From ad629c77e85c0ed27bd548bd69d22b2b6e8dbade Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 29 Aug 2026 14:12:22 +0200 Subject: [PATCH] OLD/MIX convert to NG: Phase C2 --- armsrc/appmain.c | 29 +++++++++++++++++++++++--- armsrc/mifarecmd.c | 2 +- client/src/mifare/mifarehost.c | 37 +++++++++++++++++++++++++--------- include/pm3_cmd.h | 19 +++++++++++++++++ 4 files changed, 74 insertions(+), 13 deletions(-) diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 552f12c10..4ac0105ec 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -2266,7 +2266,12 @@ static void PacketReceived(PacketCommandNG *packet) { break; } case CMD_HF_MIFARE_READSC: { - MifareReadSector(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes); + if (packet->length != sizeof(mf_readsector_t)) { + reply_ng(CMD_HF_MIFARE_READSC, PM3_EINVARG, NULL, 0); + break; + } + mf_readsector_t *payload = (mf_readsector_t *)packet->data.asBytes; + MifareReadSector(payload->sectorno, payload->keytype, payload->key); break; } case CMD_HF_MIFARE_WRITEBL_EX: { @@ -2441,11 +2446,29 @@ static void PacketReceived(PacketCommandNG *packet) { } // Gen 3 magic cards case CMD_HF_MIFARE_GEN3UID: { - MifareGen3UID(packet->oldarg[0], packet->data.asBytes); + if (packet->length < sizeof(mf_gen3uid_t)) { + reply_ng(CMD_HF_MIFARE_GEN3UID, PM3_EINVARG, NULL, 0); + break; + } + mf_gen3uid_t *payload = (mf_gen3uid_t *)packet->data.asBytes; + if (payload->uidlen > (packet->length - sizeof(mf_gen3uid_t))) { + reply_ng(CMD_HF_MIFARE_GEN3UID, PM3_EINVARG, NULL, 0); + break; + } + MifareGen3UID(payload->uidlen, payload->uid); break; } case CMD_HF_MIFARE_GEN3BLK: { - MifareGen3Blk(packet->oldarg[0], packet->data.asBytes); + if (packet->length < sizeof(mf_gen3blk_t)) { + reply_ng(CMD_HF_MIFARE_GEN3BLK, PM3_EINVARG, NULL, 0); + break; + } + mf_gen3blk_t *payload = (mf_gen3blk_t *)packet->data.asBytes; + if (payload->blocklen > (packet->length - sizeof(mf_gen3blk_t))) { + reply_ng(CMD_HF_MIFARE_GEN3BLK, PM3_EINVARG, NULL, 0); + break; + } + MifareGen3Blk(payload->blocklen, payload->block); break; } case CMD_HF_MIFARE_GEN3FREEZ: { diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index 014ab345e..27c06a390 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -254,7 +254,7 @@ void MifareReadSector(uint8_t sector_no, uint8_t key_type, uint8_t *key) { uint8_t outbuf[16 * 16]; int16_t retval = mifare_cmd_readblocks(MF_WAKE_WUPA, MIFARE_AUTH_KEYA + (key_type & 0xF), key, ISO14443A_CMD_READBLOCK, block_no, num_blocks, outbuf); - reply_old(CMD_ACK, retval == PM3_SUCCESS, 0, 0, outbuf, 16 * num_blocks); + reply_ng(CMD_HF_MIFARE_READSC, retval, outbuf, MIFARE_BLOCK_SIZE * num_blocks); } static int MifareUFastRead0(void) { diff --git a/client/src/mifare/mifarehost.c b/client/src/mifare/mifarehost.c index e0f182e76..9892c1d5e 100644 --- a/client/src/mifare/mifarehost.c +++ b/client/src/mifare/mifarehost.c @@ -979,14 +979,23 @@ out: // MIFARE int mf_read_sector(uint8_t sectorNo, uint8_t keyType, const uint8_t *key, uint8_t *data) { - clearCommandBuffer(); - SendCommandMIX(CMD_HF_MIFARE_READSC, sectorNo, keyType, 0, (uint8_t *)key, MIFARE_KEY_SIZE); - PacketResponseNG resp; - if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { - uint8_t isOK = resp.oldarg[0] & 0xFF; + mf_readsector_t payload = { + .sectorno = sectorNo, + .keytype = keyType, + }; + memcpy(payload.key, key, MIFARE_KEY_SIZE); - if (isOK) { - memcpy(data, resp.data.asBytes, mfNumBlocksPerSector(sectorNo) * MFBLOCK_SIZE); + clearCommandBuffer(); + SendCommandNG(CMD_HF_MIFARE_READSC, (uint8_t *)&payload, sizeof(payload)); + PacketResponseNG resp; + if (WaitForResponseTimeout(CMD_HF_MIFARE_READSC, &resp, 1500)) { + + if (resp.status == PM3_SUCCESS) { + size_t need = mfNumBlocksPerSector(sectorNo) * MFBLOCK_SIZE; + if (resp.length < need) { + return PM3_EUNDEF; + } + memcpy(data, resp.data.asBytes, need); return PM3_SUCCESS; } else { return PM3_EUNDEF; @@ -1309,8 +1318,13 @@ int mf_chinese_get_block(uint8_t blockNo, uint8_t *data, uint8_t params) { } int mf_chinese_gen_3_uid(uint8_t *uid, uint8_t uidlen, uint8_t *oldUid) { + uint8_t buf[PM3_CMD_DATA_SIZE] = {0}; + mf_gen3uid_t *payload = (mf_gen3uid_t *)buf; + payload->uidlen = uidlen; + memcpy(payload->uid, uid, uidlen); + clearCommandBuffer(); - SendCommandMIX(CMD_HF_MIFARE_GEN3UID, uidlen, 0, 0, uid, uidlen); + SendCommandNG(CMD_HF_MIFARE_GEN3UID, buf, sizeof(mf_gen3uid_t) + uidlen); PacketResponseNG resp; if (WaitForResponseTimeout(CMD_HF_MIFARE_GEN3UID, &resp, 3500)) { if (resp.status == PM3_SUCCESS && oldUid) { @@ -1324,8 +1338,13 @@ int mf_chinese_gen_3_uid(uint8_t *uid, uint8_t uidlen, uint8_t *oldUid) { } int mf_chinese_gen_3_block(uint8_t *block, int blockLen, uint8_t *newBlock) { + uint8_t buf[PM3_CMD_DATA_SIZE] = {0}; + mf_gen3blk_t *payload = (mf_gen3blk_t *)buf; + payload->blocklen = blockLen; + memcpy(payload->block, block, MFBLOCK_SIZE); + clearCommandBuffer(); - SendCommandMIX(CMD_HF_MIFARE_GEN3BLK, blockLen, 0, 0, block, MFBLOCK_SIZE); + SendCommandNG(CMD_HF_MIFARE_GEN3BLK, buf, sizeof(mf_gen3blk_t) + MFBLOCK_SIZE); PacketResponseNG resp; if (WaitForResponseTimeout(CMD_HF_MIFARE_GEN3BLK, &resp, 3500) == false) { PrintAndLogEx(WARNING, "command execution time out"); diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index f56d11e74..84b578183 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -392,6 +392,25 @@ typedef struct { uint8_t key[6]; } PACKED mfc_eload_t; +// CMD_HF_MIFARE_READSC payload +typedef struct { + uint8_t sectorno; + uint8_t keytype; + uint8_t key[6]; +} PACKED mf_readsector_t; + +// CMD_HF_MIFARE_GEN3UID payload +typedef struct { + uint8_t uidlen; + uint8_t uid[]; +} PACKED mf_gen3uid_t; + +// CMD_HF_MIFARE_GEN3BLK payload +typedef struct { + uint8_t blocklen; + uint8_t block[]; +} PACKED mf_gen3blk_t; + typedef struct { uint16_t turn_off_field : 1; uint16_t try_auth : 1;