Commit Graph
111 Commits
Author SHA1 Message Date
GameTec-live ea2a9410b3 Merge branch 'main' into fix-senested-key-recovery 2025-09-02 19:40:39 +02:00
Derek Jamison 8c670f8554 Add LF Viking support 2025-08-29 11:00:02 -04:00
jekkos 62e904f114 Fix for static nested key recovery
When runnin static nested recovery, we run into a sector auth faild
error that stops the recovery process. Add a try/execpt handler so we
can continue to try all possibitlities
2025-08-28 21:55:06 +02:00
GameTec-live 09870c3fc5 Merge pull request #276 from Foxushka/ultralight-key-log
Mifare Ultralight key logger from reader
2025-08-19 19:59:39 +02:00
GameTec-live 039c54a62f Merge pull request #279 from TeCHiScy/hidcopy
feat: offline HIDProx tag copy
2025-08-14 07:25:30 +02:00
TeCHiScy b4c1c63698 feat: offline HIDProx tag copy
- refines comments
- use unified code for `lf tag not found` error
- merge lf_em410x_data.h & lf_hidprox_data.h, remove unused macros
- split btn_fn_copy_ic_uid as btn_fn_copy_lf & btn_fn_copy_hf
- fixes offline em410x tag copy not working
- fixes conflict SAADC usage between battery level service & lf fsk demodulator
2025-08-11 21:01:04 +08:00
Foxushka dc28a82b19 Mifare Ultralight key logger from reader 2025-08-10 21:39:08 +03:00
unkernet 89e098c773 Make CLI compatible with Python 3.9
- Replace Python 3.10+ type hint syntax (`int | None`) with  `Union[int, None]`.
- Add explicit `byteorder='big'` argument to all `int.from_bytes()` calls.
2025-08-10 14:44:40 +07:00
TeCHiScy 098e0a914b feat: add lf HIDProx read, t55xx write, emulate function (#267)
* feat: add lf HIDProx read, t55xx write, emulate function

code quaility:
- consistance: simulation -> emulation, label -> tag
- machine translated unreadable comments are made native

logic:
- newly added cli command includes: `lf hid prox read`, `lf hid prox write`, `lf hid prox econfig`
- machester demodulator is simplified
- various wiegand formats of HIDProx are supported
- goertzel algorithm is used in  HIDProx FSK demod
- lf read is refactored using stream/feed pattern to boost scan speed
- t55xx write is refactored to share same logic between em410x & HIDProx
- lf emulating is refactored to use PWM peripheral, allowing more card type to be added

closes: #212, #210

* chore: remove not implemented wiegand format comments

* fix: build ci

* fix: build ci

* fix: build ci

* fix: build ci
2025-08-04 07:01:53 +02:00
Foxushka cf00761902 Key recovery via backdoor for static encrypted nonce cards (#263)
* Implement MF1_ENC_NESTED_ACQUIRE in firmware

* Implement MF1_ENC_NESTED_ACQUIRE in software + fix code formatter

* Remove xz and pthreads from sources, use CMake FetchContent

* Update changelog

* lzma.h

* Update CMakeLists.txt

* Update CMakeLists.txt

* Probably fix workflow taking wrong commit for building

* Fix CMake building tools into bin/Debug on Windows

* Added cmd for fetching all slots nicks (without 16 commands)

* Fix type and use temp directory instead cwd (https://github.com/RfidResearchGroup/ChameleonUltra/pull/261)

* Fix endian for mfu_read_emu_counter_data and mfu_write_emu_counter_data

* Fix  --key interpreted as list
2025-08-01 22:12:07 +02:00
AbyssAndromaliusandAbyssAndromalius 303d2d31e1 Mifare Ultralight - Shadowmode (#251)
* Adding shadow mode to UltraLight

* Syncing with main repos

---------

Co-authored-by: AbyssAndromalius <abyss@barbed.fr>
2025-04-21 18:04:24 +02:00
zeusricote 2b0d02f12e complete hardnested attack implementation (#254)
* hardnested test fixed, increased timeout on mf1_hard_nested_acquire to fix cmd exec timeout on clone

* hardnested recovery(cli command not yet ready), based in noproto/HardnestedRecovery

* removed compiled binary

* Hardnested cli ready

* removed some unnecesary files

* removed unnecesary cached files

* cmake now builds hardnested too

* removed license.md

* added liblzma source(should fix checks not passing)

* i missed a line

* trimmed xz sources

* cmake now links local liblzma.a

* third try(warning solved)

* cmake now builds and links correcctly liblzma.a

* xz-5.8.1 vfolder renamed to xz

* fixed paths

* runner test

* removed wrong placed check

* disable landlock under windows

* missing files

* missing files

* windows strtok fix

* corrected lzma path under windows

* fix

* set release config for liblzma

* corrected path

* trailing_zeros

* msclock

* msclock integer issue

* msclock missing header

* fallback if not using msvc

* deleted include by accident

* revert clock change

* change custom target for custom command

* windows fmemopen implementation

* wrong path

* wrong name

* use fmemopen only when not using msvc

* use fmemopen.h when building on windows, non msvc

* re-add static link

* wrong filename

* pthread handling for mingw(proxspace)

* cleanup
2025-04-18 23:53:25 +02:00
dxl 3f6f5ac9c1 Hardnested nonces acquire implemented. 2025-04-02 12:32:27 +08:00
dxl a4b3adad48 Reuse the 'STATUS_PAR_ERR' & Add an interface
1. Added 'cmd_processor_mf0_ntag_get_emu_page_count' interface to get available page count of mf0.
2. We can reuse the 'STATUS_PAR_ERR', and we can delete repeated cmd 'STATUS_INVALID_PARAMS'.
2024-07-16 12:47:47 +08:00
turbocool3r 607df41bca Add a command to reset MF0 / NTAG unsuccessful auth counter. 2024-07-09 21:30:27 +03:00
turbocool3r 0ce920cfcc Add hf mfu ercnt/ewcnt commands for reading and writing emulator's counters. 2024-07-09 17:11:42 +03:00
turbocool3r 37f2b0783c Add hf mfu eload command. 2024-07-08 00:33:33 +03:00
turbocool3r 297cb061cb Add support for custom version and signature data for MF0 / NTAG emulator. 2024-07-05 16:30:38 +03:00
turbocool3r eafa14e4e5 Add hf mfu eview command. 2024-07-05 03:32:23 +03:00
turbocool3r 9488127531 Add commands for reading and writing to/from MF0/NTAG emulator memory. 2024-07-05 02:58:15 +03:00
turbocool3r 248f3b2839 Add support for Ultralight emulation.
This version only emulates MF0ICU1 properly.
2024-06-19 22:55:43 +03:00
戴均民 c1eb213d4a Added command to check keys of multiple sectors at once (#199)
thx @taichunmin
2024-03-07 15:07:12 +08:00
taichunmin e79568298f Added support for mifare classic value block operations 2023-11-13 23:38:56 +08:00
Philippe Teuwen ece5e79060 typechecking fixes 2023-10-24 23:44:56 +02:00
Philippe Teuwen d77e166249 pep287 2023-10-24 00:57:44 +02:00
Philippe Teuwen ff3df15278 misc lint 2023-10-23 23:57:23 +02:00
Philippe Teuwen fa0754aed2 cli: make status an enum. rename some status for consistency 2023-10-17 23:43:25 +02:00
Philippe Teuwen 830ba98721 cli: move enums to new file 2023-10-15 01:17:34 +02:00
Philippe Teuwen 75e368da62 cli: hf mf econfig, hf mfu econfig (wip), fix dumphelp 2023-10-09 21:23:17 +02:00
Philippe Teuwen 2f4d84ed2c cli: clean enums 2023-10-08 21:17:57 +02:00
Philippe Teuwen deb6684c0d cli: enum for key type A/B, prepare hf mf auth args 2023-10-08 21:12:52 +02:00
Philippe Teuwen dcebc89654 cli: Command enum 2023-10-08 16:48:29 +02:00
Philippe Teuwen 1da470b8fe cli: hw settings btnpress 2023-10-08 14:20:09 +02:00
Philippe Teuwen 45deb30d4a cli: hw settings btnpress WIP 2023-10-08 13:55:18 +02:00
Philippe Teuwen a47e9b8b03 cli: remove unused TagSenseType list 2023-10-08 12:46:24 +02:00
Philippe Teuwen 18a1770c80 cli: hw settings animation/bleclearbonds, hw factory_reset and hw settings bleclearbonds with --force 2023-10-08 12:02:28 +02:00
Philippe Teuwen 3aa73a2def cli: metavar, simplify enums, replace tag types int by keywords 2023-10-07 23:54:13 +02:00
Philippe Teuwen 702dba0d93 Added button action to show battery level 2023-10-04 19:36:33 +02:00
Philippe Teuwen 0d2c3fae89 hw settings btnpress set: tolerate A/B/a/b for button 2023-10-04 18:53:55 +02:00
Philippe Teuwen 6915ee19a4 New DELETE_SLOT_TAG_NICK 2023-09-27 23:09:59 +02:00
Philippe Teuwen 372cfead0c style 2023-09-25 00:51:43 +02:00
Philippe Teuwen 313d772a99 hf14a_raw: use @expect_response and fix tests 2023-09-24 22:30:50 +02:00
Philippe Teuwen 1dc8891e1b Fix shadow mode not being preserved. Breaking change:
nfc_tag_mf1_write_mode_t has one new mode SHADOW_REQ.
Client can set SHADOW or SHADOW_REQ, internally it will be transformed to SHADOW_REQ.
When it's time to save data, if SHADOW_REQ, the fw will change it to SHADOW and still allow to save the data before acting as shadow.
Breaking: when client reads back MF1 write mode just after settings SHADOW and before saving config, it will receive SHADOW_REQ and must be ready to handle this new enum value.
2023-09-24 19:01:20 +02:00
Philippe Teuwen 941d42561a MF1_DETECT_SUPPORT: remove redundant data
cf https://github.com/RfidResearchGroup/ChameleonUltra/pull/147#issuecomment-1732338315
2023-09-24 01:49:26 +02:00
Philippe Teuwen f7db6d0fb3 hw 14a raw: closer to pm3 syntax, removed bit_frame,...
Now data length is always in bits
Option -o => -a and only needed to turn field on without select or data
Reorganize pcd_14a_reader_raw_cmd
Some more checks
2023-09-24 01:02:30 +02:00
Philippe Teuwen 7da58bbce8 new tag_specific_type_t enum, new slotConfig struct. FW will take care of existing slots. Disruptive changes: see below
Disruptive changes:
- tag types are 2-byte long with new values
- GET_SLOT_INFO returns 32 bytes as tag types are now 2-byte long
- "enable" is not common to one slot anymore but bound to the HF or LF part
- GET_ENABLED_SLOTS returns 16 bytes as we get "enabled_hf" and "enabled_lf" for each slot
- SET_SLOT_ENABLE needs 3 bytes slot_number|sense_type|enable as we need to specify to enable HF or LF
- slotConfig changed a lot but this is internal to the fw and its flash and a function does the format conversion on first boot after flash
  so slot data is preserved on fw upgrade, but if one downgrades to a previous version, data will be erased.
2023-09-23 21:34:15 +02:00
dxl 879b8e3459 Implemented hf 14a raw 2023-09-21 18:30:05 +08:00
Philippe Teuwen 14bffafb2a style 2023-09-20 01:26:47 +02:00
Philippe Teuwen 5a9d49ddb4 Remove unused MF1_DETECT_DARKSIDE, reallocate 2003 to MF1_STATIC_NESTED_ACQUIRE
MF1_DETECT_DARKSIDE was actually runnign the full attack, as there is no quick way to detect Darkside
So if you want to check for Darkside, just run directly MF1_DARKSIDE_ACQUIRE.
2023-09-19 16:03:20 +02:00
dxl 32b3e19279 Added support for StaticNested(FastDecrypt). 2023-09-19 18:24:30 +08:00