1917 lines
78 KiB
C
1917 lines
78 KiB
C
#include <limits.h>
|
|
#include <mbedtls/sha1.h>
|
|
#include "mifare_ultralight.h"
|
|
#include "nfc_util.h"
|
|
#include <furi.h>
|
|
#include "furi_hal_nfc.h"
|
|
|
|
#define TAG "MfUltralight"
|
|
|
|
// Algorithms from: https://github.com/RfidResearchGroup/proxmark3/blob/0f6061c16f072372b7d4d381911f1542afbc3a69/common/generator.c#L110
|
|
uint32_t mf_ul_pwdgen_xiaomi(FuriHalNfcDevData* data) {
|
|
uint8_t hash[20];
|
|
mbedtls_sha1(data->uid, data->uid_len, hash);
|
|
|
|
uint32_t pwd = 0;
|
|
pwd |= (hash[hash[0] % 20]) << 24;
|
|
pwd |= (hash[(hash[0] + 5) % 20]) << 16;
|
|
pwd |= (hash[(hash[0] + 13) % 20]) << 8;
|
|
pwd |= (hash[(hash[0] + 17) % 20]);
|
|
|
|
return pwd;
|
|
}
|
|
|
|
uint32_t mf_ul_pwdgen_amiibo(FuriHalNfcDevData* data) {
|
|
uint8_t* uid = data->uid;
|
|
|
|
uint32_t pwd = 0;
|
|
pwd |= (uid[1] ^ uid[3] ^ 0xAA) << 24;
|
|
pwd |= (uid[2] ^ uid[4] ^ 0x55) << 16;
|
|
pwd |= (uid[3] ^ uid[5] ^ 0xAA) << 8;
|
|
pwd |= uid[4] ^ uid[6] ^ 0x55;
|
|
|
|
return pwd;
|
|
}
|
|
|
|
bool mf_ul_check_card_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK) {
|
|
if((ATQA0 == 0x44) && (ATQA1 == 0x00) && (SAK == 0x00)) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
void mf_ul_reset(MfUltralightData* data) {
|
|
furi_assert(data);
|
|
data->type = MfUltralightTypeUnknown;
|
|
memset(&data->version, 0, sizeof(MfUltralightVersion));
|
|
memset(data->signature, 0, sizeof(data->signature));
|
|
memset(data->counter, 0, sizeof(data->counter));
|
|
memset(data->tearing, 0, sizeof(data->tearing));
|
|
memset(data->data, 0, sizeof(data->data));
|
|
data->data_size = 0;
|
|
data->data_read = 0;
|
|
data->curr_authlim = 0;
|
|
data->auth_success = false;
|
|
}
|
|
|
|
static MfUltralightFeatures mf_ul_get_features(MfUltralightType type) {
|
|
switch(type) {
|
|
case MfUltralightTypeUL11:
|
|
case MfUltralightTypeUL21:
|
|
return MfUltralightSupportFastRead | MfUltralightSupportCompatWrite |
|
|
MfUltralightSupportReadCounter | MfUltralightSupportIncrCounter |
|
|
MfUltralightSupportAuth | MfUltralightSupportSignature |
|
|
MfUltralightSupportTearingFlags | MfUltralightSupportVcsl;
|
|
case MfUltralightTypeNTAG213:
|
|
case MfUltralightTypeNTAG215:
|
|
case MfUltralightTypeNTAG216:
|
|
return MfUltralightSupportFastRead | MfUltralightSupportCompatWrite |
|
|
MfUltralightSupportReadCounter | MfUltralightSupportAuth |
|
|
MfUltralightSupportSignature | MfUltralightSupportSingleCounter |
|
|
MfUltralightSupportAsciiMirror;
|
|
case MfUltralightTypeNTAGI2C1K:
|
|
case MfUltralightTypeNTAGI2C2K:
|
|
return MfUltralightSupportFastRead | MfUltralightSupportSectorSelect;
|
|
case MfUltralightTypeNTAGI2CPlus1K:
|
|
case MfUltralightTypeNTAGI2CPlus2K:
|
|
return MfUltralightSupportFastRead | MfUltralightSupportAuth |
|
|
MfUltralightSupportFastWrite | MfUltralightSupportSignature |
|
|
MfUltralightSupportSectorSelect;
|
|
case MfUltralightTypeNTAG203:
|
|
return MfUltralightSupportCompatWrite | MfUltralightSupportCounterInMemory;
|
|
default:
|
|
// Assumed original MFUL 512-bit
|
|
return MfUltralightSupportCompatWrite;
|
|
}
|
|
}
|
|
|
|
static void mf_ul_set_default_version(MfUltralightReader* reader, MfUltralightData* data) {
|
|
data->type = MfUltralightTypeUnknown;
|
|
reader->pages_to_read = 16;
|
|
}
|
|
|
|
static void mf_ul_set_version_ntag203(MfUltralightReader* reader, MfUltralightData* data) {
|
|
data->type = MfUltralightTypeNTAG203;
|
|
reader->pages_to_read = 42;
|
|
}
|
|
|
|
bool mf_ultralight_read_version(
|
|
FuriHalNfcTxRxContext* tx_rx,
|
|
MfUltralightReader* reader,
|
|
MfUltralightData* data) {
|
|
bool version_read = false;
|
|
|
|
do {
|
|
FURI_LOG_D(TAG, "Reading version");
|
|
tx_rx->tx_data[0] = MF_UL_GET_VERSION_CMD;
|
|
tx_rx->tx_bits = 8;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(!furi_hal_nfc_tx_rx(tx_rx, 50) || tx_rx->rx_bits != 64) {
|
|
FURI_LOG_D(TAG, "Failed reading version");
|
|
mf_ul_set_default_version(reader, data);
|
|
furi_hal_nfc_sleep();
|
|
furi_hal_nfc_activate_nfca(300, NULL);
|
|
break;
|
|
}
|
|
MfUltralightVersion* version = (MfUltralightVersion*)tx_rx->rx_data;
|
|
data->version = *version;
|
|
if(version->storage_size == 0x0B || version->storage_size == 0x00) {
|
|
data->type = MfUltralightTypeUL11;
|
|
reader->pages_to_read = 20;
|
|
} else if(version->storage_size == 0x0E) {
|
|
data->type = MfUltralightTypeUL21;
|
|
reader->pages_to_read = 41;
|
|
} else if(version->storage_size == 0x0F) {
|
|
data->type = MfUltralightTypeNTAG213;
|
|
reader->pages_to_read = 45;
|
|
} else if(version->storage_size == 0x11) {
|
|
data->type = MfUltralightTypeNTAG215;
|
|
reader->pages_to_read = 135;
|
|
} else if(version->prod_subtype == 5 && version->prod_ver_major == 2) {
|
|
// NTAG I2C
|
|
bool known = false;
|
|
if(version->prod_ver_minor == 1) {
|
|
if(version->storage_size == 0x13) {
|
|
data->type = MfUltralightTypeNTAGI2C1K;
|
|
reader->pages_to_read = 231;
|
|
known = true;
|
|
} else if(version->storage_size == 0x15) {
|
|
data->type = MfUltralightTypeNTAGI2C2K;
|
|
reader->pages_to_read = 485;
|
|
known = true;
|
|
}
|
|
} else if(version->prod_ver_minor == 2) {
|
|
if(version->storage_size == 0x13) {
|
|
data->type = MfUltralightTypeNTAGI2CPlus1K;
|
|
reader->pages_to_read = 236;
|
|
known = true;
|
|
} else if(version->storage_size == 0x15) {
|
|
data->type = MfUltralightTypeNTAGI2CPlus2K;
|
|
reader->pages_to_read = 492;
|
|
known = true;
|
|
}
|
|
}
|
|
|
|
if(!known) {
|
|
mf_ul_set_default_version(reader, data);
|
|
}
|
|
} else if(version->storage_size == 0x13) {
|
|
data->type = MfUltralightTypeNTAG216;
|
|
reader->pages_to_read = 231;
|
|
} else {
|
|
mf_ul_set_default_version(reader, data);
|
|
break;
|
|
}
|
|
version_read = true;
|
|
} while(false);
|
|
|
|
reader->supported_features = mf_ul_get_features(data->type);
|
|
return version_read;
|
|
}
|
|
|
|
bool mf_ultralight_authenticate(FuriHalNfcTxRxContext* tx_rx, uint32_t key, uint16_t* pack) {
|
|
furi_assert(pack);
|
|
bool authenticated = false;
|
|
|
|
do {
|
|
FURI_LOG_D(TAG, "Authenticating");
|
|
tx_rx->tx_data[0] = MF_UL_AUTH;
|
|
nfc_util_num2bytes(key, 4, &tx_rx->tx_data[1]);
|
|
tx_rx->tx_bits = 40;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(!furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
|
FURI_LOG_D(TAG, "Tag did not respond to authentication");
|
|
break;
|
|
}
|
|
|
|
// PACK
|
|
if(tx_rx->rx_bits < 2 * 8) {
|
|
FURI_LOG_D(TAG, "Authentication failed");
|
|
break;
|
|
}
|
|
|
|
*pack = (tx_rx->rx_data[1] << 8) | tx_rx->rx_data[0];
|
|
|
|
FURI_LOG_I(TAG, "Auth success. Password: %08lX. PACK: %04X", key, *pack);
|
|
authenticated = true;
|
|
} while(false);
|
|
|
|
return authenticated;
|
|
}
|
|
|
|
static int16_t mf_ultralight_page_addr_to_tag_addr(uint8_t sector, uint8_t page) {
|
|
return sector * 256 + page;
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_lin_to_tag_1k(
|
|
int16_t linear_address,
|
|
uint8_t* sector,
|
|
int16_t* valid_pages) {
|
|
// 0 - 226: sector 0
|
|
// 227 - 228: config registers
|
|
// 229 - 230: session registers
|
|
|
|
if(linear_address > 230) {
|
|
*valid_pages = 0;
|
|
return -1;
|
|
} else if(linear_address >= 229) {
|
|
*sector = 3;
|
|
*valid_pages = 2 - (linear_address - 229);
|
|
return linear_address - 229 + 248;
|
|
} else if(linear_address >= 227) {
|
|
*sector = 0;
|
|
*valid_pages = 2 - (linear_address - 227);
|
|
return linear_address - 227 + 232;
|
|
} else {
|
|
*sector = 0;
|
|
*valid_pages = 227 - linear_address;
|
|
return linear_address;
|
|
}
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_lin_to_tag_2k(
|
|
int16_t linear_address,
|
|
uint8_t* sector,
|
|
int16_t* valid_pages) {
|
|
// 0 - 255: sector 0
|
|
// 256 - 480: sector 1
|
|
// 481 - 482: config registers
|
|
// 483 - 484: session registers
|
|
|
|
if(linear_address > 484) {
|
|
*valid_pages = 0;
|
|
return -1;
|
|
} else if(linear_address >= 483) {
|
|
*sector = 3;
|
|
*valid_pages = 2 - (linear_address - 483);
|
|
return linear_address - 483 + 248;
|
|
} else if(linear_address >= 481) {
|
|
*sector = 1;
|
|
*valid_pages = 2 - (linear_address - 481);
|
|
return linear_address - 481 + 232;
|
|
} else if(linear_address >= 256) {
|
|
*sector = 1;
|
|
*valid_pages = 225 - (linear_address - 256);
|
|
return linear_address - 256;
|
|
} else {
|
|
*sector = 0;
|
|
*valid_pages = 256 - linear_address;
|
|
return linear_address;
|
|
}
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_lin_to_tag_plus_1k(
|
|
int16_t linear_address,
|
|
uint8_t* sector,
|
|
int16_t* valid_pages) {
|
|
// 0 - 233: sector 0 + registers
|
|
// 234 - 235: session registers
|
|
|
|
if(linear_address > 235) {
|
|
*valid_pages = 0;
|
|
return -1;
|
|
} else if(linear_address >= 234) {
|
|
*sector = 0;
|
|
*valid_pages = 2 - (linear_address - 234);
|
|
return linear_address - 234 + 236;
|
|
} else {
|
|
*sector = 0;
|
|
*valid_pages = 234 - linear_address;
|
|
return linear_address;
|
|
}
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_lin_to_tag_plus_2k(
|
|
int16_t linear_address,
|
|
uint8_t* sector,
|
|
int16_t* valid_pages) {
|
|
// 0 - 233: sector 0 + registers
|
|
// 234 - 235: session registers
|
|
// 236 - 491: sector 1
|
|
|
|
if(linear_address > 491) {
|
|
*valid_pages = 0;
|
|
return -1;
|
|
} else if(linear_address >= 236) {
|
|
*sector = 1;
|
|
*valid_pages = 256 - (linear_address - 236);
|
|
return linear_address - 236;
|
|
} else if(linear_address >= 234) {
|
|
*sector = 0;
|
|
*valid_pages = 2 - (linear_address - 234);
|
|
return linear_address - 234 + 236;
|
|
} else {
|
|
*sector = 0;
|
|
*valid_pages = 234 - linear_address;
|
|
return linear_address;
|
|
}
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_lin_to_tag(
|
|
MfUltralightData* data,
|
|
MfUltralightReader* reader,
|
|
int16_t linear_address,
|
|
uint8_t* sector,
|
|
int16_t* valid_pages) {
|
|
switch(data->type) {
|
|
case MfUltralightTypeNTAGI2C1K:
|
|
return mf_ultralight_ntag_i2c_addr_lin_to_tag_1k(linear_address, sector, valid_pages);
|
|
|
|
case MfUltralightTypeNTAGI2C2K:
|
|
return mf_ultralight_ntag_i2c_addr_lin_to_tag_2k(linear_address, sector, valid_pages);
|
|
|
|
case MfUltralightTypeNTAGI2CPlus1K:
|
|
return mf_ultralight_ntag_i2c_addr_lin_to_tag_plus_1k(linear_address, sector, valid_pages);
|
|
|
|
case MfUltralightTypeNTAGI2CPlus2K:
|
|
return mf_ultralight_ntag_i2c_addr_lin_to_tag_plus_2k(linear_address, sector, valid_pages);
|
|
|
|
default:
|
|
*sector = 0xff;
|
|
*valid_pages = reader->pages_to_read - linear_address;
|
|
return linear_address;
|
|
}
|
|
}
|
|
|
|
static int16_t
|
|
mf_ultralight_ntag_i2c_addr_tag_to_lin_1k(uint8_t page, uint8_t sector, uint16_t* valid_pages) {
|
|
bool valid = false;
|
|
int16_t translated_page;
|
|
if(sector == 0) {
|
|
if(page <= 226) {
|
|
*valid_pages = 227 - page;
|
|
translated_page = page;
|
|
valid = true;
|
|
} else if(page >= 232 && page <= 233) {
|
|
*valid_pages = 2 - (page - 232);
|
|
translated_page = page - 232 + 227;
|
|
valid = true;
|
|
}
|
|
} else if(sector == 3) {
|
|
if(page >= 248 && page <= 249) {
|
|
*valid_pages = 2 - (page - 248);
|
|
translated_page = page - 248 + 229;
|
|
valid = true;
|
|
}
|
|
}
|
|
|
|
if(!valid) {
|
|
*valid_pages = 0;
|
|
translated_page = -1;
|
|
}
|
|
return translated_page;
|
|
}
|
|
|
|
static int16_t
|
|
mf_ultralight_ntag_i2c_addr_tag_to_lin_2k(uint8_t page, uint8_t sector, uint16_t* valid_pages) {
|
|
bool valid = false;
|
|
int16_t translated_page;
|
|
if(sector == 0) {
|
|
*valid_pages = 256 - page;
|
|
translated_page = page;
|
|
valid = true;
|
|
} else if(sector == 1) {
|
|
if(page <= 224) {
|
|
*valid_pages = 225 - page;
|
|
translated_page = 256 + page;
|
|
valid = true;
|
|
} else if(page >= 232 && page <= 233) {
|
|
*valid_pages = 2 - (page - 232);
|
|
translated_page = page - 232 + 481;
|
|
valid = true;
|
|
}
|
|
} else if(sector == 3) {
|
|
if(page >= 248 && page <= 249) {
|
|
*valid_pages = 2 - (page - 248);
|
|
translated_page = page - 248 + 483;
|
|
valid = true;
|
|
}
|
|
}
|
|
|
|
if(!valid) {
|
|
*valid_pages = 0;
|
|
translated_page = -1;
|
|
}
|
|
return translated_page;
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_tag_to_lin_plus_1k(
|
|
uint8_t page,
|
|
uint8_t sector,
|
|
uint16_t* valid_pages) {
|
|
bool valid = false;
|
|
int16_t translated_page;
|
|
if(sector == 0) {
|
|
if(page <= 233) {
|
|
*valid_pages = 234 - page;
|
|
translated_page = page;
|
|
valid = true;
|
|
} else if(page >= 236 && page <= 237) {
|
|
*valid_pages = 2 - (page - 236);
|
|
translated_page = page - 236 + 234;
|
|
valid = true;
|
|
}
|
|
} else if(sector == 3) {
|
|
if(page >= 248 && page <= 249) {
|
|
*valid_pages = 2 - (page - 248);
|
|
translated_page = page - 248 + 234;
|
|
valid = true;
|
|
}
|
|
}
|
|
|
|
if(!valid) {
|
|
*valid_pages = 0;
|
|
translated_page = -1;
|
|
}
|
|
return translated_page;
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_tag_to_lin_plus_2k(
|
|
uint8_t page,
|
|
uint8_t sector,
|
|
uint16_t* valid_pages) {
|
|
bool valid = false;
|
|
int16_t translated_page;
|
|
if(sector == 0) {
|
|
if(page <= 233) {
|
|
*valid_pages = 234 - page;
|
|
translated_page = page;
|
|
valid = true;
|
|
} else if(page >= 236 && page <= 237) {
|
|
*valid_pages = 2 - (page - 236);
|
|
translated_page = page - 236 + 234;
|
|
valid = true;
|
|
}
|
|
} else if(sector == 1) {
|
|
*valid_pages = 256 - page;
|
|
translated_page = page + 236;
|
|
valid = true;
|
|
} else if(sector == 3) {
|
|
if(page >= 248 && page <= 249) {
|
|
*valid_pages = 2 - (page - 248);
|
|
translated_page = page - 248 + 234;
|
|
valid = true;
|
|
}
|
|
}
|
|
|
|
if(!valid) {
|
|
*valid_pages = 0;
|
|
translated_page = -1;
|
|
}
|
|
return translated_page;
|
|
}
|
|
|
|
static int16_t mf_ultralight_ntag_i2c_addr_tag_to_lin(
|
|
MfUltralightData* data,
|
|
uint8_t page,
|
|
uint8_t sector,
|
|
uint16_t* valid_pages) {
|
|
switch(data->type) {
|
|
case MfUltralightTypeNTAGI2C1K:
|
|
return mf_ultralight_ntag_i2c_addr_tag_to_lin_1k(page, sector, valid_pages);
|
|
|
|
case MfUltralightTypeNTAGI2C2K:
|
|
return mf_ultralight_ntag_i2c_addr_tag_to_lin_2k(page, sector, valid_pages);
|
|
|
|
case MfUltralightTypeNTAGI2CPlus1K:
|
|
return mf_ultralight_ntag_i2c_addr_tag_to_lin_plus_1k(page, sector, valid_pages);
|
|
|
|
case MfUltralightTypeNTAGI2CPlus2K:
|
|
return mf_ultralight_ntag_i2c_addr_tag_to_lin_plus_2k(page, sector, valid_pages);
|
|
|
|
default:
|
|
*valid_pages = data->data_size / 4 - page;
|
|
return page;
|
|
}
|
|
}
|
|
|
|
MfUltralightConfigPages* mf_ultralight_get_config_pages(MfUltralightData* data) {
|
|
if(data->type >= MfUltralightTypeUL11 && data->type <= MfUltralightTypeNTAG216) {
|
|
return (MfUltralightConfigPages*)&data->data[data->data_size - 4 * 4];
|
|
} else if(
|
|
data->type >= MfUltralightTypeNTAGI2CPlus1K &&
|
|
data->type <= MfUltralightTypeNTAGI2CPlus2K) {
|
|
return (MfUltralightConfigPages*)&data->data[0xe3 * 4]; //-V641
|
|
} else {
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
static uint16_t mf_ultralight_calc_auth_count(MfUltralightData* data) {
|
|
if(mf_ul_get_features(data->type) & MfUltralightSupportAuth) {
|
|
MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
|
|
uint16_t scaled_authlim = config->access.authlim;
|
|
// NTAG I2C Plus uses 2^AUTHLIM attempts rather than the direct number
|
|
if(scaled_authlim > 0 && data->type >= MfUltralightTypeNTAGI2CPlus1K &&
|
|
data->type <= MfUltralightTypeNTAGI2CPlus2K) {
|
|
scaled_authlim = 1 << scaled_authlim;
|
|
}
|
|
return scaled_authlim;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
// NTAG21x will NAK if NFC_CNT_EN unset, so preempt
|
|
static bool mf_ultralight_should_read_counters(MfUltralightData* data) {
|
|
if(data->type < MfUltralightTypeNTAG213 || data->type > MfUltralightTypeNTAG216) return true;
|
|
|
|
MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
|
|
return config->access.nfc_cnt_en;
|
|
}
|
|
|
|
static bool mf_ultralight_sector_select(FuriHalNfcTxRxContext* tx_rx, uint8_t sector) {
|
|
FURI_LOG_D(TAG, "Selecting sector %u", sector);
|
|
tx_rx->tx_data[0] = MF_UL_SECTOR_SELECT;
|
|
tx_rx->tx_data[1] = 0xff;
|
|
tx_rx->tx_bits = 16;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(!furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
|
FURI_LOG_D(TAG, "Failed to issue sector select command");
|
|
return false;
|
|
}
|
|
|
|
tx_rx->tx_data[0] = sector;
|
|
tx_rx->tx_data[1] = 0x00;
|
|
tx_rx->tx_data[2] = 0x00;
|
|
tx_rx->tx_data[3] = 0x00;
|
|
tx_rx->tx_bits = 32;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
// This is NOT a typo! The tag ACKs by not sending a response within 1ms.
|
|
if(furi_hal_nfc_tx_rx(tx_rx, 20)) {
|
|
// TODO: what gets returned when an actual NAK is received?
|
|
FURI_LOG_D(TAG, "Sector %u select NAK'd", sector);
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
bool mf_ultralight_read_pages_direct(
|
|
FuriHalNfcTxRxContext* tx_rx,
|
|
uint8_t start_index,
|
|
uint8_t* data) {
|
|
FURI_LOG_D(TAG, "Reading pages %d - %d", start_index, start_index + 3);
|
|
tx_rx->tx_data[0] = MF_UL_READ_CMD;
|
|
tx_rx->tx_data[1] = start_index;
|
|
tx_rx->tx_bits = 16;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(!furi_hal_nfc_tx_rx(tx_rx, 50) || tx_rx->rx_bits < 16 * 8) {
|
|
FURI_LOG_D(TAG, "Failed to read pages %d - %d", start_index, start_index + 3);
|
|
return false;
|
|
}
|
|
memcpy(data, tx_rx->rx_data, 16); //-V1086
|
|
return true;
|
|
}
|
|
|
|
bool mf_ultralight_read_pages(
|
|
FuriHalNfcTxRxContext* tx_rx,
|
|
MfUltralightReader* reader,
|
|
MfUltralightData* data) {
|
|
uint8_t pages_read_cnt = 0;
|
|
uint8_t curr_sector_index = 0xff;
|
|
reader->pages_read = 0;
|
|
for(size_t i = 0; i < reader->pages_to_read; i += pages_read_cnt) {
|
|
uint8_t tag_sector;
|
|
int16_t valid_pages;
|
|
int16_t tag_page = mf_ultralight_ntag_i2c_addr_lin_to_tag(
|
|
data, reader, (int16_t)i, &tag_sector, &valid_pages);
|
|
|
|
furi_assert(tag_page != -1);
|
|
if(curr_sector_index != tag_sector) {
|
|
if(!mf_ultralight_sector_select(tx_rx, tag_sector)) return false;
|
|
curr_sector_index = tag_sector;
|
|
}
|
|
|
|
FURI_LOG_D(
|
|
TAG, "Reading pages %zu - %zu", i, i + (valid_pages > 4 ? 4 : valid_pages) - 1U);
|
|
tx_rx->tx_data[0] = MF_UL_READ_CMD;
|
|
tx_rx->tx_data[1] = tag_page;
|
|
tx_rx->tx_bits = 16;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
|
|
if(!furi_hal_nfc_tx_rx(tx_rx, 50) || tx_rx->rx_bits < 16 * 8) {
|
|
FURI_LOG_D(
|
|
TAG,
|
|
"Failed to read pages %zu - %zu",
|
|
i,
|
|
i + (valid_pages > 4 ? 4 : valid_pages) - 1U);
|
|
break;
|
|
}
|
|
|
|
if(valid_pages > 4) {
|
|
pages_read_cnt = 4;
|
|
} else {
|
|
pages_read_cnt = valid_pages;
|
|
}
|
|
reader->pages_read += pages_read_cnt;
|
|
memcpy(&data->data[i * 4], tx_rx->rx_data, pages_read_cnt * 4);
|
|
}
|
|
data->data_size = reader->pages_to_read * 4;
|
|
data->data_read = reader->pages_read * 4;
|
|
|
|
return reader->pages_read > 0;
|
|
}
|
|
|
|
bool mf_ultralight_fast_read_pages(
|
|
FuriHalNfcTxRxContext* tx_rx,
|
|
MfUltralightReader* reader,
|
|
MfUltralightData* data) {
|
|
uint8_t curr_sector_index = 0xff;
|
|
reader->pages_read = 0;
|
|
while(reader->pages_read < reader->pages_to_read) {
|
|
uint8_t tag_sector;
|
|
int16_t valid_pages;
|
|
int16_t tag_page = mf_ultralight_ntag_i2c_addr_lin_to_tag(
|
|
data, reader, reader->pages_read, &tag_sector, &valid_pages);
|
|
|
|
furi_assert(tag_page != -1);
|
|
if(curr_sector_index != tag_sector) {
|
|
if(!mf_ultralight_sector_select(tx_rx, tag_sector)) return false;
|
|
curr_sector_index = tag_sector;
|
|
}
|
|
|
|
FURI_LOG_D(
|
|
TAG, "Reading pages %d - %d", reader->pages_read, reader->pages_read + valid_pages - 1);
|
|
tx_rx->tx_data[0] = MF_UL_FAST_READ_CMD;
|
|
tx_rx->tx_data[1] = tag_page;
|
|
tx_rx->tx_data[2] = valid_pages - 1;
|
|
tx_rx->tx_bits = 24;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
|
memcpy(&data->data[reader->pages_read * 4], tx_rx->rx_data, valid_pages * 4);
|
|
reader->pages_read += valid_pages;
|
|
data->data_size = reader->pages_read * 4;
|
|
} else {
|
|
FURI_LOG_D(
|
|
TAG,
|
|
"Failed to read pages %d - %d",
|
|
reader->pages_read,
|
|
reader->pages_read + valid_pages - 1);
|
|
break;
|
|
}
|
|
}
|
|
|
|
return reader->pages_read == reader->pages_to_read;
|
|
}
|
|
|
|
bool mf_ultralight_read_signature(FuriHalNfcTxRxContext* tx_rx, MfUltralightData* data) {
|
|
bool signature_read = false;
|
|
|
|
FURI_LOG_D(TAG, "Reading signature");
|
|
tx_rx->tx_data[0] = MF_UL_READ_SIG;
|
|
tx_rx->tx_data[1] = 0;
|
|
tx_rx->tx_bits = 16;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
|
memcpy(data->signature, tx_rx->rx_data, sizeof(data->signature));
|
|
signature_read = true;
|
|
} else {
|
|
FURI_LOG_D(TAG, "Failed redaing signature");
|
|
}
|
|
|
|
return signature_read;
|
|
}
|
|
|
|
bool mf_ultralight_read_counters(FuriHalNfcTxRxContext* tx_rx, MfUltralightData* data) {
|
|
uint8_t counter_read = 0;
|
|
|
|
FURI_LOG_D(TAG, "Reading counters");
|
|
bool is_single_counter = (mf_ul_get_features(data->type) & MfUltralightSupportSingleCounter) !=
|
|
0;
|
|
for(size_t i = is_single_counter ? 2 : 0; i < 3; i++) {
|
|
tx_rx->tx_data[0] = MF_UL_READ_CNT;
|
|
tx_rx->tx_data[1] = i;
|
|
tx_rx->tx_bits = 16;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(!furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
|
FURI_LOG_D(TAG, "Failed to read %d counter", i);
|
|
break;
|
|
}
|
|
data->counter[i] = (tx_rx->rx_data[2] << 16) | (tx_rx->rx_data[1] << 8) |
|
|
tx_rx->rx_data[0];
|
|
counter_read++;
|
|
}
|
|
|
|
return counter_read == (is_single_counter ? 1 : 3);
|
|
}
|
|
|
|
bool mf_ultralight_read_tearing_flags(FuriHalNfcTxRxContext* tx_rx, MfUltralightData* data) {
|
|
uint8_t flag_read = 0;
|
|
|
|
FURI_LOG_D(TAG, "Reading tearing flags");
|
|
for(size_t i = 0; i < 3; i++) {
|
|
tx_rx->tx_data[0] = MF_UL_CHECK_TEARING;
|
|
tx_rx->rx_data[1] = i;
|
|
tx_rx->tx_bits = 16;
|
|
tx_rx->tx_rx_type = FuriHalNfcTxRxTypeDefault;
|
|
if(!furi_hal_nfc_tx_rx(tx_rx, 50)) {
|
|
FURI_LOG_D(TAG, "Failed to read %d tearing flag", i);
|
|
break;
|
|
}
|
|
data->tearing[i] = tx_rx->rx_data[0];
|
|
flag_read++;
|
|
}
|
|
|
|
return flag_read == 2;
|
|
}
|
|
|
|
bool mf_ul_read_card(
|
|
FuriHalNfcTxRxContext* tx_rx,
|
|
MfUltralightReader* reader,
|
|
MfUltralightData* data) {
|
|
furi_assert(tx_rx);
|
|
furi_assert(reader);
|
|
furi_assert(data);
|
|
|
|
bool card_read = false;
|
|
|
|
// Read Mifare Ultralight version
|
|
if(mf_ultralight_read_version(tx_rx, reader, data)) {
|
|
if(reader->supported_features & MfUltralightSupportSignature) {
|
|
// Read Signature
|
|
mf_ultralight_read_signature(tx_rx, data);
|
|
}
|
|
} else {
|
|
// No GET_VERSION command, check for NTAG203 by reading last page (41)
|
|
uint8_t dummy[16];
|
|
if(mf_ultralight_read_pages_direct(tx_rx, 41, dummy)) {
|
|
mf_ul_set_version_ntag203(reader, data);
|
|
reader->supported_features = mf_ul_get_features(data->type);
|
|
} else {
|
|
// We're really an original Mifare Ultralight, reset tag for safety
|
|
furi_hal_nfc_sleep();
|
|
furi_hal_nfc_activate_nfca(300, NULL);
|
|
}
|
|
}
|
|
|
|
card_read = mf_ultralight_read_pages(tx_rx, reader, data);
|
|
|
|
if(card_read) {
|
|
if(reader->supported_features & MfUltralightSupportReadCounter &&
|
|
mf_ultralight_should_read_counters(data)) {
|
|
mf_ultralight_read_counters(tx_rx, data);
|
|
}
|
|
if(reader->supported_features & MfUltralightSupportTearingFlags) {
|
|
mf_ultralight_read_tearing_flags(tx_rx, data);
|
|
}
|
|
data->curr_authlim = 0;
|
|
|
|
if(reader->pages_read == reader->pages_to_read &&
|
|
reader->supported_features & MfUltralightSupportAuth && !data->auth_success) {
|
|
MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
|
|
if(config->access.authlim == 0) {
|
|
// Attempt to auth with default PWD
|
|
uint16_t pack;
|
|
data->auth_success = mf_ultralight_authenticate(tx_rx, MF_UL_DEFAULT_PWD, &pack);
|
|
if(data->auth_success) {
|
|
config->auth_data.pwd.value = MF_UL_DEFAULT_PWD;
|
|
config->auth_data.pack.value = pack;
|
|
} else {
|
|
furi_hal_nfc_sleep();
|
|
furi_hal_nfc_activate_nfca(300, NULL);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if(reader->pages_read != reader->pages_to_read) {
|
|
if(reader->supported_features & MfUltralightSupportAuth) {
|
|
// Probably password protected, fix AUTH0 and PROT so before AUTH0
|
|
// can be written and since AUTH0 won't be readable, like on the
|
|
// original card
|
|
MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
|
|
config->auth0 = reader->pages_read;
|
|
config->access.prot = true;
|
|
}
|
|
}
|
|
|
|
return card_read;
|
|
}
|
|
|
|
static void mf_ul_protect_auth_data_on_read_command_i2c(
|
|
uint8_t* tx_buff,
|
|
uint8_t start_page,
|
|
uint8_t end_page,
|
|
MfUltralightEmulator* emulator) {
|
|
if(emulator->data.type >= MfUltralightTypeNTAGI2CPlus1K) {
|
|
// Blank out PWD and PACK
|
|
if(start_page <= 229 && end_page >= 229) {
|
|
uint16_t offset = (229 - start_page) * 4;
|
|
uint8_t count = 4;
|
|
if(end_page >= 230) count += 2;
|
|
memset(&tx_buff[offset], 0, count);
|
|
}
|
|
|
|
// Handle AUTH0 for sector 0
|
|
if(!emulator->auth_success) {
|
|
if(emulator->config_cache.access.prot) {
|
|
uint8_t auth0 = emulator->config_cache.auth0;
|
|
if(auth0 < end_page) {
|
|
// start_page is always < auth0; otherwise is NAK'd already
|
|
uint8_t page_offset = auth0 - start_page;
|
|
uint8_t page_count = end_page - auth0;
|
|
memset(&tx_buff[page_offset * 4], 0, page_count * 4);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
static void mf_ul_ntag_i2c_fill_cross_area_read(
|
|
uint8_t* tx_buff,
|
|
uint8_t start_page,
|
|
uint8_t end_page,
|
|
MfUltralightEmulator* emulator) {
|
|
// For copying config or session registers in fast read
|
|
int16_t tx_page_offset;
|
|
int16_t data_page_offset;
|
|
uint8_t page_length;
|
|
bool apply = false;
|
|
MfUltralightType type = emulator->data.type;
|
|
if(emulator->curr_sector == 0) {
|
|
if(type == MfUltralightTypeNTAGI2C1K) {
|
|
if(start_page <= 233 && end_page >= 232) {
|
|
tx_page_offset = start_page - 232;
|
|
data_page_offset = 227;
|
|
page_length = 2;
|
|
apply = true;
|
|
}
|
|
} else if(type == MfUltralightTypeNTAGI2CPlus1K || type == MfUltralightTypeNTAGI2CPlus2K) {
|
|
if(start_page <= 237 && end_page >= 236) {
|
|
tx_page_offset = start_page - 236;
|
|
data_page_offset = 234;
|
|
page_length = 2;
|
|
apply = true;
|
|
}
|
|
}
|
|
} else if(emulator->curr_sector == 1) {
|
|
if(type == MfUltralightTypeNTAGI2C2K) {
|
|
if(start_page <= 233 && end_page >= 232) {
|
|
tx_page_offset = start_page - 232;
|
|
data_page_offset = 483;
|
|
page_length = 2;
|
|
apply = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
if(apply) {
|
|
while(tx_page_offset < 0 && page_length > 0) { //-V614
|
|
++tx_page_offset;
|
|
++data_page_offset;
|
|
--page_length;
|
|
}
|
|
memcpy(
|
|
&tx_buff[tx_page_offset * 4],
|
|
&emulator->data.data[data_page_offset * 4],
|
|
page_length * 4);
|
|
}
|
|
}
|
|
|
|
static bool mf_ul_check_auth(MfUltralightEmulator* emulator, uint8_t start_page, bool is_write) {
|
|
if(!emulator->auth_success) {
|
|
if(start_page >= emulator->config_cache.auth0 &&
|
|
(emulator->config_cache.access.prot || is_write))
|
|
return false;
|
|
}
|
|
|
|
if(is_write && emulator->config_cache.access.cfglck) {
|
|
uint16_t config_start_page = emulator->page_num - 4;
|
|
if(start_page == config_start_page || start_page == config_start_page + 1) return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static bool mf_ul_ntag_i2c_plus_check_auth(
|
|
MfUltralightEmulator* emulator,
|
|
uint8_t start_page,
|
|
bool is_write) {
|
|
if(!emulator->auth_success) {
|
|
// Check NFC_PROT
|
|
if(emulator->curr_sector == 0 && (emulator->config_cache.access.prot || is_write)) {
|
|
if(start_page >= emulator->config_cache.auth0) return false;
|
|
} else if(emulator->curr_sector == 1) {
|
|
// We don't have to specifically check for type because this is done
|
|
// by address translator
|
|
uint8_t pt_i2c = emulator->data.data[231 * 4];
|
|
// Check 2K_PROT
|
|
if(pt_i2c & 0x08) return false;
|
|
}
|
|
}
|
|
|
|
if(emulator->curr_sector == 1) {
|
|
// Check NFC_DIS_SEC1
|
|
if(emulator->config_cache.access.nfc_dis_sec1) return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static int16_t mf_ul_get_dynamic_lock_page_addr(MfUltralightData* data) {
|
|
switch(data->type) {
|
|
case MfUltralightTypeNTAG203:
|
|
return 0x28;
|
|
case MfUltralightTypeUL21:
|
|
case MfUltralightTypeNTAG213:
|
|
case MfUltralightTypeNTAG215:
|
|
case MfUltralightTypeNTAG216:
|
|
return data->data_size / 4 - 5;
|
|
case MfUltralightTypeNTAGI2C1K:
|
|
case MfUltralightTypeNTAGI2CPlus1K:
|
|
case MfUltralightTypeNTAGI2CPlus2K:
|
|
return 0xe2;
|
|
case MfUltralightTypeNTAGI2C2K:
|
|
return 0x1e0;
|
|
default:
|
|
return -1; // No dynamic lock bytes
|
|
}
|
|
}
|
|
|
|
// Returns true if page not locked
|
|
// write_page is tag address
|
|
static bool mf_ul_check_lock(MfUltralightEmulator* emulator, int16_t write_page) {
|
|
if(write_page < 2) return false; // Page 0-1 is always locked
|
|
if(write_page == 2) return true; // Page 2 does not have a lock flag
|
|
|
|
// Check static lock bytes
|
|
if(write_page <= 15) {
|
|
uint16_t static_lock_bytes = emulator->data.data[10] | (emulator->data.data[11] << 8);
|
|
return (static_lock_bytes & (1 << write_page)) == 0;
|
|
}
|
|
|
|
// Check dynamic lock bytes
|
|
|
|
// Check max page
|
|
switch(emulator->data.type) {
|
|
case MfUltralightTypeNTAG203:
|
|
// Counter page can be locked and is after dynamic locks
|
|
if(write_page == 40) return true;
|
|
break;
|
|
case MfUltralightTypeUL21:
|
|
case MfUltralightTypeNTAG213:
|
|
case MfUltralightTypeNTAG215:
|
|
case MfUltralightTypeNTAG216:
|
|
if(write_page >= emulator->page_num - 5) return true;
|
|
break;
|
|
case MfUltralightTypeNTAGI2C1K:
|
|
case MfUltralightTypeNTAGI2CPlus1K:
|
|
if(write_page > 225) return true;
|
|
break;
|
|
case MfUltralightTypeNTAGI2C2K:
|
|
if(write_page > 479) return true;
|
|
break;
|
|
case MfUltralightTypeNTAGI2CPlus2K:
|
|
if(write_page >= 226 && write_page <= 255) return true;
|
|
if(write_page >= 512) return true;
|
|
break;
|
|
default:
|
|
furi_crash("Unknown MFUL");
|
|
return true;
|
|
}
|
|
|
|
int16_t dynamic_lock_index = mf_ul_get_dynamic_lock_page_addr(&emulator->data);
|
|
if(dynamic_lock_index == -1) return true;
|
|
// Run address through converter because NTAG I2C 2K is special
|
|
uint16_t valid_pages; // unused
|
|
dynamic_lock_index =
|
|
mf_ultralight_ntag_i2c_addr_tag_to_lin(
|
|
&emulator->data, dynamic_lock_index & 0xff, dynamic_lock_index >> 8, &valid_pages) *
|
|
4;
|
|
|
|
uint16_t dynamic_lock_bytes = emulator->data.data[dynamic_lock_index] |
|
|
(emulator->data.data[dynamic_lock_index + 1] << 8);
|
|
uint8_t shift;
|
|
|
|
switch(emulator->data.type) {
|
|
// low byte LSB range, MSB range
|
|
case MfUltralightTypeNTAG203:
|
|
if(write_page >= 16 && write_page <= 27) //-V560
|
|
shift = (write_page - 16) / 4 + 1;
|
|
else if(write_page >= 28 && write_page <= 39) //-V560
|
|
shift = (write_page - 28) / 4 + 5;
|
|
else if(write_page == 41)
|
|
shift = 12;
|
|
else {
|
|
furi_crash("Unknown MFUL");
|
|
}
|
|
|
|
break;
|
|
case MfUltralightTypeUL21:
|
|
case MfUltralightTypeNTAG213:
|
|
// 16-17, 30-31
|
|
shift = (write_page - 16) / 2;
|
|
break;
|
|
case MfUltralightTypeNTAG215:
|
|
case MfUltralightTypeNTAG216:
|
|
case MfUltralightTypeNTAGI2C1K:
|
|
case MfUltralightTypeNTAGI2CPlus1K:
|
|
// 16-31, 128-129
|
|
// 16-31, 128-143
|
|
shift = (write_page - 16) / 16;
|
|
break;
|
|
case MfUltralightTypeNTAGI2C2K:
|
|
// 16-47, 240-271
|
|
shift = (write_page - 16) / 32;
|
|
break;
|
|
case MfUltralightTypeNTAGI2CPlus2K:
|
|
// 16-47, 256-271
|
|
if(write_page >= 208 && write_page <= 225)
|
|
shift = 6;
|
|
else if(write_page >= 256 && write_page <= 271)
|
|
shift = 7;
|
|
else
|
|
shift = (write_page - 16) / 32;
|
|
break;
|
|
default:
|
|
furi_crash("Unknown MFUL");
|
|
break;
|
|
}
|
|
|
|
return (dynamic_lock_bytes & (1 << shift)) == 0;
|
|
}
|
|
|
|
static void mf_ul_make_ascii_mirror(MfUltralightEmulator* emulator, FuriString* str) {
|
|
// Locals to improve readability
|
|
uint8_t mirror_page = emulator->config->mirror_page;
|
|
uint8_t mirror_byte = emulator->config->mirror.mirror_byte;
|
|
MfUltralightMirrorConf mirror_conf = emulator->config_cache.mirror.mirror_conf;
|
|
uint16_t last_user_page_index = emulator->page_num - 6;
|
|
bool uid_printed = false;
|
|
|
|
if(mirror_conf == MfUltralightMirrorUid || mirror_conf == MfUltralightMirrorUidCounter) {
|
|
// UID range check
|
|
if(mirror_page < 4 || mirror_page > last_user_page_index - 3 ||
|
|
(mirror_page == last_user_page_index - 3 && mirror_byte > 2)) {
|
|
if(mirror_conf == MfUltralightMirrorUid) return;
|
|
// NTAG21x has the peculiar behavior when UID+counter selected, if UID does not fit but
|
|
// counter will fit, it will actually mirror the counter
|
|
furi_string_cat(str, " ");
|
|
} else {
|
|
for(int i = 0; i < 3; ++i) {
|
|
furi_string_cat_printf(str, "%02X", emulator->data.data[i]);
|
|
}
|
|
// Skip BCC0
|
|
for(int i = 4; i < 8; ++i) {
|
|
furi_string_cat_printf(str, "%02X", emulator->data.data[i]);
|
|
}
|
|
uid_printed = true;
|
|
}
|
|
|
|
uint16_t next_byte_offset = mirror_page * 4 + mirror_byte + 14;
|
|
if(mirror_conf == MfUltralightMirrorUidCounter) ++next_byte_offset;
|
|
mirror_page = next_byte_offset / 4;
|
|
mirror_byte = next_byte_offset % 4;
|
|
}
|
|
|
|
if(mirror_conf == MfUltralightMirrorCounter || mirror_conf == MfUltralightMirrorUidCounter) {
|
|
// Counter is only printed if counter enabled
|
|
if(emulator->config_cache.access.nfc_cnt_en) {
|
|
// Counter protection check
|
|
if(emulator->config_cache.access.nfc_cnt_pwd_prot && !emulator->auth_success) return;
|
|
// Counter range check
|
|
if(mirror_page < 4) return;
|
|
if(mirror_page > last_user_page_index - 1) return;
|
|
if(mirror_page == last_user_page_index - 1 && mirror_byte > 2) return;
|
|
|
|
if(mirror_conf == MfUltralightMirrorUidCounter)
|
|
furi_string_cat(str, uid_printed ? "x" : " ");
|
|
|
|
furi_string_cat_printf(str, "%06lX", emulator->data.counter[2]);
|
|
}
|
|
}
|
|
}
|
|
|
|
static void mf_ul_increment_single_counter(MfUltralightEmulator* emulator) {
|
|
if(!emulator->read_counter_incremented && emulator->config_cache.access.nfc_cnt_en) {
|
|
if(emulator->data.counter[2] < 0xFFFFFF) {
|
|
++emulator->data.counter[2];
|
|
emulator->data_changed = true;
|
|
}
|
|
emulator->read_counter_incremented = true;
|
|
}
|
|
}
|
|
|
|
static bool
|
|
mf_ul_emulate_ntag203_counter_write(MfUltralightEmulator* emulator, uint8_t* page_buff) {
|
|
// We'll reuse the existing counters for other NTAGs as staging
|
|
// Counter 0 stores original value, data is new value
|
|
uint32_t counter_value;
|
|
if(emulator->data.tearing[0] == MF_UL_TEARING_FLAG_DEFAULT) {
|
|
counter_value = emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4] |
|
|
(emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4 + 1] << 8);
|
|
} else {
|
|
// We've had a reset here, so load from original value
|
|
counter_value = emulator->data.counter[0];
|
|
}
|
|
// Although the datasheet says increment by 0 is always possible, this is not the case on
|
|
// an actual tag. If the counter is at 0xFFFF, any writes are locked out.
|
|
if(counter_value == 0xFFFF) return false;
|
|
uint32_t increment = page_buff[0] | (page_buff[1] << 8);
|
|
if(counter_value == 0) {
|
|
counter_value = increment;
|
|
} else {
|
|
// Per datasheet specifying > 0x000F is supposed to NAK, but actual tag doesn't
|
|
increment &= 0x000F;
|
|
if(counter_value + increment > 0xFFFF) return false;
|
|
counter_value += increment;
|
|
}
|
|
// Commit to new value counter
|
|
emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4] = (uint8_t)counter_value;
|
|
emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4 + 1] = (uint8_t)(counter_value >> 8);
|
|
emulator->data.tearing[0] = MF_UL_TEARING_FLAG_DEFAULT;
|
|
if(counter_value == 0xFFFF) {
|
|
// Tag will lock out counter if final number is 0xFFFF, even if you try to roll it back
|
|
emulator->data.counter[1] = 0xFFFF;
|
|
}
|
|
emulator->data_changed = true;
|
|
return true;
|
|
}
|
|
|
|
static void mf_ul_emulate_write(
|
|
MfUltralightEmulator* emulator,
|
|
int16_t tag_addr,
|
|
int16_t write_page,
|
|
uint8_t* page_buff) {
|
|
// Assumption: all access checks have been completed
|
|
|
|
if(tag_addr == 2) {
|
|
// Handle static locks
|
|
uint16_t orig_static_locks = emulator->data.data[write_page * 4 + 2] |
|
|
(emulator->data.data[write_page * 4 + 3] << 8);
|
|
uint16_t new_static_locks = page_buff[2] | (page_buff[3] << 8);
|
|
if(orig_static_locks & 1) new_static_locks &= ~0x08;
|
|
if(orig_static_locks & 2) new_static_locks &= ~0xF0;
|
|
if(orig_static_locks & 4) new_static_locks &= 0xFF;
|
|
new_static_locks |= orig_static_locks;
|
|
page_buff[0] = emulator->data.data[write_page * 4];
|
|
page_buff[1] = emulator->data.data[write_page * 4 + 1];
|
|
page_buff[2] = new_static_locks & 0xff;
|
|
page_buff[3] = new_static_locks >> 8;
|
|
} else if(tag_addr == 3) {
|
|
// Handle OTP/capability container
|
|
*(uint32_t*)page_buff |= *(uint32_t*)&emulator->data.data[write_page * 4];
|
|
} else if(tag_addr == mf_ul_get_dynamic_lock_page_addr(&emulator->data)) {
|
|
// Handle dynamic locks
|
|
if(emulator->data.type == MfUltralightTypeNTAG203) {
|
|
// NTAG203 lock bytes are a bit different from the others
|
|
uint8_t orig_page_lock_byte = emulator->data.data[write_page * 4];
|
|
uint8_t orig_cnt_lock_byte = emulator->data.data[write_page * 4 + 1];
|
|
uint8_t new_page_lock_byte = page_buff[0];
|
|
uint8_t new_cnt_lock_byte = page_buff[1];
|
|
|
|
if(orig_page_lock_byte & 0x01) // Block lock bits 1-3
|
|
new_page_lock_byte &= ~0x0E;
|
|
if(orig_page_lock_byte & 0x10) // Block lock bits 5-7
|
|
new_page_lock_byte &= ~0xE0;
|
|
for(uint8_t i = 0; i < 4; ++i) {
|
|
if(orig_cnt_lock_byte & (1 << i)) // Block lock counter bit
|
|
new_cnt_lock_byte &= ~(1 << (4 + i));
|
|
}
|
|
|
|
new_page_lock_byte |= orig_page_lock_byte;
|
|
new_cnt_lock_byte |= orig_cnt_lock_byte;
|
|
page_buff[0] = new_page_lock_byte;
|
|
page_buff[1] = new_cnt_lock_byte;
|
|
} else {
|
|
uint16_t orig_locks = emulator->data.data[write_page * 4] |
|
|
(emulator->data.data[write_page * 4 + 1] << 8);
|
|
uint8_t orig_block_locks = emulator->data.data[write_page * 4 + 2];
|
|
uint16_t new_locks = page_buff[0] | (page_buff[1] << 8);
|
|
uint8_t new_block_locks = page_buff[2];
|
|
|
|
int block_lock_count;
|
|
switch(emulator->data.type) {
|
|
case MfUltralightTypeUL21:
|
|
block_lock_count = 5;
|
|
break;
|
|
case MfUltralightTypeNTAG213:
|
|
block_lock_count = 6;
|
|
break;
|
|
case MfUltralightTypeNTAG215:
|
|
block_lock_count = 4;
|
|
break;
|
|
case MfUltralightTypeNTAG216:
|
|
case MfUltralightTypeNTAGI2C1K:
|
|
case MfUltralightTypeNTAGI2CPlus1K:
|
|
block_lock_count = 7;
|
|
break;
|
|
case MfUltralightTypeNTAGI2C2K:
|
|
case MfUltralightTypeNTAGI2CPlus2K:
|
|
block_lock_count = 8;
|
|
break;
|
|
default:
|
|
furi_crash("Unknown MFUL");
|
|
break;
|
|
}
|
|
|
|
for(int i = 0; i < block_lock_count; ++i) {
|
|
if(orig_block_locks & (1 << i)) new_locks &= ~(3 << (2 * i));
|
|
}
|
|
|
|
new_locks |= orig_locks;
|
|
new_block_locks |= orig_block_locks;
|
|
|
|
page_buff[0] = new_locks & 0xff;
|
|
page_buff[1] = new_locks >> 8;
|
|
page_buff[2] = new_block_locks;
|
|
if(emulator->data.type >= MfUltralightTypeUL21 && //-V1016
|
|
emulator->data.type <= MfUltralightTypeNTAG216)
|
|
page_buff[3] = MF_UL_TEARING_FLAG_DEFAULT;
|
|
else
|
|
page_buff[3] = 0;
|
|
}
|
|
}
|
|
|
|
memcpy(&emulator->data.data[write_page * 4], page_buff, 4);
|
|
emulator->data_changed = true;
|
|
}
|
|
|
|
void mf_ul_reset_emulation(MfUltralightEmulator* emulator, bool is_power_cycle) {
|
|
emulator->comp_write_cmd_started = false;
|
|
emulator->sector_select_cmd_started = false;
|
|
emulator->curr_sector = 0;
|
|
emulator->ntag_i2c_plus_sector3_lockout = false;
|
|
emulator->auth_success = false;
|
|
if(is_power_cycle) {
|
|
if(emulator->config != NULL) emulator->config_cache = *emulator->config;
|
|
|
|
if(emulator->supported_features & MfUltralightSupportSingleCounter) {
|
|
emulator->read_counter_incremented = false;
|
|
}
|
|
|
|
if(emulator->data.type == MfUltralightTypeNTAG203) {
|
|
// Apply lockout if counter ever reached 0xFFFF
|
|
if(emulator->data.counter[1] == 0xFFFF) {
|
|
emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4] = 0xFF;
|
|
emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4 + 1] = 0xFF;
|
|
}
|
|
// Copy original counter value from data
|
|
emulator->data.counter[0] =
|
|
emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4] |
|
|
(emulator->data.data[MF_UL_NTAG203_COUNTER_PAGE * 4 + 1] << 8);
|
|
}
|
|
} else {
|
|
if(emulator->config != NULL) {
|
|
// ACCESS (less CFGLCK) and AUTH0 are updated when reactivated
|
|
// MIRROR_CONF is not; don't know about STRG_MOD_EN, but we're not using that anyway
|
|
emulator->config_cache.access.value = (emulator->config->access.value & 0xBF) |
|
|
(emulator->config_cache.access.value & 0x40);
|
|
emulator->config_cache.auth0 = emulator->config->auth0;
|
|
}
|
|
}
|
|
if(emulator->data.type == MfUltralightTypeNTAG203) {
|
|
// Mark counter as dirty
|
|
emulator->data.tearing[0] = 0;
|
|
}
|
|
}
|
|
|
|
void mf_ul_prepare_emulation(MfUltralightEmulator* emulator, MfUltralightData* data) {
|
|
FURI_LOG_D(TAG, "Prepare emulation");
|
|
emulator->data = *data;
|
|
emulator->supported_features = mf_ul_get_features(data->type);
|
|
emulator->config = mf_ultralight_get_config_pages(&emulator->data);
|
|
emulator->page_num = emulator->data.data_size / 4;
|
|
emulator->data_changed = false;
|
|
memset(&emulator->auth_attempt, 0, sizeof(MfUltralightAuth));
|
|
mf_ul_reset_emulation(emulator, true);
|
|
}
|
|
|
|
bool mf_ul_prepare_emulation_response(
|
|
uint8_t* buff_rx,
|
|
uint16_t buff_rx_len,
|
|
uint8_t* buff_tx,
|
|
uint16_t* buff_tx_len,
|
|
uint32_t* data_type,
|
|
void* context) {
|
|
furi_assert(context);
|
|
MfUltralightEmulator* emulator = context;
|
|
uint16_t tx_bytes = 0;
|
|
uint16_t tx_bits = 0;
|
|
bool command_parsed = false;
|
|
bool send_ack = false;
|
|
bool respond_nothing = false;
|
|
bool reset_idle = false;
|
|
|
|
#ifdef FURI_DEBUG
|
|
FuriString* debug_buf;
|
|
debug_buf = furi_string_alloc();
|
|
for(int i = 0; i < (buff_rx_len + 7) / 8; ++i) {
|
|
furi_string_cat_printf(debug_buf, "%02x ", buff_rx[i]);
|
|
}
|
|
furi_string_trim(debug_buf);
|
|
FURI_LOG_T(TAG, "Emu RX (%d): %s", buff_rx_len, furi_string_get_cstr(debug_buf));
|
|
furi_string_reset(debug_buf);
|
|
#endif
|
|
|
|
// Check composite commands
|
|
if(emulator->comp_write_cmd_started) {
|
|
if(buff_rx_len == 16 * 8) {
|
|
if(emulator->data.type == MfUltralightTypeNTAG203 &&
|
|
emulator->comp_write_page_addr == MF_UL_NTAG203_COUNTER_PAGE) {
|
|
send_ack = mf_ul_emulate_ntag203_counter_write(emulator, buff_rx);
|
|
command_parsed = send_ack;
|
|
} else {
|
|
mf_ul_emulate_write(
|
|
emulator,
|
|
emulator->comp_write_page_addr,
|
|
emulator->comp_write_page_addr,
|
|
buff_rx);
|
|
send_ack = true;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
emulator->comp_write_cmd_started = false;
|
|
} else if(emulator->sector_select_cmd_started) {
|
|
if(buff_rx_len == 4 * 8) {
|
|
if(buff_rx[0] <= 0xFE) {
|
|
emulator->curr_sector = buff_rx[0] > 3 ? 0 : buff_rx[0];
|
|
emulator->ntag_i2c_plus_sector3_lockout = false;
|
|
command_parsed = true;
|
|
respond_nothing = true;
|
|
FURI_LOG_D(TAG, "Changing sector to %d", emulator->curr_sector);
|
|
}
|
|
}
|
|
emulator->sector_select_cmd_started = false;
|
|
} else if(buff_rx_len >= 8) {
|
|
uint8_t cmd = buff_rx[0];
|
|
if(cmd == MF_UL_GET_VERSION_CMD) {
|
|
if(emulator->data.type >= MfUltralightTypeUL11) {
|
|
if(buff_rx_len == 1 * 8) {
|
|
tx_bytes = sizeof(emulator->data.version);
|
|
memcpy(buff_tx, &emulator->data.version, tx_bytes);
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_READ_CMD) {
|
|
if(buff_rx_len == (1 + 1) * 8) {
|
|
int16_t start_page = buff_rx[1];
|
|
tx_bytes = 16;
|
|
if(emulator->data.type < MfUltralightTypeNTAGI2C1K) {
|
|
if(start_page < emulator->page_num) {
|
|
do {
|
|
uint8_t copied_pages = 0;
|
|
uint8_t src_page = start_page;
|
|
uint8_t last_page_plus_one = start_page + 4;
|
|
uint8_t pwd_page = emulator->page_num - 2;
|
|
FuriString* ascii_mirror = NULL;
|
|
size_t ascii_mirror_len = 0;
|
|
const char* ascii_mirror_cptr = NULL;
|
|
uint8_t ascii_mirror_curr_page = 0;
|
|
uint8_t ascii_mirror_curr_byte = 0;
|
|
if(last_page_plus_one > emulator->page_num)
|
|
last_page_plus_one = emulator->page_num;
|
|
if(emulator->supported_features & MfUltralightSupportAuth) {
|
|
if(!mf_ul_check_auth(emulator, start_page, false)) break;
|
|
if(!emulator->auth_success && emulator->config_cache.access.prot &&
|
|
emulator->config_cache.auth0 < last_page_plus_one)
|
|
last_page_plus_one = emulator->config_cache.auth0;
|
|
}
|
|
if(emulator->supported_features & MfUltralightSupportSingleCounter)
|
|
mf_ul_increment_single_counter(emulator);
|
|
if(emulator->supported_features & MfUltralightSupportAsciiMirror &&
|
|
emulator->config_cache.mirror.mirror_conf !=
|
|
MfUltralightMirrorNone) {
|
|
ascii_mirror_curr_byte = emulator->config->mirror.mirror_byte;
|
|
ascii_mirror_curr_page = emulator->config->mirror_page;
|
|
// Try to avoid wasting time making mirror if we won't copy it
|
|
// Conservatively check with UID+counter mirror size
|
|
if(last_page_plus_one > ascii_mirror_curr_page &&
|
|
start_page + 3 >= ascii_mirror_curr_page &&
|
|
start_page <= ascii_mirror_curr_page + 6) {
|
|
ascii_mirror = furi_string_alloc();
|
|
mf_ul_make_ascii_mirror(emulator, ascii_mirror);
|
|
ascii_mirror_len = furi_string_utf8_length(ascii_mirror);
|
|
ascii_mirror_cptr = furi_string_get_cstr(ascii_mirror);
|
|
// Move pointer to where it should be to start copying
|
|
if(ascii_mirror_len > 0 &&
|
|
ascii_mirror_curr_page < start_page &&
|
|
ascii_mirror_curr_byte != 0) {
|
|
uint8_t diff = 4 - ascii_mirror_curr_byte;
|
|
ascii_mirror_len -= diff;
|
|
ascii_mirror_cptr += diff;
|
|
ascii_mirror_curr_byte = 0;
|
|
++ascii_mirror_curr_page;
|
|
}
|
|
while(ascii_mirror_len > 0 &&
|
|
ascii_mirror_curr_page < start_page) {
|
|
uint8_t diff = ascii_mirror_len > 4 ? 4 : ascii_mirror_len;
|
|
ascii_mirror_len -= diff;
|
|
ascii_mirror_cptr += diff;
|
|
++ascii_mirror_curr_page;
|
|
}
|
|
}
|
|
}
|
|
|
|
uint8_t* dest_ptr = buff_tx;
|
|
while(copied_pages < 4) {
|
|
// Copy page
|
|
memcpy(dest_ptr, &emulator->data.data[src_page * 4], 4);
|
|
|
|
// Note: don't have to worry about roll-over with ASCII mirror because
|
|
// lowest valid page for it is 4, while roll-over will at best read
|
|
// pages 0-2
|
|
if(ascii_mirror_len > 0 && src_page == ascii_mirror_curr_page) {
|
|
// Copy ASCII mirror
|
|
size_t copy_len = 4 - ascii_mirror_curr_byte;
|
|
if(copy_len > ascii_mirror_len) copy_len = ascii_mirror_len;
|
|
for(size_t i = 0; i < copy_len; ++i) {
|
|
if(*ascii_mirror_cptr != ' ')
|
|
dest_ptr[ascii_mirror_curr_byte] =
|
|
(uint8_t)*ascii_mirror_cptr;
|
|
++ascii_mirror_curr_byte;
|
|
++ascii_mirror_cptr;
|
|
}
|
|
ascii_mirror_len -= copy_len;
|
|
// Don't care if this is inaccurate after ascii_mirror_len = 0
|
|
ascii_mirror_curr_byte = 0;
|
|
++ascii_mirror_curr_page;
|
|
}
|
|
|
|
if(emulator->supported_features & MfUltralightSupportAuth) {
|
|
if(src_page == pwd_page || src_page == pwd_page + 1) {
|
|
// Blank out PWD and PACK pages
|
|
memset(dest_ptr, 0, 4);
|
|
}
|
|
}
|
|
|
|
dest_ptr += 4;
|
|
++copied_pages;
|
|
++src_page;
|
|
if(src_page >= last_page_plus_one) src_page = 0;
|
|
}
|
|
if(ascii_mirror != NULL) {
|
|
furi_string_free(ascii_mirror);
|
|
}
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
} while(false);
|
|
}
|
|
} else {
|
|
uint16_t valid_pages;
|
|
start_page = mf_ultralight_ntag_i2c_addr_tag_to_lin(
|
|
&emulator->data, start_page, emulator->curr_sector, &valid_pages);
|
|
if(start_page != -1) {
|
|
if(emulator->data.type < MfUltralightTypeNTAGI2CPlus1K ||
|
|
mf_ul_ntag_i2c_plus_check_auth(emulator, buff_rx[1], false)) {
|
|
if(emulator->data.type >= MfUltralightTypeNTAGI2CPlus1K &&
|
|
emulator->curr_sector == 3 && valid_pages == 1) {
|
|
// Rewind back a sector to match behavior on a real tag
|
|
--start_page;
|
|
++valid_pages;
|
|
}
|
|
|
|
uint16_t copy_count = (valid_pages > 4 ? 4 : valid_pages) * 4;
|
|
FURI_LOG_D(
|
|
TAG,
|
|
"NTAG I2C Emu: page valid, %02x:%02x -> %d, %d",
|
|
emulator->curr_sector,
|
|
buff_rx[1],
|
|
start_page,
|
|
valid_pages);
|
|
memcpy(buff_tx, &emulator->data.data[start_page * 4], copy_count);
|
|
// For NTAG I2C, there's no roll-over; remainder is filled by null bytes
|
|
if(copy_count < tx_bytes)
|
|
memset(&buff_tx[copy_count], 0, tx_bytes - copy_count);
|
|
// Special case: NTAG I2C Plus sector 0 page 233 read crosses into page 236
|
|
if(start_page == 233)
|
|
memcpy(
|
|
&buff_tx[12], &emulator->data.data[(start_page + 1) * 4], 4);
|
|
mf_ul_protect_auth_data_on_read_command_i2c(
|
|
buff_tx, start_page, start_page + copy_count / 4 - 1, emulator);
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
}
|
|
} else {
|
|
FURI_LOG_D(
|
|
TAG,
|
|
"NTAG I2C Emu: page invalid, %02x:%02x",
|
|
emulator->curr_sector,
|
|
buff_rx[1]);
|
|
if(emulator->data.type >= MfUltralightTypeNTAGI2CPlus1K &&
|
|
emulator->curr_sector == 3 &&
|
|
!emulator->ntag_i2c_plus_sector3_lockout) {
|
|
// NTAG I2C Plus has a weird behavior where if you read sector 3
|
|
// at an invalid address, it responds with zeroes then locks
|
|
// the read out, while if you read the mirrored session registers,
|
|
// it returns both session registers on either pages
|
|
memset(buff_tx, 0, tx_bytes);
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
emulator->ntag_i2c_plus_sector3_lockout = true;
|
|
}
|
|
}
|
|
}
|
|
if(!command_parsed) tx_bytes = 0;
|
|
}
|
|
} else if(cmd == MF_UL_FAST_READ_CMD) {
|
|
if(emulator->supported_features & MfUltralightSupportFastRead) {
|
|
if(buff_rx_len == (1 + 2) * 8) {
|
|
int16_t start_page = buff_rx[1];
|
|
uint8_t end_page = buff_rx[2];
|
|
if(start_page <= end_page) {
|
|
tx_bytes = ((end_page + 1) - start_page) * 4;
|
|
if(emulator->data.type < MfUltralightTypeNTAGI2C1K) {
|
|
if((start_page < emulator->page_num) &&
|
|
(end_page < emulator->page_num)) {
|
|
do {
|
|
if(emulator->supported_features & MfUltralightSupportAuth) {
|
|
// NAK if not authenticated and requested pages cross over AUTH0
|
|
if(!emulator->auth_success &&
|
|
emulator->config_cache.access.prot &&
|
|
(start_page >= emulator->config_cache.auth0 ||
|
|
end_page >= emulator->config_cache.auth0))
|
|
break;
|
|
}
|
|
if(emulator->supported_features &
|
|
MfUltralightSupportSingleCounter)
|
|
mf_ul_increment_single_counter(emulator);
|
|
|
|
// Copy requested pages
|
|
memcpy(
|
|
buff_tx, &emulator->data.data[start_page * 4], tx_bytes);
|
|
|
|
if(emulator->supported_features &
|
|
MfUltralightSupportAsciiMirror &&
|
|
emulator->config_cache.mirror.mirror_conf !=
|
|
MfUltralightMirrorNone) {
|
|
// Copy ASCII mirror
|
|
// Less stringent check here, because expecting FAST_READ to
|
|
// only be issued once rather than repeatedly
|
|
FuriString* ascii_mirror;
|
|
ascii_mirror = furi_string_alloc();
|
|
mf_ul_make_ascii_mirror(emulator, ascii_mirror);
|
|
size_t ascii_mirror_len =
|
|
furi_string_utf8_length(ascii_mirror);
|
|
const char* ascii_mirror_cptr =
|
|
furi_string_get_cstr(ascii_mirror);
|
|
int16_t mirror_start_offset =
|
|
(emulator->config->mirror_page - start_page) * 4 +
|
|
emulator->config->mirror.mirror_byte;
|
|
if(mirror_start_offset < 0) {
|
|
if(mirror_start_offset < -(int16_t)ascii_mirror_len) {
|
|
// Past ASCII mirror, don't copy
|
|
ascii_mirror_len = 0;
|
|
} else {
|
|
ascii_mirror_cptr += -mirror_start_offset;
|
|
ascii_mirror_len -= -mirror_start_offset;
|
|
mirror_start_offset = 0;
|
|
}
|
|
}
|
|
if(ascii_mirror_len > 0) {
|
|
int16_t mirror_end_offset =
|
|
mirror_start_offset + ascii_mirror_len;
|
|
if(mirror_end_offset > (end_page + 1) * 4) {
|
|
mirror_end_offset = (end_page + 1) * 4;
|
|
ascii_mirror_len =
|
|
mirror_end_offset - mirror_start_offset;
|
|
}
|
|
for(size_t i = 0; i < ascii_mirror_len; ++i) {
|
|
if(*ascii_mirror_cptr != ' ')
|
|
buff_tx[mirror_start_offset] =
|
|
(uint8_t)*ascii_mirror_cptr;
|
|
++mirror_start_offset;
|
|
++ascii_mirror_cptr;
|
|
}
|
|
}
|
|
furi_string_free(ascii_mirror);
|
|
}
|
|
|
|
if(emulator->supported_features & MfUltralightSupportAuth) {
|
|
// Clear PWD and PACK pages
|
|
uint8_t pwd_page = emulator->page_num - 2;
|
|
int16_t pwd_page_offset = pwd_page - start_page;
|
|
// PWD page
|
|
if(pwd_page_offset >= 0 && pwd_page <= end_page) {
|
|
memset(&buff_tx[pwd_page_offset * 4], 0, 4);
|
|
// PACK page
|
|
if(pwd_page + 1 <= end_page)
|
|
memset(&buff_tx[(pwd_page_offset + 1) * 4], 0, 4);
|
|
}
|
|
}
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
} while(false);
|
|
}
|
|
} else {
|
|
uint16_t valid_pages;
|
|
start_page = mf_ultralight_ntag_i2c_addr_tag_to_lin(
|
|
&emulator->data, start_page, emulator->curr_sector, &valid_pages);
|
|
if(start_page != -1) {
|
|
if(emulator->data.type < MfUltralightTypeNTAGI2CPlus1K ||
|
|
mf_ul_ntag_i2c_plus_check_auth(emulator, buff_rx[1], false)) {
|
|
uint16_t copy_count = tx_bytes;
|
|
if(copy_count > valid_pages * 4) copy_count = valid_pages * 4;
|
|
memcpy(
|
|
buff_tx, &emulator->data.data[start_page * 4], copy_count);
|
|
if(copy_count < tx_bytes)
|
|
memset(&buff_tx[copy_count], 0, tx_bytes - copy_count);
|
|
mf_ul_ntag_i2c_fill_cross_area_read(
|
|
buff_tx, buff_rx[1], buff_rx[2], emulator);
|
|
mf_ul_protect_auth_data_on_read_command_i2c(
|
|
buff_tx,
|
|
start_page,
|
|
start_page + copy_count / 4 - 1,
|
|
emulator);
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
}
|
|
if(!command_parsed) tx_bytes = 0;
|
|
}
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_WRITE) {
|
|
if(buff_rx_len == (1 + 5) * 8) {
|
|
do {
|
|
uint8_t orig_write_page = buff_rx[1];
|
|
int16_t write_page = orig_write_page;
|
|
uint16_t valid_pages; // unused
|
|
write_page = mf_ultralight_ntag_i2c_addr_tag_to_lin(
|
|
&emulator->data, write_page, emulator->curr_sector, &valid_pages);
|
|
if(write_page == -1) // NTAG I2C range check
|
|
break;
|
|
else if(write_page < 2 || write_page >= emulator->page_num) // Other MFUL/NTAG range check
|
|
break;
|
|
|
|
if(emulator->supported_features & MfUltralightSupportAuth) {
|
|
if(emulator->data.type >= MfUltralightTypeNTAGI2CPlus1K) {
|
|
if(!mf_ul_ntag_i2c_plus_check_auth(emulator, orig_write_page, true))
|
|
break;
|
|
} else {
|
|
if(!mf_ul_check_auth(emulator, orig_write_page, true)) break;
|
|
}
|
|
}
|
|
int16_t tag_addr = mf_ultralight_page_addr_to_tag_addr(
|
|
emulator->curr_sector, orig_write_page);
|
|
if(!mf_ul_check_lock(emulator, tag_addr)) break;
|
|
if(emulator->data.type == MfUltralightTypeNTAG203 &&
|
|
orig_write_page == MF_UL_NTAG203_COUNTER_PAGE) {
|
|
send_ack = mf_ul_emulate_ntag203_counter_write(emulator, &buff_rx[2]);
|
|
command_parsed = send_ack;
|
|
} else {
|
|
mf_ul_emulate_write(emulator, tag_addr, write_page, &buff_rx[2]);
|
|
send_ack = true;
|
|
command_parsed = true;
|
|
}
|
|
} while(false);
|
|
}
|
|
} else if(cmd == MF_UL_FAST_WRITE) {
|
|
if(emulator->supported_features & MfUltralightSupportFastWrite) {
|
|
if(buff_rx_len == (1 + 66) * 8) {
|
|
if(buff_rx[1] == 0xF0 && buff_rx[2] == 0xFF) {
|
|
// TODO: update when SRAM emulation implemented
|
|
send_ack = true;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_COMP_WRITE) {
|
|
if(emulator->supported_features & MfUltralightSupportCompatWrite) {
|
|
if(buff_rx_len == (1 + 1) * 8) {
|
|
uint8_t write_page = buff_rx[1];
|
|
do {
|
|
if(write_page < 2 || write_page >= emulator->page_num) break;
|
|
if(emulator->supported_features & MfUltralightSupportAuth &&
|
|
!mf_ul_check_auth(emulator, write_page, true))
|
|
break;
|
|
// Note we don't convert to tag addr here because there's only one sector
|
|
if(!mf_ul_check_lock(emulator, write_page)) break;
|
|
|
|
emulator->comp_write_cmd_started = true;
|
|
emulator->comp_write_page_addr = write_page;
|
|
send_ack = true;
|
|
command_parsed = true;
|
|
} while(false);
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_READ_CNT) {
|
|
if(emulator->supported_features & MfUltralightSupportReadCounter) {
|
|
if(buff_rx_len == (1 + 1) * 8) {
|
|
do {
|
|
uint8_t cnt_num = buff_rx[1];
|
|
|
|
// NTAG21x checks
|
|
if(emulator->supported_features & MfUltralightSupportSingleCounter) {
|
|
if(cnt_num != 2) break; // Only counter 2 is available
|
|
if(!emulator->config_cache.access.nfc_cnt_en)
|
|
break; // NAK if counter not enabled
|
|
if(emulator->config_cache.access.nfc_cnt_pwd_prot &&
|
|
!emulator->auth_success)
|
|
break;
|
|
}
|
|
|
|
if(cnt_num < 3) {
|
|
buff_tx[0] = emulator->data.counter[cnt_num] & 0xFF;
|
|
buff_tx[1] = (emulator->data.counter[cnt_num] >> 8) & 0xFF;
|
|
buff_tx[2] = (emulator->data.counter[cnt_num] >> 16) & 0xFF;
|
|
tx_bytes = 3;
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
}
|
|
} while(false);
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_INC_CNT) {
|
|
if(emulator->supported_features & MfUltralightSupportIncrCounter) {
|
|
if(buff_rx_len == (1 + 5) * 8) {
|
|
uint8_t cnt_num = buff_rx[1];
|
|
uint32_t inc = (buff_rx[2] | (buff_rx[3] << 8) | (buff_rx[4] << 16));
|
|
// TODO: can you increment by 0 when counter is at 0xffffff?
|
|
if((cnt_num < 3) && (emulator->data.counter[cnt_num] != 0x00FFFFFF) &&
|
|
(emulator->data.counter[cnt_num] + inc <= 0x00FFFFFF)) {
|
|
emulator->data.counter[cnt_num] += inc;
|
|
// We're RAM-backed, so tearing never happens
|
|
emulator->data.tearing[cnt_num] = MF_UL_TEARING_FLAG_DEFAULT;
|
|
emulator->data_changed = true;
|
|
send_ack = true;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_AUTH) {
|
|
if(emulator->supported_features & MfUltralightSupportAuth) {
|
|
if(buff_rx_len == (1 + 4) * 8) {
|
|
// Record password sent by PCD
|
|
memcpy(
|
|
emulator->auth_attempt.pwd.raw,
|
|
&buff_rx[1],
|
|
sizeof(emulator->auth_attempt.pwd.raw));
|
|
emulator->auth_attempted = true;
|
|
if(emulator->auth_received_callback) {
|
|
emulator->auth_received_callback(
|
|
emulator->auth_attempt, emulator->context);
|
|
}
|
|
|
|
uint16_t scaled_authlim = mf_ultralight_calc_auth_count(&emulator->data);
|
|
if(scaled_authlim != 0 && emulator->data.curr_authlim >= scaled_authlim) {
|
|
if(emulator->data.curr_authlim != UINT16_MAX) {
|
|
// Handle case where AUTHLIM has been lowered or changed from 0
|
|
emulator->data.curr_authlim = UINT16_MAX;
|
|
emulator->data_changed = true;
|
|
}
|
|
// AUTHLIM reached, always fail
|
|
buff_tx[0] = MF_UL_NAK_AUTHLIM_REACHED;
|
|
tx_bits = 4;
|
|
*data_type = FURI_HAL_NFC_TX_RAW_RX_DEFAULT;
|
|
mf_ul_reset_emulation(emulator, false);
|
|
command_parsed = true;
|
|
} else {
|
|
if(memcmp(&buff_rx[1], emulator->config->auth_data.pwd.raw, 4) == 0) {
|
|
// Correct password
|
|
buff_tx[0] = emulator->config->auth_data.pack.raw[0];
|
|
buff_tx[1] = emulator->config->auth_data.pack.raw[1];
|
|
tx_bytes = 2;
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
emulator->auth_success = true;
|
|
command_parsed = true;
|
|
if(emulator->data.curr_authlim != 0) {
|
|
// Reset current AUTHLIM
|
|
emulator->data.curr_authlim = 0;
|
|
emulator->data_changed = true;
|
|
}
|
|
} else if(!emulator->config->auth_data.pwd.value) {
|
|
// Unknown password, pretend to be an Amiibo
|
|
buff_tx[0] = 0x80;
|
|
buff_tx[1] = 0x80;
|
|
tx_bytes = 2;
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
emulator->auth_success = true;
|
|
command_parsed = true;
|
|
} else {
|
|
// Wrong password, increase negative verification count
|
|
if(emulator->data.curr_authlim < UINT16_MAX) {
|
|
++emulator->data.curr_authlim;
|
|
emulator->data_changed = true;
|
|
}
|
|
if(scaled_authlim != 0 &&
|
|
emulator->data.curr_authlim >= scaled_authlim) {
|
|
emulator->data.curr_authlim = UINT16_MAX;
|
|
buff_tx[0] = MF_UL_NAK_AUTHLIM_REACHED;
|
|
tx_bits = 4;
|
|
*data_type = FURI_HAL_NFC_TX_RAW_RX_DEFAULT;
|
|
mf_ul_reset_emulation(emulator, false);
|
|
command_parsed = true;
|
|
} else {
|
|
// Should delay here to slow brute forcing
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_READ_SIG) {
|
|
if(emulator->supported_features & MfUltralightSupportSignature) {
|
|
// Check 2nd byte = 0x00 - RFU
|
|
if(buff_rx_len == (1 + 1) * 8 && buff_rx[1] == 0x00) {
|
|
tx_bytes = sizeof(emulator->data.signature);
|
|
memcpy(buff_tx, emulator->data.signature, tx_bytes);
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_CHECK_TEARING) {
|
|
if(emulator->supported_features & MfUltralightSupportTearingFlags) {
|
|
if(buff_rx_len == (1 + 1) * 8) {
|
|
uint8_t cnt_num = buff_rx[1];
|
|
if(cnt_num < 3) {
|
|
buff_tx[0] = emulator->data.tearing[cnt_num];
|
|
tx_bytes = 1;
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_HALT_START) {
|
|
reset_idle = true;
|
|
FURI_LOG_D(TAG, "Received HLTA");
|
|
} else if(cmd == MF_UL_SECTOR_SELECT) {
|
|
if(emulator->supported_features & MfUltralightSupportSectorSelect) {
|
|
if(buff_rx_len == (1 + 1) * 8 && buff_rx[1] == 0xFF) {
|
|
// Send ACK
|
|
emulator->sector_select_cmd_started = true;
|
|
send_ack = true;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
} else if(cmd == MF_UL_READ_VCSL) {
|
|
if(emulator->supported_features & MfUltralightSupportVcsl) {
|
|
if(buff_rx_len == (1 + 20) * 8) {
|
|
buff_tx[0] = emulator->config_cache.vctid;
|
|
tx_bytes = 1;
|
|
*data_type = FURI_HAL_NFC_TXRX_DEFAULT;
|
|
command_parsed = true;
|
|
}
|
|
}
|
|
} else {
|
|
// NTAG203 appears to NAK instead of just falling off on invalid commands
|
|
if(emulator->data.type != MfUltralightTypeNTAG203) reset_idle = true;
|
|
FURI_LOG_D(TAG, "Received invalid command");
|
|
}
|
|
} else {
|
|
reset_idle = true;
|
|
FURI_LOG_D(TAG, "Received invalid buffer less than 8 bits in length");
|
|
}
|
|
|
|
if(reset_idle) {
|
|
mf_ul_reset_emulation(emulator, false);
|
|
tx_bits = 0;
|
|
command_parsed = true;
|
|
}
|
|
|
|
if(!command_parsed) {
|
|
// Send NACK
|
|
buff_tx[0] = MF_UL_NAK_INVALID_ARGUMENT;
|
|
tx_bits = 4;
|
|
*data_type = FURI_HAL_NFC_TX_RAW_RX_DEFAULT;
|
|
// Every NAK should cause reset to IDLE
|
|
mf_ul_reset_emulation(emulator, false);
|
|
} else if(send_ack) {
|
|
buff_tx[0] = MF_UL_ACK;
|
|
tx_bits = 4;
|
|
*data_type = FURI_HAL_NFC_TX_RAW_RX_DEFAULT;
|
|
}
|
|
|
|
if(respond_nothing) {
|
|
*buff_tx_len = UINT16_MAX;
|
|
*data_type = FURI_HAL_NFC_TX_RAW_RX_DEFAULT;
|
|
} else {
|
|
// Return tx buffer size in bits
|
|
if(tx_bytes) {
|
|
tx_bits = tx_bytes * 8;
|
|
}
|
|
*buff_tx_len = tx_bits;
|
|
}
|
|
|
|
#ifdef FURI_DEBUG
|
|
if(*buff_tx_len == UINT16_MAX) {
|
|
FURI_LOG_T(TAG, "Emu TX: no reply");
|
|
} else if(*buff_tx_len > 0) {
|
|
int count = (*buff_tx_len + 7) / 8;
|
|
for(int i = 0; i < count; ++i) {
|
|
furi_string_cat_printf(debug_buf, "%02x ", buff_tx[i]);
|
|
}
|
|
furi_string_trim(debug_buf);
|
|
FURI_LOG_T(TAG, "Emu TX (%d): %s", *buff_tx_len, furi_string_get_cstr(debug_buf));
|
|
furi_string_free(debug_buf);
|
|
} else {
|
|
FURI_LOG_T(TAG, "Emu TX: HALT");
|
|
}
|
|
#endif
|
|
|
|
return tx_bits > 0;
|
|
}
|
|
|
|
bool mf_ul_is_full_capture(MfUltralightData* data) {
|
|
if(data->data_read != data->data_size) return false;
|
|
|
|
// Having read all the pages doesn't mean that we've got everything.
|
|
// By default PWD is 0xFFFFFFFF, but if read back it is always 0x00000000,
|
|
// so a default read on an auth-supported NTAG is never complete.
|
|
if(!(mf_ul_get_features(data->type) & MfUltralightSupportAuth)) return true;
|
|
MfUltralightConfigPages* config = mf_ultralight_get_config_pages(data);
|
|
return config->auth_data.pwd.value != 0 || config->auth_data.pack.value != 0;
|
|
}
|