adapt tear off parameter to handle limits correct

armsrc/mifarecmd.c

@@ -4101,8 +4101,12 @@ void MifareU_Otp_Tearoff(uint8_t blno, uint32_t tearoff_time, uint8_t *data_test
 
     if (g_dbglevel >= DBG_DEBUG) DbpString("Preparing OTP tear-off");
 
-    if (tearoff_time > 43000) {
-        tearoff_time = 43000;
+    // Was 43000: past that the PWM tick count wrapped into 16 bits and the
+    // delay silently came up short. SpinDelayUsPrecision() chunks long waits
+    // now, so the ceiling is the host side one (uint16 us) rather than a
+    // property of the timer.
+    if (tearoff_time > 65535) {
+        tearoff_time = 65535;
     }
 
     g_tearoff_delay_us = tearoff_time;
@@ -4140,8 +4144,12 @@ void MifareU_Otp_Tearoff(uint8_t blno, uint32_t tearoff_time, uint8_t *data_test
 // Tear-off attack against MFU counter
 void MifareU_Counter_Tearoff(uint8_t counter, uint32_t tearoff_time, uint8_t *datain) {
 
-    if (tearoff_time > 43000) {
-        tearoff_time = 43000;
+    // Was 43000: past that the PWM tick count wrapped into 16 bits and the
+    // delay silently came up short. SpinDelayUsPrecision() chunks long waits
+    // now, so the ceiling is the host side one (uint16 us) rather than a
+    // property of the timer.
+    if (tearoff_time > 65535) {
+        tearoff_time = 65535;
     }
 
     LEDsoff();

client/src/cmdhficlass.c

@@ -3956,7 +3956,7 @@ static int CmdHFiClass_TearBlock(const char *Cmd) {
         arg_lit0(NULL, "nr", "replay of NR/MAC"),
         arg_lit0("v", "verbose", "verbose output"),
         arg_lit0(NULL, "shallow", "use shallow (ASK) reader modulation instead of OOK"),
-        arg_int1("s", NULL, "<dec>", "tearoff delay start (in us) must be between 1 and 43000 (43ms). Precision is about 1/3 us"),
+        arg_int1("s", NULL, "<dec>", "tearoff delay start (in us) must be between 1 and 65535 (65ms). Precision is about 1/3 us"),
         arg_int0("i", NULL, "<dec>", "tearoff delay increment (in us) - default 10"),
         arg_int0("e", NULL, "<dec>", "tearoff delay end (in us) must be a higher value than the start delay"),
         arg_int0(NULL, "loop", "<dec>", "number of times to loop per tearoff time"),
@@ -4532,7 +4532,7 @@ static int CmdHFiClass_BlackTears(const char *Cmd) {
         arg_str0("k", "key", "<hex>", "Access key as 8 hex bytes"),
         arg_int0(NULL, "ki", "<dec>", "Key index to select key from memory 'hf iclass managekeys'"),
         arg_lit0(NULL, "credit", "key is assumed to be the credit key"),
-        arg_int0("s", NULL, "<dec>", "tearoff delay start (in us) must be between 1 and 43000 (43ms). Precision is about 1/3 us"),
+        arg_int0("s", NULL, "<dec>", "tearoff delay start (in us) must be between 1 and 65535 (65ms). Precision is about 1/3 us"),
         arg_int0("i", NULL, "<dec>", "tearoff delay increment (in us) - default 5"),
         arg_int0("e", NULL, "<dec>", "tearoff delay end (in us) must be a higher value than the start delay"),
         arg_str0("o", "otp", "<hex>", "Custom OTP value as 2 hex bytes"),

client/src/cmdhfmfu.c

@@ -6395,8 +6395,8 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
         PrintAndLogEx(WARNING, "end time smaller than increase value");
         return PM3_EINVARG;
     }
-    if (end > 43000) {
-        PrintAndLogEx(WARNING, "end time - out of 1 .. 43000 range");
+    if (end > 65535) {
+        PrintAndLogEx(WARNING, "end time - out of 1 .. 65535 range");
         return PM3_EINVARG;
     }
     if (start > (end - steps)) {
@@ -6703,8 +6703,8 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) {
         PrintAndLogEx(WARNING, "Wrong time limit number");
         return PM3_EINVARG;
     }
-    if (time_limit > 43000) {
-        PrintAndLogEx(WARNING, "You can't set delay out of 1..43000 range!");
+    if (time_limit > 65535) {
+        PrintAndLogEx(WARNING, "You can't set delay out of 1..65535 range!");
         return PM3_EINVARG;
     }
     uint8_t cnt_no = 0;

client/src/cmdhw.c

@@ -1421,7 +1421,7 @@ static int CmdTearoff(const char *Cmd) {
     CLIParserInit(&ctx, "hw tearoff",
                   "Configure a tear-off hook for the next write command supporting tear-off\n"
                   "After having been triggered by a write command, the tear-off hook is deactivated\n"
-                  "Delay (in us) must be between 1 and 43000 (43ms). Precision is about 1/3us.",
+                  "Delay (in us) must be between 1 and 65535 (65ms). Precision is about 1/3us.",
                   "hw tearoff --delay 1200 --> define delay of 1200us\n"
                   "hw tearoff --on --> (re)activate a previously defined delay\n"
                   "hw tearoff --off --> deactivate a previously activated but not yet triggered hook\n"
@@ -1429,7 +1429,7 @@ static int CmdTearoff(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_int0(NULL, "delay", "<dec>", "Delay in us before triggering tear-off, must be between 1 and 43000"),
+        arg_int0(NULL, "delay", "<dec>", "Delay in us before triggering tear-off, must be between 1 and 65535"),
         arg_lit0(NULL, "on", "Activate tear-off hook"),
         arg_lit0(NULL, "off", "Deactivate tear-off hook"),
         arg_int0(NULL, "skip", "<dec>", "Skip N triggers before activating the hook"),
@@ -1476,8 +1476,11 @@ static int CmdTearoff(const char *Cmd) {
     }
 
     if (delay != -1) {
-        if ((delay < 1) || (delay > 43000)) {
-            PrintAndLogEx(WARNING, "You can't set delay out of 1..43000 range!");
+        // 65535 is where tearoff_params_t.delay_us runs out, not where the
+        // timer does. The old 43000 was the point past which the PWM tick
+        // count wrapped into 16 bits and the delay silently came up short.
+        if ((delay < 1) || (delay > 65535)) {
+            PrintAndLogEx(WARNING, "You can't set delay out of 1..65535 range!");
             return PM3_EINVARG;
         }
     } else {