dandri/proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-10-15 13:20:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix CEP reply corruption: move payload memset after time-critical reads

Browse Source 
receive_ng_internal() zeroed rx->data (up to PM3_CMD_DATA_SIZE bytes)
between the preamble read and the payload read. CEP's SPI1 receiver has
no FIFO (single-byte holding register), so that stall lost bytes on every
frame - confirmed via logic analyzer (wire content byte-perfect) plus
Dbprintf instrumentation showing the payload read consistently short by
half. Reordered so preamble/payload/postamble/CRC are all read back-to-back
before any memset/memcpy happens. USB/FPC/BWM are unaffected: same total
work, just resequenced.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Tom Harkness
2026-09-28 21:27:50 +02:00
committed by Philippe Teuwen
co-authored by Claude Sonnet 5
parent 23d57af8bd
commit e6d7cd1f9d
2 changed files with 26 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1
View File
@@ -13,6 +13,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
- Fixed `lf t55xx p1detect`, `lf search` - T5577 clones with a non-Atmel manufacturer byte now recognised (@iceman1001)
- Added Flipper Zero link on PM5's Type-C extended port (handshake + NG frames over SPI) - on by default, `PLATFORM_EXTRAS=SKIP_CEP` to disable, independent so it can run alongside BWM; RF-dependent functionality still needs the FPGA side, tracked in #3667 (@TomHarkness)
- Fixed PM5 CEP hang - missing `StartTicks()` before `I2C_init()` in `cep_attach_poll()`/`cep_init()` could freeze the main loop, e.g. during `hf search` (@TomHarkness)
- Fixed PM5 CEP reply corruption - `receive_ng()` zeroed the payload buffer between two time-critical SPI reads, losing bytes on CEP's FIFO-less receiver (@TomHarkness)
- Fixed `hf mf autopwn` on FM11RF08S - static encrypted nonce is now detected via the backdoor key (@iceman1001)
- Added `hf mfu view -v` - prints the UL-C 3DES key or UL-AES key stored in the dump file (@iceman1001)
- Added `hf mf sen --ns` - skip writing the key and dump files (@iceman1001)
armsrc/cmd.c
+25 -23
View File
@@ -217,13 +217,6 @@ static int receive_ng_internal(PacketCommandNG *rx, uint32_t read_ng(uint8_t *da
return PM3_EIO;
}
// Zero the payload only once a packet is really coming in: doing it for
// every idle poll of the main loop cost more than the rest of the loop.
// Both branches below leave the tail of data untouched -- an NG command
// fills only its own length, and an old style one only PM3_CMD_DATA_SIZE_OLD
// -- so what is not written has to start at zero.
memset(&rx->data, 0, sizeof(rx->data));
rx->magic = rx_raw.pre.magic;
rx->ng = rx_raw.pre.ng;
rx->cmd = rx_raw.pre.cmd;
@@ -241,6 +234,30 @@ static int receive_ng_internal(PacketCommandNG *rx, uint32_t read_ng(uint8_t *da
return PM3_EIO;
}
// Get the postamble
bytes = read_ng((uint8_t *)&rx_raw.foopost, sizeof(PacketCommandNGPostamble));
if (bytes != sizeof(PacketCommandNGPostamble)) {
return PM3_EIO;
}
// Check CRC, accept MAGIC as placeholder
rx->crc = rx_raw.foopost.crc;
if (rx->crc != COMMANDNG_POSTAMBLE_MAGIC) {
uint8_t first, second;
compute_crc(CRC_14443_A, (uint8_t *)&rx_raw, sizeof(PacketCommandNGPreamble) + length, &first, &second);
if ((first << 8) + second != rx->crc) {
return PM3_EIO;
}
}
// Zero the payload only once a packet is really coming in, and only
// after all wire reads: CEP's SPI receiver has no FIFO, so a stall
// between reads (this memset touches up to PM3_CMD_DATA_SIZE bytes)
// loses data. Both branches leave the tail of data untouched -- an
// NG command fills only its own length, an old style one only
// PM3_CMD_DATA_SIZE_OLD -- so what is not written has to start zero.
memset(&rx->data, 0, sizeof(rx->data));
if (rx->ng) {
memcpy(rx->data.asBytes, rx_raw.data, length);
rx->length = length;
@@ -258,22 +275,6 @@ static int receive_ng_internal(PacketCommandNG *rx, uint32_t read_ng(uint8_t *da
rx->length = length - sizeof(arg);
}
// Get the postamble
bytes = read_ng((uint8_t *)&rx_raw.foopost, sizeof(PacketCommandNGPostamble));
if (bytes != sizeof(PacketCommandNGPostamble)) {
return PM3_EIO;
}
// Check CRC, accept MAGIC as placeholder
rx->crc = rx_raw.foopost.crc;
if (rx->crc != COMMANDNG_POSTAMBLE_MAGIC) {
uint8_t first, second;
compute_crc(CRC_14443_A, (uint8_t *)&rx_raw, sizeof(PacketCommandNGPreamble) + length, &first, &second);
if ((first << 8) + second != rx->crc) {
return PM3_EIO;
}
}
g_reply_via_usb = usb;
g_reply_via_fpc = fpc;
g_reply_via_cep = cep;
@@ -297,6 +298,7 @@ static int receive_ng_internal(PacketCommandNG *rx, uint32_t read_ng(uint8_t *da
rx->oldarg[1] = rx_old.arg[1];
rx->oldarg[2] = rx_old.arg[2];
rx->length = PM3_CMD_DATA_SIZE_OLD;
memset(&rx->data, 0, sizeof(rx->data));
memcpy(&rx->data, &rx_old.d.asBytes, rx->length);
}
return PM3_SUCCESS;