[FL-2245] Introduce Mifare Classic Emulation (#1242)

* digital signal: introduce digital signal * nfca: add nfca signal encoder * nfc: add mifare classic emulation scene * nfca: add classic emulation support to lib and hal * mifare classic: support basic read commands * nfc: add mifare classic menu scene * mifare classic: start parsing commands in emulation * mifare classic: add nested auth * nfc: fix errors * mifare classic: add encrypt function * nfc: fix mifare classic save * lib hex: add hex uint64_t ASCII parser * flipper format: add uint64 hex format support * nfc: add mifare classic key map * nfc: hide mifare classic keys on emulation * mifare classic: add NACK responce * nfc: add partial bytes support in transparent mode * nfc: mifare classic add shadow file support * digital signal: move arr buffer from BSS to heap * mifare classic: process access bits more careful * nfca: fix memory leack * nfc: format sources * mifare classic: cleun up Co-authored-by: あく <alleteam@gmail.com>
2022-05-24 17:00:15 +03:00
parent 2017baac48
commit d31578508a
28 changed files with 1150 additions and 28 deletions
--- a/lib/nfc_protocols/crypto1.c
+++ b/lib/nfc_protocols/crypto1.c
@@ -58,7 +58,7 @@ uint8_t crypto1_byte(Crypto1* crypto1, uint8_t in, int is_encrypted) {
    return out;
 }

-uint8_t crypto1_word(Crypto1* crypto1, uint32_t in, int is_encrypted) {
+uint32_t crypto1_word(Crypto1* crypto1, uint32_t in, int is_encrypted) {
    furi_assert(crypto1);
    uint32_t out = 0;
    for(uint8_t i = 0; i < 32; i++) {
--- a/lib/nfc_protocols/crypto1.h
+++ b/lib/nfc_protocols/crypto1.h
@@ -16,7 +16,7 @@ uint8_t crypto1_bit(Crypto1* crypto1, uint8_t in, int is_encrypted);

 uint8_t crypto1_byte(Crypto1* crypto1, uint8_t in, int is_encrypted);

-uint8_t crypto1_word(Crypto1* crypto1, uint32_t in, int is_encrypted);
+uint32_t crypto1_word(Crypto1* crypto1, uint32_t in, int is_encrypted);

 uint32_t crypto1_filter(uint32_t in);

--- a/lib/nfc_protocols/mifare_classic.c
+++ b/lib/nfc_protocols/mifare_classic.c
@@ -1,6 +1,7 @@
 #include "mifare_classic.h"
 #include "nfca.h"
 #include "nfc_util.h"
+#include <furi_hal_rtc.h>

 // Algorithm from https://github.com/RfidResearchGroup/proxmark3.git

@@ -10,6 +11,20 @@
 #define MF_CLASSIC_AUTH_KEY_B_CMD (0x61U)
 #define MF_CLASSIC_READ_SECT_CMD (0x30)

+typedef enum {
+    MfClassicActionDataRead,
+    MfClassicActionDataWrite,
+    MfClassicActionDataInc,
+    MfClassicActionDataDec,
+
+    MfClassicActionKeyARead,
+    MfClassicActionKeyAWrite,
+    MfClassicActionKeyBRead,
+    MfClassicActionKeyBWrite,
+    MfClassicActionACRead,
+    MfClassicActionACWrite,
+} MfClassicAction;
+
 static uint8_t mf_classic_get_first_block_num_of_sector(uint8_t sector) {
    furi_assert(sector < 40);
    if(sector < 32) {
@@ -19,11 +34,31 @@ static uint8_t mf_classic_get_first_block_num_of_sector(uint8_t sector) {
    }
 }

+static uint8_t mf_classic_get_sector_by_block(uint8_t block) {
+    if(block < 128) {
+        return (block | 0x03) / 4;
+    } else {
+        return 32 + ((block | 0xf) - 32 * 4) / 16;
+    }
+}
+
 static uint8_t mf_classic_get_blocks_num_in_sector(uint8_t sector) {
    furi_assert(sector < 40);
    return sector < 32 ? 4 : 16;
 }

+static uint8_t mf_classic_get_sector_trailer(uint8_t block) {
+    if(block < 128) {
+        return block | 0x03;
+    } else {
+        return block | 0x0f;
+    }
+}
+
+static bool mf_classic_is_sector_trailer(uint8_t block) {
+    return block == mf_classic_get_sector_trailer(block);
+}
+
 uint8_t mf_classic_get_total_sectors_num(MfClassicReader* reader) {
    furi_assert(reader);
    if(reader->type == MfClassicType1k) {
@@ -35,6 +70,132 @@ uint8_t mf_classic_get_total_sectors_num(MfClassicReader* reader) {
    }
 }

+static uint16_t mf_classic_get_total_block_num(MfClassicType type) {
+    if(type == MfClassicType1k) {
+        return 64;
+    } else if(type == MfClassicType4k) {
+        return 256;
+    } else {
+        return 0;
+    }
+}
+
+static bool mf_classic_is_allowed_access_sector_trailer(
+    MfClassicEmulator* emulator,
+    uint8_t block_num,
+    MfClassicKey key,
+    MfClassicAction action) {
+    uint8_t* sector_trailer = emulator->data.block[block_num].value;
+    uint8_t AC = ((sector_trailer[7] >> 5) & 0x04) | ((sector_trailer[8] >> 2) & 0x02) |
+                 ((sector_trailer[8] >> 7) & 0x01);
+    switch(action) {
+    case MfClassicActionKeyARead: {
+        return false;
+    }
+    case MfClassicActionKeyAWrite: {
+        return (
+            (key == MfClassicKeyA && (AC == 0x00 || AC == 0x01)) ||
+            (key == MfClassicKeyB && (AC == 0x04 || AC == 0x03)));
+    }
+    case MfClassicActionKeyBRead: {
+        return (key == MfClassicKeyA && (AC == 0x00 || AC == 0x02 || AC == 0x01));
+    }
+    case MfClassicActionKeyBWrite: {
+        return (
+            (key == MfClassicKeyA && (AC == 0x00 || AC == 0x01)) ||
+            (key == MfClassicKeyB && (AC == 0x04 || AC == 0x03)));
+    }
+    case MfClassicActionACRead: {
+        return (
+            (key == MfClassicKeyA) ||
+            (key == MfClassicKeyB && !(AC == 0x00 || AC == 0x02 || AC == 0x01)));
+    }
+    case MfClassicActionACWrite: {
+        return (
+            (key == MfClassicKeyA && (AC == 0x01)) ||
+            (key == MfClassicKeyB && (AC == 0x03 || AC == 0x05)));
+    }
+    default:
+        return false;
+    }
+    return true;
+}
+
+static bool mf_classic_is_allowed_access_data_block(
+    MfClassicEmulator* emulator,
+    uint8_t block_num,
+    MfClassicKey key,
+    MfClassicAction action) {
+    uint8_t* sector_trailer = emulator->data.block[mf_classic_get_sector_trailer(block_num)].value;
+
+    uint8_t sector_block;
+    if(block_num <= 128) {
+        sector_block = block_num & 0x03;
+    } else {
+        sector_block = (block_num & 0x0f) / 5;
+    }
+
+    uint8_t AC;
+    switch(sector_block) {
+    case 0x00: {
+        AC = ((sector_trailer[7] >> 2) & 0x04) | ((sector_trailer[8] << 1) & 0x02) |
+             ((sector_trailer[8] >> 4) & 0x01);
+        break;
+    }
+    case 0x01: {
+        AC = ((sector_trailer[7] >> 3) & 0x04) | ((sector_trailer[8] >> 0) & 0x02) |
+             ((sector_trailer[8] >> 5) & 0x01);
+        break;
+    }
+    case 0x02: {
+        AC = ((sector_trailer[7] >> 4) & 0x04) | ((sector_trailer[8] >> 1) & 0x02) |
+             ((sector_trailer[8] >> 6) & 0x01);
+        break;
+    }
+    default:
+        return false;
+    }
+
+    switch(action) {
+    case MfClassicActionDataRead: {
+        return (
+            (key == MfClassicKeyA && !(AC == 0x03 || AC == 0x05 || AC == 0x07)) ||
+            (key == MfClassicKeyB && !(AC == 0x07)));
+    }
+    case MfClassicActionDataWrite: {
+        return (
+            (key == MfClassicKeyA && (AC == 0x00)) ||
+            (key == MfClassicKeyB && (AC == 0x00 || AC == 0x04 || AC == 0x06 || AC == 0x03)));
+    }
+    case MfClassicActionDataInc: {
+        return (
+            (key == MfClassicKeyA && (AC == 0x00)) ||
+            (key == MfClassicKeyB && (AC == 0x00 || AC == 0x06)));
+    }
+    case MfClassicActionDataDec: {
+        return (
+            (key == MfClassicKeyA && (AC == 0x00 || AC == 0x06 || AC == 0x01)) ||
+            (key == MfClassicKeyB && (AC == 0x00 || AC == 0x06 || AC == 0x01)));
+    }
+    default:
+        return false;
+    }
+
+    return false;
+}
+
+static bool mf_classic_is_allowed_access(
+    MfClassicEmulator* emulator,
+    uint8_t block_num,
+    MfClassicKey key,
+    MfClassicAction action) {
+    if(mf_classic_is_sector_trailer(block_num)) {
+        return mf_classic_is_allowed_access_sector_trailer(emulator, block_num, key, action);
+    } else {
+        return mf_classic_is_allowed_access_data_block(emulator, block_num, key, action);
+    }
+}
+
 bool mf_classic_check_card_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK) {
    UNUSED(ATQA1);
    if((ATQA0 == 0x44 || ATQA0 == 0x04) && (SAK == 0x08)) {
@@ -120,7 +281,7 @@ static bool mf_classic_auth(
        tx_rx->tx_data[1] = block;
        tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRxNoCrc;
        tx_rx->tx_bits = 2 * 8;
-        if(!furi_hal_nfc_tx_rx(tx_rx, 5)) break;
+        if(!furi_hal_nfc_tx_rx(tx_rx, 6)) break;

        uint32_t nt = (uint32_t)nfc_util_bytes2num(tx_rx->rx_data, 4);
        crypto1_init(crypto, key);
@@ -142,7 +303,7 @@ static bool mf_classic_auth(
        }
        tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
        tx_rx->tx_bits = 8 * 8;
-        if(!furi_hal_nfc_tx_rx(tx_rx, 5)) break;
+        if(!furi_hal_nfc_tx_rx(tx_rx, 6)) break;
        if(tx_rx->rx_bits == 32) {
            crypto1_word(crypto, 0, 0);
            auth_success = true;
@@ -296,6 +457,8 @@ uint8_t mf_classic_read_card(

    uint8_t sectors_read = 0;
    data->type = reader->type;
+    data->key_a_mask = 0;
+    data->key_b_mask = 0;
    MfClassicSector temp_sector = {};
    for(uint8_t i = 0; i < reader->sectors_to_read; i++) {
        if(mf_classic_read_sector(
@@ -305,9 +468,279 @@ uint8_t mf_classic_read_card(
            for(uint8_t j = 0; j < temp_sector.total_blocks; j++) {
                data->block[first_block + j] = temp_sector.block[j];
            }
+            if(reader->sector_reader[i].key_a != MF_CLASSIC_NO_KEY) {
+                data->key_a_mask |= 1 << reader->sector_reader[i].sector_num;
+            }
+            if(reader->sector_reader[i].key_b != MF_CLASSIC_NO_KEY) {
+                data->key_b_mask |= 1 << reader->sector_reader[i].sector_num;
+            }
            sectors_read++;
        }
    }

    return sectors_read;
 }
+
+void mf_crypto1_decrypt(
+    Crypto1* crypto,
+    uint8_t* encrypted_data,
+    uint16_t encrypted_data_bits,
+    uint8_t* decrypted_data) {
+    if(encrypted_data_bits < 8) {
+        uint8_t decrypted_byte = 0;
+        decrypted_byte |= (crypto1_bit(crypto, 0, 0) ^ FURI_BIT(encrypted_data[0], 0)) << 0;
+        decrypted_byte |= (crypto1_bit(crypto, 0, 0) ^ FURI_BIT(encrypted_data[0], 1)) << 1;
+        decrypted_byte |= (crypto1_bit(crypto, 0, 0) ^ FURI_BIT(encrypted_data[0], 2)) << 2;
+        decrypted_byte |= (crypto1_bit(crypto, 0, 0) ^ FURI_BIT(encrypted_data[0], 3)) << 3;
+        decrypted_data[0] = decrypted_byte;
+    } else {
+        for(size_t i = 0; i < encrypted_data_bits / 8; i++) {
+            decrypted_data[i] = crypto1_byte(crypto, 0, 0) ^ encrypted_data[i];
+        }
+    }
+}
+
+void mf_crypto1_encrypt(
+    Crypto1* crypto,
+    uint8_t* keystream,
+    uint8_t* plain_data,
+    uint16_t plain_data_bits,
+    uint8_t* encrypted_data,
+    uint8_t* encrypted_parity) {
+    if(plain_data_bits < 8) {
+        encrypted_data[0] = 0;
+        for(size_t i = 0; i < plain_data_bits; i++) {
+            encrypted_data[0] |= (crypto1_bit(crypto, 0, 0) ^ FURI_BIT(plain_data[0], i)) << i;
+        }
+    } else {
+        memset(encrypted_parity, 0, plain_data_bits / 8 + 1);
+        for(uint8_t i = 0; i < plain_data_bits / 8; i++) {
+            encrypted_data[i] = crypto1_byte(crypto, keystream ? keystream[i] : 0, 0) ^
+                                plain_data[i];
+            encrypted_parity[i / 8] |=
+                (((crypto1_filter(crypto->odd) ^ nfc_util_odd_parity8(plain_data[i])) & 0x01)
+                 << (7 - (i & 0x0007)));
+        }
+    }
+}
+
+bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_rx) {
+    furi_assert(emulator);
+    furi_assert(tx_rx);
+    bool command_processed = false;
+    bool is_encrypted = false;
+    uint8_t plain_data[MF_CLASSIC_MAX_DATA_SIZE];
+    MfClassicKey access_key = MfClassicKeyA;
+
+    // Read command
+    while(!command_processed) {
+        if(!is_encrypted) {
+            // Read first frame
+            tx_rx->tx_bits = 0;
+            tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
+        }
+        if(!furi_hal_nfc_tx_rx(tx_rx, 300)) {
+            FURI_LOG_D(
+                TAG, "Error in tx rx. Tx :%d bits, Rx: %d bits", tx_rx->tx_bits, tx_rx->rx_bits);
+            break;
+        }
+        if(!is_encrypted) {
+            memcpy(plain_data, tx_rx->rx_data, tx_rx->rx_bits / 8);
+        } else {
+            mf_crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
+        }
+        // TODO Check crc
+
+        if(plain_data[0] == 0x50 && plain_data[1] == 00) {
+            FURI_LOG_T(TAG, "Halt received");
+            command_processed = true;
+            break;
+        } else if(plain_data[0] == 0x60 || plain_data[0] == 0x61) {
+            uint8_t block = plain_data[1];
+            uint64_t key = 0;
+            uint8_t sector_trailer_block = mf_classic_get_sector_trailer(block);
+            MfClassicSectorTrailer* sector_trailer =
+                (MfClassicSectorTrailer*)emulator->data.block[sector_trailer_block].value;
+            if(plain_data[0] == 0x61) {
+                key = nfc_util_bytes2num(sector_trailer->key_b, 6);
+                access_key = MfClassicKeyA;
+            } else {
+                key = nfc_util_bytes2num(sector_trailer->key_a, 6);
+                access_key = MfClassicKeyB;
+            }
+
+            uint32_t nonce = prng_successor(DWT->CYCCNT, 32);
+            uint8_t nt[4];
+            uint8_t nt_keystream[4];
+            nfc_util_num2bytes(nonce, 4, nt);
+            nfc_util_num2bytes(nonce ^ emulator->cuid, 4, nt_keystream);
+            crypto1_init(&emulator->crypto, key);
+            if(!is_encrypted) {
+                crypto1_word(&emulator->crypto, emulator->cuid ^ nonce, 0);
+                memcpy(tx_rx->tx_data, nt, sizeof(nt));
+                tx_rx->tx_bits = sizeof(nt) * 8;
+                tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRxRaw;
+            } else {
+                mf_crypto1_encrypt(
+                    &emulator->crypto,
+                    nt_keystream,
+                    nt,
+                    sizeof(nt) * 8,
+                    tx_rx->tx_data,
+                    tx_rx->tx_parity);
+                tx_rx->tx_bits = sizeof(nt) * 8;
+                tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+            }
+            if(!furi_hal_nfc_tx_rx(tx_rx, 500)) {
+                FURI_LOG_E(TAG, "Error in NT exchange");
+                command_processed = true;
+                break;
+            }
+
+            if(tx_rx->rx_bits != 64) {
+                FURI_LOG_W(TAG, "Incorrect nr + ar");
+                command_processed = true;
+                break;
+            }
+
+            // Check if we store valid key
+            if(access_key == MfClassicKeyA) {
+                if(FURI_BIT(emulator->data.key_a_mask, mf_classic_get_sector_by_block(block)) ==
+                   0) {
+                    FURI_LOG_D(TAG, "Unsupported sector key A for block %d", sector_trailer_block);
+                    break;
+                }
+            } else if(access_key == MfClassicKeyB) {
+                if(FURI_BIT(emulator->data.key_b_mask, mf_classic_get_sector_by_block(block)) ==
+                   0) {
+                    FURI_LOG_D(TAG, "Unsupported sector key B for block %d", sector_trailer_block);
+                    break;
+                }
+            }
+
+            uint32_t nr = nfc_util_bytes2num(tx_rx->rx_data, 4);
+            uint32_t ar = nfc_util_bytes2num(&tx_rx->rx_data[4], 4);
+            crypto1_word(&emulator->crypto, nr, 1);
+            uint32_t cardRr = ar ^ crypto1_word(&emulator->crypto, 0, 0);
+            if(cardRr != prng_successor(nonce, 64)) {
+                FURI_LOG_T(TAG, "Wrong AUTH! %08X != %08X", cardRr, prng_successor(nonce, 64));
+                // Don't send NACK, as tag don't send it
+                command_processed = true;
+                break;
+            }
+
+            uint32_t ans = prng_successor(nonce, 96);
+            uint8_t responce[4] = {};
+            nfc_util_num2bytes(ans, 4, responce);
+            mf_crypto1_encrypt(
+                &emulator->crypto,
+                NULL,
+                responce,
+                sizeof(responce) * 8,
+                tx_rx->tx_data,
+                tx_rx->tx_parity);
+            tx_rx->tx_bits = sizeof(responce) * 8;
+            tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+
+            is_encrypted = true;
+        } else if(is_encrypted && plain_data[0] == 0x30) {
+            uint8_t block = plain_data[1];
+            uint8_t block_data[18] = {};
+            memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
+            if(mf_classic_is_sector_trailer(block)) {
+                if(!mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionKeyARead)) {
+                    memset(block_data, 0, 6);
+                }
+                if(!mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionKeyBRead)) {
+                    memset(&block_data[10], 0, 6);
+                }
+                if(!mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionACRead)) {
+                    memset(&block_data[6], 0, 4);
+                }
+            } else {
+                if(!mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionDataRead)) {
+                    memset(block_data, 0, 16);
+                }
+            }
+            nfca_append_crc16(block_data, 16);
+
+            mf_crypto1_encrypt(
+                &emulator->crypto,
+                NULL,
+                block_data,
+                sizeof(block_data) * 8,
+                tx_rx->tx_data,
+                tx_rx->tx_parity);
+            tx_rx->tx_bits = 18 * 8;
+            tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+        } else if(is_encrypted && plain_data[0] == 0xA0) {
+            uint8_t block = plain_data[1];
+            if(block > mf_classic_get_total_block_num(emulator->data.type)) {
+                break;
+            }
+            // Send ACK
+            uint8_t ack = 0x0A;
+            mf_crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
+            tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+            tx_rx->tx_bits = 4;
+
+            if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
+            if(tx_rx->rx_bits != 18 * 8) break;
+
+            mf_crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
+            uint8_t block_data[16] = {};
+            memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
+            if(mf_classic_is_sector_trailer(block)) {
+                if(mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionKeyAWrite)) {
+                    memcpy(block_data, plain_data, 6);
+                }
+                if(mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionKeyBWrite)) {
+                    memcpy(&block_data[10], &plain_data[10], 6);
+                }
+                if(mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionACWrite)) {
+                    memcpy(&block_data[6], &plain_data[6], 4);
+                }
+            } else {
+                if(mf_classic_is_allowed_access(
+                       emulator, block, access_key, MfClassicActionDataWrite)) {
+                    memcpy(block_data, plain_data, MF_CLASSIC_BLOCK_SIZE);
+                }
+            }
+            if(memcmp(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE)) {
+                memcpy(emulator->data.block[block].value, block_data, MF_CLASSIC_BLOCK_SIZE);
+                emulator->data_changed = true;
+            }
+            // Send ACK
+            ack = 0x0A;
+            mf_crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
+            tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+            tx_rx->tx_bits = 4;
+        } else {
+            // Unknown command
+            break;
+        }
+    }
+
+    if(!command_processed) {
+        // Send NACK
+        uint8_t nack = 0x04;
+        if(is_encrypted) {
+            mf_crypto1_encrypt(
+                &emulator->crypto, NULL, &nack, 4, tx_rx->tx_data, tx_rx->tx_parity);
+        } else {
+            tx_rx->tx_data[0] = nack;
+        }
+        tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+        tx_rx->tx_bits = 4;
+        furi_hal_nfc_tx_rx(tx_rx, 300);
+    }
+
+    return true;
+}
--- a/lib/nfc_protocols/mifare_classic.h
+++ b/lib/nfc_protocols/mifare_classic.h
@@ -13,6 +13,7 @@
 #define MF_CLASSIC_BLOCKS_IN_SECTOR_MAX (16)

 #define MF_CLASSIC_NO_KEY (0xFFFFFFFFFFFFFFFF)
+#define MF_CLASSIC_MAX_DATA_SIZE (16)

 typedef enum {
    MfClassicType1k,
@@ -41,6 +42,8 @@ typedef struct {

 typedef struct {
    MfClassicType type;
+    uint64_t key_a_mask;
+    uint64_t key_b_mask;
    MfClassicBlock block[MF_CLASSIC_TOTAL_BLOCKS_MAX];
 } MfClassicData;

@@ -65,6 +68,13 @@ typedef struct {
    MfClassicSectorReader sector_reader[MF_CLASSIC_SECTORS_MAX];
 } MfClassicReader;

+typedef struct {
+    uint32_t cuid;
+    Crypto1 crypto;
+    MfClassicData data;
+    bool data_changed;
+} MfClassicEmulator;
+
 bool mf_classic_check_card_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK);

 bool mf_classic_get_type(
@@ -100,3 +110,5 @@ uint8_t mf_classic_read_card(
    FuriHalNfcTxRxContext* tx_rx,
    MfClassicReader* reader,
    MfClassicData* data);
+
+bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_rx);
--- a/lib/nfc_protocols/nfca.c
+++ b/lib/nfc_protocols/nfca.c
@@ -1,11 +1,17 @@
 #include "nfca.h"
 #include <string.h>
 #include <stdio.h>
+#include <furi.h>

 #define NFCA_CMD_RATS (0xE0U)

 #define NFCA_CRC_INIT (0x6363)

+#define NFCA_F_SIG (13560000.0)
+#define NFCA_T_SIG (1.0 / NFCA_F_SIG)
+
+#define NFCA_SIGNAL_MAX_EDGES (1350)
+
 typedef struct {
    uint8_t cmd;
    uint8_t param;
@@ -53,3 +59,81 @@ bool nfca_emulation_handler(

    return sleep;
 }
+
+static void nfca_add_bit(DigitalSignal* signal, bool bit) {
+    if(bit) {
+        signal->start_level = true;
+        for(size_t i = 0; i < 7; i++) {
+            signal->edge_timings[i] = 8 * NFCA_T_SIG;
+        }
+        signal->edge_timings[7] = 9 * 8 * NFCA_T_SIG;
+        signal->edge_cnt = 8;
+    } else {
+        signal->start_level = false;
+        signal->edge_timings[0] = 8 * 8 * NFCA_T_SIG;
+        for(size_t i = 1; i < 9; i++) {
+            signal->edge_timings[i] = 8 * NFCA_T_SIG;
+        }
+        signal->edge_cnt = 9;
+    }
+}
+
+static void nfca_add_byte(NfcaSignal* nfca_signal, uint8_t byte, bool parity) {
+    for(uint8_t i = 0; i < 8; i++) {
+        if(byte & (1 << i)) {
+            digital_signal_append(nfca_signal->tx_signal, nfca_signal->one);
+        } else {
+            digital_signal_append(nfca_signal->tx_signal, nfca_signal->zero);
+        }
+    }
+    if(parity) {
+        digital_signal_append(nfca_signal->tx_signal, nfca_signal->one);
+    } else {
+        digital_signal_append(nfca_signal->tx_signal, nfca_signal->zero);
+    }
+}
+
+NfcaSignal* nfca_signal_alloc() {
+    NfcaSignal* nfca_signal = malloc(sizeof(NfcaSignal));
+    nfca_signal->one = digital_signal_alloc(10);
+    nfca_signal->zero = digital_signal_alloc(10);
+    nfca_add_bit(nfca_signal->one, true);
+    nfca_add_bit(nfca_signal->zero, false);
+    nfca_signal->tx_signal = digital_signal_alloc(NFCA_SIGNAL_MAX_EDGES);
+
+    return nfca_signal;
+}
+
+void nfca_signal_free(NfcaSignal* nfca_signal) {
+    furi_assert(nfca_signal);
+
+    digital_signal_free(nfca_signal->one);
+    digital_signal_free(nfca_signal->zero);
+    digital_signal_free(nfca_signal->tx_signal);
+    free(nfca_signal);
+}
+
+void nfca_signal_encode(NfcaSignal* nfca_signal, uint8_t* data, uint16_t bits, uint8_t* parity) {
+    furi_assert(nfca_signal);
+    furi_assert(data);
+    furi_assert(parity);
+
+    nfca_signal->tx_signal->edge_cnt = 0;
+    nfca_signal->tx_signal->start_level = true;
+    // Start of frame
+    digital_signal_append(nfca_signal->tx_signal, nfca_signal->one);
+
+    if(bits < 8) {
+        for(size_t i = 0; i < bits; i++) {
+            if(FURI_BIT(data[0], i)) {
+                digital_signal_append(nfca_signal->tx_signal, nfca_signal->one);
+            } else {
+                digital_signal_append(nfca_signal->tx_signal, nfca_signal->zero);
+            }
+        }
+    } else {
+        for(size_t i = 0; i < bits / 8; i++) {
+            nfca_add_byte(nfca_signal, data[i], parity[i / 8] & (1 << (7 - (i & 0x07))));
+        }
+    }
+}
--- a/lib/nfc_protocols/nfca.h
+++ b/lib/nfc_protocols/nfca.h
@@ -3,6 +3,14 @@
 #include <stdint.h>
 #include <stdbool.h>

+#include <lib/digital_signal/digital_signal.h>
+
+typedef struct {
+    DigitalSignal* one;
+    DigitalSignal* zero;
+    DigitalSignal* tx_signal;
+} NfcaSignal;
+
 uint16_t nfca_get_crc16(uint8_t* buff, uint16_t len);

 void nfca_append_crc16(uint8_t* buff, uint16_t len);
@@ -12,3 +20,9 @@ bool nfca_emulation_handler(
    uint16_t buff_rx_len,
    uint8_t* buff_tx,
    uint16_t* buff_tx_len);
+
+NfcaSignal* nfca_signal_alloc();
+
+void nfca_signal_free(NfcaSignal* nfca_signal);
+
+void nfca_signal_encode(NfcaSignal* nfca_signal, uint8_t* data, uint16_t bits, uint8_t* parity);