Skip to content

NFC: Fix gen1 writing with invalid BCC (lost fix from PR #2511) #2710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
skotopes merged 8 commits into from
May 31, 2023
Merged

NFC: Fix gen1 writing with invalid BCC (lost fix from PR #2511) #2710

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
682649b
NFC: Fix gen1 writing with invalid BCC (lost fix from PR #2511)
AloneLiberty May 28, 2023
f814dc0
Bad copying
AloneLiberty May 28, 2023
e91e4f9
Very bad copying
AloneLiberty May 28, 2023
14d2a03
Return more lost code, removed leftovers, migrate wipe to proxmark wa…
AloneLiberty May 29, 2023
595ad1d
Finally, blind development
AloneLiberty May 29, 2023
28ab39a
Cringe fixes
AloneLiberty May 29, 2023
4eeeb28
Merge branch 'dev' into nfc-magic-bcc-fix
AloneLiberty May 29, 2023
1b52d6e
Merge branch 'dev' into nfc-magic-bcc-fix
skotopes May 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 0 additions & 30 deletions applications/external/nfc_magic/lib/magic/classic_gen1.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
#define TAG "Magic"

#define MAGIC_CMD_WUPA (0x40)
#define MAGIC_CMD_WIPE (0x41)
#define MAGIC_CMD_ACCESS (0x43)

#define MAGIC_MIFARE_READ_CMD (0x30)
Expand Down Expand Up @@ -144,32 +143,3 @@ bool magic_gen1_write_blk(uint8_t block_num, MfClassicBlock* data) {

return write_success;
}

bool magic_gen1_wipe() {
bool wipe_success = false;
uint8_t tx_data[MAGIC_BUFFER_SIZE] = {};
uint8_t rx_data[MAGIC_BUFFER_SIZE] = {};
uint16_t rx_len = 0;
FuriHalNfcReturn ret = 0;

do {
tx_data[0] = MAGIC_CMD_WIPE;
ret = furi_hal_nfc_ll_txrx_bits(
tx_data,
8,
rx_data,
sizeof(rx_data),
&rx_len,
FURI_HAL_NFC_LL_TXRX_FLAGS_CRC_TX_MANUAL | FURI_HAL_NFC_LL_TXRX_FLAGS_AGC_ON |
FURI_HAL_NFC_LL_TXRX_FLAGS_CRC_RX_KEEP,
furi_hal_nfc_ll_ms2fc(2000));

if(ret != FuriHalNfcReturnIncompleteByte) break;
if(rx_len != 4) break;
if(rx_data[0] != MAGIC_ACK) break;

wipe_success = true;
} while(false);

return wipe_success;
}
2 changes: 0 additions & 2 deletions applications/external/nfc_magic/lib/magic/classic_gen1.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,3 @@ bool magic_gen1_read_block(uint8_t block_num, MfClassicBlock* data);
bool magic_gen1_data_access_cmd();

bool magic_gen1_write_blk(uint8_t block_num, MfClassicBlock* data);

bool magic_gen1_wipe();
175 changes: 0 additions & 175 deletions applications/external/nfc_magic/lib/magic/magic.c
View file
Open in desktop

This file was deleted.

66 changes: 45 additions & 21 deletions applications/external/nfc_magic/nfc_magic_worker.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,51 +92,49 @@ void nfc_magic_worker_write(NfcMagicWorker* nfc_magic_worker) {

while(nfc_magic_worker->state == NfcMagicWorkerStateWrite) {
do {
if(furi_hal_nfc_detect(&nfc_data, 200)) {
if(nfc_data.cuid != magic_dev->cuid) break;
if(!card_found_notified) {
nfc_magic_worker->callback(
NfcMagicWorkerEventCardDetected, nfc_magic_worker->context);
card_found_notified = true;
}
furi_hal_nfc_sleep();

magic_activate();
if(magic_dev->type == MagicTypeClassicGen1) {
if(dev_protocol != NfcDeviceProtocolMifareClassic) break;
MfClassicData* mfc_data = &dev_data->mf_classic_data;

if(mfc_data->type != MfClassicType1k) break;
if(magic_dev->type == MagicTypeClassicGen1) {
if(furi_hal_nfc_detect(&nfc_data, 200)) {
magic_deactivate();
magic_activate();
if(!magic_gen1_wupa()) {
FURI_LOG_E(TAG, "Not Magic card");
FURI_LOG_E(TAG, "No card response to WUPA (not a magic card)");
nfc_magic_worker->callback(
NfcMagicWorkerEventWrongCard, nfc_magic_worker->context);
done = true;
break;
}
magic_deactivate();
}
magic_activate();
if(magic_gen1_wupa()) {
if(!magic_gen1_data_access_cmd()) {
FURI_LOG_E(TAG, "Not Magic card");
FURI_LOG_E(
TAG, "No card response to data access command (not a magic card)");
nfc_magic_worker->callback(
NfcMagicWorkerEventWrongCard, nfc_magic_worker->context);
done = true;
break;
}

MfClassicData* mfc_data = &dev_data->mf_classic_data;
for(size_t i = 0; i < 64; i++) {
FURI_LOG_D(TAG, "Writing block %d", i);
if(!magic_gen1_write_blk(i, &mfc_data->block[i])) {
FURI_LOG_E(TAG, "Failed to write %d block", i);
done = true;
nfc_magic_worker->callback(
NfcMagicWorkerEventFail, nfc_magic_worker->context);
done = true;
break;
}
}

done = true;
nfc_magic_worker->callback(
NfcMagicWorkerEventSuccess, nfc_magic_worker->context);
done = true;
break;
} else if(magic_dev->type == MagicTypeGen4) {
}
} else if(magic_dev->type == MagicTypeGen4) {
if(furi_hal_nfc_detect(&nfc_data, 200)) {
uint8_t gen4_config[28];
uint32_t password = magic_dev->password;

Expand Down Expand Up @@ -196,6 +194,7 @@ void nfc_magic_worker_write(NfcMagicWorker* nfc_magic_worker) {
gen4_config[25] = dev_data->nfc_data.atqa[1];
gen4_config[26] = dev_data->nfc_data.sak;

furi_hal_nfc_sleep();
furi_hal_nfc_activate_nfca(200, &cuid);
if(!magic_gen4_set_cfg(password, gen4_config, sizeof(gen4_config), false)) {
nfc_magic_worker->callback(
Expand Down Expand Up @@ -394,6 +393,11 @@ void nfc_magic_worker_wipe(NfcMagicWorker* nfc_magic_worker) {

MfClassicBlock block;
memset(&block, 0, sizeof(MfClassicBlock));
MfClassicBlock empty_block;
memset(&empty_block, 0, sizeof(MfClassicBlock));
MfClassicBlock trailer_block;
memset(&trailer_block, 0xff, sizeof(MfClassicBlock));

block.value[0] = 0x01;
block.value[1] = 0x02;
block.value[2] = 0x03;
Expand All @@ -402,6 +406,10 @@ void nfc_magic_worker_wipe(NfcMagicWorker* nfc_magic_worker) {
block.value[5] = 0x08;
block.value[6] = 0x04;

trailer_block.value[7] = 0x07;
trailer_block.value[8] = 0x80;
trailer_block.value[9] = 0x69;

while(nfc_magic_worker->state == NfcMagicWorkerStateWipe) {
do {
magic_deactivate();
Expand All @@ -415,10 +423,26 @@ void nfc_magic_worker_wipe(NfcMagicWorker* nfc_magic_worker) {
card_found_notified = true;
}

if(!magic_gen1_wipe()) break;
if(!magic_gen1_data_access_cmd()) break;
if(!magic_gen1_write_blk(0, &block)) break;

for(size_t i = 1; i < 64; i++) {
FURI_LOG_D(TAG, "Wiping block %d", i);
bool success = false;
if((i | 0x03) == i) {
success = magic_gen1_write_blk(i, &trailer_block);
} else {
success = magic_gen1_write_blk(i, &empty_block);
}

if(!success) {
FURI_LOG_E(TAG, "Failed to write %d block", i);
nfc_magic_worker->callback(
NfcMagicWorkerEventFail, nfc_magic_worker->context);
break;
}
}

card_wiped = true;
nfc_magic_worker->callback(NfcMagicWorkerEventSuccess, nfc_magic_worker->context);
} else if(magic_dev->type == MagicTypeGen4) {
Expand Down