mirror of
https://github.com/Next-Flip/Momentum-Firmware.git
synced 2026-07-28 01:58:11 -07:00
NFC: initial support for NFC-F (FeliCa)
This commit is contained in:
@@ -39,13 +39,14 @@ struct ReaderAnalyzer {
|
||||
|
||||
const FuriHalNfcDevData reader_analyzer_nfc_data[] = {
|
||||
[ReaderAnalyzerNfcDataMfClassic] =
|
||||
{.sak = 0x08,
|
||||
.atqa = {0x44, 0x00},
|
||||
.interface = FuriHalNfcInterfaceRf,
|
||||
{.interface = FuriHalNfcInterfaceRf,
|
||||
.type = FuriHalNfcTypeA,
|
||||
.uid_len = 7,
|
||||
.uid = {0x04, 0x77, 0x70, 0x2A, 0x23, 0x4F, 0x80},
|
||||
.cuid = 0x2A234F80},
|
||||
.a_data = {
|
||||
.sak = 0x08,
|
||||
.atqa = {0x44, 0x00},
|
||||
.cuid = 0x2A234F80}},
|
||||
};
|
||||
|
||||
void reader_analyzer_parse(ReaderAnalyzer* instance, uint8_t* buffer, size_t size) {
|
||||
@@ -130,7 +131,7 @@ void reader_analyzer_start(ReaderAnalyzer* instance, ReaderAnalyzerMode mode) {
|
||||
instance->debug_log = nfc_debug_log_alloc();
|
||||
}
|
||||
if(mode & ReaderAnalyzerModeMfkey) {
|
||||
instance->mfkey32 = mfkey32_alloc(instance->nfc_data.cuid);
|
||||
instance->mfkey32 = mfkey32_alloc(instance->nfc_data.a_data.cuid);
|
||||
if(instance->mfkey32) {
|
||||
mfkey32_set_callback(instance->mfkey32, reader_analyzer_mfkey_callback, instance);
|
||||
}
|
||||
|
||||
@@ -1041,8 +1041,8 @@ bool nfc_device_save(NfcDevice* dev, const char* dev_name) {
|
||||
if(!flipper_format_write_comment_cstr(file, "UID, ATQA and SAK are common for all formats"))
|
||||
break;
|
||||
if(!flipper_format_write_hex(file, "UID", data->uid, data->uid_len)) break;
|
||||
if(!flipper_format_write_hex(file, "ATQA", data->atqa, 2)) break;
|
||||
if(!flipper_format_write_hex(file, "SAK", &data->sak, 1)) break;
|
||||
if(!flipper_format_write_hex(file, "ATQA", data->a_data.atqa, 2)) break;
|
||||
if(!flipper_format_write_hex(file, "SAK", &data->a_data.sak, 1)) break;
|
||||
// Save more data if necessary
|
||||
if(dev->format == NfcDeviceSaveFormatMifareUl) {
|
||||
if(!nfc_device_save_mifare_ul_data(file, dev)) break;
|
||||
@@ -1119,14 +1119,14 @@ static bool nfc_device_load_data(NfcDevice* dev, FuriString* path, bool show_dia
|
||||
if(!(data_cnt == 4 || data_cnt == 7)) break;
|
||||
data->uid_len = data_cnt;
|
||||
if(!flipper_format_read_hex(file, "UID", data->uid, data->uid_len)) break;
|
||||
if(!flipper_format_read_hex(file, "ATQA", data->atqa, 2)) break;
|
||||
if(!flipper_format_read_hex(file, "SAK", &data->sak, 1)) break;
|
||||
if(!flipper_format_read_hex(file, "ATQA", data->a_data.atqa, 2)) break;
|
||||
if(!flipper_format_read_hex(file, "SAK", &data->a_data.sak, 1)) break;
|
||||
// Load CUID
|
||||
uint8_t* cuid_start = data->uid;
|
||||
if(data->uid_len == 7) {
|
||||
cuid_start = &data->uid[3];
|
||||
}
|
||||
data->cuid = (cuid_start[0] << 24) | (cuid_start[1] << 16) | (cuid_start[2] << 8) |
|
||||
data->a_data.cuid = (cuid_start[0] << 24) | (cuid_start[1] << 16) | (cuid_start[2] << 8) |
|
||||
(cuid_start[3]);
|
||||
// Parse other data
|
||||
if(dev->format == NfcDeviceSaveFormatMifareUl) {
|
||||
|
||||
@@ -11,6 +11,7 @@
|
||||
#include <lib/nfc/protocols/mifare_ultralight.h>
|
||||
#include <lib/nfc/protocols/mifare_classic.h>
|
||||
#include <lib/nfc/protocols/mifare_desfire.h>
|
||||
#include <lib/nfc/protocols/felica.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
@@ -32,6 +33,7 @@ typedef enum {
|
||||
NfcDeviceProtocolMifareUl,
|
||||
NfcDeviceProtocolMifareClassic,
|
||||
NfcDeviceProtocolMifareDesfire,
|
||||
NfcDeviceProtocolFelica,
|
||||
} NfcProtocol;
|
||||
|
||||
typedef enum {
|
||||
@@ -40,6 +42,7 @@ typedef enum {
|
||||
NfcDeviceSaveFormatMifareUl,
|
||||
NfcDeviceSaveFormatMifareClassic,
|
||||
NfcDeviceSaveFormatMifareDesfire,
|
||||
NfcDeviceSaveFormatFelica,
|
||||
} NfcDeviceSaveFormat;
|
||||
|
||||
typedef struct {
|
||||
@@ -58,6 +61,7 @@ typedef enum {
|
||||
NfcReadModeMfDesfire,
|
||||
NfcReadModeEMV,
|
||||
NfcReadModeNFCA,
|
||||
NfcReadModeNFCF,
|
||||
} NfcReadMode;
|
||||
|
||||
typedef struct {
|
||||
@@ -74,6 +78,7 @@ typedef struct {
|
||||
MfUltralightData mf_ul_data;
|
||||
MfClassicData mf_classic_data;
|
||||
MifareDesfireData mf_df_data;
|
||||
FelicaData felica_data;
|
||||
};
|
||||
FuriString* parsed_data;
|
||||
} NfcDeviceData;
|
||||
|
||||
@@ -63,3 +63,63 @@ const char* nfc_mf_classic_type(MfClassicType type) {
|
||||
return "Mifare Classic";
|
||||
}
|
||||
}
|
||||
|
||||
const char* nfc_felica_type(FelicaICType type) {
|
||||
if(type == FelicaICType576B) {
|
||||
return "FeliCa Classic 576B";
|
||||
} else if(type == FelicaICType2K) {
|
||||
return "FeliCa Classic 2K";
|
||||
} else if(type == FelicaICType4K) {
|
||||
return "FeliCa Classic 4K";
|
||||
} else if(type == FelicaICTypeFRAM_4K) {
|
||||
return "FeliCa Classic 4K (FRAM)";
|
||||
} else if(type == FelicaICTypeFRAM_9K) {
|
||||
return "FeliCa Classic 9K";
|
||||
} else if(type == FelicaICTypeEMV_16K) {
|
||||
return "FeliCa Classic EMV 16K";
|
||||
} else if(type == FelicaICTypeEMV_32K) {
|
||||
return "FeliCa Classic EMV 32K";
|
||||
} else if(type == FelicaICTypeEMV_36K) {
|
||||
return "FeliCa Classic EMV 36K";
|
||||
} else if(type == FelicaICTypeEMV_36K) {
|
||||
return "FeliCa Classic EMV 36K";
|
||||
} else if(type == FelicaICTypeSD1WithDES) {
|
||||
return "FeliCa SD1 (DES compatible)";
|
||||
} else if(type == FelicaICTypeSD1) {
|
||||
return "FeliCa SD1";
|
||||
} else if(type == FelicaICTypeRC_SA08) {
|
||||
return "FeliCa RC-SA08";
|
||||
} else if(type == FelicaICTypeSD2WithDES) {
|
||||
return "FeliCa SD2 (DES compatible)";
|
||||
} else if(type == FelicaICTypeSD2_4K) {
|
||||
return "FeliCa SD2 4K";
|
||||
} else if(type == FelicaICTypeSD2_6K) {
|
||||
return "FeliCa SD2 6K";
|
||||
} else if(type == FelicaICTypeRC_SA24_6K) {
|
||||
return "FeliCa RC-SA24 6K";
|
||||
} else if(type == FelicaICTypeRC_SA24_10K) {
|
||||
return "FeliCa RC-SA24 6K";
|
||||
} else if(type == FelicaICTypeMobileIC_V1) {
|
||||
return "Mobile FeliCa v1";
|
||||
} else if(type == FelicaICTypeMobileIC_V2) {
|
||||
return "Mobile FeliCa v2";
|
||||
} else if(type == FelicaICTypeMobileIC_V3) {
|
||||
return "Mobile FeliCa v3";
|
||||
} else if(type == FelicaICTypeMobileIC_V4) {
|
||||
return "Mobile FeliCa v4";
|
||||
} else if(type == FelicaICTypeMobileIC_V4_1) {
|
||||
return "Mobile FeliCa v4.1";
|
||||
} else if(type == FelicaICTypeLite) {
|
||||
return "FeliCa Lite";
|
||||
} else if(type == FelicaICTypeLiteS) {
|
||||
return "FeliCa Lite-S";
|
||||
} else if(type == FelicaICTypeLink) {
|
||||
return "FeliCa Link";
|
||||
} else if(type == FelicaICTypePlug) {
|
||||
return "FeliCa Plug";
|
||||
} else if(type == FelicaICTypeSuica) {
|
||||
return "FeliCa (SuiCa)";
|
||||
} else {
|
||||
return "FeliCa";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -9,3 +9,5 @@ const char* nfc_guess_protocol(NfcProtocol protocol);
|
||||
const char* nfc_mf_ul_type(MfUltralightType type, bool full_name);
|
||||
|
||||
const char* nfc_mf_classic_type(MfClassicType type);
|
||||
|
||||
const char* nfc_felica_type(FelicaICType type);
|
||||
+68
-16
@@ -292,20 +292,21 @@ static bool nfc_worker_read_bank_card(NfcWorker* nfc_worker, FuriHalNfcTxRxConte
|
||||
|
||||
static bool nfc_worker_read_nfca(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
FuriHalNfcADevData* a_data = &nfc_data->a_data;
|
||||
|
||||
bool card_read = false;
|
||||
furi_hal_nfc_sleep();
|
||||
if(mf_ul_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
|
||||
if(mf_ul_check_card_type(a_data->atqa[0], a_data->atqa[1], a_data->sak)) {
|
||||
FURI_LOG_I(TAG, "Mifare Ultralight / NTAG detected");
|
||||
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareUl;
|
||||
card_read = nfc_worker_read_mf_ultralight(nfc_worker, tx_rx);
|
||||
} else if(mf_classic_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
|
||||
} else if(mf_classic_check_card_type(a_data->atqa[0], a_data->atqa[1], a_data->sak)) {
|
||||
FURI_LOG_I(TAG, "Mifare Classic detected");
|
||||
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareClassic;
|
||||
nfc_worker->dev_data->mf_classic_data.type =
|
||||
mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
|
||||
mf_classic_get_classic_type(a_data->atqa[0], a_data->atqa[1], a_data->sak);
|
||||
card_read = nfc_worker_read_mf_classic(nfc_worker, tx_rx);
|
||||
} else if(mf_df_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
|
||||
} else if(mf_df_check_card_type(a_data->atqa[0], a_data->atqa[1], a_data->sak)) {
|
||||
FURI_LOG_I(TAG, "Mifare DESFire detected");
|
||||
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareDesfire;
|
||||
if(!nfc_worker_read_mf_desfire(nfc_worker, tx_rx)) {
|
||||
@@ -329,6 +330,46 @@ static bool nfc_worker_read_nfca(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* t
|
||||
return card_read;
|
||||
}
|
||||
|
||||
static bool nfc_worker_read_felica(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
|
||||
bool read_success = false;
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
FelicaData* data = &nfc_worker->dev_data->felica_data;
|
||||
|
||||
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
|
||||
reader_analyzer_prepare_tx_rx(nfc_worker->reader_analyzer, tx_rx, false);
|
||||
reader_analyzer_start(nfc_worker->reader_analyzer, ReaderAnalyzerModeDebugLog);
|
||||
}
|
||||
|
||||
do {
|
||||
if(!furi_hal_nfc_detect(&nfc_worker->dev_data->nfc_data, 300)) break;
|
||||
if(!felica_read_card(tx_rx, data, nfc_data->uid, nfc_data->f_data.pmm)) break;
|
||||
read_success = true;
|
||||
} while(false);
|
||||
|
||||
if(furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug)) {
|
||||
reader_analyzer_stop(nfc_worker->reader_analyzer);
|
||||
}
|
||||
|
||||
return read_success;
|
||||
}
|
||||
|
||||
static bool nfc_worker_read_nfcf(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
FuriHalNfcFDevData* f_data = &nfc_data->f_data;
|
||||
|
||||
bool card_read = false;
|
||||
furi_hal_nfc_sleep();
|
||||
if(felica_check_ic_type(f_data->pmm)) {
|
||||
FURI_LOG_I(TAG, "FeliCa detected");
|
||||
nfc_worker->dev_data->protocol = NfcDeviceProtocolFelica;
|
||||
nfc_worker->dev_data->felica_data.type = felica_get_ic_type(f_data->pmm);
|
||||
card_read = nfc_worker_read_felica(nfc_worker, tx_rx);
|
||||
} else {
|
||||
nfc_worker->dev_data->protocol = NfcDeviceProtocolUnknown;
|
||||
}
|
||||
return card_read;
|
||||
}
|
||||
|
||||
void nfc_worker_read(NfcWorker* nfc_worker) {
|
||||
furi_assert(nfc_worker);
|
||||
furi_assert(nfc_worker->callback);
|
||||
@@ -373,6 +414,11 @@ void nfc_worker_read(NfcWorker* nfc_worker) {
|
||||
event = NfcWorkerEventReadUidNfcB;
|
||||
break;
|
||||
} else if(nfc_data->type == FuriHalNfcTypeF) {
|
||||
nfc_worker->callback(NfcWorkerEventCardDetected, nfc_worker->context);
|
||||
if(nfc_worker_read_nfcf(nfc_worker, &tx_rx)) {
|
||||
event = NfcWorkerEventReadFelica;
|
||||
break;
|
||||
}
|
||||
event = NfcWorkerEventReadUidNfcF;
|
||||
break;
|
||||
} else if(nfc_data->type == FuriHalNfcTypeV) {
|
||||
@@ -417,7 +463,7 @@ void nfc_worker_read_type(NfcWorker* nfc_worker) {
|
||||
if(read_mode == NfcReadModeMfClassic) {
|
||||
nfc_worker->dev_data->protocol = NfcDeviceProtocolMifareClassic;
|
||||
nfc_worker->dev_data->mf_classic_data.type = mf_classic_get_classic_type(
|
||||
nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
|
||||
nfc_data->a_data.atqa[0], nfc_data->a_data.atqa[1], nfc_data->a_data.sak);
|
||||
if(nfc_worker_read_mf_classic(nfc_worker, &tx_rx)) {
|
||||
FURI_LOG_D(TAG, "Card read");
|
||||
dev_data->protocol = NfcDeviceProtocolMifareClassic;
|
||||
@@ -478,7 +524,8 @@ void nfc_worker_emulate_uid(NfcWorker* nfc_worker) {
|
||||
// Need to save ATS to support ISO-14443A-4 emulation
|
||||
|
||||
while(nfc_worker->state == NfcWorkerStateUidEmulate) {
|
||||
if(furi_hal_nfc_listen(data->uid, data->uid_len, data->atqa, data->sak, false, 100)) {
|
||||
if(furi_hal_nfc_listen(
|
||||
data->uid, data->uid_len, data->a_data.atqa, data->a_data.sak, false, 100)) {
|
||||
if(furi_hal_nfc_tx_rx(&tx_rx, 100)) {
|
||||
reader_data->size = tx_rx.rx_bits / 8;
|
||||
if(reader_data->size > 0) {
|
||||
@@ -499,8 +546,11 @@ void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
|
||||
FuriHalNfcDevData params = {
|
||||
.uid = {0xCF, 0x72, 0xd4, 0x40},
|
||||
.uid_len = 4,
|
||||
.atqa = {0x00, 0x04},
|
||||
.sak = 0x20,
|
||||
.a_data =
|
||||
{
|
||||
.atqa = {0x00, 0x04},
|
||||
.sak = 0x20,
|
||||
},
|
||||
.type = FuriHalNfcTypeA,
|
||||
};
|
||||
|
||||
@@ -510,7 +560,8 @@ void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
|
||||
}
|
||||
|
||||
while(nfc_worker->state == NfcWorkerStateEmulateApdu) {
|
||||
if(furi_hal_nfc_listen(params.uid, params.uid_len, params.atqa, params.sak, false, 300)) {
|
||||
if(furi_hal_nfc_listen(
|
||||
params.uid, params.uid_len, params.a_data.atqa, params.a_data.sak, false, 300)) {
|
||||
FURI_LOG_D(TAG, "POS terminal detected");
|
||||
if(emv_card_emulation(&tx_rx)) {
|
||||
FURI_LOG_D(TAG, "EMV card emulated");
|
||||
@@ -551,8 +602,8 @@ void nfc_worker_emulate_mf_ultralight(NfcWorker* nfc_worker) {
|
||||
furi_hal_nfc_emulate_nfca(
|
||||
nfc_data->uid,
|
||||
nfc_data->uid_len,
|
||||
nfc_data->atqa,
|
||||
nfc_data->sak,
|
||||
nfc_data->a_data.atqa,
|
||||
nfc_data->a_data.sak,
|
||||
mf_ul_prepare_emulation_response,
|
||||
&emulator,
|
||||
5000);
|
||||
@@ -783,8 +834,8 @@ void nfc_worker_write_mf_classic(NfcWorker* nfc_worker) {
|
||||
}
|
||||
|
||||
FURI_LOG_I(TAG, "Check mf classic type");
|
||||
MfClassicType type =
|
||||
mf_classic_get_classic_type(nfc_data.atqa[0], nfc_data.atqa[1], nfc_data.sak);
|
||||
MfClassicType type = mf_classic_get_classic_type(
|
||||
nfc_data.a_data.atqa[0], nfc_data.a_data.atqa[1], nfc_data.a_data.sak);
|
||||
if(type != nfc_worker->dev_data->mf_classic_data.type) {
|
||||
FURI_LOG_E(TAG, "Wrong mf classic type");
|
||||
nfc_worker->callback(NfcWorkerEventWrongCard, nfc_worker->context);
|
||||
@@ -855,8 +906,8 @@ void nfc_worker_update_mf_classic(NfcWorker* nfc_worker) {
|
||||
}
|
||||
|
||||
FURI_LOG_I(TAG, "Check MF classic type");
|
||||
MfClassicType type =
|
||||
mf_classic_get_classic_type(nfc_data.atqa[0], nfc_data.atqa[1], nfc_data.sak);
|
||||
MfClassicType type = mf_classic_get_classic_type(
|
||||
nfc_data.a_data.atqa[0], nfc_data.a_data.atqa[1], nfc_data.a_data.sak);
|
||||
if(type != nfc_worker->dev_data->mf_classic_data.type) {
|
||||
FURI_LOG_E(TAG, "MF classic type mismatch");
|
||||
nfc_worker->callback(NfcWorkerEventWrongCard, nfc_worker->context);
|
||||
@@ -918,7 +969,8 @@ void nfc_worker_mf_ultralight_read_auth(NfcWorker* nfc_worker) {
|
||||
while(nfc_worker->state == NfcWorkerStateReadMfUltralightReadAuth) {
|
||||
furi_hal_nfc_sleep();
|
||||
if(furi_hal_nfc_detect(nfc_data, 300) && nfc_data->type == FuriHalNfcTypeA) {
|
||||
if(mf_ul_check_card_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak)) {
|
||||
if(mf_ul_check_card_type(
|
||||
nfc_data->a_data.atqa[0], nfc_data->a_data.atqa[1], nfc_data->a_data.sak)) {
|
||||
nfc_worker->callback(NfcWorkerEventCardDetected, nfc_worker->context);
|
||||
if(data->auth_method == MfUltralightAuthMethodManual ||
|
||||
data->auth_method == MfUltralightAuthMethodAuto) {
|
||||
|
||||
@@ -34,6 +34,7 @@ typedef enum {
|
||||
NfcWorkerEventReadUidNfcV,
|
||||
NfcWorkerEventReadUidNfcF,
|
||||
NfcWorkerEventReadUidNfcA,
|
||||
NfcWorkerEventReadFelica,
|
||||
NfcWorkerEventReadMfUltralight,
|
||||
NfcWorkerEventReadMfDesfire,
|
||||
NfcWorkerEventReadMfClassicDone,
|
||||
|
||||
@@ -11,6 +11,7 @@
|
||||
#include <lib/nfc/protocols/mifare_ultralight.h>
|
||||
#include <lib/nfc/protocols/mifare_classic.h>
|
||||
#include <lib/nfc/protocols/mifare_desfire.h>
|
||||
#include <lib/nfc/protocols/felica.h>
|
||||
#include <lib/nfc/protocols/nfca.h>
|
||||
#include <lib/nfc/helpers/reader_analyzer.h>
|
||||
|
||||
|
||||
@@ -70,8 +70,8 @@ bool plantain_4k_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx
|
||||
furi_assert(nfc_worker);
|
||||
|
||||
MfClassicReader reader = {};
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
|
||||
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
|
||||
for(size_t i = 0; i < COUNT_OF(plantain_keys_4k); i++) {
|
||||
mf_classic_reader_add_sector(
|
||||
&reader,
|
||||
|
||||
@@ -45,8 +45,8 @@ bool plantain_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
|
||||
furi_assert(nfc_worker);
|
||||
|
||||
MfClassicReader reader = {};
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
|
||||
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
|
||||
for(size_t i = 0; i < COUNT_OF(plantain_keys); i++) {
|
||||
mf_classic_reader_add_sector(
|
||||
&reader, plantain_keys[i].sector, plantain_keys[i].key_a, plantain_keys[i].key_b);
|
||||
|
||||
@@ -67,8 +67,8 @@ bool troika_4k_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx)
|
||||
furi_assert(nfc_worker);
|
||||
|
||||
MfClassicReader reader = {};
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
|
||||
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
|
||||
for(size_t i = 0; i < COUNT_OF(troika_4k_keys); i++) {
|
||||
mf_classic_reader_add_sector(
|
||||
&reader, troika_4k_keys[i].sector, troika_4k_keys[i].key_a, troika_4k_keys[i].key_b);
|
||||
|
||||
@@ -43,8 +43,8 @@ bool troika_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx) {
|
||||
furi_assert(nfc_worker);
|
||||
|
||||
MfClassicReader reader = {};
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
|
||||
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
|
||||
|
||||
for(size_t i = 0; i < COUNT_OF(troika_keys); i++) {
|
||||
mf_classic_reader_add_sector(
|
||||
|
||||
@@ -71,8 +71,8 @@ bool two_cities_parser_read(NfcWorker* nfc_worker, FuriHalNfcTxRxContext* tx_rx)
|
||||
furi_assert(nfc_worker);
|
||||
|
||||
MfClassicReader reader = {};
|
||||
FuriHalNfcDevData* nfc_data = &nfc_worker->dev_data->nfc_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_data->atqa[0], nfc_data->atqa[1], nfc_data->sak);
|
||||
FuriHalNfcADevData* nfc_a_data = &nfc_worker->dev_data->nfc_data.a_data;
|
||||
reader.type = mf_classic_get_classic_type(nfc_a_data->atqa[0], nfc_a_data->atqa[1], nfc_a_data->sak);
|
||||
for(size_t i = 0; i < COUNT_OF(two_cities_keys_4k); i++) {
|
||||
mf_classic_reader_add_sector(
|
||||
&reader,
|
||||
|
||||
@@ -0,0 +1,572 @@
|
||||
#include <limits.h>
|
||||
#include <mbedtls/sha1.h>
|
||||
#include "felica.h"
|
||||
#include "nfc_util.h"
|
||||
#include <furi.h>
|
||||
#include "furi_hal_nfc.h"
|
||||
|
||||
#define TAG "FeliCa"
|
||||
|
||||
bool felica_check_ic_type(uint8_t* PMm) {
|
||||
uint8_t ic_type = PMm[0];
|
||||
uint8_t rom_type = PMm[1];
|
||||
|
||||
bool is_valid_ic = false;
|
||||
if (ic_type == 0xff) { // RC-S967 in nfc-dep
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0xf0 || ic_type == 0xf2) { // Lite(S)
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0xe1) { // RC-S967 in plug mode
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0xe0) { // RC-S926
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type >= 0x44 && ic_type <= 0x48) { // SD2
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x3e && rom_type == 0x03) { // RC-SA08
|
||||
return true;
|
||||
} else if (ic_type == 0x35) { // RC-SA01
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x32) { // RC-SA00
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x31) { // Suica/PASMO
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x20) { // RC-S962
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type >= 0x10 && ic_type <= 0x1f) { // Mobile IC version 2/3
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x0d) { // RC-S960
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x0c) { // RC-S954
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x0b) { // Old Suica?
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x09) { // RC-S953
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x08) { // RC-S952
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x06 || ic_type == 0x07) { // Mobile IC version 1
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x02) { // RC-S919
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x01) { // RC-S915
|
||||
is_valid_ic = true;
|
||||
} else if (ic_type == 0x00) { // RC-S830
|
||||
is_valid_ic = true;
|
||||
}
|
||||
|
||||
if (!is_valid_ic) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// need more samples to confirm below
|
||||
/*
|
||||
if (rom_type != 0x01) {
|
||||
return false;
|
||||
}
|
||||
*/
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
uint8_t felica_prepare_unencrypted_read(
|
||||
uint8_t* dest,
|
||||
const FelicaReader* reader,
|
||||
const uint16_t* service_code_list, uint8_t service_count,
|
||||
const uint32_t* block_list, uint8_t block_count) {
|
||||
dest[0] = FELICA_UNENCRYPTED_READ_CMD;
|
||||
memcpy(&dest[1], reader->current_idm, 8);
|
||||
|
||||
dest[9] = service_count;
|
||||
uint8_t msg_len = 10;
|
||||
for(int i = 0; i < service_count; i++) {
|
||||
uint16_t service_code = service_code_list[i];
|
||||
dest[msg_len++] = service_code & 0xFF;
|
||||
dest[msg_len++] = service_code >> 8;
|
||||
}
|
||||
|
||||
dest[msg_len++] = block_count;
|
||||
for(int i = 0; i < block_count; i++) {
|
||||
uint16_t block_num = block_list[i];
|
||||
dest[msg_len++] = block_num & 0xFF;
|
||||
dest[msg_len++] = block_num >> 8;
|
||||
}
|
||||
|
||||
return msg_len;
|
||||
}
|
||||
|
||||
uint8_t felica_lite_prepare_unencrypted_read(
|
||||
uint8_t* dest,
|
||||
const FelicaReader* reader,
|
||||
bool is_read_only,
|
||||
const uint8_t* block_list, uint8_t block_count) {
|
||||
|
||||
dest[0] = FELICA_UNENCRYPTED_READ_CMD;
|
||||
memcpy(&dest[1], reader->current_idm, 8);
|
||||
|
||||
dest[9] = 1;
|
||||
uint8_t msg_len = 10;
|
||||
uint8_t service_code = RANDOM_TYPE_SERVICE_ATTRIBUTE | (
|
||||
(is_read_only)
|
||||
? UNAUTH_RO_SERVICE_ATTRIBUTE
|
||||
: UNAUTH_RW_SERVICE_ATTRIBUTE);
|
||||
|
||||
dest[msg_len++] = service_code & 0xFF;
|
||||
dest[msg_len++] = service_code >> 8;
|
||||
|
||||
dest[msg_len++] = block_count;
|
||||
for(int i = 0; i < block_count; i++) {
|
||||
dest[msg_len++] = IS_2_BYTE_BLOCK_LIST_ELEMENT;
|
||||
dest[msg_len++] = block_list[i];
|
||||
}
|
||||
|
||||
return msg_len;
|
||||
}
|
||||
|
||||
uint16_t felica_parse_unencrypted_read(
|
||||
uint8_t* buf, uint8_t len,
|
||||
FelicaReader* reader,
|
||||
uint8_t* out, uint16_t out_len) {
|
||||
if(len < 12) {
|
||||
return false;
|
||||
}
|
||||
len--;
|
||||
buf++;
|
||||
|
||||
if(*buf != FELICA_UNENCRYPTED_READ_RES) {
|
||||
return false;
|
||||
}
|
||||
len--;
|
||||
buf++;
|
||||
|
||||
if(memcmp(buf, reader->current_idm, 8) != 0) {
|
||||
return false;
|
||||
}
|
||||
len -= 8;
|
||||
buf += 8;
|
||||
|
||||
reader->status_flags[0] = buf[0];
|
||||
reader->status_flags[1] = buf[1];
|
||||
len -= 2;
|
||||
buf += 2;
|
||||
if(reader->status_flags[0] != 0) {
|
||||
FURI_LOG_W(TAG, "SF1: %02X SF2: %02X", reader->status_flags[0], reader->status_flags[1]);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if(len < 1) {
|
||||
return 0;
|
||||
}
|
||||
uint16_t data_length = *buf * 16;
|
||||
len--;
|
||||
buf++;
|
||||
|
||||
if (len < data_length || out_len < data_length) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
memcpy(out, buf, data_length);
|
||||
|
||||
return data_length;
|
||||
}
|
||||
|
||||
uint8_t felica_prepare_unencrypted_write(
|
||||
uint8_t* dest,
|
||||
FelicaReader* reader,
|
||||
const uint16_t* service_code_list, uint8_t service_count,
|
||||
const uint32_t* block_list, uint8_t block_count,
|
||||
const uint8_t* block_data) {
|
||||
dest[0] = FELICA_UNENCRYPTED_WRITE_CMD;
|
||||
memcpy(&dest[1], reader->current_idm, 8);
|
||||
|
||||
dest[9] = service_count;
|
||||
uint8_t msg_len = 10;
|
||||
for(int i = 0; i < service_count; i++) {
|
||||
uint16_t service_code = service_code_list[i];
|
||||
dest[msg_len++] = service_code & 0xFF;
|
||||
dest[msg_len++] = service_code >> 8;
|
||||
}
|
||||
|
||||
dest[msg_len++] = block_count;
|
||||
for(int i = 0; i < block_count; i++) {
|
||||
uint16_t block_num = block_list[i];
|
||||
dest[msg_len++] = block_num & 0xFF;
|
||||
dest[msg_len++] = block_num >> 8;
|
||||
}
|
||||
|
||||
uint16_t data_length = block_count * FELICA_BLOCK_SIZE;
|
||||
memcpy(dest + msg_len, block_data, data_length);
|
||||
msg_len += data_length;
|
||||
return msg_len;
|
||||
}
|
||||
|
||||
uint8_t felica_lite_prepare_unencrypted_write(
|
||||
uint8_t* dest,
|
||||
const FelicaReader* reader,
|
||||
const uint8_t* block_list, uint8_t block_count,
|
||||
const uint8_t* block_data) {
|
||||
|
||||
dest[0] = FELICA_UNENCRYPTED_WRITE_CMD;
|
||||
memcpy(&dest[1], reader->current_idm, 8);
|
||||
|
||||
dest[9] = 1;
|
||||
uint8_t msg_len = 10;
|
||||
uint8_t service_code = RANDOM_TYPE_SERVICE_ATTRIBUTE | UNAUTH_RW_SERVICE_ATTRIBUTE;
|
||||
dest[msg_len++] = service_code & 0xFF;
|
||||
dest[msg_len++] = service_code >> 8;
|
||||
|
||||
dest[msg_len++] = block_count;
|
||||
for(int i = 0; i < block_count; i++) {
|
||||
dest[msg_len++] = block_list[i];
|
||||
dest[msg_len++] = IS_2_BYTE_BLOCK_LIST_ELEMENT;
|
||||
}
|
||||
|
||||
uint16_t data_length = block_count * FELICA_BLOCK_SIZE;
|
||||
memcpy(dest + msg_len, block_data, data_length);
|
||||
msg_len += data_length;
|
||||
return msg_len;
|
||||
}
|
||||
|
||||
bool felica_parse_unencrypted_write(
|
||||
uint8_t* buf, uint8_t len,
|
||||
FelicaReader* reader) {
|
||||
if(len < 12) {
|
||||
return false;
|
||||
}
|
||||
len--;
|
||||
buf++;
|
||||
|
||||
if(*buf != FELICA_UNENCRYPTED_WRITE_RES) {
|
||||
return false;
|
||||
}
|
||||
len--;
|
||||
buf++;
|
||||
|
||||
if(memcmp(buf, reader->current_idm, 8) != 0) {
|
||||
return false;
|
||||
}
|
||||
len -= 8;
|
||||
buf += 8;
|
||||
|
||||
reader->status_flags[0] = buf[0];
|
||||
reader->status_flags[1] = buf[1];
|
||||
len -= 2;
|
||||
buf += 2;
|
||||
if(reader->status_flags[0] != 0) {
|
||||
FURI_LOG_W(TAG, "SF1: %02X SF2: %02X", reader->status_flags[0], reader->status_flags[1]);
|
||||
return 0;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
FelicaICType felica_get_ic_type(uint8_t* PMm) {
|
||||
uint8_t rom_type = PMm[0];
|
||||
uint8_t ic_type = PMm[1];
|
||||
|
||||
UNUSED(rom_type);
|
||||
switch(ic_type) {
|
||||
case 0xff:
|
||||
return FelicaICTypeLink;
|
||||
case 0xf2:
|
||||
return FelicaICTypeLink;
|
||||
case 0xf1:
|
||||
return FelicaICTypeLiteS;
|
||||
case 0xf0:
|
||||
return FelicaICTypeLite;
|
||||
case 0xe1:
|
||||
return FelicaICTypeLink;
|
||||
case 0xe0:
|
||||
return FelicaICTypePlug;
|
||||
case 0x48:
|
||||
return FelicaICTypeSD2_6K;
|
||||
case 0x47:
|
||||
return FelicaICTypeRC_SA24_6K;
|
||||
case 0x46:
|
||||
return FelicaICTypeSD2_4K;
|
||||
case 0x45:
|
||||
case 0x44:
|
||||
return FelicaICTypeSD2WithDES;
|
||||
case 0x3e:
|
||||
return FelicaICTypeRC_SA08;
|
||||
case 0x35:
|
||||
return FelicaICTypeSD1;
|
||||
case 0x32:
|
||||
return FelicaICTypeSD1WithDES;
|
||||
case 0x31:
|
||||
return FelicaICTypeSuica;
|
||||
case 0x20:
|
||||
return FelicaICTypeFRAM_4K;
|
||||
case 0x1f:
|
||||
case 0x1e:
|
||||
case 0x1d:
|
||||
case 0x1c:
|
||||
case 0x1b:
|
||||
case 0x1a:
|
||||
case 0x19:
|
||||
case 0x18:
|
||||
return FelicaICTypeMobileIC_V4_1;
|
||||
case 0x17:
|
||||
return FelicaICTypeMobileIC_V4;
|
||||
case 0x16:
|
||||
case 0x15:
|
||||
case 0x14:
|
||||
return FelicaICTypeMobileIC_V3;
|
||||
case 0x13:
|
||||
case 0x12:
|
||||
case 0x11:
|
||||
case 0x10:
|
||||
return FelicaICTypeMobileIC_V2;
|
||||
case 0x0d:
|
||||
return FelicaICTypeFRAM_9K;
|
||||
case 0x0c:
|
||||
return FelicaICTypeEMV_36K;
|
||||
case 0x0b: // Old Suica?
|
||||
return FelicaICTypeSuica;
|
||||
case 0x09:
|
||||
return FelicaICTypeEMV_16K;
|
||||
case 0x08:
|
||||
return FelicaICTypeEMV_32K;
|
||||
case 0x07:
|
||||
case 0x06:
|
||||
return FelicaICTypeMobileIC_V1;
|
||||
case 0x02:
|
||||
return FelicaICType576B;
|
||||
case 0x01:
|
||||
return FelicaICType4K;
|
||||
case 0x00:
|
||||
return FelicaICType2K;
|
||||
}
|
||||
|
||||
return FelicaICType2K;
|
||||
}
|
||||
|
||||
void felica_parse_system_info(FelicaSystem* system, uint8_t* IDm, uint8_t* PMm) {
|
||||
memcpy(system->idm, IDm, 8);
|
||||
memcpy(system->pmm, PMm, 8);
|
||||
for(int i = 0; i < 6; i++) {
|
||||
char MRT_byte = PMm[2 + i];
|
||||
FelicaMRTParts* mrt_data = &system->maximum_response_times[i];
|
||||
mrt_data->real_a = (MRT_byte & 7) + 1;
|
||||
MRT_byte >>= 3;
|
||||
mrt_data->real_b = (MRT_byte & 7) + 1;
|
||||
MRT_byte >>= 3;
|
||||
mrt_data->exponent = (MRT_byte & 3);
|
||||
}
|
||||
}
|
||||
|
||||
bool felica_lite_can_read_without_mac(uint8_t* mc_r_restr, uint8_t block_number) {
|
||||
if(block_number > REG_LITE_BLOCK) {
|
||||
return true;
|
||||
}
|
||||
uint8_t byte = mc_r_restr[block_number < 8 ? 0 : 1];
|
||||
return ((byte >> (block_number % 8)) & 1) == 0;
|
||||
}
|
||||
|
||||
void felica_define_normal_block(FelicaService* service, uint16_t number, uint8_t* data) {
|
||||
FelicaBlock* block = malloc(sizeof(FelicaBlock));
|
||||
block->type = FelicaBlockTypeNormal;
|
||||
memcpy(block->data, data, FELICA_BLOCK_SIZE);
|
||||
service->blocks[number] = block;
|
||||
}
|
||||
|
||||
bool felica_read_lite_system(FuriHalNfcTxRxContext* tx_rx, FelicaReader* reader, FelicaData* data, FelicaSystem* system) {
|
||||
const uint8_t fixed_services[] = {
|
||||
SYS_CODE_LITE_BLOCK,
|
||||
RC_LITE_BLOCK,
|
||||
ID_LITE_BLOCK,
|
||||
MAC_LITE_BLOCK,
|
||||
DEVICE_ID_LITE_BLOCK,
|
||||
CARD_KEY_VER_LITE_BLOCK,
|
||||
MEM_CONFIG_LITE_BLOCK,
|
||||
};
|
||||
|
||||
uint8_t block_data[FELICA_BLOCK_SIZE * 4];
|
||||
|
||||
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
|
||||
tx_rx->tx_data,
|
||||
reader,
|
||||
true,
|
||||
fixed_services, 1
|
||||
);
|
||||
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
|
||||
FURI_LOG_W(TAG, "Bad exchange verifying Lite system code");
|
||||
return false;
|
||||
}
|
||||
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE) {
|
||||
FURI_LOG_W(TAG, "Bad response to Read without Encryption (SYS_C)");
|
||||
return false;
|
||||
}
|
||||
if (block_data[0] != (LITE_SYSTEM_CODE >> 8) && block_data[1] != (LITE_SYSTEM_CODE & 0xFF)) {
|
||||
FURI_LOG_W(TAG, "Unexpected SYS_C value");
|
||||
return false;
|
||||
}
|
||||
system->code = LITE_SYSTEM_CODE;
|
||||
|
||||
FelicaService* service = malloc(sizeof(FelicaService));
|
||||
system->services = service;
|
||||
service->number = 0;
|
||||
service->block_count = CRC_CHECK_LITE_BLOCK;
|
||||
service->blocks = malloc(sizeof(FelicaBlock*) * service->block_count);
|
||||
for(int i = 0; i < service->block_count; i++) {
|
||||
service->blocks[i] = NULL;
|
||||
}
|
||||
|
||||
felica_define_normal_block(service, SYS_CODE_LITE_BLOCK, block_data);
|
||||
|
||||
memset(block_data, 0, FELICA_BLOCK_SIZE);
|
||||
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_write(
|
||||
tx_rx->tx_data,
|
||||
reader,
|
||||
&fixed_services[1], 1,
|
||||
block_data
|
||||
);
|
||||
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
|
||||
FURI_LOG_W(TAG, "Bad exchange writing random challenge");
|
||||
return false;
|
||||
}
|
||||
if(!felica_parse_unencrypted_write(tx_rx->rx_data, tx_rx->rx_bits / 8, reader)) {
|
||||
FURI_LOG_W(TAG, "Bad response to Write without Encryption (RC)");
|
||||
return false;
|
||||
}
|
||||
felica_define_normal_block(service, RC_LITE_BLOCK, block_data);
|
||||
|
||||
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
|
||||
tx_rx->tx_data,
|
||||
reader,
|
||||
true,
|
||||
&fixed_services[2], 2
|
||||
);
|
||||
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
|
||||
FURI_LOG_W(TAG, "Bad exchange reading ID with MAC");
|
||||
return false;
|
||||
}
|
||||
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 2) {
|
||||
FURI_LOG_W(TAG, "Bad response to Read without Encryption (ID, MAC)");
|
||||
return false;
|
||||
}
|
||||
felica_define_normal_block(service, ID_LITE_BLOCK, block_data);
|
||||
felica_define_normal_block(service, MAC_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
|
||||
FURI_LOG_I(TAG, "ID:");
|
||||
for(int i = 0; i < 16; i++) {
|
||||
FURI_LOG_I(TAG, "%02X", block_data[i]);
|
||||
}
|
||||
FURI_LOG_I(TAG, "MAC:");
|
||||
for(int i = 0; i < 16; i++) {
|
||||
FURI_LOG_I(TAG, "%02X", block_data[i + FELICA_BLOCK_SIZE]);
|
||||
}
|
||||
|
||||
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
|
||||
tx_rx->tx_data,
|
||||
reader,
|
||||
true,
|
||||
&fixed_services[4], 3
|
||||
);
|
||||
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
|
||||
FURI_LOG_W(TAG, "Bad exchange reading blocks");
|
||||
return false;
|
||||
}
|
||||
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 3) {
|
||||
FURI_LOG_W(TAG, "Bad response to Read without Encryption (D_ID, CKV, MC)");
|
||||
return false;
|
||||
}
|
||||
felica_define_normal_block(service, DEVICE_ID_LITE_BLOCK, block_data);
|
||||
felica_define_normal_block(service, CARD_KEY_VER_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
|
||||
felica_define_normal_block(service, MEM_CONFIG_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE * 2);
|
||||
|
||||
// Read SPAD and REG accordingly to MC
|
||||
uint8_t* mc_data = block_data + (FELICA_BLOCK_SIZE * 2);
|
||||
for (uint8_t block_number = 0; block_number <= REG_LITE_BLOCK; block_number++) {
|
||||
if(!felica_lite_can_read_without_mac(mc_data + 6, block_number)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
|
||||
tx_rx->tx_data,
|
||||
reader,
|
||||
true,
|
||||
&block_number, 1
|
||||
);
|
||||
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
|
||||
FURI_LOG_W(TAG, "Bad exchange reading blocks");
|
||||
return false;
|
||||
}
|
||||
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE) {
|
||||
FURI_LOG_W(TAG, "Bad response to Read without Encryption (block %d)", block_number);
|
||||
return false;
|
||||
}
|
||||
felica_define_normal_block(service, block_number, block_data);
|
||||
}
|
||||
if (data->type == FelicaICTypeLiteS) {
|
||||
const uint8_t fixed_s_services[] = {
|
||||
ID_LITE_BLOCK,
|
||||
MAC_A_LITE_BLOCK,
|
||||
WRITE_COUNT_LITE_BLOCK,
|
||||
CRC_CHECK_LITE_BLOCK,
|
||||
};
|
||||
|
||||
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
|
||||
tx_rx->tx_data,
|
||||
reader,
|
||||
true,
|
||||
fixed_s_services, 2
|
||||
);
|
||||
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
|
||||
FURI_LOG_W(TAG, "Bad exchange reading ID with MAC_A");
|
||||
return false;
|
||||
}
|
||||
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 2) {
|
||||
FURI_LOG_W(TAG, "Bad response to Read without Encryption (ID, MAC_A)");
|
||||
return false;
|
||||
}
|
||||
felica_define_normal_block(service, ID_LITE_BLOCK, block_data);
|
||||
felica_define_normal_block(service, MAC_A_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
|
||||
|
||||
tx_rx->tx_bits = 8 * felica_lite_prepare_unencrypted_read(
|
||||
tx_rx->tx_data,
|
||||
reader,
|
||||
true,
|
||||
&fixed_s_services[2], 2
|
||||
);
|
||||
if(!furi_hal_nfc_tx_rx_full(tx_rx)) {
|
||||
FURI_LOG_W(TAG, "Bad exchange reading ID with MAC_A");
|
||||
return false;
|
||||
}
|
||||
if(felica_parse_unencrypted_read(tx_rx->rx_data, tx_rx->rx_bits / 8, reader, block_data, sizeof(block_data)) != FELICA_BLOCK_SIZE * 2) {
|
||||
FURI_LOG_W(TAG, "Bad response to Read without Encryption (WC, CRC_CHECK)");
|
||||
return false;
|
||||
}
|
||||
felica_define_normal_block(service, WRITE_COUNT_LITE_BLOCK, block_data);
|
||||
felica_define_normal_block(service, CRC_CHECK_LITE_BLOCK, block_data + FELICA_BLOCK_SIZE);
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool felica_read_card(FuriHalNfcTxRxContext* tx_rx, FelicaData* data, uint8_t* polled_idm, uint8_t* polled_pmm) {
|
||||
furi_assert(tx_rx);
|
||||
furi_assert(polled_idm);
|
||||
furi_assert(polled_pmm);
|
||||
|
||||
bool card_read = false;
|
||||
do {
|
||||
FelicaReader reader;
|
||||
memcpy(reader.current_idm, polled_idm, 8);
|
||||
memcpy(reader.current_pmm, polled_pmm, 8);
|
||||
|
||||
FelicaSystem* current_system = malloc(sizeof(FelicaSystem));
|
||||
data->systems = current_system;
|
||||
|
||||
felica_parse_system_info(current_system, polled_idm, polled_pmm);
|
||||
current_system->next = NULL;
|
||||
|
||||
if (data->type == FelicaICTypeLite || data->type == FelicaICTypeLiteS) {
|
||||
FURI_LOG_I(TAG, "Reading Felica Lite system");
|
||||
felica_read_lite_system(tx_rx, &reader, data, current_system);
|
||||
card_read = true;
|
||||
break;
|
||||
}
|
||||
} while(false);
|
||||
|
||||
return card_read;
|
||||
}
|
||||
@@ -0,0 +1,173 @@
|
||||
#pragma once
|
||||
|
||||
#include <furi_hal_nfc.h>
|
||||
|
||||
#define NFCF_F_SIG (13560000.0)
|
||||
#define MRT_T_SIG 302064.89 //ns, 256 * 16 / NFC_F_SIG * 1e9
|
||||
#define MRT_T_SIG_x4 1208259.56 //ns, MRT_T_SIG * (4 ** 1)
|
||||
#define MRT_T_SIG_x16 4833038.24 //ns, MRT_T_SIG * (4 ** 2)
|
||||
#define MRT_T_SIG_x64 19332152.96 //ns, MRT_T_SIG * (4 ** 2)
|
||||
|
||||
#define FELICA_BLOCK_SIZE 16
|
||||
|
||||
#define SUICA_SYSTEM_CODE 0x0003
|
||||
#define NDEF_SYSTEM_CODE 0x12fc
|
||||
#define HCE_F_SYSTEM_CODE 0x4000
|
||||
#define OCTOPUS_SYSTEM_CODE 0x8008
|
||||
#define EDY_SYSTEM_CODE 0x811d
|
||||
#define PASPY_SYSTEM_CODE 0x8592
|
||||
#define BLACKBOARD_SYSTEM_CODE 0x8620
|
||||
#define SAPICA_SYSTEM_CODE 0x865e
|
||||
#define LITE_SYSTEM_CODE 0x88b4
|
||||
#define RYUTO_SYSTEM_CODE 0x8b5d
|
||||
#define OKICA_SYSTEM_CODE 0x8fc1
|
||||
#define SECURE_ID_SYSTEM_CODE 0x957a
|
||||
#define IRUCA_SYSTEM_CODE 0xde80
|
||||
#define COMMON_AREA_SYSTEM_CODE 0xfe00
|
||||
#define PLUG_SYSTEM_CODE 0xfee1
|
||||
|
||||
#define REG_LITE_BLOCK 0x0e
|
||||
#define RC_LITE_BLOCK 0x80
|
||||
#define MAC_LITE_BLOCK 0x81
|
||||
#define ID_LITE_BLOCK 0x82
|
||||
#define DEVICE_ID_LITE_BLOCK 0x83
|
||||
#define SERVICE_CODE_LITE_BLOCK 0x84
|
||||
#define SYS_CODE_LITE_BLOCK 0x85
|
||||
#define CARD_KEY_VER_LITE_BLOCK 0x86
|
||||
#define CARD_KEY_LITE_BLOCK 0x87
|
||||
#define MEM_CONFIG_LITE_BLOCK 0x88
|
||||
#define WRITE_COUNT_LITE_BLOCK 0x90
|
||||
#define MAC_A_LITE_BLOCK 0x91
|
||||
#define STATE_LITE_BLOCK 0x92
|
||||
#define CRC_CHECK_LITE_BLOCK 0xA0
|
||||
|
||||
#define RANDOM_TYPE_SERVICE_ATTRIBUTE (0b0010 << 2)
|
||||
#define CYCLIC_TYPE_SERVICE_ATTRIBUTE (0b0011 << 2)
|
||||
#define PURSE_TYPE_SERVICE_ATTRIBUTE (0b010 << 3)
|
||||
|
||||
#define AUTH_RW_SERVICE_ATTRIBUTE (0b00)
|
||||
#define UNAUTH_RW_SERVICE_ATTRIBUTE (0b01)
|
||||
#define AUTH_RO_SERVICE_ATTRIBUTE (0b10)
|
||||
#define UNAUTH_RO_SERVICE_ATTRIBUTE (0b11)
|
||||
|
||||
#define AUTH_DIRECT_ACCESS_SERVICE_ATTRIBUTE (0b000)
|
||||
#define UNAUTH_DIRECT_ACCESS_SERVICE_ATTRIBUTE (0b001)
|
||||
#define AUTH_CASHBACK_DECREMENT_SERVICE_ATTRIBUTE (0b010)
|
||||
#define UNAUTH_CASHBACK_DECREMENT_SERVICE_ATTRIBUTE (0b011)
|
||||
#define AUTH_DECREMENT_SERVICE_ATTRIBUTE (0b100)
|
||||
#define UNAUTH_DECREMENT_SERVICE_ATTRIBUTE (0b101)
|
||||
#define AUTH_RO_PURSE_SERVICE_ATTRIBUTE (0b110)
|
||||
#define UNAUTH_RO_PURSE_SERVICE_ATTRIBUTE (0b111)
|
||||
|
||||
#define IS_2_BYTE_BLOCK_LIST_ELEMENT 0x80
|
||||
|
||||
#define FELICA_UNENCRYPTED_READ_CMD 0x06
|
||||
#define FELICA_UNENCRYPTED_WRITE_CMD 0x08
|
||||
|
||||
#define FELICA_UNENCRYPTED_READ_RES 0x07
|
||||
#define FELICA_UNENCRYPTED_WRITE_RES 0x09
|
||||
|
||||
typedef enum {
|
||||
FelicaICTypeRC_SA24_10K, // RC-SA24/1x
|
||||
FelicaICTypeRC_SA24_6K, // RC-SA24/1x1
|
||||
FelicaICTypeSD2_6K, // RC-SA21/2x1
|
||||
FelicaICTypeSD2_4K, // RC-SA21/2
|
||||
FelicaICTypeSD2WithDES, // RC-SA20/1, RC-SA20/2
|
||||
FelicaICTypeRC_SA08, // Certifications exist, prototype?
|
||||
FelicaICTypeSD1, // RC-SA01
|
||||
FelicaICTypeSD1WithDES, // RC-SA00
|
||||
FelicaICTypeFRAM_4K, // RC-S962
|
||||
FelicaICTypeFRAM_9K, // RC-S960
|
||||
FelicaICTypeEMV_36K, // RC-S954
|
||||
FelicaICTypeEMV_16K, // RC-S953
|
||||
FelicaICTypeEMV_32K, // RC-S952
|
||||
FelicaICType576B, // RC-S919
|
||||
FelicaICType4K, // RC-S915
|
||||
FelicaICType2K, // RC-S830 series cards, chip name unknown,
|
||||
FelicaICTypeMobileIC_V4_1,
|
||||
FelicaICTypeMobileIC_V4,
|
||||
FelicaICTypeMobileIC_V3,
|
||||
FelicaICTypeMobileIC_V2,
|
||||
FelicaICTypeMobileIC_V1,
|
||||
FelicaICTypeLite, // RC-S965
|
||||
FelicaICTypeLiteS, // RC-S966
|
||||
FelicaICTypeLink, // RC-S967,
|
||||
FelicaICTypePlug, // RC-S926
|
||||
FelicaICTypeSuica, // https://www.tuv-nederland.nl/assets/files/cerfiticaten/2019/07/cr-nscib-cc-10-30076-cr.pdf
|
||||
} FelicaICType;
|
||||
|
||||
typedef struct {
|
||||
uint8_t exponent: 2;
|
||||
// Incremented at read
|
||||
uint8_t real_a: 4;
|
||||
uint8_t real_b: 4;
|
||||
} FelicaMRTParts;
|
||||
|
||||
typedef enum {
|
||||
FelicaMRTCommandTypeVariable = 0,
|
||||
FelicaMRTCommandTypeFixed = 1,
|
||||
FelicaMRTCommandTypeMutualAuth = 2,
|
||||
FelicaMRTCommandTypeDataRead = 3,
|
||||
FelicaMRTCommandTypeDataWrite = 4,
|
||||
FelicaMRTCommandTypeDataOther = 4,
|
||||
} FelicaMRTCommandType;
|
||||
|
||||
typedef FelicaMRTParts FelicaMRTParameters[6];
|
||||
|
||||
typedef struct {
|
||||
uint16_t number;
|
||||
uint16_t end_service_code;
|
||||
} FelicaArea;
|
||||
|
||||
typedef enum {
|
||||
FelicaBlockTypeNormal,
|
||||
FelicaBlockTypeOverlap,
|
||||
FelicaBlockTypeExtended,
|
||||
} FelicaBlockType;
|
||||
|
||||
typedef struct {
|
||||
FelicaBlockType type;
|
||||
union {
|
||||
uint8_t data[FELICA_BLOCK_SIZE];
|
||||
};
|
||||
} FelicaBlock;
|
||||
|
||||
// typedef struct {} FelicaOverlapBlock;
|
||||
|
||||
typedef struct _FelicaService_t {
|
||||
uint16_t number;
|
||||
uint16_t block_count;
|
||||
FelicaBlock** blocks;
|
||||
|
||||
struct _FelicaService_t* next;
|
||||
} FelicaService;
|
||||
|
||||
typedef struct _FelicaSystem_t {
|
||||
uint8_t number;
|
||||
uint16_t code;
|
||||
uint8_t idm[8];
|
||||
uint8_t pmm[8];
|
||||
FelicaMRTParameters maximum_response_times;
|
||||
|
||||
FelicaService* services;
|
||||
|
||||
struct _FelicaSystem_t* next;
|
||||
} FelicaSystem;
|
||||
|
||||
typedef struct {
|
||||
FelicaICType type;
|
||||
uint8_t subtype;
|
||||
uint8_t system_count;
|
||||
FelicaSystem* systems;
|
||||
} FelicaData;
|
||||
|
||||
typedef struct {
|
||||
uint8_t current_idm[8];
|
||||
uint8_t current_pmm[8];
|
||||
|
||||
uint8_t status_flags[2];
|
||||
} FelicaReader;
|
||||
|
||||
bool felica_check_ic_type(uint8_t* PMm);
|
||||
FelicaICType felica_get_ic_type(uint8_t* PMm);
|
||||
bool felica_read_card(FuriHalNfcTxRxContext* tx_rx, FelicaData* data, uint8_t* polled_idm, uint8_t* polled_pmm);
|
||||
Reference in New Issue
Block a user