Skip to content

Commit f9101d8

Browse files
Astrrragornekichskotopes
authored
[FL-3686] Mifare Classic fixes (#3221)
* Update Mifare Classic generators to create more accuate data * Check the transfer buffer validity for NACK * Fix the AC issues * CRC errors don't really affect emulation, checking for them isn't worth it * Make ATQA logic a bit easier to understand * mf classic: change log level * mf classic: fix log level Co-authored-by: gornekich <[email protected]> Co-authored-by: あく <[email protected]>
1 parent 1c3cbec commit f9101d8

File tree

5 files changed

+60
-22
lines changed

5 files changed

+60
-22
lines changed

‎lib/nfc/helpers/nfc_data_generator.c

+27-14
Original file line numberDiff line numberDiff line change
@@ -329,9 +329,23 @@ static void nfc_generate_mf_classic_uid(uint8_t* uid, uint8_t length) {
329329
static void
330330
nfc_generate_mf_classic_common(MfClassicData* data, uint8_t uid_len, MfClassicType type) {
331331
data->iso14443_3a_data->uid_len = uid_len;
332-
data->iso14443_3a_data->atqa[0] = 0x44;
332+
data->iso14443_3a_data->atqa[0] = 0x00;
333333
data->iso14443_3a_data->atqa[1] = 0x00;
334-
data->iso14443_3a_data->sak = 0x08;
334+
data->iso14443_3a_data->sak = 0x00;
335+
// Calculate the proper ATQA and SAK
336+
if(uid_len == 7) {
337+
data->iso14443_3a_data->atqa[0] |= 0x40;
338+
}
339+
if(type == MfClassicType1k) {
340+
data->iso14443_3a_data->atqa[0] |= 0x04;
341+
data->iso14443_3a_data->sak = 0x08;
342+
} else if(type == MfClassicType4k) {
343+
data->iso14443_3a_data->atqa[0] |= 0x02;
344+
data->iso14443_3a_data->sak = 0x18;
345+
} else if(type == MfClassicTypeMini) {
346+
data->iso14443_3a_data->atqa[0] |= 0x08;
347+
data->iso14443_3a_data->sak = 0x09;
348+
}
335349
data->type = type;
336350
}
337351

@@ -343,6 +357,11 @@ static void nfc_generate_mf_classic_sector_trailer(MfClassicData* data, uint8_t
343357
sec_tr->access_bits.data[2] = 0x80;
344358
sec_tr->access_bits.data[3] = 0x69; // Nice
345359

360+
for(int i = 0; i < 6; i++) {
361+
sec_tr->key_a.data[i] = 0xFF;
362+
sec_tr->key_b.data[i] = 0xFF;
363+
}
364+
346365
mf_classic_set_block_read(data, block, &data->block[block]);
347366
mf_classic_set_key_found(
348367
data, mf_classic_get_sector_by_block(block), MfClassicKeyTypeA, 0xFFFFFFFFFFFF);
@@ -396,41 +415,35 @@ static void nfc_generate_mf_classic(NfcDevice* nfc_device, uint8_t uid_len, MfCl
396415

397416
uint16_t block_num = mf_classic_get_total_block_num(type);
398417
if(type == MfClassicType4k) {
399-
// Set every block to 0xFF
418+
// Set every block to 0x00
400419
for(uint16_t i = 1; i < block_num; i++) {
401420
if(mf_classic_is_sector_trailer(i)) {
402421
nfc_generate_mf_classic_sector_trailer(mfc_data, i);
403422
} else {
404-
memset(&mfc_data->block[i].data, 0xFF, 16);
423+
memset(&mfc_data->block[i].data, 0x00, 16);
405424
}
406425
mf_classic_set_block_read(mfc_data, i, &mfc_data->block[i]);
407426
}
408-
// Set SAK to 18
409-
mfc_data->iso14443_3a_data->sak = 0x18;
410427
} else if(type == MfClassicType1k) {
411-
// Set every block to 0xFF
428+
// Set every block to 0x00
412429
for(uint16_t i = 1; i < block_num; i++) {
413430
if(mf_classic_is_sector_trailer(i)) {
414431
nfc_generate_mf_classic_sector_trailer(mfc_data, i);
415432
} else {
416-
memset(&mfc_data->block[i].data, 0xFF, 16);
433+
memset(&mfc_data->block[i].data, 0x00, 16);
417434
}
418435
mf_classic_set_block_read(mfc_data, i, &mfc_data->block[i]);
419436
}
420-
// Set SAK to 08
421-
mfc_data->iso14443_3a_data->sak = 0x08;
422437
} else if(type == MfClassicTypeMini) {
423-
// Set every block to 0xFF
438+
// Set every block to 0x00
424439
for(uint16_t i = 1; i < block_num; i++) {
425440
if(mf_classic_is_sector_trailer(i)) {
426441
nfc_generate_mf_classic_sector_trailer(mfc_data, i);
427442
} else {
428-
memset(&mfc_data->block[i].data, 0xFF, 16);
443+
memset(&mfc_data->block[i].data, 0x00, 16);
429444
}
430445
mf_classic_set_block_read(mfc_data, i, &mfc_data->block[i]);
431446
}
432-
// Set SAK to 09
433-
mfc_data->iso14443_3a_data->sak = 0x09;
434447
}
435448

436449
nfc_generate_mf_classic_block_0(

‎lib/nfc/protocols/mf_classic/mf_classic.c

+7-6
Original file line numberDiff line numberDiff line change
@@ -606,6 +606,7 @@ static bool mf_classic_is_allowed_access_sector_trailer(
606606
uint8_t* access_bits_arr = sec_tr->access_bits.data;
607607
uint8_t AC = ((access_bits_arr[1] >> 5) & 0x04) | ((access_bits_arr[2] >> 2) & 0x02) |
608608
((access_bits_arr[2] >> 7) & 0x01);
609+
FURI_LOG_T("NFC", "AC: %02X", AC);
609610

610611
switch(action) {
611612
case MfClassicActionKeyARead: {
@@ -615,20 +616,20 @@ static bool mf_classic_is_allowed_access_sector_trailer(
615616
case MfClassicActionKeyBWrite: {
616617
return (
617618
(key_type == MfClassicKeyTypeA && (AC == 0x00 || AC == 0x01)) ||
618-
(key_type == MfClassicKeyTypeB && (AC == 0x04 || AC == 0x03)));
619+
(key_type == MfClassicKeyTypeB &&
620+
(AC == 0x00 || AC == 0x04 || AC == 0x03 || AC == 0x01)));
619621
}
620622
case MfClassicActionKeyBRead: {
621-
return (key_type == MfClassicKeyTypeA && (AC == 0x00 || AC == 0x02 || AC == 0x01));
623+
return (key_type == MfClassicKeyTypeA && (AC == 0x00 || AC == 0x02 || AC == 0x01)) ||
624+
(key_type == MfClassicKeyTypeB && (AC == 0x00 || AC == 0x02 || AC == 0x01));
622625
}
623626
case MfClassicActionACRead: {
624-
return (
625-
(key_type == MfClassicKeyTypeA) ||
626-
(key_type == MfClassicKeyTypeB && !(AC == 0x00 || AC == 0x02 || AC == 0x01)));
627+
return ((key_type == MfClassicKeyTypeA) || (key_type == MfClassicKeyTypeB));
627628
}
628629
case MfClassicActionACWrite: {
629630
return (
630631
(key_type == MfClassicKeyTypeA && (AC == 0x01)) ||
631-
(key_type == MfClassicKeyTypeB && (AC == 0x03 || AC == 0x05)));
632+
(key_type == MfClassicKeyTypeB && (AC == 0x01 || AC == 0x03 || AC == 0x05)));
632633
}
633634
default:
634635
return false;

‎lib/nfc/protocols/mf_classic/mf_classic.h

+2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ extern "C" {
1919
#define MF_CLASSIC_CMD_HALT_LSB (0x00)
2020
#define MF_CLASSIC_CMD_ACK (0x0A)
2121
#define MF_CLASSIC_CMD_NACK (0x00)
22+
#define MF_CLASSIC_CMD_NACK_TRANSFER_INVALID (0x04)
23+
#define MF_CLASSIC_CMD_NACK_TRANSFER_CRC_ERROR (0x01)
2224

2325
#define MF_CLASSIC_TOTAL_SECTORS_MAX (40)
2426
#define MF_CLASSIC_TOTAL_BLOCKS_MAX (256)

‎lib/nfc/protocols/mf_classic/mf_classic_listener.c

+23-2
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ static void mf_classic_listener_reset_state(MfClassicListener* instance) {
3434
instance->cmd_in_progress = false;
3535
instance->current_cmd_handler_idx = 0;
3636
instance->transfer_value = 0;
37+
instance->transfer_valid = false;
3738
instance->value_cmd = MfClassicValueCommandInvalid;
3839
}
3940

@@ -154,7 +155,7 @@ static MfClassicListenerCommand
154155
uint32_t nt_num = nfc_util_bytes2num(instance->auth_context.nt.data, sizeof(MfClassicNt));
155156
uint32_t secret_poller = ar_num ^ crypto1_word(instance->crypto, 0, 0);
156157
if(secret_poller != prng_successor(nt_num, 64)) {
157-
FURI_LOG_D(
158+
FURI_LOG_T(
158159
TAG, "Wrong reader key: %08lX != %08lX", secret_poller, prng_successor(nt_num, 64));
159160
mf_classic_listener_reset_state(instance);
160161
break;
@@ -272,6 +273,17 @@ static MfClassicListenerCommand mf_classic_listener_write_block_second_part_hand
272273

273274
if(mf_classic_is_sector_trailer(block_num)) {
274275
MfClassicSectorTrailer* sec_tr = (MfClassicSectorTrailer*)&block;
276+
277+
// Check if any writing is allowed
278+
if(!mf_classic_is_allowed_access(
279+
instance->data, block_num, key_type, MfClassicActionKeyAWrite) &&
280+
!mf_classic_is_allowed_access(
281+
instance->data, block_num, key_type, MfClassicActionKeyBWrite) &&
282+
!mf_classic_is_allowed_access(
283+
instance->data, block_num, key_type, MfClassicActionACWrite)) {
284+
break;
285+
}
286+
275287
if(mf_classic_is_allowed_access(
276288
instance->data, block_num, key_type, MfClassicActionKeyAWrite)) {
277289
bit_buffer_write_bytes_mid(buff, sec_tr->key_a.data, 0, sizeof(MfClassicKey));
@@ -338,6 +350,7 @@ static MfClassicListenerCommand
338350
break;
339351
}
340352

353+
instance->transfer_valid = true;
341354
instance->cmd_in_progress = true;
342355
instance->current_cmd_handler_idx++;
343356
command = MfClassicListenerCommandAck;
@@ -382,6 +395,7 @@ static MfClassicListenerCommand
382395
}
383396

384397
instance->transfer_value += data;
398+
instance->transfer_valid = true;
385399

386400
instance->cmd_in_progress = true;
387401
instance->current_cmd_handler_idx++;
@@ -411,6 +425,7 @@ static MfClassicListenerCommand
411425
mf_classic_value_to_block(
412426
instance->transfer_value, block_num, &instance->data->block[block_num]);
413427
instance->transfer_value = 0;
428+
instance->transfer_valid = false;
414429

415430
command = MfClassicListenerCommandAck;
416431
} while(false);
@@ -581,7 +596,13 @@ NfcCommand mf_classic_listener_run(NfcGenericEvent event, void* context) {
581596
if(mfc_command == MfClassicListenerCommandAck) {
582597
mf_classic_listener_send_short_frame(instance, MF_CLASSIC_CMD_ACK);
583598
} else if(mfc_command == MfClassicListenerCommandNack) {
584-
mf_classic_listener_send_short_frame(instance, MF_CLASSIC_CMD_NACK);
599+
// Calculate nack based on the transfer buffer validity
600+
uint8_t nack = MF_CLASSIC_CMD_NACK;
601+
if(!instance->transfer_valid) {
602+
nack += MF_CLASSIC_CMD_NACK_TRANSFER_INVALID;
603+
}
604+
605+
mf_classic_listener_send_short_frame(instance, nack);
585606
} else if(mfc_command == MfClassicListenerCommandSilent) {
586607
command = NfcCommandReset;
587608
} else if(mfc_command == MfClassicListenerCommandSleep) {

‎lib/nfc/protocols/mf_classic/mf_classic_listener_i.h

+1
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ struct MfClassicListener {
4242

4343
// Value operation data
4444
int32_t transfer_value;
45+
bool transfer_valid;
4546
MfClassicValueCommand value_cmd;
4647

4748
NfcGenericEvent generic_event;

0 commit comments

Comments
 (0)