void nfc_scene_felica_read_success_widget_callback(
GuiButtonType result,
InputType type,
void* context) {
furi_assert(context);
Nfc* nfc = context;
if(type == InputTypeShort) {
view_dispatcher_send_custom_event(nfc->view_dispatcher, result);
}
}
void nfc_scene_felica_read_success_on_enter(void* context) {
Nfc* nfc = context;
FelicaData* felica_data = &nfc->dev->dev_data.felica_data;
// Setup view
Widget* widget = nfc->widget;
widget_add_button_element(
widget, GuiButtonTypeLeft, "Retry", nfc_scene_felica_read_success_widget_callback, nfc);
FuriString* temp_str = NULL;
if(furi_string_size(nfc->dev->dev_data.parsed_data)) {
temp_str = furi_string_alloc_set(nfc->dev->dev_data.parsed_data);
} else {
temp_str = furi_string_alloc_printf("\e#%s", nfc_felica_type(felica_data->type));
FelicaSystem* current_system = felica_data->systems;
while(current_system) {
furi_string_cat_printf(temp_str, "\nSystem %04X (#%d):", current_system->code, current_system->number);
furi_string_cat_printf(temp_str, "\nIDm:\n ");
for(size_t i = 0; i < 8; i++) {
furi_string_cat_printf(temp_str, "%02X", current_system->idm[i]);
}
furi_string_cat_printf(temp_str, "\nPMm:\n ");
for(size_t i = 0; i < 8; i++) {
furi_string_cat_printf(temp_str, "%02X", current_system->pmm[i]);
}
current_system = current_system->next;
}
}
widget_add_text_scroll_element(widget, 0, 0, 128, 52, furi_string_get_cstr(temp_str));
furi_string_free(temp_str);
notification_message_block(nfc->notifications, &sequence_set_green_255);
view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewWidget);
}
bool nfc_scene_felica_read_success_on_event(void* context, SceneManagerEvent event) {
Nfc* nfc = context;
bool consumed = false;
if(event.type == SceneManagerEventTypeCustom) {
if(event.event == GuiButtonTypeLeft) {
scene_manager_next_scene(nfc->scene_manager, NfcSceneRetryConfirm);
consumed = true;
} else if(event.event == GuiButtonTypeRight) {
scene_manager_next_scene(nfc->scene_manager, NfcSceneNfcaMenu);
consumed = true;
}
} else if(event.type == SceneManagerEventTypeBack) {
scene_manager_next_scene(nfc->scene_manager, NfcSceneExitConfirm);
consumed = true;
}
return consumed;
}
void nfc_scene_felica_read_success_on_exit(void* context) {
Nfc* nfc = context;
notification_message_block(nfc->notifications, &sequence_reset_green);
// Clear view
widget_reset(nfc->widget);
}
applications/main/nfc/scenes/nfc_scene_nfc_data_info.c
+3 -3
View File
@@ -45,14 +45,14 @@ void nfc_scene_nfc_data_info_on_enter(void* context) {
}
// Set tag iso data
char iso_type = FURI_BIT(nfc_data->sak, 5) ? '4' : '3';
char iso_type = FURI_BIT(nfc_data->a_data.sak, 5) ? '4' : '3';
furi_string_cat_printf(temp_str, "ISO 14443-%c (NFC-A)\n", iso_type);
furi_string_cat_printf(temp_str, "UID:");
for(size_t i = 0; i < nfc_data->uid_len; i++) {
furi_string_cat_printf(temp_str, " %02X", nfc_data->uid[i]);
}
furi_string_cat_printf(temp_str, "\nATQA: %02X %02X ", nfc_data->atqa[1], nfc_data->atqa[0]);
furi_string_cat_printf(temp_str, " SAK: %02X", nfc_data->sak);
furi_string_cat_printf(temp_str, "\nATQA: %02X %02X ", nfc_data->a_data.atqa[1], nfc_data->a_data.atqa[0]);
furi_string_cat_printf(temp_str, " SAK: %02X", nfc_data->a_data.sak);
// Set application specific data
if(protocol == NfcDeviceProtocolMifareDesfire) {
applications/main/nfc/scenes/nfc_scene_nfca_read_success.c
+3 -3
View File
@@ -24,14 +24,14 @@ void nfc_scene_nfca_read_success_on_enter(void* context) {
notification_message_block(nfc->notifications, &sequence_set_green_255);
char iso_type = FURI_BIT(data->sak, 5) ? '4' : '3';
char iso_type = FURI_BIT(data->a_data.sak, 5) ? '4' : '3';
furi_string_cat_printf(temp_str, "ISO 14443-%c (NFC-A)\n", iso_type);
furi_string_cat_printf(temp_str, "UID:");
for(size_t i = 0; i < data->uid_len; i++) {
furi_string_cat_printf(temp_str, " %02X", data->uid[i]);
}
furi_string_cat_printf(temp_str, "\nATQA: %02X %02X ", data->atqa[1], data->atqa[0]);
furi_string_cat_printf(temp_str, " SAK: %02X", data->sak);
furi_string_cat_printf(temp_str, "\nATQA: %02X %02X ", data->a_data.atqa[1], data->a_data.atqa[0]);
furi_string_cat_printf(temp_str, " SAK: %02X", data->a_data.sak);
widget_add_text_scroll_element(widget, 0, 0, 128, 52, furi_string_get_cstr(temp_str));
furi_string_free(temp_str);
applications/main/nfc/scenes/nfc_scene_read.c
+5
View File
@@ -97,6 +97,11 @@ bool nfc_scene_read_on_event(void* context, SceneManagerEvent event) {
scene_manager_next_scene(nfc->scene_manager, NfcSceneDictNotFound);
}
consumed = true;
} else if(event.event == NfcWorkerEventReadFelica) {
notification_message(nfc->notifications, &sequence_success);
scene_manager_next_scene(nfc->scene_manager, NfcSceneFelicaReadSuccess);
DOLPHIN_DEED(DolphinDeedNfcReadSuccess);
consumed = true;
} else if(event.event == NfcWorkerEventCardDetected) {
nfc_scene_read_set_state(nfc, NfcSceneReadStateReading);
nfc_blink_detect_start(nfc);
applications/main/nfc/scenes/nfc_scene_set_atqa.c
+1 -1
View File
@@ -17,7 +17,7 @@ void nfc_scene_set_atqa_on_enter(void* context) {
nfc_scene_set_atqa_byte_input_callback,
NULL,
nfc,
nfc->dev->dev_data.nfc_data.atqa,
nfc->dev->dev_data.nfc_data.a_data.atqa,
2);
view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewByteInput);
}
applications/main/nfc/scenes/nfc_scene_set_sak.c
+1 -1
View File
@@ -17,7 +17,7 @@ void nfc_scene_set_sak_on_enter(void* context) {
nfc_scene_set_sak_byte_input_callback,
NULL,
nfc,
&nfc->dev->dev_data.nfc_data.sak,
&nfc->dev->dev_data.nfc_data.a_data.sak,
1);
view_dispatcher_switch_to_view(nfc->view_dispatcher, NfcViewByteInput);
}
firmware/targets/f7/api_symbols.csv
+4 -1
View File
@@ -1,5 +1,5 @@
entry,status,name,type,params
Version,+,8.1,,
Version,+,8.2,,
Header,+,applications/services/bt/bt_service/bt.h,,
Header,+,applications/services/cli/cli.h,,
Header,+,applications/services/cli/cli_vcp.h,,
@@ -791,6 +791,9 @@ Function,-,fdim,double,"double, double"
Function,-,fdimf,float,"float, float"
Function,-,fdiml,long double,"long double, long double"
Function,-,fdopen,FILE*,"int, const char*"
Function,-,felica_check_ic_type,_Bool,uint8_t*
Function,-,felica_get_ic_type,FelicaICType,uint8_t*
Function,-,felica_read_card,_Bool,"FuriHalNfcTxRxContext*, FelicaData*, uint8_t*, uint8_t*"
Function,-,feof,int,FILE*
Function,-,feof_unlocked,int,FILE*
Function,-,ferror,int,FILE*
1 entry status name type params
2 Version + 8.1 8.2
3 Header + applications/services/bt/bt_service/bt.h
4 Header + applications/services/cli/cli.h
5 Header + applications/services/cli/cli_vcp.h
791 Function - fdimf float float, float
792 Function - fdiml long double long double, long double
793 Function - fdopen FILE* int, const char*
794 Function - felica_check_ic_type _Bool uint8_t*
795 Function - felica_get_ic_type FelicaICType uint8_t*
796 Function - felica_read_card _Bool FuriHalNfcTxRxContext*, FelicaData*, uint8_t*, uint8_t*
797 Function - feof int FILE*
798 Function - feof_unlocked int FILE*
799 Function - ferror int FILE*
firmware/targets/f7/furi_hal/furi_hal_nfc.c
+25 -10
View File
@@ -118,21 +118,36 @@ bool furi_hal_nfc_detect(FuriHalNfcDevData* nfc_data, uint32_t timeout) {
if(detected) {
if(dev_list[0].type == RFAL_NFC_LISTEN_TYPE_NFCA) {
nfc_data->type = FuriHalNfcTypeA;
nfc_data->atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
nfc_data->atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
nfc_data->sak = dev_list[0].dev.nfca.selRes.sak;
nfc_data->a_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
nfc_data->a_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
nfc_data->a_data.sak = dev_list[0].dev.nfca.selRes.sak;
uint8_t* cuid_start = dev_list[0].nfcid;
if(dev_list[0].nfcidLen == 7) {
cuid_start = &dev_list[0].nfcid[3];
}
nfc_data->cuid = (cuid_start[0] << 24) | (cuid_start[1] << 16) | (cuid_start[2] << 8) |
(cuid_start[3]);
nfc_data->a_data.cuid = (cuid_start[0] << 24) | (cuid_start[1] << 16) |
(cuid_start[2] << 8) | (cuid_start[3]);
} else if(
dev_list[0].type == RFAL_NFC_LISTEN_TYPE_NFCB ||
dev_list[0].type == RFAL_NFC_LISTEN_TYPE_ST25TB) {
nfc_data->type = FuriHalNfcTypeB;
} else if(dev_list[0].type == RFAL_NFC_LISTEN_TYPE_NFCF) {
nfc_data->type = FuriHalNfcTypeF;
furi_assert(dev_list[0].nfcidLen == RFAL_NFCF_NFCID2_LEN);
memcpy(
&nfc_data->f_data.pmm[0],
dev_list[0].dev.nfcf.sensfRes.PAD0,
RFAL_NFCF_SENSF_RES_PAD0_LEN);
memcpy(
&nfc_data->f_data.pmm[RFAL_NFCF_SENSF_RES_PAD0_LEN],
dev_list[0].dev.nfcf.sensfRes.PAD1,
RFAL_NFCF_SENSF_RES_PAD1_LEN);
nfc_data->f_data.pmm[RFAL_NFCF_SENSF_RES_PAD0_LEN + RFAL_NFCF_SENSF_RES_PAD1_LEN] =
dev_list[0].dev.nfcf.sensfRes.MRTIcheck;
nfc_data->f_data.pmm[RFAL_NFCF_SENSF_RES_PAD0_LEN + RFAL_NFCF_SENSF_RES_PAD1_LEN + 1] =
dev_list[0].dev.nfcf.sensfRes.MRTIupdate;
nfc_data->f_data.pmm[RFAL_NFCF_SENSF_RES_PAD0_LEN + RFAL_NFCF_SENSF_RES_PAD1_LEN + 2] =
dev_list[0].dev.nfcf.sensfRes.PAD2;
} else if(dev_list[0].type == RFAL_NFC_LISTEN_TYPE_NFCV) {
nfc_data->type = FuriHalNfcTypeV;
}
@@ -352,15 +367,15 @@ void furi_hal_nfc_listen_start(FuriHalNfcDevData* nfc_data) {
// Write PT Memory
uint8_t pt_memory[15] = {};
memcpy(pt_memory, nfc_data->uid, nfc_data->uid_len);
pt_memory[10] = nfc_data->atqa[0];
pt_memory[11] = nfc_data->atqa[1];
pt_memory[10] = nfc_data->a_data.atqa[0];
pt_memory[11] = nfc_data->a_data.atqa[1];
if(nfc_data->uid_len == 4) {
pt_memory[12] = nfc_data->sak & ~FURI_HAL_NFC_UID_INCOMPLETE;
pt_memory[12] = nfc_data->a_data.sak & ~FURI_HAL_NFC_UID_INCOMPLETE;
} else {
pt_memory[12] = FURI_HAL_NFC_UID_INCOMPLETE;
}
pt_memory[13] = nfc_data->sak & ~FURI_HAL_NFC_UID_INCOMPLETE;
pt_memory[14] = nfc_data->sak & ~FURI_HAL_NFC_UID_INCOMPLETE;
pt_memory[13] = nfc_data->a_data.sak & ~FURI_HAL_NFC_UID_INCOMPLETE;
pt_memory[14] = nfc_data->a_data.sak & ~FURI_HAL_NFC_UID_INCOMPLETE;
st25r3916WritePTMem(pt_memory, sizeof(pt_memory));
// Go to sense
firmware/targets/furi_hal_include/furi_hal_nfc.h
+14 -3
View File
@@ -69,14 +69,25 @@ typedef enum {
FuriHalNfcInterfaceNfcDep,
} FuriHalNfcInterface;
typedef struct {
uint32_t cuid;
uint8_t atqa[2];
uint8_t sak;
} FuriHalNfcADevData;
typedef struct {
uint8_t pmm[8];
} FuriHalNfcFDevData;
typedef struct {
FuriHalNfcType type;
FuriHalNfcInterface interface;
uint8_t uid_len;
uint8_t uid[10];
uint32_t cuid;
uint8_t atqa[2];
uint8_t sak;
union {
FuriHalNfcADevData a_data;
FuriHalNfcFDevData f_data;
};
} FuriHalNfcDevData;
typedef void (
lib/nfc/helpers/reader_analyzer.c
+6 -5
View File
@@ -39,13 +39,14 @@ struct ReaderAnalyzer {
const FuriHalNfcDevData reader_analyzer_nfc_data[] = {
[ReaderAnalyzerNfcDataMfClassic] =
{.sak = 0x08,
.atqa = {0x44, 0x00},
.interface = FuriHalNfcInterfaceRf,
{.interface = FuriHalNfcInterfaceRf,
.type = FuriHalNfcTypeA,
.uid_len = 7,
.uid = {0x04, 0x77, 0x70, 0x2A, 0x23, 0x4F, 0x80},
.cuid = 0x2A234F80},
.a_data = {
.sak = 0x08,
.atqa = {0x44, 0x00},
.cuid = 0x2A234F80}},
};
void reader_analyzer_parse(ReaderAnalyzer* instance, uint8_t* buffer, size_t size) {
@@ -130,7 +131,7 @@ void reader_analyzer_start(ReaderAnalyzer* instance, ReaderAnalyzerMode mode) {
instance->debug_log = nfc_debug_log_alloc();
}
if(mode & ReaderAnalyzerModeMfkey) {
instance->mfkey32 = mfkey32_alloc(instance->nfc_data.cuid);
instance->mfkey32 = mfkey32_alloc(instance->nfc_data.a_data.cuid);
if(instance->mfkey32) {
mfkey32_set_callback(instance->mfkey32, reader_analyzer_mfkey_callback, instance);
}
lib/nfc/nfc_device.c
+5 -5
View File
@@ -1041,8 +1041,8 @@ bool nfc_device_save(NfcDevice* dev, const char* dev_name) {
if(!flipper_format_write_comment_cstr(file, "UID, ATQA and SAK are common for all formats"))
break;
if(!flipper_format_write_hex(file, "UID", data->uid, data->uid_len)) break;
if(!flipper_format_write_hex(file, "ATQA", data->atqa, 2)) break;
if(!flipper_format_write_hex(file, "SAK", &data->sak, 1)) break;
if(!flipper_format_write_hex(file, "ATQA", data->a_data.atqa, 2)) break;
if(!flipper_format_write_hex(file, "SAK", &data->a_data.sak, 1)) break;
// Save more data if necessary
if(dev->format == NfcDeviceSaveFormatMifareUl) {
if(!nfc_device_save_mifare_ul_data(file, dev)) break;
@@ -1119,14 +1119,14 @@ static bool nfc_device_load_data(NfcDevice* dev, FuriString* path, bool show_dia
if(!(data_cnt == 4 || data_cnt == 7)) break;
data->uid_len = data_cnt;
if(!flipper_format_read_hex(file, "UID", data->uid, data->uid_len)) break;
if(!flipper_format_read_hex(file, "ATQA", data->atqa, 2)) break;
if(!flipper_format_read_hex(file, "SAK", &data->sak, 1)) break;
if(!flipper_format_read_hex(file, "ATQA", data->a_data.atqa, 2)) break;
if(!flipper_format_read_hex(file, "SAK", &data->a_data.sak, 1)) break;
// Load CUID
uint8_t* cuid_start = data->uid;
if(data->uid_len == 7) {
cuid_start = &data->uid[3];
}
data->cuid = (cuid_start[0] << 24) | (cuid_start[1] << 16) | (cuid_start[2] << 8) |
data->a_data.cuid = (cuid_start[0] << 24) | (cuid_start[1] << 16) | (cuid_start[2] << 8) |
(cuid_start[3]);
// Parse other data
if(dev->format == NfcDeviceSaveFormatMifareUl) {
lib/nfc/nfc_device.h
+5
View File
@@ -11,6 +11,7 @@
#include <lib/nfc/protocols/mifare_ultralight.h>
#include <lib/nfc/protocols/mifare_classic.h>
#include <lib/nfc/protocols/mifare_desfire.h>
#include <lib/nfc/protocols/felica.h>
#ifdef __cplusplus
extern "C" {
@@ -32,6 +33,7 @@ typedef enum {
NfcDeviceProtocolMifareUl,
NfcDeviceProtocolMifareClassic,
NfcDeviceProtocolMifareDesfire,
NfcDeviceProtocolFelica,
} NfcProtocol;
typedef enum {
@@ -40,6 +42,7 @@ typedef enum {
NfcDeviceSaveFormatMifareUl,
NfcDeviceSaveFormatMifareClassic,
NfcDeviceSaveFormatMifareDesfire,
NfcDeviceSaveFormatFelica,
} NfcDeviceSaveFormat;
typedef struct {
@@ -58,6 +61,7 @@ typedef enum {
NfcReadModeMfDesfire,
NfcReadModeEMV,
NfcReadModeNFCA,
NfcReadModeNFCF,
} NfcReadMode;
typedef struct {
@@ -74,6 +78,7 @@ typedef struct {
MfUltralightData mf_ul_data;
MfClassicData mf_classic_data;
MifareDesfireData mf_df_data;
FelicaData felica_data;
};
FuriString* parsed_data;
} NfcDeviceData;
lib/nfc/nfc_types.c
+60
View File
@@ -63,3 +63,63 @@ const char* nfc_mf_classic_type(MfClassicType type) {
return "Mifare Classic";
}
}
const char* nfc_felica_type(FelicaICType type) {
if(type == FelicaICType576B) {
return "FeliCa Classic 576B";
} else if(type == FelicaICType2K) {
return "FeliCa Classic 2K";
} else if(type == FelicaICType4K) {
return "FeliCa Classic 4K";
} else if(type == FelicaICTypeFRAM_4K) {
return "FeliCa Classic 4K (FRAM)";
} else if(type == FelicaICTypeFRAM_9K) {
return "FeliCa Classic 9K";
} else if(type == FelicaICTypeEMV_16K) {
return "FeliCa Classic EMV 16K";
} else if(type == FelicaICTypeEMV_32K) {
return "FeliCa Classic EMV 32K";
} else if(type == FelicaICTypeEMV_36K) {
return "FeliCa Classic EMV 36K";
} else if(type == FelicaICTypeEMV_36K) {
return "FeliCa Classic EMV 36K";
} else if(type == FelicaICTypeSD1WithDES) {
return "FeliCa SD1 (DES compatible)";
} else if(type == FelicaICTypeSD1) {
return "FeliCa SD1";
} else if(type == FelicaICTypeRC_SA08) {
return "FeliCa RC-SA08";
} else if(type == FelicaICTypeSD2WithDES) {
return "FeliCa SD2 (DES compatible)";
} else if(type == FelicaICTypeSD2_4K) {
return "FeliCa SD2 4K";
} else if(type == FelicaICTypeSD2_6K) {
return "FeliCa SD2 6K";
} else if(type == FelicaICTypeRC_SA24_6K) {
return "FeliCa RC-SA24 6K";
} else if(type == FelicaICTypeRC_SA24_10K) {
return "FeliCa RC-SA24 6K";
} else if(type == FelicaICTypeMobileIC_V1) {
return "Mobile FeliCa v1";
} else if(type == FelicaICTypeMobileIC_V2) {
return "Mobile FeliCa v2";
} else if(type == FelicaICTypeMobileIC_V3) {
return "Mobile FeliCa v3";
} else if(type == FelicaICTypeMobileIC_V4) {
return "Mobile FeliCa v4";
} else if(type == FelicaICTypeMobileIC_V4_1) {
return "Mobile FeliCa v4.1";
} else if(type == FelicaICTypeLite) {
return "FeliCa Lite";
} else if(type == FelicaICTypeLiteS) {
return "FeliCa Lite-S";
} else if(type == FelicaICTypeLink) {
return "FeliCa Link";
} else if(type == FelicaICTypePlug) {
return "FeliCa Plug";
} else if(type == FelicaICTypeSuica) {
return "FeliCa (SuiCa)";
} else {
return "FeliCa";
}
}
lib/nfc/nfc_types.h
+2
View File
@@ -9,3 +9,5 @@ const char* nfc_guess_protocol(NfcProtocol protocol);
const char* nfc_mf_ul_type(MfUltralightType type, bool full_name);
const char* nfc_mf_classic_type(MfClassicType type);
const char* nfc_felica_type(FelicaICType type);
lib/nfc/nfc_worker.c
+68 -16
View File
@@ -292,20 +292,21 @@ static bool nfc_worker_read_bank_card(NfcWorker* nfc_worker, FuriHalNfcTxRxConte
static bool nfc_worker_read_nfca(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
FuriHalNfcADevData* a_data = &nfc_data->a_data;
bool card_read = false;
furi_hal_nfc_sleep();
if(mf_ul_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
if(mf_ul_check_card_type(a_data->atqa[0], a_data->atqa[1], a_data->sak)) {
FURI_LOG_I(TAG, "Mifare Ultralight / NTAG detected");
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareUl;
card_read = nfc_worker_read_mf_ultralight(nfc_worker, tx_rx);
} else if(mf_classic_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
} else if(mf_classic_check_card_type(a_data->atqa[0], a_data->atqa[1], a_data->sak)) {
FURI_LOG_I(TAG, "Mifare Classic detected");
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareClassic;
nfc_worker->dev_data->mf_classic_data.type =
mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
mf_classic_get_classic_type(a_data->atqa[0], a_data->atqa[1], a_data->sak);
card_read = nfc_worker_read_mf_classic(nfc_worker, tx_rx);
} else if(mf_df_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
} else if(mf_df_check_card_type(a_data->atqa[0], a_data->atqa[1], a_data->sak)) {
FURI_LOG_I(TAG, "Mifare DESFire detected");
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareDesfire;
if(!nfc_worker_read_mf_desfire(nfc_worker, tx_rx)) {
@@ -329,6 +330,46 @@ static bool nfc_worker_read_nfca(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* t
return card_read;
}
static bool nfc_worker_read_felica(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
bool read_success = false;
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
FelicaData* data = &nfc_worker->dev_data->felica_data;
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_prepare_tx_rx(nfc_worker->reader_analyzer, tx_rx, false);
reader_analyzer_start(nfc_worker->reader_analyzer, ReaderAnalyzerModeDebugLog);
}
do {
if(!furi_hal_nfc_detect(&nfc_worker->dev_data->nfc_data, 300)) break;
if(!felica_read_card(tx_rx, data, nfc_data->uid, nfc_data->f_data.pmm)) break;
read_success = true;
} while(false);
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
reader_analyzer_stop(nfc_worker->reader_analyzer);
}
return read_success;
}
static bool nfc_worker_read_nfcf(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
FuriHalNfcFDevData* f_data = &nfc_data->f_data;
bool card_read = false;
furi_hal_nfc_sleep();
if(felica_check_ic_type(f_data->pmm)) {
FURI_LOG_I(TAG, "FeliCa detected");
nfc_worker->dev_data->protocol = NfcDeviceProtocolFelica;
nfc_worker->dev_data->felica_data.type = felica_get_ic_type(f_data->pmm);
card_read = nfc_worker_read_felica(nfc_worker, tx_rx);
} else {
nfc_worker->dev_data->protocol = NfcDeviceProtocolUnknown;
}
return card_read;
}
void nfc_worker_read(NfcWorker* nfc_worker) {
furi_assert(nfc_worker);
furi_assert(nfc_worker->callback);
@@ -373,6 +414,11 @@ void nfc_worker_read(NfcWorker* nfc_worker) {
event = NfcWorkerEventReadUidNfcB;
break;
} else if(nfc_data->type == FuriHalNfcTypeF) {
nfc_worker->callback(NfcWorkerEventCardDetected, nfc_worker->context);
if(nfc_worker_read_nfcf(nfc_worker, &tx_rx)) {
event = NfcWorkerEventReadFelica;
break;
}
event = NfcWorkerEventReadUidNfcF;
break;
} else if(nfc_data->type == FuriHalNfcTypeV) {
@@ -417,7 +463,7 @@ void nfc_worker_read_type(NfcWorker* nfc_worker) {
if(read_mode == NfcReadModeMfClassic) {
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareClassic;
nfc_worker->dev_data->mf_classic_data.type = mf_classic_get_classic_type(
nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
nfc_data->a_data.atqa[0], nfc_data->a_data.atqa[1], nfc_data->a_data.sak);
if(nfc_worker_read_mf_classic(nfc_worker, &tx_rx)) {
FURI_LOG_D(TAG, "Card read");
dev_data->protocol = NfcDeviceProtocolMifareClassic;
@@ -478,7 +524,8 @@ void nfc_worker_emulate_uid(NfcWorker* nfc_worker) {
// Need to save ATS to support ISO-14443A-4 emulation
while(nfc_worker->state == NfcWorkerStateUidEmulate) {
if(furi_hal_nfc_listen(data->uid, data->uid_len, data->atqa, data->sak, false, 100)) {
if(furi_hal_nfc_listen(
data->uid, data->uid_len, data->a_data.atqa, data->a_data.sak, false, 100)) {
if(furi_hal_nfc_tx_rx(&tx_rx, 100)) {
reader_data->size = tx_rx.rx_bits / 8;
if(reader_data->size > 0) {
@@ -499,8 +546,11 @@ void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
FuriHalNfcDevData params = {
.uid = {0xCF, 0x72, 0xd4, 0x40},
.uid_len = 4,
.atqa = {0x00, 0x04},
.sak = 0x20,
.a_data =
{
.atqa = {0x00, 0x04},
.sak = 0x20,
},
.type = FuriHalNfcTypeA,
};
@@ -510,7 +560,8 @@ void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
}
while(nfc_worker->state == NfcWorkerStateEmulateApdu) {
if(furi_hal_nfc_listen(params.uid, params.uid_len, params.atqa, params.sak, false, 300)) {
if(furi_hal_nfc_listen(
params.uid, params.uid_len, params.a_data.atqa, params.a_data.sak, false, 300)) {
FURI_LOG_D(TAG, "POS terminal detected");
if(emv_card_emulation(&tx_rx)) {
FURI_LOG_D(TAG, "EMV card emulated");
@@ -551,8 +602,8 @@ void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
furi_hal_nfc_emulate_nfca(
nfc_data->uid,
nfc_data->uid_len,
nfc_data->atqa,
nfc_data->sak,
nfc_data->a_data.atqa,
nfc_data->a_data.sak,
mf_ul_prepare_emulation_response,
&emulator,
5000);
@@ -783,8 +834,8 @@ void nfc_worker_write_mf_classic(NfcWorker* nfc_worker) {
}
FURI_LOG_I(TAG, "Check mf classic type");
MfClassicType type =
mf_classic_get_classic_type(nfc_data.atqa[0], nfc_data.atqa[1], nfc_data.sak);
MfClassicType type = mf_classic_get_classic_type(
nfc_data.a_data.atqa[0], nfc_data.a_data.atqa[1], nfc_data.a_data.sak);
if(type != nfc_worker->dev_data->mf_classic_data.type) {
FURI_LOG_E(TAG, "Wrong mf classic type");
nfc_worker->callback(NfcWorkerEventWrongCard, nfc_worker->context);
@@ -855,8 +906,8 @@ void nfc_worker_update_mf_classic(NfcWorker* nfc_worker) {
}
FURI_LOG_I(TAG, "Check MF classic type");
MfClassicType type =
mf_classic_get_classic_type(nfc_data.atqa[0], nfc_data.atqa[1], nfc_data.sak);
MfClassicType type = mf_classic_get_classic_type(
nfc_data.a_data.atqa[0], nfc_data.a_data.atqa[1], nfc_data.a_data.sak);
if(type != nfc_worker->dev_data->mf_classic_data.type) {
FURI_LOG_E(TAG, "MF classic type mismatch");
nfc_worker->callback(NfcWorkerEventWrongCard, nfc_worker->context);
@@ -918,7 +969,8 @@ void nfc_worker_mf_ultralight_read_auth(NfcWorker* nfc_worker) {
while(nfc_worker->state == NfcWorkerStateReadMfUltralightReadAuth) {
furi_hal_nfc_sleep();
if(furi_hal_nfc_detect(nfc_data, 300) && nfc_data->type == FuriHalNfcTypeA) {
if(mf_ul_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
if(mf_ul_check_card_type(
nfc_data->a_data.atqa[0], nfc_data->a_data.atqa[1], nfc_data->a_data.sak)) {
nfc_worker->callback(NfcWorkerEventCardDetected, nfc_worker->context);
if(data->auth_method == MfUltralightAuthMethodManual ||
data->auth_method == MfUltralightAuthMethodAuto) {
lib/nfc/nfc_worker.h
+1
View File
@@ -34,6 +34,7 @@ typedef enum {
NfcWorkerEventReadUidNfcV,
NfcWorkerEventReadUidNfcF,
NfcWorkerEventReadUidNfcA,
NfcWorkerEventReadFelica,
NfcWorkerEventReadMfUltralight,
NfcWorkerEventReadMfDesfire,
NfcWorkerEventReadMfClassicDone,
lib/nfc/nfc_worker_i.h
+1
View File
@@ -11,6 +11,7 @@
#include <lib/nfc/protocols/mifare_ultralight.h>
#include <lib/nfc/protocols/mifare_classic.h>
#include <lib/nfc/protocols/mifare_desfire.h>
#include <lib/nfc/protocols/felica.h>
#include <lib/nfc/protocols/nfca.h>
#include <lib/nfc/helpers/reader_analyzer.h>
lib/nfc/parsers/plantain_4k_parser.c
+2 -2
View File
@@ -70,8 +70,8 @@ bool plantain_4k_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx
furi_assert(nfc_worker);
MfClassicReader reader = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
for(size_t i = 0; i < COUNT_OF(plantain_keys_4k); i++) {
mf_classic_reader_add_sector(
&reader,
lib/nfc/parsers/plantain_parser.c
+2 -2
View File
@@ -45,8 +45,8 @@ bool plantain_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
furi_assert(nfc_worker);
MfClassicReader reader = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
for(size_t i = 0; i < COUNT_OF(plantain_keys); i++) {
mf_classic_reader_add_sector(
&reader, plantain_keys[i].sector, plantain_keys[i].key_a, plantain_keys[i].key_b);
lib/nfc/parsers/troika_4k_parser.c
+2 -2
View File
@@ -67,8 +67,8 @@ bool troika_4k_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx)
furi_assert(nfc_worker);
MfClassicReader reader = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
for(size_t i = 0; i < COUNT_OF(troika_4k_keys); i++) {
mf_classic_reader_add_sector(
&reader, troika_4k_keys[i].sector, troika_4k_keys[i].key_a, troika_4k_keys[i].key_b);
lib/nfc/parsers/troika_parser.c
+2 -2
View File
@@ -43,8 +43,8 @@ bool troika_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
furi_assert(nfc_worker);
MfClassicReader reader = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
for(size_t i = 0; i < COUNT_OF(troika_keys); i++) {
mf_classic_reader_add_sector(
lib/nfc/parsers/two_cities.c
+2 -2
View File
@@ -71,8 +71,8 @@ bool two_cities_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx)
furi_assert(nfc_worker);
MfClassicReader reader = {};
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
for(size_t i = 0; i < COUNT_OF(two_cities_keys_4k); i++) {
mf_classic_reader_add_sector(
&reader,
lib/nfc/protocols/felica.c
+572
View File
@@ -0,0 +1,572 @@
#include <limits.h>
#include <mbedtls/sha1.h>
#include "felica.h"
#include "nfc_util.h"
#include <furi.h>
#include "furi_hal_nfc.h"
#define TAG "FeliCa"
bool felica_check_ic_type(uint8_t* PMm) {
uint8_t ic_type = PMm[0];
uint8_t rom_type = PMm[1];
bool is_valid_ic = false;
if (ic_type == 0xff) { // RC-S967 in nfc-dep
is_valid_ic = true;
} else if (ic_type == 0xf0 || ic_type == 0xf2) { // Lite(S)
is_valid_ic = true;
} else if (ic_type == 0xe1) { // RC-S967 in plug mode
is_valid_ic = true;
} else if (ic_type == 0xe0) { // RC-S926
is_valid_ic = true;
} else if (ic_type >= 0x44 && ic_type <= 0x48) { // SD2
is_valid_ic = true;
} else if (ic_type == 0x3e && rom_type == 0x03) { // RC-SA08
return true;
} else if (ic_type == 0x35) { // RC-SA01
is_valid_ic = true;
} else if (ic_type == 0x32) { // RC-SA00
is_valid_ic = true;
} else if (ic_type == 0x31) { // Suica/PASMO
is_valid_ic = true;
} else if (ic_type == 0x20) { // RC-S962
is_valid_ic = true;
} else if (ic_type >= 0x10 && ic_type <= 0x1f) { // Mobile IC version 2/3
is_valid_ic = true;
} else if (ic_type == 0x0d) { // RC-S960
is_valid_ic = true;
} else if (ic_type == 0x0c) { // RC-S954
is_valid_ic = true;
} else if (ic_type == 0x0b) { // Old Suica?
is_valid_ic = true;
} else if (ic_type == 0x09) { // RC-S953
is_valid_ic = true;
} else if (ic_type == 0x08) { // RC-S952
is_valid_ic = true;
} else if (ic_type == 0x06 || ic_type == 0x07) { // Mobile IC version 1
is_valid_ic = true;
} else if (ic_type == 0x02) { // RC-S919
is_valid_ic = true;
} else if (ic_type == 0x01) { // RC-S915
is_valid_ic = true;
} else if (ic_type == 0x00) { // RC-S830
is_valid_ic = true;
}
if (!is_valid_ic) {
return false;
}
// need more samples to confirm below
/*
if (rom_type != 0x01) {
return false;
}
*/
return true;
}
uint8_t felica_prepare_unencrypted_read(
uint8_t* dest,
const FelicaReader* reader,
const uint16_t* service_code_list, uint8_t service_count,
const uint32_t* block_list, uint8_t block_count) {
dest[0] = FELICA_UNENCRYPTED_READ_CMD;
memcpy(&dest[1], reader->current_idm, 8);
dest[9] = service_count;
uint8_t msg_len = 10;
for(int i = 0; i < service_count; i++) {
uint16_t service_code = service_code_list[i];
dest[msg_len++] = service_code & 0xFF;
dest[msg_len++] = service_code >> 8;
}
dest[msg_len++] = block_count;
for(int i = 0; i < block_count; i++) {
uint16_t block_num = block_list[i];
dest[msg_len++] = block_num & 0xFF;
dest[msg_len++] = block_num >> 8;
}
return msg_len;
}
uint8_t felica_lite_prepare_unencrypted_read(
uint8_t* dest,
const FelicaReader* reader,
bool is_read_only,
const uint8_t* block_list, uint8_t block_count) {
dest[0] = FELICA_UNENCRYPTED_READ_CMD;
memcpy(&dest[1], reader->current_idm, 8);
dest[9] = 1;
uint8_t msg_len = 10;
uint8_t service_code = RANDOM_TYPE_SERVICE_ATTRIBUTE | (
(is_read_only)
? UNAUTH_RO_SERVICE_ATTRIBUTE
: UNAUTH_RW_SERVICE_ATTRIBUTE);
dest[msg_len++] = service_code & 0xFF;
dest[msg_len++] = service_code >> 8;
dest[msg_len++] = block_count;
for(int i = 0; i < block_count; i++) {
dest[msg_len++] = IS_2_BYTE_BLOCK_LIST_ELEMENT;
dest[msg_len++] = block_list[i];
}
return msg_len;
}
uint16_t felica_parse_unencrypted_read(
uint8_t* buf, uint8_t len,
FelicaReader* reader,
uint8_t* out, uint16_t out_len) {
if(len < 12) {
return false;
}
len--;
buf++;
if(*buf != FELICA_UNENCRYPTED_READ_RES) {
return false;
}
len--;
buf++;
if(memcmp(buf, reader->current_idm, 8) != 0) {
return false;
}
len -= 8;
buf += 8;
reader->status_flags[0] = buf[0];
reader->status_flags[1] = buf[1];
len -= 2;
buf += 2;
if(reader->status_flags[0] != 0) {
FURI_LOG_W(TAG, "SF1: %02X SF2: %02X", reader->status_flags[0], reader->status_flags[1]);
return 0;
}
if(len < 1) {
return 0;
}
uint16_t data_length = *buf * 16;
len--;
buf++;
if (len < data_length || out_len < data_length) {
return 0;
}
memcpy(out, buf, data_length);
return data_length;
}
uint8_t felica_prepare_unencrypted_write(
uint8_t* dest,
FelicaReader* reader,
const uint16_t* service_code_list, uint8_t service_count,
const uint32_t* block_list, uint8_t block_count,
const uint8_t* block_data) {
dest[0] = FELICA_UNENCRYPTED_WRITE_CMD;
memcpy(&dest[1], reader->current_idm, 8);
dest[9] = service_count;
uint8_t msg_len = 10;
for(int i = 0; i < service_count; i++) {
uint16_t service_code = service_code_list[i];
dest[msg_len++] = service_code & 0xFF;
dest[msg_len++] = service_code >> 8;
}
dest[msg_len++] = block_count;
for(int i = 0; i < block_count; i++) {
uint16_t block_num = block_list[i];
dest[msg_len++] = block_num & 0xFF;
dest[msg_len++] = block_num >> 8;
}
uint16_t data_length = block_count * FELICA_BLOCK_SIZE;
memcpy(dest + msg_len, block_data, data_length);
msg_len += data_length;
return msg_len;
}
uint8_t felica_lite_prepare_unencrypted_write(
uint8_t* dest,
const FelicaReader* reader,
const uint8_t* block_list, uint8_t block_count,
const uint8_t* block_data) {
dest[0] = FELICA_UNENCRYPTED_WRITE_CMD;
memcpy(&dest[1], reader->current_idm, 8);
dest[9] = 1;
uint8_t msg_len = 10;
uint8_t service_code = RANDOM_TYPE_SERVICE_ATTRIBUTE | UNAUTH_RW_SERVICE_ATTRIBUTE;
dest[msg_len++] = service_code & 0xFF;
dest[msg_len++] = service_code >> 8;
dest[msg_len++] = block_count;
for(int i = 0; i < block_count; i++) {
dest[msg_len++] = block_list[i];
dest[msg_len++] = IS_2_BYTE_BLOCK_LIST_ELEMENT;
}
uint16_t data_length = block_count * FELICA_BLOCK_SIZE;
memcpy(dest + msg_len, block_data, data_length);
msg_len += data_length;
return msg_len;
}
bool felica_parse_unencrypted_write(
uint8_t* buf, uint8_t len,
FelicaReader* reader) {
if(len < 12) {
return false;
}
len--;
buf++;
if(*buf != FELICA_UNENCRYPTED_WRITE_RES) {
return false;
}
len--;
buf++;
if(memcmp(buf, reader->current_idm, 8) != 0) {
return false;
}
len -= 8;
buf += 8;
reader->status_flags[0] = buf[0];
reader->status_flags[1] = buf[1];
len -= 2;
buf += 2;
if(reader->status_flags[0] != 0) {
FURI_LOG_W(TAG, "SF1: %02X SF2: %02X", reader->status_flags[0], reader->status_flags[1]);
return 0;
}
return true;
}
FelicaICType felica_get_ic_type(uint8_t* PMm) {
uint8_t rom_type = PMm[0];
uint8_t ic_type = PMm[1];
UNUSED(rom_type);
switch(ic_type) {
case 0xff:
return FelicaICTypeLink;
case 0xf2:
return FelicaICTypeLink;
case 0xf1:
return FelicaICTypeLiteS;
case 0xf0:
return FelicaICTypeLite;
case 0xe1:
return FelicaICTypeLink;
case 0xe0:
return FelicaICTypePlug;
case 0x48:
return FelicaICTypeSD2_6K;
case 0x47:
return FelicaICTypeRC_SA24_6K;
case 0x46:
return FelicaICTypeSD2_4K;
case 0x45:
case 0x44:
return FelicaICTypeSD2WithDES;
case 0x3e:
return FelicaICTypeRC_SA08;
case 0x35:
return FelicaICTypeSD1;
case 0x32:
return FelicaICTypeSD1WithDES;
case 0x31:
return FelicaICTypeSuica;
case 0x20:
return FelicaICTypeFRAM_4K;
case 0x1f:
case 0x1e:
case 0x1d:
case 0x1c:
case 0x1b:
case 0x1a:
case 0x19:
case 0x18:
return FelicaICTypeMobileIC_V4_1;
case 0x17:
return FelicaICTypeMobileIC_V4;
case 0x16:
case 0x15:
case 0x14:
return FelicaICTypeMobileIC_V3;
case 0x13:
case 0x12:
case 0x11:
case 0x10:
return FelicaICTypeMobileIC_V2;
case 0x0d:
return FelicaICTypeFRAM_9K;
case 0x0c:
return FelicaICTypeEMV_36K;
case 0x0b: // Old Suica?
return FelicaICTypeSuica;
case 0x09:
return FelicaICTypeEMV_16K;
case 0x08:
return FelicaICTypeEMV_32K;
case 0x07:
case 0x06:
return FelicaICTypeMobileIC_V1;
case 0x02:
return FelicaICType576B;
case 0x01:
return FelicaICType4K;
case 0x00:
return FelicaICType2K;
}
return FelicaICType2K;
}
void felica_parse_system_info(FelicaSystem* system, uint8_t* IDm, uint8_t* PMm) {
memcpy(system->idm, IDm, 8);
memcpy(system->pmm, PMm, 8);
for(int i = 0; i < 6; i++) {
char MRT_byte = PMm[2 + i];
FelicaMRTParts* mrt_data = &system->maximum_response_times[i];
mrt_data->real_a = (MRT_byte & 7) + 1;
MRT_byte >>= 3;
mrt_data->real_b = (MRT_byte & 7) + 1;
MRT_byte >>= 3;
mrt_data->exponent = (MRT_byte & 3);
}
}
bool felica_lite_can_read_without_mac(uint8_t* mc_r_restr, uint8_t block_number) {
if(block_number > REG_LITE_BLOCK) {
return true;
}
uint8_t byte = mc_r_restr[block_number < 8 ? 0 : 1];
return ((byte >> (block_number % 8)) & 1) == 0;
}
void felica_define_normal_block(FelicaService* service, uint16_t number, uint8_t* data) {
FelicaBlock* block = malloc(sizeof(FelicaBlock));
block->type = FelicaBlockTypeNormal;
memcpy(block->data, data, FELICA_BLOCK_SIZE);
service->blocks[number] = block;
}
bool felica_read_lite_system(FuriHalNfcTxRxContext* tx_rx, FelicaReader* reader, FelicaData* data, FelicaSystem* system) {
const uint8_t fixed_services[] = {
SYS_CODE_LITE_BLOCK,
RC_LITE_BLOCK,
ID_LITE_BLOCK,
MAC_LITE_BLOCK,
DEVICE_ID_LITE_BLOCK,
CARD_KEY_VER_LITE_BLOCK,
MEM_CONFIG_LITE_BLOCK,
};
uint8_t block_data[FELICA_BLOCK_SIZE * 4];
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
tx_rx->tx_data,
reader,
true,
fixed_services, 1
);
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
FURI_LOG_W(TAG, "Bad exchange verifying Lite system code");
return false;
}
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE) {
FURI_LOG_W(TAG, "Bad response to Read without Encryption (SYS_C)");
return false;
}
if (block_data[0] != (LITE_SYSTEM_CODE >> 8) && block_data[1] != (LITE_SYSTEM_CODE & 0xFF)) {
FURI_LOG_W(TAG, "Unexpected SYS_C value");
return false;
}
system->code = LITE_SYSTEM_CODE;
FelicaService* service = malloc(sizeof(FelicaService));
system->services = service;
service->number = 0;
service->block_count = CRC_CHECK_LITE_BLOCK;
service->blocks = malloc(sizeof(FelicaBlock*) * service->block_count);
for(int i = 0; i < service->block_count; i++) {
service->blocks[i] = NULL;
}
felica_define_normal_block(service, SYS_CODE_LITE_BLOCK, block_data);
memset(block_data, 0, FELICA_BLOCK_SIZE);
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_write(
tx_rx->tx_data,
reader,
&fixed_services[1], 1,
block_data
);
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
FURI_LOG_W(TAG, "Bad exchange writing random challenge");
return false;
}
if(!felica_parse_unencrypted_write(tx_rx->rx_data, tx_rx->rx_bits / 8, reader)) {
FURI_LOG_W(TAG, "Bad response to Write without Encryption (RC)");
return false;
}
felica_define_normal_block(service, RC_LITE_BLOCK, block_data);
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
tx_rx->tx_data,
reader,
true,
&fixed_services[2], 2
);
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
FURI_LOG_W(TAG, "Bad exchange reading ID with MAC");
return false;
}
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 2) {
FURI_LOG_W(TAG, "Bad response to Read without Encryption (ID, MAC)");
return false;
}
felica_define_normal_block(service, ID_LITE_BLOCK, block_data);
felica_define_normal_block(service, MAC_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
FURI_LOG_I(TAG, "ID:");
for(int i = 0; i < 16; i++) {
FURI_LOG_I(TAG, "%02X", block_data[i]);
}
FURI_LOG_I(TAG, "MAC:");
for(int i = 0; i < 16; i++) {
FURI_LOG_I(TAG, "%02X", block_data[i + FELICA_BLOCK_SIZE]);
}
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
tx_rx->tx_data,
reader,
true,
&fixed_services[4], 3
);
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
FURI_LOG_W(TAG, "Bad exchange reading blocks");
return false;
}
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 3) {
FURI_LOG_W(TAG, "Bad response to Read without Encryption (D_ID, CKV, MC)");
return false;
}
felica_define_normal_block(service, DEVICE_ID_LITE_BLOCK, block_data);
felica_define_normal_block(service, CARD_KEY_VER_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
felica_define_normal_block(service, MEM_CONFIG_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE * 2);
// Read SPAD and REG accordingly to MC
uint8_t* mc_data = block_data + (FELICA_BLOCK_SIZE * 2);
for (uint8_t block_number = 0; block_number <= REG_LITE_BLOCK; block_number++) {
if(!felica_lite_can_read_without_mac(mc_data + 6, block_number)) {
continue;
}
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
tx_rx->tx_data,
reader,
true,
&block_number, 1
);
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
FURI_LOG_W(TAG, "Bad exchange reading blocks");
return false;
}
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE) {
FURI_LOG_W(TAG, "Bad response to Read without Encryption (block %d)", block_number);
return false;
}
felica_define_normal_block(service, block_number, block_data);
}
if (data->type == FelicaICTypeLiteS) {
const uint8_t fixed_s_services[] = {
ID_LITE_BLOCK,
MAC_A_LITE_BLOCK,
WRITE_COUNT_LITE_BLOCK,
CRC_CHECK_LITE_BLOCK,
};
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
tx_rx->tx_data,
reader,
true,
fixed_s_services, 2
);
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
FURI_LOG_W(TAG, "Bad exchange reading ID with MAC_A");
return false;
}
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 2) {
FURI_LOG_W(TAG, "Bad response to Read without Encryption (ID, MAC_A)");
return false;
}
felica_define_normal_block(service, ID_LITE_BLOCK, block_data);
felica_define_normal_block(service, MAC_A_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
tx_rx->tx_data,
reader,
true,
&fixed_s_services[2], 2
);
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
FURI_LOG_W(TAG, "Bad exchange reading ID with MAC_A");
return false;
}
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 2) {
FURI_LOG_W(TAG, "Bad response to Read without Encryption (WC, CRC_CHECK)");
return false;
}
felica_define_normal_block(service, WRITE_COUNT_LITE_BLOCK, block_data);
felica_define_normal_block(service, CRC_CHECK_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
}
return true;
}
bool felica_read_card(FuriHalNfcTxRxContext* tx_rx, FelicaData* data, uint8_t* polled_idm, uint8_t* polled_pmm) {
furi_assert(tx_rx);
furi_assert(polled_idm);
furi_assert(polled_pmm);
bool card_read = false;
do {
FelicaReader reader;
memcpy(reader.current_idm, polled_idm, 8);
memcpy(reader.current_pmm, polled_pmm, 8);
FelicaSystem* current_system = malloc(sizeof(FelicaSystem));
data->systems = current_system;
felica_parse_system_info(current_system, polled_idm, polled_pmm);
current_system->next = NULL;
if (data->type == FelicaICTypeLite || data->type == FelicaICTypeLiteS) {
FURI_LOG_I(TAG, "Reading Felica Lite system");
felica_read_lite_system(tx_rx, &reader, data, current_system);
card_read = true;
break;
}
} while(false);
return card_read;
}
lib/nfc/protocols/felica.h
+173
View File
@@ -0,0 +1,173 @@
#pragma once
#include <furi_hal_nfc.h>
#define NFCF_F_SIG (13560000.0)
#define MRT_T_SIG 302064.89 //ns, 256 * 16 / NFC_F_SIG * 1e9
#define MRT_T_SIG_x4 1208259.56 //ns, MRT_T_SIG * (4 ** 1)
#define MRT_T_SIG_x16 4833038.24 //ns, MRT_T_SIG * (4 ** 2)
#define MRT_T_SIG_x64 19332152.96 //ns, MRT_T_SIG * (4 ** 2)
#define FELICA_BLOCK_SIZE 16
#define SUICA_SYSTEM_CODE 0x0003
#define NDEF_SYSTEM_CODE 0x12fc
#define HCE_F_SYSTEM_CODE 0x4000
#define OCTOPUS_SYSTEM_CODE 0x8008
#define EDY_SYSTEM_CODE 0x811d
#define PASPY_SYSTEM_CODE 0x8592
#define BLACKBOARD_SYSTEM_CODE 0x8620
#define SAPICA_SYSTEM_CODE 0x865e
#define LITE_SYSTEM_CODE 0x88b4
#define RYUTO_SYSTEM_CODE 0x8b5d
#define OKICA_SYSTEM_CODE 0x8fc1
#define SECURE_ID_SYSTEM_CODE 0x957a
#define IRUCA_SYSTEM_CODE 0xde80
#define COMMON_AREA_SYSTEM_CODE 0xfe00
#define PLUG_SYSTEM_CODE 0xfee1
#define REG_LITE_BLOCK 0x0e
#define RC_LITE_BLOCK 0x80
#define MAC_LITE_BLOCK 0x81
#define ID_LITE_BLOCK 0x82
#define DEVICE_ID_LITE_BLOCK 0x83
#define SERVICE_CODE_LITE_BLOCK 0x84
#define SYS_CODE_LITE_BLOCK 0x85
#define CARD_KEY_VER_LITE_BLOCK 0x86
#define CARD_KEY_LITE_BLOCK 0x87
#define MEM_CONFIG_LITE_BLOCK 0x88
#define WRITE_COUNT_LITE_BLOCK 0x90
#define MAC_A_LITE_BLOCK 0x91
#define STATE_LITE_BLOCK 0x92
#define CRC_CHECK_LITE_BLOCK 0xA0
#define RANDOM_TYPE_SERVICE_ATTRIBUTE (0b0010 << 2)
#define CYCLIC_TYPE_SERVICE_ATTRIBUTE (0b0011 << 2)
#define PURSE_TYPE_SERVICE_ATTRIBUTE (0b010 << 3)
#define AUTH_RW_SERVICE_ATTRIBUTE (0b00)
#define UNAUTH_RW_SERVICE_ATTRIBUTE (0b01)
#define AUTH_RO_SERVICE_ATTRIBUTE (0b10)
#define UNAUTH_RO_SERVICE_ATTRIBUTE (0b11)
#define AUTH_DIRECT_ACCESS_SERVICE_ATTRIBUTE (0b000)
#define UNAUTH_DIRECT_ACCESS_SERVICE_ATTRIBUTE (0b001)
#define AUTH_CASHBACK_DECREMENT_SERVICE_ATTRIBUTE (0b010)
#define UNAUTH_CASHBACK_DECREMENT_SERVICE_ATTRIBUTE (0b011)
#define AUTH_DECREMENT_SERVICE_ATTRIBUTE (0b100)
#define UNAUTH_DECREMENT_SERVICE_ATTRIBUTE (0b101)
#define AUTH_RO_PURSE_SERVICE_ATTRIBUTE (0b110)
#define UNAUTH_RO_PURSE_SERVICE_ATTRIBUTE (0b111)
#define IS_2_BYTE_BLOCK_LIST_ELEMENT 0x80
#define FELICA_UNENCRYPTED_READ_CMD 0x06
#define FELICA_UNENCRYPTED_WRITE_CMD 0x08
#define FELICA_UNENCRYPTED_READ_RES 0x07
#define FELICA_UNENCRYPTED_WRITE_RES 0x09
typedef enum {
FelicaICTypeRC_SA24_10K, // RC-SA24/1x
FelicaICTypeRC_SA24_6K, // RC-SA24/1x1
FelicaICTypeSD2_6K, // RC-SA21/2x1
FelicaICTypeSD2_4K, // RC-SA21/2
FelicaICTypeSD2WithDES, // RC-SA20/1, RC-SA20/2
FelicaICTypeRC_SA08, // Certifications exist, prototype?
FelicaICTypeSD1, // RC-SA01
FelicaICTypeSD1WithDES, // RC-SA00
FelicaICTypeFRAM_4K, // RC-S962
FelicaICTypeFRAM_9K, // RC-S960
FelicaICTypeEMV_36K, // RC-S954
FelicaICTypeEMV_16K, // RC-S953
FelicaICTypeEMV_32K, // RC-S952
FelicaICType576B, // RC-S919
FelicaICType4K, // RC-S915
FelicaICType2K, // RC-S830 series cards, chip name unknown,
FelicaICTypeMobileIC_V4_1,
FelicaICTypeMobileIC_V4,
FelicaICTypeMobileIC_V3,
FelicaICTypeMobileIC_V2,
FelicaICTypeMobileIC_V1,
FelicaICTypeLite, // RC-S965
FelicaICTypeLiteS, // RC-S966
FelicaICTypeLink, // RC-S967,
FelicaICTypePlug, // RC-S926
FelicaICTypeSuica, // https://www.tuv-nederland.nl/assets/files/cerfiticaten/2019/07/cr-nscib-cc-10-30076-cr.pdf
} FelicaICType;
typedef struct {
uint8_t exponent: 2;
// Incremented at read
uint8_t real_a: 4;
uint8_t real_b: 4;
} FelicaMRTParts;
typedef enum {
FelicaMRTCommandTypeVariable = 0,
FelicaMRTCommandTypeFixed = 1,
FelicaMRTCommandTypeMutualAuth = 2,
FelicaMRTCommandTypeDataRead = 3,
FelicaMRTCommandTypeDataWrite = 4,
FelicaMRTCommandTypeDataOther = 4,
} FelicaMRTCommandType;
typedef FelicaMRTParts FelicaMRTParameters[6];
typedef struct {
uint16_t number;
uint16_t end_service_code;
} FelicaArea;
typedef enum {
FelicaBlockTypeNormal,
FelicaBlockTypeOverlap,
FelicaBlockTypeExtended,
} FelicaBlockType;
typedef struct {
FelicaBlockType type;
union {
uint8_t data[FELICA_BLOCK_SIZE];
};
} FelicaBlock;
// typedef struct {} FelicaOverlapBlock;
typedef struct _FelicaService_t {
uint16_t number;
uint16_t block_count;
FelicaBlock** blocks;
struct _FelicaService_t* next;
} FelicaService;
typedef struct _FelicaSystem_t {
uint8_t number;
uint16_t code;
uint8_t idm[8];
uint8_t pmm[8];
FelicaMRTParameters maximum_response_times;
FelicaService* services;
struct _FelicaSystem_t* next;
} FelicaSystem;
typedef struct {
FelicaICType type;
uint8_t subtype;
uint8_t system_count;
FelicaSystem* systems;
} FelicaData;
typedef struct {
uint8_t current_idm[8];
uint8_t current_pmm[8];
uint8_t status_flags[2];
} FelicaReader;
bool felica_check_ic_type(uint8_t* PMm);
FelicaICType felica_get_ic_type(uint8_t* PMm);
bool felica_read_card(FuriHalNfcTxRxContext* tx_rx, FelicaData* data, uint8_t* polled_idm, uint8_t* polled_pmm);