mount/flipperzero-firmware
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nfc: Add mifare classic value block commands (#2317)

Browse Source 
Co-authored-by: gornekich <n.gorbadey@gmail.com>
Co-authored-by: あく <alleteam@gmail.com>
This commit is contained in:
Krzysztof Zdulski 2023-02-07 04:21:25 +01:00 committed by GitHub
parent 1ff5843ee6
commit d035872cf6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 541 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
firmware/targets/f7/api_symbols.csv
View File

@ -1863,8 +1863,10 @@ Function,+,menu_reset,void,Menu*
Function,+,menu_set_selected_item,void,"Menu*, uint32_t"
Function,-,mf_classic_auth_attempt,_Bool,"FuriHalNfcTxRxContext*, MfClassicAuthContext*, uint64_t"
Function,-,mf_classic_auth_init_context,void,"MfClassicAuthContext*, uint8_t"
Function,-,mf_classic_auth_write_block,_Bool,"FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t"
Function,-,mf_classic_authenticate,_Bool,"FuriHalNfcTxRxContext*, uint8_t, uint64_t, MfClassicKey"
Function,-,mf_classic_authenticate_skip_activate,_Bool,"FuriHalNfcTxRxContext*, uint8_t, uint64_t, MfClassicKey, _Bool, uint32_t"
Function,-,mf_classic_block_to_value,_Bool,"const uint8_t*, int32_t*, uint8_t*"
Function,-,mf_classic_check_card_type,_Bool,"uint8_t, uint8_t, uint8_t"
Function,-,mf_classic_dict_add_key,_Bool,"MfClassicDict*, uint8_t*"
Function,-,mf_classic_dict_add_key_str,_Bool,"MfClassicDict*, FuriString*"
@ -1891,6 +1893,7 @@ Function,-,mf_classic_get_sector_trailer_by_sector,MfClassicSectorTrailer*,"MfCl
Function,-,mf_classic_get_total_block_num,uint16_t,MfClassicType
Function,-,mf_classic_get_total_sectors_num,uint8_t,MfClassicType
Function,-,mf_classic_get_type_str,const char*,MfClassicType
Function,-,mf_classic_halt,void,"FuriHalNfcTxRxContext*, Crypto1*"
Function,-,mf_classic_is_allowed_access_data_block,_Bool,"MfClassicData*, uint8_t, MfClassicKey, MfClassicAction"
Function,-,mf_classic_is_allowed_access_sector_trailer,_Bool,"MfClassicData*, uint8_t, MfClassicKey, MfClassicAction"
Function,-,mf_classic_is_block_read,_Bool,"MfClassicData*, uint8_t"
@ -1899,6 +1902,8 @@ Function,-,mf_classic_is_key_found,_Bool,"MfClassicData*, uint8_t, MfClassicKey"
Function,-,mf_classic_is_sector_data_read,_Bool,"MfClassicData*, uint8_t"
Function,-,mf_classic_is_sector_read,_Bool,"MfClassicData*, uint8_t"
Function,-,mf_classic_is_sector_trailer,_Bool,uint8_t
Function,-,mf_classic_is_value_block,_Bool,"MfClassicData*, uint8_t"
Function,-,mf_classic_read_block,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t, MfClassicBlock*"
Function,-,mf_classic_read_card,uint8_t,"FuriHalNfcTxRxContext*, MfClassicReader*, MfClassicData*"
Function,-,mf_classic_read_sector,void,"FuriHalNfcTxRxContext*, MfClassicData*, uint8_t"
Function,-,mf_classic_reader_add_sector,void,"MfClassicReader*, uint8_t, uint64_t, uint64_t"
@ -1906,8 +1911,12 @@ Function,-,mf_classic_set_block_read,void,"MfClassicData*, uint8_t, MfClassicBlo
Function,-,mf_classic_set_key_found,void,"MfClassicData*, uint8_t, MfClassicKey, uint64_t"
Function,-,mf_classic_set_key_not_found,void,"MfClassicData*, uint8_t, MfClassicKey"
Function,-,mf_classic_set_sector_data_not_read,void,MfClassicData*
Function,-,mf_classic_transfer,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t"
Function,-,mf_classic_update_card,uint8_t,"FuriHalNfcTxRxContext*, MfClassicData*"
Function,-,mf_classic_write_block,_Bool,"FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t"
Function,-,mf_classic_value_cmd,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t, uint8_t, int32_t"
Function,-,mf_classic_value_cmd_full,_Bool,"FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t, int32_t"
Function,-,mf_classic_value_to_block,void,"int32_t, uint8_t, uint8_t*"
Function,-,mf_classic_write_block,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t, MfClassicBlock*"
Function,-,mf_classic_write_sector,_Bool,"FuriHalNfcTxRxContext*, MfClassicData*, MfClassicData*, uint8_t"
Function,-,mf_df_cat_application,void,"MifareDesfireApplication*, FuriString*"
Function,-,mf_df_cat_application_info,void,"MifareDesfireApplication*, FuriString*"

1 entry status name type params
1863 Function + menu_set_selected_item void Menu*, uint32_t
1864 Function - mf_classic_auth_attempt _Bool FuriHalNfcTxRxContext*, MfClassicAuthContext*, uint64_t
1865 Function - mf_classic_auth_init_context void MfClassicAuthContext*, uint8_t
1866 Function - mf_classic_auth_write_block _Bool FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t
1867 Function - mf_classic_authenticate _Bool FuriHalNfcTxRxContext*, uint8_t, uint64_t, MfClassicKey
1868 Function - mf_classic_authenticate_skip_activate _Bool FuriHalNfcTxRxContext*, uint8_t, uint64_t, MfClassicKey, _Bool, uint32_t
1869 Function - mf_classic_block_to_value _Bool const uint8_t*, int32_t*, uint8_t*
1870 Function - mf_classic_check_card_type _Bool uint8_t, uint8_t, uint8_t
1871 Function - mf_classic_dict_add_key _Bool MfClassicDict*, uint8_t*
1872 Function - mf_classic_dict_add_key_str _Bool MfClassicDict*, FuriString*
1893 Function - mf_classic_get_total_block_num uint16_t MfClassicType
1894 Function - mf_classic_get_total_sectors_num uint8_t MfClassicType
1895 Function - mf_classic_get_type_str const char* MfClassicType
1896 Function - mf_classic_halt void FuriHalNfcTxRxContext*, Crypto1*
1897 Function - mf_classic_is_allowed_access_data_block _Bool MfClassicData*, uint8_t, MfClassicKey, MfClassicAction
1898 Function - mf_classic_is_allowed_access_sector_trailer _Bool MfClassicData*, uint8_t, MfClassicKey, MfClassicAction
1899 Function - mf_classic_is_block_read _Bool MfClassicData*, uint8_t
1902 Function - mf_classic_is_sector_data_read _Bool MfClassicData*, uint8_t
1903 Function - mf_classic_is_sector_read _Bool MfClassicData*, uint8_t
1904 Function - mf_classic_is_sector_trailer _Bool uint8_t
1905 Function - mf_classic_is_value_block _Bool MfClassicData*, uint8_t
1906 Function - mf_classic_read_block _Bool FuriHalNfcTxRxContext*, Crypto1*, uint8_t, MfClassicBlock*
1907 Function - mf_classic_read_card uint8_t FuriHalNfcTxRxContext*, MfClassicReader*, MfClassicData*
1908 Function - mf_classic_read_sector void FuriHalNfcTxRxContext*, MfClassicData*, uint8_t
1909 Function - mf_classic_reader_add_sector void MfClassicReader*, uint8_t, uint64_t, uint64_t
1911 Function - mf_classic_set_key_found void MfClassicData*, uint8_t, MfClassicKey, uint64_t
1912 Function - mf_classic_set_key_not_found void MfClassicData*, uint8_t, MfClassicKey
1913 Function - mf_classic_set_sector_data_not_read void MfClassicData*
1914 Function - mf_classic_transfer _Bool FuriHalNfcTxRxContext*, Crypto1*, uint8_t
1915 Function - mf_classic_update_card uint8_t FuriHalNfcTxRxContext*, MfClassicData*
1916 Function - mf_classic_write_block mf_classic_value_cmd _Bool FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t FuriHalNfcTxRxContext*, Crypto1*, uint8_t, uint8_t, int32_t
1917 Function - mf_classic_value_cmd_full _Bool FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t, int32_t
1918 Function - mf_classic_value_to_block void int32_t, uint8_t, uint8_t*
1919 Function - mf_classic_write_block _Bool FuriHalNfcTxRxContext*, Crypto1*, uint8_t, MfClassicBlock*
1920 Function - mf_classic_write_sector _Bool FuriHalNfcTxRxContext*, MfClassicData*, MfClassicData*, uint8_t
1921 Function - mf_df_cat_application void MifareDesfireApplication*, FuriString*
1922 Function - mf_df_cat_application_info void MifareDesfireApplication*, FuriString*

515
lib/nfc/protocols/mifare_classic.c
View File

@ -7,10 +7,17 @@
#define TAG "MfClassic"
#define MF_CLASSIC_AUTH_KEY_A_CMD (0x60U)
#define MF_CLASSIC_AUTH_KEY_B_CMD (0x61U)
#define MF_CLASSIC_READ_BLOCK_CMD (0x30)
#define MF_CLASSIC_WRITE_BLOCK_CMD (0xA0)
#define MF_CLASSIC_ACK_CMD 0xAU
#define MF_CLASSIC_NACK_BUF_VALID_CMD 0x0U
#define MF_CLASSIC_NACK_BUF_INVALID_CMD 0x4U
#define MF_CLASSIC_AUTH_KEY_A_CMD 0x60U
#define MF_CLASSIC_AUTH_KEY_B_CMD 0x61U
#define MF_CLASSIC_READ_BLOCK_CMD 0x30U
#define MF_CLASSIC_WRITE_BLOCK_CMD 0xA0U
#define MF_CLASSIC_TRANSFER_CMD 0xB0U
#define MF_CLASSIC_DECREMENT_CMD 0xC0U
#define MF_CLASSIC_INCREMENT_CMD 0xC1U
#define MF_CLASSIC_RESTORE_CMD 0xC2U
const char* mf_classic_get_type_str(MfClassicType type) {
if(type == MfClassicTypeMini) {
@ -217,8 +224,8 @@ void mf_classic_get_read_sectors_and_keys(
uint8_t first_block = mf_classic_get_first_block_num_of_sector(i);
uint8_t total_blocks_in_sec = mf_classic_get_blocks_num_in_sector(i);
bool blocks_read = true;
for(size_t i = first_block; i < first_block + total_blocks_in_sec; i++) {
blocks_read = mf_classic_is_block_read(data, i);
for(size_t j = first_block; j < first_block + total_blocks_in_sec; j++) {
blocks_read = mf_classic_is_block_read(data, j);
if(!blocks_read) break;
}
if(blocks_read) {
@ -353,6 +360,16 @@ static bool mf_classic_is_allowed_access(
}
}
bool mf_classic_is_value_block(MfClassicData* data, uint8_t block_num) {
// Check if key A can write, if it can, it's transport configuration, not data block
return !mf_classic_is_allowed_access_data_block(
data, block_num, MfClassicKeyA, MfClassicActionDataWrite) &&
(mf_classic_is_allowed_access_data_block(
data, block_num, MfClassicKeyB, MfClassicActionDataInc) ||
mf_classic_is_allowed_access_data_block(
data, block_num, MfClassicKeyB, MfClassicActionDataDec));
}
bool mf_classic_check_card_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK) {
UNUSED(ATQA1);
if((ATQA0 == 0x44 || ATQA0 == 0x04) && (SAK == 0x08 || SAK == 0x88 || SAK == 0x09)) {
@ -401,6 +418,36 @@ void mf_classic_reader_add_sector(
}
}
bool mf_classic_block_to_value(const uint8_t* block, int32_t* value, uint8_t* addr) {
uint32_t v = *(uint32_t*)&block[0];
uint32_t v_inv = *(uint32_t*)&block[4];
uint32_t v1 = *(uint32_t*)&block[8];
bool val_checks =
((v == v1) && (v == ~v_inv) && (block[12] == (~block[13] & 0xFF)) &&
(block[14] == (~block[15] & 0xFF)) && (block[12] == block[14]));
if(value) {
*value = (int32_t)v;
}
if(addr) {
*addr = block[12];
}
return val_checks;
}
void mf_classic_value_to_block(int32_t value, uint8_t addr, uint8_t* block) {
uint32_t v_inv = ~((uint32_t)value);
memcpy(block, &value, 4);
memcpy(block + 4, &v_inv, 4);
memcpy(block + 8, &value, 4);
block[12] = addr;
block[13] = ~addr & 0xFF;
block[14] = addr;
block[15] = ~addr & 0xFF;
}
void mf_classic_auth_init_context(MfClassicAuthContext* auth_ctx, uint8_t sector) {
furi_assert(auth_ctx);
auth_ctx->sector = sector;
@ -553,8 +600,9 @@ bool mf_classic_read_block(
uint8_t plain_cmd[4] = {MF_CLASSIC_READ_BLOCK_CMD, block_num, 0x00, 0x00};
nfca_append_crc16(plain_cmd, 2);
crypto1_encrypt(crypto, NULL, plain_cmd, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_bits = 4 * 9;
crypto1_encrypt(
crypto, NULL, plain_cmd, sizeof(plain_cmd) * 8, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_bits = sizeof(plain_cmd) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
@ -779,6 +827,9 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
bool is_encrypted = false;
uint8_t plain_data[MF_CLASSIC_MAX_DATA_SIZE];
MfClassicKey access_key = MfClassicKeyA;
// Used for decrement and increment - copy to block on transfer
uint8_t transfer_buf[MF_CLASSIC_BLOCK_SIZE] = {};
bool transfer_buf_valid = false;
// Read command
while(!command_processed) { //-V654
@ -797,18 +848,25 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
}
if(plain_data[0] == 0x50 && plain_data[1] == 0x00) {
// After increment, decrement or restore the only allowed command is transfer
uint8_t cmd = plain_data[0];
if(transfer_buf_valid && cmd != MF_CLASSIC_TRANSFER_CMD) {
break;
}
if(cmd == 0x50 && plain_data[1] == 0x00) {
FURI_LOG_T(TAG, "Halt received");
furi_hal_nfc_listen_sleep();
command_processed = true;
break;
} else if(plain_data[0] == 0x60 || plain_data[0] == 0x61) {
}
if(cmd == MF_CLASSIC_AUTH_KEY_A_CMD || cmd == MF_CLASSIC_AUTH_KEY_B_CMD) {
uint8_t block = plain_data[1];
uint64_t key = 0;
uint8_t sector_trailer_block = mf_classic_get_sector_trailer_num_by_block(block);
MfClassicSectorTrailer* sector_trailer =
(MfClassicSectorTrailer*)emulator->data.block[sector_trailer_block].value;
if(plain_data[0] == 0x60) {
if(cmd == MF_CLASSIC_AUTH_KEY_A_CMD) {
key = nfc_util_bytes2num(sector_trailer->key_a, 6);
access_key = MfClassicKeyA;
} else {
@ -826,9 +884,7 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
crypto1_word(&emulator->crypto, emulator->cuid ^ nonce, 0);
memcpy(tx_rx->tx_data, nt, sizeof(nt));
tx_rx->tx_parity[0] = 0;
for(size_t i = 0; i < sizeof(nt); i++) {
tx_rx->tx_parity[0] |= nfc_util_odd_parity8(nt[i]) << (7 - i);
}
nfc_util_odd_parity(tx_rx->tx_data, tx_rx->tx_parity, sizeof(nt));
tx_rx->tx_bits = sizeof(nt) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
} else {
@ -849,7 +905,7 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
}
if(tx_rx->rx_bits != 64) {
FURI_LOG_W(TAG, "Incorrect nr + ar");
FURI_LOG_W(TAG, "Incorrect nr + ar length: %d", tx_rx->rx_bits);
command_processed = true;
break;
}
@ -857,16 +913,6 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
uint32_t nr = nfc_util_bytes2num(tx_rx->rx_data, 4);
uint32_t ar = nfc_util_bytes2num(&tx_rx->rx_data[4], 4);
FURI_LOG_D(
TAG,
"%08lx key%c block %d nt/nr/ar: %08lx %08lx %08lx",
emulator->cuid,
access_key == MfClassicKeyA ? 'A' : 'B',
sector_trailer_block,
nonce,
nr,
ar);
crypto1_word(&emulator->crypto, nr, 1);
uint32_t cardRr = ar ^ crypto1_word(&emulator->crypto, 0, 0);
if(cardRr != prng_successor(nonce, 64)) {
@ -877,22 +923,30 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
}
uint32_t ans = prng_successor(nonce, 96);
uint8_t responce[4] = {};
nfc_util_num2bytes(ans, 4, responce);
uint8_t response[4] = {};
nfc_util_num2bytes(ans, 4, response);
crypto1_encrypt(
&emulator->crypto,
NULL,
responce,
sizeof(responce) * 8,
response,
sizeof(response) * 8,
tx_rx->tx_data,
tx_rx->tx_parity);
tx_rx->tx_bits = sizeof(responce) * 8;
tx_rx->tx_bits = sizeof(response) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
is_encrypted = true;
} else if(is_encrypted && plain_data[0] == 0x30) {
continue;
}
if(!is_encrypted) {
FURI_LOG_T(TAG, "Invalid command before auth session established: %02X", cmd);
break;
}
if(cmd == MF_CLASSIC_READ_BLOCK_CMD) {
uint8_t block = plain_data[1];
uint8_t block_data[18] = {};
uint8_t block_data[MF_CLASSIC_BLOCK_SIZE + 2] = {};
memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
if(mf_classic_is_sector_trailer(block)) {
if(!mf_classic_is_allowed_access(
@ -927,24 +981,24 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
sizeof(block_data) * 8,
tx_rx->tx_data,
tx_rx->tx_parity);
tx_rx->tx_bits = 18 * 8;
tx_rx->tx_bits = (MF_CLASSIC_BLOCK_SIZE + 2) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
} else if(is_encrypted && plain_data[0] == 0xA0) {
} else if(cmd == MF_CLASSIC_WRITE_BLOCK_CMD) {
uint8_t block = plain_data[1];
if(block > mf_classic_get_total_block_num(emulator->data.type)) {
break;
}
// Send ACK
uint8_t ack = 0x0A;
uint8_t ack = MF_CLASSIC_ACK_CMD;
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
if(tx_rx->rx_bits != 18 * 8) break;
if(tx_rx->rx_bits != (MF_CLASSIC_BLOCK_SIZE + 2) * 8) break;
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
uint8_t block_data[16] = {};
uint8_t block_data[MF_CLASSIC_BLOCK_SIZE] = {};
memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
if(mf_classic_is_sector_trailer(block)) {
if(mf_classic_is_allowed_access(
@ -963,6 +1017,8 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
if(mf_classic_is_allowed_access(
emulator, block, access_key, MfClassicActionDataWrite)) {
memcpy(block_data, plain_data, MF_CLASSIC_BLOCK_SIZE);
} else {
break;
}
}
if(memcmp(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) != 0) {
@ -970,19 +1026,83 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
emulator->data_changed = true;
}
// Send ACK
ack = 0x0A;
ack = MF_CLASSIC_ACK_CMD;
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
} else if(
cmd == MF_CLASSIC_DECREMENT_CMD || cmd == MF_CLASSIC_INCREMENT_CMD ||
cmd == MF_CLASSIC_RESTORE_CMD) {
uint8_t block = plain_data[1];
if(block > mf_classic_get_total_block_num(emulator->data.type)) {
break;
}
MfClassicAction action = MfClassicActionDataDec;
if(cmd == MF_CLASSIC_INCREMENT_CMD) {
action = MfClassicActionDataInc;
}
if(!mf_classic_is_allowed_access(emulator, block, access_key, action)) {
break;
}
int32_t prev_value;
uint8_t addr;
if(!mf_classic_block_to_value(emulator->data.block[block].value, &prev_value, &addr)) {
break;
}
// Send ACK
uint8_t ack = MF_CLASSIC_ACK_CMD;
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
if(tx_rx->rx_bits != (sizeof(int32_t) + 2) * 8) break;
crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
int32_t value = *(int32_t*)&plain_data[0];
if(value < 0) {
value = -value;
}
if(cmd == MF_CLASSIC_DECREMENT_CMD) {
value = -value;
} else if(cmd == MF_CLASSIC_RESTORE_CMD) {
value = 0;
}
mf_classic_value_to_block(prev_value + value, addr, transfer_buf);
transfer_buf_valid = true;
// Commands do not ACK
tx_rx->tx_bits = 0;
} else if(cmd == MF_CLASSIC_TRANSFER_CMD) {
uint8_t block = plain_data[1];
if(!mf_classic_is_allowed_access(emulator, block, access_key, MfClassicActionDataDec)) {
break;
}
if(memcmp(transfer_buf, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) !=
0) {
memcpy(emulator->data.block[block].value, transfer_buf, MF_CLASSIC_BLOCK_SIZE);
emulator->data_changed = true;
}
transfer_buf_valid = false;
uint8_t ack = MF_CLASSIC_ACK_CMD;
crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
tx_rx->tx_bits = 4;
} else {
// Unknown command
FURI_LOG_T(TAG, "Unknown command: %02X", cmd);
break;
}
}
if(!command_processed) {
// Send NACK
uint8_t nack = 0x04;
uint8_t nack = transfer_buf_valid ? MF_CLASSIC_NACK_BUF_VALID_CMD :
MF_CLASSIC_NACK_BUF_INVALID_CMD;
if(is_encrypted) {
crypto1_encrypt(&emulator->crypto, NULL, &nack, 4, tx_rx->tx_data, tx_rx->tx_parity);
} else {
@ -996,37 +1116,50 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
return true;
}
void mf_classic_halt(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto) {
furi_assert(tx_rx);
uint8_t plain_data[4] = {0x50, 0x00, 0x00, 0x00};
nfca_append_crc16(plain_data, 2);
if(crypto) {
crypto1_encrypt(
crypto, NULL, plain_data, sizeof(plain_data) * 8, tx_rx->tx_data, tx_rx->tx_parity);
} else {
memcpy(tx_rx->tx_data, plain_data, sizeof(plain_data));
nfc_util_odd_parity(tx_rx->tx_data, tx_rx->tx_parity, sizeof(plain_data));
}
tx_rx->tx_bits = sizeof(plain_data) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
furi_hal_nfc_tx_rx(tx_rx, 50);
}
bool mf_classic_write_block(
FuriHalNfcTxRxContext* tx_rx,
MfClassicBlock* src_block,
Crypto1* crypto,
uint8_t block_num,
MfClassicKey key_type,
uint64_t key) {
MfClassicBlock* src_block) {
furi_assert(tx_rx);
furi_assert(crypto);
furi_assert(src_block);
Crypto1 crypto = {};
uint8_t plain_data[18] = {};
uint8_t resp = 0;
bool write_success = false;
uint8_t plain_data[MF_CLASSIC_BLOCK_SIZE + 2] = {};
uint8_t resp;
do {
furi_hal_nfc_sleep();
if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
FURI_LOG_D(TAG, "Auth fail");
break;
}
// Send write command
plain_data[0] = MF_CLASSIC_WRITE_BLOCK_CMD;
plain_data[1] = block_num;
nfca_append_crc16(plain_data, 2);
crypto1_encrypt(&crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
crypto1_encrypt(crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_bits = 4 * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
if(tx_rx->rx_bits == 4) {
crypto1_decrypt(&crypto, tx_rx->rx_data, 4, &resp);
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
if(resp != 0x0A) {
FURI_LOG_D(TAG, "NACK received on write cmd: %02X", resp);
break;
@ -1044,7 +1177,7 @@ bool mf_classic_write_block(
memcpy(plain_data, src_block->value, MF_CLASSIC_BLOCK_SIZE);
nfca_append_crc16(plain_data, MF_CLASSIC_BLOCK_SIZE);
crypto1_encrypt(
&crypto,
crypto,
NULL,
plain_data,
(MF_CLASSIC_BLOCK_SIZE + 2) * 8,
@ -1054,8 +1187,8 @@ bool mf_classic_write_block(
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
if(tx_rx->rx_bits == 4) {
crypto1_decrypt(&crypto, tx_rx->rx_data, 4, &resp);
if(resp != 0x0A) {
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
if(resp != MF_CLASSIC_ACK_CMD) {
FURI_LOG_D(TAG, "NACK received on sending data");
break;
}
@ -1067,22 +1200,200 @@ bool mf_classic_write_block(
FURI_LOG_D(TAG, "Failed to send data");
break;
}
write_success = true;
// Send Halt
plain_data[0] = 0x50;
plain_data[1] = 0x00;
nfca_append_crc16(plain_data, 2);
crypto1_encrypt(&crypto, NULL, plain_data, 2 * 8, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_bits = 2 * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
// No response is expected
furi_hal_nfc_tx_rx(tx_rx, 50);
write_success = true;
} while(false);
return write_success;
}
bool mf_classic_auth_write_block(
FuriHalNfcTxRxContext* tx_rx,
MfClassicBlock* src_block,
uint8_t block_num,
MfClassicKey key_type,
uint64_t key) {
furi_assert(tx_rx);
furi_assert(src_block);
Crypto1 crypto = {};
bool write_success = false;
do {
furi_hal_nfc_sleep();
if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
FURI_LOG_D(TAG, "Auth fail");
break;
}
if(!mf_classic_write_block(tx_rx, &crypto, block_num, src_block)) {
FURI_LOG_D(TAG, "Write fail");
break;
}
write_success = true;
mf_classic_halt(tx_rx, &crypto);
} while(false);
return write_success;
}
bool mf_classic_transfer(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto, uint8_t block_num) {
furi_assert(tx_rx);
furi_assert(crypto);
// Send transfer command
uint8_t plain_data[4] = {MF_CLASSIC_TRANSFER_CMD, block_num, 0, 0};
uint8_t resp = 0;
bool transfer_success = false;
nfca_append_crc16(plain_data, 2);
crypto1_encrypt(
crypto, NULL, plain_data, sizeof(plain_data) * 8, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_bits = sizeof(plain_data) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
do {
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
if(tx_rx->rx_bits == 4) {
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
if(resp != 0x0A) {
FURI_LOG_D(TAG, "NACK received on transfer cmd: %02X", resp);
break;
}
} else {
FURI_LOG_D(TAG, "Not ACK received");
break;
}
} else {
FURI_LOG_D(TAG, "Failed to send transfer cmd");
break;
}
transfer_success = true;
} while(false);
return transfer_success;
}
bool mf_classic_value_cmd(
FuriHalNfcTxRxContext* tx_rx,
Crypto1* crypto,
uint8_t block_num,
uint8_t cmd,
int32_t d_value) {
furi_assert(tx_rx);
furi_assert(crypto);
furi_assert(
cmd == MF_CLASSIC_INCREMENT_CMD || cmd == MF_CLASSIC_DECREMENT_CMD ||
cmd == MF_CLASSIC_RESTORE_CMD);
furi_assert(d_value >= 0);
uint8_t plain_data[sizeof(d_value) + 2] = {};
uint8_t resp = 0;
bool success = false;
do {
// Send cmd
plain_data[0] = cmd;
plain_data[1] = block_num;
nfca_append_crc16(plain_data, 2);
crypto1_encrypt(crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_bits = 4 * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
if(tx_rx->rx_bits == 4) {
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
if(resp != 0x0A) {
FURI_LOG_D(TAG, "NACK received on write cmd: %02X", resp);
break;
}
} else {
FURI_LOG_D(TAG, "Not ACK received");
break;
}
} else {
FURI_LOG_D(TAG, "Failed to send write cmd");
break;
}
// Send data
memcpy(plain_data, &d_value, sizeof(d_value));
nfca_append_crc16(plain_data, sizeof(d_value));
crypto1_encrypt(
crypto, NULL, plain_data, (sizeof(d_value) + 2) * 8, tx_rx->tx_data, tx_rx->tx_parity);
tx_rx->tx_bits = (sizeof(d_value) + 2) * 8;
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
// inc, dec, restore do not ACK, but they do NACK
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
if(tx_rx->rx_bits == 4) {
crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
if(resp != 0x0A) {
FURI_LOG_D(TAG, "NACK received on transfer cmd: %02X", resp);
break;
}
} else {
FURI_LOG_D(TAG, "Not NACK received");
break;
}
}
success = true;
} while(false);
return success;
}
bool mf_classic_value_cmd_full(
FuriHalNfcTxRxContext* tx_rx,
MfClassicBlock* src_block,
uint8_t block_num,
MfClassicKey key_type,
uint64_t key,
int32_t d_value) {
furi_assert(tx_rx);
furi_assert(src_block);
Crypto1 crypto = {};
uint8_t cmd;
bool success = false;
if(d_value > 0) {
cmd = MF_CLASSIC_INCREMENT_CMD;
} else if(d_value < 0) {
cmd = MF_CLASSIC_DECREMENT_CMD;
d_value = -d_value;
} else {
cmd = MF_CLASSIC_RESTORE_CMD;
}
do {
furi_hal_nfc_sleep();
if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
FURI_LOG_D(TAG, "Value cmd auth fail");
break;
}
if(!mf_classic_value_cmd(tx_rx, &crypto, block_num, cmd, d_value)) {
FURI_LOG_D(TAG, "Value cmd inc/dec/res fail");
break;
}
if(!mf_classic_transfer(tx_rx, &crypto, block_num)) {
FURI_LOG_D(TAG, "Value cmd transfer fail");
break;
}
success = true;
// Send Halt
mf_classic_halt(tx_rx, &crypto);
} while(false);
return success;
}
bool mf_classic_write_sector(
FuriHalNfcTxRxContext* tx_rx,
MfClassicData* dest_data,
@ -1103,6 +1414,71 @@ bool mf_classic_write_sector(
// Compare blocks
if(memcmp(dest_data->block[i].value, src_data->block[i].value, MF_CLASSIC_BLOCK_SIZE) !=
0) {
if(mf_classic_is_value_block(dest_data, i)) {
bool key_a_inc_allowed = mf_classic_is_allowed_access_data_block(
dest_data, i, MfClassicKeyA, MfClassicActionDataInc);
bool key_b_inc_allowed = mf_classic_is_allowed_access_data_block(
dest_data, i, MfClassicKeyB, MfClassicActionDataInc);
bool key_a_dec_allowed = mf_classic_is_allowed_access_data_block(
dest_data, i, MfClassicKeyA, MfClassicActionDataDec);
bool key_b_dec_allowed = mf_classic_is_allowed_access_data_block(
dest_data, i, MfClassicKeyB, MfClassicActionDataDec);
int32_t src_value, dst_value;
mf_classic_block_to_value(src_data->block[i].value, &src_value, NULL);
mf_classic_block_to_value(dest_data->block[i].value, &dst_value, NULL);
int32_t diff = src_value - dst_value;
if(diff > 0) {
if(key_a_found && key_a_inc_allowed) {
FURI_LOG_I(TAG, "Incrementing block %d with key A by %ld", i, diff);
uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
if(!mf_classic_value_cmd_full(
tx_rx, &src_data->block[i], i, MfClassicKeyA, key, diff)) {
FURI_LOG_E(TAG, "Failed to increment block %d", i);
write_success = false;
break;
}
} else if(key_b_found && key_b_inc_allowed) {
FURI_LOG_I(TAG, "Incrementing block %d with key B by %ld", i, diff);
uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
if(!mf_classic_value_cmd_full(
tx_rx, &src_data->block[i], i, MfClassicKeyB, key, diff)) {
FURI_LOG_E(TAG, "Failed to increment block %d", i);
write_success = false;
break;
}
} else {
FURI_LOG_E(TAG, "Failed to increment block %d", i);
}
} else if(diff < 0) {
if(key_a_found && key_a_dec_allowed) {
FURI_LOG_I(TAG, "Decrementing block %d with key A by %ld", i, -diff);
uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
if(!mf_classic_value_cmd_full(
tx_rx, &src_data->block[i], i, MfClassicKeyA, key, diff)) {
FURI_LOG_E(TAG, "Failed to decrement block %d", i);
write_success = false;
break;
}
} else if(key_b_found && key_b_dec_allowed) {
FURI_LOG_I(TAG, "Decrementing block %d with key B by %ld", i, diff);
uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
if(!mf_classic_value_cmd_full(
tx_rx, &src_data->block[i], i, MfClassicKeyB, key, diff)) {
FURI_LOG_E(TAG, "Failed to decrement block %d", i);
write_success = false;
break;
}
} else {
FURI_LOG_E(TAG, "Failed to decrement block %d", i);
}
} else {
FURI_LOG_E(TAG, "Value block %d address changed, cannot write it", i);
}
} else {
bool key_a_write_allowed = mf_classic_is_allowed_access_data_block(
dest_data, i, MfClassicKeyA, MfClassicActionDataWrite);
bool key_b_write_allowed = mf_classic_is_allowed_access_data_block(
@ -1111,7 +1487,8 @@ bool mf_classic_write_sector(
if(key_a_found && key_a_write_allowed) {
FURI_LOG_I(TAG, "Writing block %d with key A", i);
uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
if(!mf_classic_write_block(tx_rx, &src_data->block[i], i, MfClassicKeyA, key)) {
if(!mf_classic_auth_write_block(
tx_rx, &src_data->block[i], i, MfClassicKeyA, key)) {
FURI_LOG_E(TAG, "Failed to write block %d", i);
write_success = false;
break;
@ -1119,7 +1496,8 @@ bool mf_classic_write_sector(
} else if(key_b_found && key_b_write_allowed) {
FURI_LOG_I(TAG, "Writing block %d with key A", i);
uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
if(!mf_classic_write_block(tx_rx, &src_data->block[i], i, MfClassicKeyB, key)) {
if(!mf_classic_auth_write_block(
tx_rx, &src_data->block[i], i, MfClassicKeyB, key)) {
FURI_LOG_E(TAG, "Failed to write block %d", i);
write_success = false;
break;
@ -1129,6 +1507,7 @@ bool mf_classic_write_sector(
write_success = false;
break;
}
}
} else {
FURI_LOG_D(TAG, "Blocks %d are equal", i);
}

37
lib/nfc/protocols/mifare_classic.h
View File

@ -120,6 +120,12 @@ bool mf_classic_is_allowed_access_data_block(
MfClassicKey key,
MfClassicAction action);
bool mf_classic_is_value_block(MfClassicData* data, uint8_t block_num);
bool mf_classic_block_to_value(const uint8_t* block, int32_t* value, uint8_t* addr);
void mf_classic_value_to_block(int32_t value, uint8_t addr, uint8_t* block);
bool mf_classic_is_key_found(MfClassicData* data, uint8_t sector_num, MfClassicKey key_type);
void mf_classic_set_key_found(
@ -177,6 +183,12 @@ void mf_classic_reader_add_sector(
uint64_t key_a,
uint64_t key_b);
bool mf_classic_read_block(
FuriHalNfcTxRxContext* tx_rx,
Crypto1* crypto,
uint8_t block_num,
MfClassicBlock* block);
void mf_classic_read_sector(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data, uint8_t sec_num);
uint8_t mf_classic_read_card(
@ -188,13 +200,38 @@ uint8_t mf_classic_update_card(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data
bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_rx);
void mf_classic_halt(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto);
bool mf_classic_write_block(
FuriHalNfcTxRxContext* tx_rx,
Crypto1* crypto,
uint8_t block_num,
MfClassicBlock* src_block);
bool mf_classic_auth_write_block(
FuriHalNfcTxRxContext* tx_rx,
MfClassicBlock* src_block,
uint8_t block_num,
MfClassicKey key_type,
uint64_t key);
bool mf_classic_transfer(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto, uint8_t block_num);
bool mf_classic_value_cmd(
FuriHalNfcTxRxContext* tx_rx,
Crypto1* crypto,
uint8_t block_num,
uint8_t cmd,
int32_t d_value);
bool mf_classic_value_cmd_full(
FuriHalNfcTxRxContext* tx_rx,
MfClassicBlock* src_block,
uint8_t block_num,
MfClassicKey key_type,
uint64_t key,
int32_t d_value);
bool mf_classic_write_sector(
FuriHalNfcTxRxContext* tx_rx,
MfClassicData* dest_data,

25
lib/nfc/protocols/nfc_util.c
View File

@ -23,7 +23,7 @@ void nfc_util_num2bytes(uint64_t src, uint8_t len, uint8_t* dest) {
}
}
uint64_t nfc_util_bytes2num(uint8_t* src, uint8_t len) {
uint64_t nfc_util_bytes2num(const uint8_t* src, uint8_t len) {
furi_assert(src);
furi_assert(len <= 8);
@ -45,3 +45,26 @@ uint8_t nfc_util_even_parity32(uint32_t data) {
uint8_t nfc_util_odd_parity8(uint8_t data) {
return nfc_util_odd_byte_parity[data];
}
void nfc_util_odd_parity(const uint8_t* src, uint8_t* dst, uint8_t len) {
furi_assert(src);
furi_assert(dst);
uint8_t parity = 0;
uint8_t bit = 0;
while(len--) {
parity |= nfc_util_odd_parity8(*src) << (7 - bit); // parity is MSB first
bit++;
if(bit == 8) {
*dst = parity;
dst++;
parity = 0;
bit = 0;
}
src++;
}
if(bit) {
*dst = parity;
}
}

4
lib/nfc/protocols/nfc_util.h
View File

@ -4,8 +4,10 @@
void nfc_util_num2bytes(uint64_t src, uint8_t len, uint8_t* dest);
uint64_t nfc_util_bytes2num(uint8_t* src, uint8_t len);
uint64_t nfc_util_bytes2num(const uint8_t* src, uint8_t len);
uint8_t nfc_util_even_parity32(uint32_t data);
uint8_t nfc_util_odd_parity8(uint8_t data);
void nfc_util_odd_parity(const uint8_t* src, uint8_t* dst, uint8_t len);