From 80388c8fea6cc7dd5ae1e5d0de990249a49dc34b Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 29 Aug 2026 06:53:58 +0200 Subject: [PATCH] adapt tear off parameter to handle limits correct --- armsrc/mifarecmd.c | 16 ++++++++++++---- client/src/cmdhficlass.c | 4 ++-- client/src/cmdhfmfu.c | 8 ++++---- client/src/cmdhw.c | 11 +++++++---- 4 files changed, 25 insertions(+), 14 deletions(-) diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index 3dabebad1..014ab345e 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -4101,8 +4101,12 @@ void MifareU_Otp_Tearoff(uint8_t blno, uint32_t tearoff_time, uint8_t *data_test if (g_dbglevel >= DBG_DEBUG) DbpString("Preparing OTP tear-off"); - if (tearoff_time > 43000) { - tearoff_time = 43000; + // Was 43000: past that the PWM tick count wrapped into 16 bits and the + // delay silently came up short. SpinDelayUsPrecision() chunks long waits + // now, so the ceiling is the host side one (uint16 us) rather than a + // property of the timer. + if (tearoff_time > 65535) { + tearoff_time = 65535; } g_tearoff_delay_us = tearoff_time; @@ -4140,8 +4144,12 @@ void MifareU_Otp_Tearoff(uint8_t blno, uint32_t tearoff_time, uint8_t *data_test // Tear-off attack against MFU counter void MifareU_Counter_Tearoff(uint8_t counter, uint32_t tearoff_time, uint8_t *datain) { - if (tearoff_time > 43000) { - tearoff_time = 43000; + // Was 43000: past that the PWM tick count wrapped into 16 bits and the + // delay silently came up short. SpinDelayUsPrecision() chunks long waits + // now, so the ceiling is the host side one (uint16 us) rather than a + // property of the timer. + if (tearoff_time > 65535) { + tearoff_time = 65535; } LEDsoff(); diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 4e915948b..d8c8482d2 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -3956,7 +3956,7 @@ static int CmdHFiClass_TearBlock(const char *Cmd) { arg_lit0(NULL, "nr", "replay of NR/MAC"), arg_lit0("v", "verbose", "verbose output"), arg_lit0(NULL, "shallow", "use shallow (ASK) reader modulation instead of OOK"), - arg_int1("s", NULL, "", "tearoff delay start (in us) must be between 1 and 43000 (43ms). Precision is about 1/3 us"), + arg_int1("s", NULL, "", "tearoff delay start (in us) must be between 1 and 65535 (65ms). Precision is about 1/3 us"), arg_int0("i", NULL, "", "tearoff delay increment (in us) - default 10"), arg_int0("e", NULL, "", "tearoff delay end (in us) must be a higher value than the start delay"), arg_int0(NULL, "loop", "", "number of times to loop per tearoff time"), @@ -4532,7 +4532,7 @@ static int CmdHFiClass_BlackTears(const char *Cmd) { arg_str0("k", "key", "", "Access key as 8 hex bytes"), arg_int0(NULL, "ki", "", "Key index to select key from memory 'hf iclass managekeys'"), arg_lit0(NULL, "credit", "key is assumed to be the credit key"), - arg_int0("s", NULL, "", "tearoff delay start (in us) must be between 1 and 43000 (43ms). Precision is about 1/3 us"), + arg_int0("s", NULL, "", "tearoff delay start (in us) must be between 1 and 65535 (65ms). Precision is about 1/3 us"), arg_int0("i", NULL, "", "tearoff delay increment (in us) - default 5"), arg_int0("e", NULL, "", "tearoff delay end (in us) must be a higher value than the start delay"), arg_str0("o", "otp", "", "Custom OTP value as 2 hex bytes"), diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c index 1b307e2bd..681e50739 100644 --- a/client/src/cmdhfmfu.c +++ b/client/src/cmdhfmfu.c @@ -6395,8 +6395,8 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) { PrintAndLogEx(WARNING, "end time smaller than increase value"); return PM3_EINVARG; } - if (end > 43000) { - PrintAndLogEx(WARNING, "end time - out of 1 .. 43000 range"); + if (end > 65535) { + PrintAndLogEx(WARNING, "end time - out of 1 .. 65535 range"); return PM3_EINVARG; } if (start > (end - steps)) { @@ -6703,8 +6703,8 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { PrintAndLogEx(WARNING, "Wrong time limit number"); return PM3_EINVARG; } - if (time_limit > 43000) { - PrintAndLogEx(WARNING, "You can't set delay out of 1..43000 range!"); + if (time_limit > 65535) { + PrintAndLogEx(WARNING, "You can't set delay out of 1..65535 range!"); return PM3_EINVARG; } uint8_t cnt_no = 0; diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c index d73c61301..e495e61f6 100644 --- a/client/src/cmdhw.c +++ b/client/src/cmdhw.c @@ -1421,7 +1421,7 @@ static int CmdTearoff(const char *Cmd) { CLIParserInit(&ctx, "hw tearoff", "Configure a tear-off hook for the next write command supporting tear-off\n" "After having been triggered by a write command, the tear-off hook is deactivated\n" - "Delay (in us) must be between 1 and 43000 (43ms). Precision is about 1/3us.", + "Delay (in us) must be between 1 and 65535 (65ms). Precision is about 1/3us.", "hw tearoff --delay 1200 --> define delay of 1200us\n" "hw tearoff --on --> (re)activate a previously defined delay\n" "hw tearoff --off --> deactivate a previously activated but not yet triggered hook\n" @@ -1429,7 +1429,7 @@ static int CmdTearoff(const char *Cmd) { void *argtable[] = { arg_param_begin, - arg_int0(NULL, "delay", "", "Delay in us before triggering tear-off, must be between 1 and 43000"), + arg_int0(NULL, "delay", "", "Delay in us before triggering tear-off, must be between 1 and 65535"), arg_lit0(NULL, "on", "Activate tear-off hook"), arg_lit0(NULL, "off", "Deactivate tear-off hook"), arg_int0(NULL, "skip", "", "Skip N triggers before activating the hook"), @@ -1476,8 +1476,11 @@ static int CmdTearoff(const char *Cmd) { } if (delay != -1) { - if ((delay < 1) || (delay > 43000)) { - PrintAndLogEx(WARNING, "You can't set delay out of 1..43000 range!"); + // 65535 is where tearoff_params_t.delay_us runs out, not where the + // timer does. The old 43000 was the point past which the PWM tick + // count wrapped into 16 bits and the delay silently came up short. + if ((delay < 1) || (delay > 65535)) { + PrintAndLogEx(WARNING, "You can't set delay out of 1..65535 range!"); return PM3_EINVARG; } } else {