unleashed-firmware/lib/nfc/protocols/mifare_ultralight.h
Yukai Li 6b47bc1af4
Nfc: NTAG password auto capture (and other password-related changes) ()
* nfc: MFUL minor cleanup
* nfc: Add mechanism to pass event data
* nfc: Add NTAG authentication event to emulation
* nfc: Rename enum member to align with existing convention
* nfc: Add function to determine whether MFUL is fully captured
* nfc: Fix emulation of incompletely-read password-protected MFUL
* nfc: Add reader password capture scene
* nfc: Set default MFUL password input to 0xFFFFFFFF
* nfc: Fix MFUL auth counter loading
* nfc: Be explicit about using manual auth method when using auto unlock
* nfc: Fill in MFUL has_auth when loading file
* nfc: Fix MFUL auth success usage, remove unused variable
* nfc: Display PWD and PACK in MFUL info if available
* nfc: Remove unnecessary include
* nfc: Add unlock options to loaded MFUL menu
* nfc: Move set default MFUL password. This way it can be edited if needed instead of reentered
* nfc: Fix unlock menu not maintaining selection index
* nfc: Move captured MFUL auth data from worker to device data
* nfc: Attempt to authenticate with default PWD when possible when reading NTAG
* nfc: Don't try to auth NTAG on read if we already authed
* nfc: Add title for all pages read but failed auth for NTAG auth
* nfc: Add faster auth callback patch
* lib: Remove scons submodule from index
* nfc: Revise MFUL unlock UI flow
* nfc: Disallow MFUL unlock with reader if card not read yet. Trying to read first results in either needing to make a new scene or badly jury rigging other scenes, so let's just not do that
* f7: Bump API symbols
* Format code

Co-authored-by: gornekich <n.gorbadey@gmail.com>
Co-authored-by: あく <alleteam@gmail.com>
2022-11-29 03:16:22 +09:00

256 lines
7.2 KiB
C

#pragma once
#include <furi_hal_nfc.h>
// Largest tag is NTAG I2C Plus 2K, both data sectors plus SRAM
#define MF_UL_MAX_DUMP_SIZE ((238 + 256 + 16) * 4)
#define MF_UL_TEARING_FLAG_DEFAULT (0xBD)
#define MF_UL_HALT_START (0x50)
#define MF_UL_GET_VERSION_CMD (0x60)
#define MF_UL_READ_CMD (0x30)
#define MF_UL_FAST_READ_CMD (0x3A)
#define MF_UL_WRITE (0xA2)
#define MF_UL_FAST_WRITE (0xA6)
#define MF_UL_COMP_WRITE (0xA0)
#define MF_UL_READ_CNT (0x39)
#define MF_UL_INC_CNT (0xA5)
#define MF_UL_AUTH (0x1B)
#define MF_UL_READ_SIG (0x3C)
#define MF_UL_CHECK_TEARING (0x3E)
#define MF_UL_READ_VCSL (0x4B)
#define MF_UL_SECTOR_SELECT (0xC2)
#define MF_UL_ACK (0xa)
#define MF_UL_NAK_INVALID_ARGUMENT (0x0)
#define MF_UL_NAK_AUTHLIM_REACHED (0x4)
#define MF_UL_NTAG203_COUNTER_PAGE (41)
#define MF_UL_DEFAULT_PWD (0xFFFFFFFF)
typedef enum {
MfUltralightAuthMethodManual,
MfUltralightAuthMethodAmeebo,
MfUltralightAuthMethodXiaomi,
MfUltralightAuthMethodAuto,
} MfUltralightAuthMethod;
// Important: order matters; some features are based on positioning in this enum
typedef enum {
MfUltralightTypeUnknown,
MfUltralightTypeNTAG203,
// Below have config pages and GET_VERSION support
MfUltralightTypeUL11,
MfUltralightTypeUL21,
MfUltralightTypeNTAG213,
MfUltralightTypeNTAG215,
MfUltralightTypeNTAG216,
// Below also have sector select
// NTAG I2C's *does not* have regular config pages, so it's a bit of an odd duck
MfUltralightTypeNTAGI2C1K,
MfUltralightTypeNTAGI2C2K,
// NTAG I2C Plus has stucture expected from NTAG21x
MfUltralightTypeNTAGI2CPlus1K,
MfUltralightTypeNTAGI2CPlus2K,
// Keep last for number of types calculation
MfUltralightTypeNum,
} MfUltralightType;
typedef enum {
MfUltralightSupportNone = 0,
MfUltralightSupportFastRead = 1 << 0,
MfUltralightSupportTearingFlags = 1 << 1,
MfUltralightSupportReadCounter = 1 << 2,
MfUltralightSupportIncrCounter = 1 << 3,
MfUltralightSupportSignature = 1 << 4,
MfUltralightSupportFastWrite = 1 << 5,
MfUltralightSupportCompatWrite = 1 << 6,
MfUltralightSupportAuth = 1 << 7,
MfUltralightSupportVcsl = 1 << 8,
MfUltralightSupportSectorSelect = 1 << 9,
// NTAG21x only has counter 2
MfUltralightSupportSingleCounter = 1 << 10,
// ASCII mirror is not a command, but handy to have as a flag
MfUltralightSupportAsciiMirror = 1 << 11,
// NTAG203 counter that's in memory rather than through a command
MfUltralightSupportCounterInMemory = 1 << 12,
} MfUltralightFeatures;
typedef enum {
MfUltralightMirrorNone,
MfUltralightMirrorUid,
MfUltralightMirrorCounter,
MfUltralightMirrorUidCounter,
} MfUltralightMirrorConf;
typedef struct {
uint8_t header;
uint8_t vendor_id;
uint8_t prod_type;
uint8_t prod_subtype;
uint8_t prod_ver_major;
uint8_t prod_ver_minor;
uint8_t storage_size;
uint8_t protocol_type;
} MfUltralightVersion;
typedef struct {
uint8_t sn0[3];
uint8_t btBCC0;
uint8_t sn1[4];
uint8_t btBCC1;
uint8_t internal;
uint8_t lock[2];
uint8_t otp[4];
} MfUltralightManufacturerBlock;
typedef struct {
MfUltralightType type;
MfUltralightVersion version;
uint8_t signature[32];
uint32_t counter[3];
uint8_t tearing[3];
MfUltralightAuthMethod auth_method;
uint8_t auth_key[4];
bool auth_success;
uint16_t curr_authlim;
uint16_t data_size;
uint8_t data[MF_UL_MAX_DUMP_SIZE];
uint16_t data_read;
} MfUltralightData;
typedef struct __attribute__((packed)) {
union {
uint8_t raw[4];
uint32_t value;
} pwd;
union {
uint8_t raw[2];
uint16_t value;
} pack;
} MfUltralightAuth;
// Common configuration pages for MFUL EV1, NTAG21x, and NTAG I2C Plus
typedef struct __attribute__((packed)) {
union {
uint8_t value;
struct {
uint8_t rfui1 : 2;
bool strg_mod_en : 1;
bool rfui2 : 1;
uint8_t mirror_byte : 2;
MfUltralightMirrorConf mirror_conf : 2;
};
} mirror;
uint8_t rfui1;
uint8_t mirror_page;
uint8_t auth0;
union {
uint8_t value;
struct {
uint8_t authlim : 3;
bool nfc_cnt_pwd_prot : 1;
bool nfc_cnt_en : 1;
bool nfc_dis_sec1 : 1; // NTAG I2C Plus only
bool cfglck : 1;
bool prot : 1;
};
} access;
uint8_t vctid;
uint8_t rfui2[2];
MfUltralightAuth auth_data;
uint8_t rfui3[2];
} MfUltralightConfigPages;
typedef struct {
uint16_t pages_to_read;
int16_t pages_read;
MfUltralightFeatures supported_features;
} MfUltralightReader;
// TODO rework with reader analyzer
typedef void (*MfUltralightAuthReceivedCallback)(MfUltralightAuth auth, void* context);
typedef struct {
MfUltralightData data;
MfUltralightConfigPages* config;
// Most config values don't apply until power cycle, so cache config pages
// for correct behavior
MfUltralightConfigPages config_cache;
MfUltralightFeatures supported_features;
uint16_t page_num;
bool data_changed;
bool comp_write_cmd_started;
uint8_t comp_write_page_addr;
bool auth_success;
uint8_t curr_sector;
bool sector_select_cmd_started;
bool ntag_i2c_plus_sector3_lockout;
bool read_counter_incremented;
bool auth_attempted;
MfUltralightAuth auth_attempt;
// TODO rework with reader analyzer
MfUltralightAuthReceivedCallback auth_received_callback;
void* context;
} MfUltralightEmulator;
void mf_ul_reset(MfUltralightData* data);
bool mf_ul_check_card_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK);
bool mf_ultralight_read_version(
FuriHalNfcTxRxContext* tx_rx,
MfUltralightReader* reader,
MfUltralightData* data);
bool mf_ultralight_read_pages_direct(
FuriHalNfcTxRxContext* tx_rx,
uint8_t start_index,
uint8_t* data);
bool mf_ultralight_read_pages(
FuriHalNfcTxRxContext* tx_rx,
MfUltralightReader* reader,
MfUltralightData* data);
bool mf_ultralight_fast_read_pages(
FuriHalNfcTxRxContext* tx_rx,
MfUltralightReader* reader,
MfUltralightData* data);
bool mf_ultralight_read_signature(FuriHalNfcTxRxContext* tx_rx, MfUltralightData* data);
bool mf_ultralight_read_counters(FuriHalNfcTxRxContext* tx_rx, MfUltralightData* data);
bool mf_ultralight_read_tearing_flags(FuriHalNfcTxRxContext* tx_rx, MfUltralightData* data);
bool mf_ultralight_authenticate(FuriHalNfcTxRxContext* tx_rx, uint32_t key, uint16_t* pack);
MfUltralightConfigPages* mf_ultralight_get_config_pages(MfUltralightData* data);
bool mf_ul_read_card(
FuriHalNfcTxRxContext* tx_rx,
MfUltralightReader* reader,
MfUltralightData* data);
void mf_ul_reset_emulation(MfUltralightEmulator* emulator, bool is_power_cycle);
void mf_ul_prepare_emulation(MfUltralightEmulator* emulator, MfUltralightData* data);
bool mf_ul_prepare_emulation_response(
uint8_t* buff_rx,
uint16_t buff_rx_len,
uint8_t* buff_tx,
uint16_t* buff_tx_len,
uint32_t* data_type,
void* context);
uint32_t mf_ul_pwdgen_amiibo(FuriHalNfcDevData* data);
uint32_t mf_ul_pwdgen_xiaomi(FuriHalNfcDevData* data);
bool mf_ul_is_full_capture(MfUltralightData* data);