Iceman and GitHub
8b59f23bca
Merge pull request #3376 from kormax/felica-sim
...
Add `hf felica sim` command
2026-06-12 18:53:13 +02:00
Sanduuz
e83e2e58a3
Add missing files to CMakeLists for experimental client lib
2026-06-12 19:02:54 +03:00
kormax
4ad136b5db
Implement 'hf felica sim' command
2026-06-12 18:31:57 +03:00
kormax
0f2a56cdec
Add container issue information to 'hf felica dump'
2026-06-12 05:45:01 +03:00
kormax
3e86f39978
Add product information to 'hf felica dump'
2026-06-12 05:35:01 +03:00
kormax
35869128e5
Add specification version to 'hf felica dump'
2026-06-12 05:28:01 +03:00
kormax
2ac41a3d90
Add system node discovery to 'hf felica dump'
2026-06-12 05:13:01 +03:00
kormax
32a110db1a
Add support for generating dump files in 'hf felica dump'
2026-06-11 21:40:17 +03:00
kormax
fee86ca374
Add support for dumping multiple systems in 'hf felica dump'
2026-06-08 19:12:35 +03:00
Iceman and GitHub
1121063eee
Merge pull request #3357 from AlxCzl/mad-ops-revamp
...
Add a global mad command
2026-06-10 17:14:53 +02:00
Philippe Teuwen
410769e463
counterfeit ULC: remove legacy poc
2026-06-10 08:05:15 +02:00
Philippe Teuwen
652602d23c
Fix alignment warning
2026-06-10 01:16:14 +02:00
Philippe Teuwen
184a957436
counterfeit ULC: add support to auth with nonce pairs
2026-06-10 01:02:14 +02:00
Philippe Teuwen
607737e52e
counterfeit ULC: need to merge nonce collection in auth logic for proper timings
2026-06-10 00:39:46 +02:00
Philippe Teuwen
6d8ed745fd
counterfeit ULC: misc tuning
2026-06-10 00:39:46 +02:00
achazal
36fac3f647
mad: restore fixes lost during rebase (e.g. harden callers, fix MAD2 read gating...)
2026-06-09 19:08:58 +02:00
achazal
d6ed3c18c2
mad: Add unified MAD read/write/verify with ops struct abstraction
2026-06-09 18:48:25 +02:00
Iceman and GitHub
d9265ad813
Merge pull request #3369 from dangerous-tac0s/15693-inventory-enhancements
...
15693 inventory enhancements
2026-06-09 07:59:40 +02:00
CinderSocket
0791bcc32c
fix-emulator-hardening
2026-06-08 18:08:26 -07:00
michael and Claude Opus 4.8
e380bc09e4
hf 15 reader --all -@: live presence table for continuous inventory
...
Continuous 16-slot inventory now shows a persistent, in-place presence table: one row
per UID seen this session (kept as rows, never removed), redrawn in place each scan with
present / gone (Ns ago) status and a present/total count.
Also keep the RF field up across scans in continuous mode (drop it once on exit) instead
of re-initialising every round -- faster, and avoids per-scan 'Setting ISODEP' churn when
APDU logging is enabled. Fix the reader help text (the polling loop exits on Enter, not
the pm3 button).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-08 14:54:00 -07:00
michael
9a4fcf2140
hf 15 reader: 16-slot anti-collision inventory (--all)
...
Add ISO 15693 16-slot inventory with anti-collision tree-walking, reachable via 'hf 15 reader --all'; single-tag reading stays the default. The firmware steps the 16 slots with EOF markers and flags 'signal but no decode' slots as collision hints; the client walks the UID mask tree, validates CRC per slot to confirm real collisions, and dedups discovered tags. Single-tag reading (default) and 16-slot inventory (--all) both run under hf 15 reader.
2026-06-08 14:54:00 -07:00
Iceman and GitHub
71b0df6cc5
Merge pull request #3368 from cindersocket/feat-iclass-non06-aia
...
Support non-06 iCLASS SE AIA SIO blocks
2026-06-08 14:13:38 +02:00
CinderSocket
b05a4f9bcf
Support non-06 iCLASS SE AIA SIO blocks
2026-06-08 04:37:26 -07:00
Iceman and GitHub
8c54d901f7
Merge pull request #3361 from dangerous-tac0s/ultimatecard-pack-fix
...
PACK fix for the lua script hf_mf_ultimatecard
2026-06-08 09:51:58 +02:00
Philippe Teuwen
efcc34a698
make style
2026-06-07 23:01:20 +02:00
Philippe Teuwen
ff04e1ea9a
hf mfu cauth: add -c to collect nonces
2026-06-07 22:58:39 +02:00
CinderSocket
d02c42eb10
Add DES and plain iCLASS transport
2026-06-07 11:15:17 -07:00
kormax
5be7e8f9a3
Add --dfname param to 'hf mfdes read'
2026-06-07 16:24:31 +03:00
kormax
73d0388141
Add 'hf mfdes getversion' command
2026-06-07 16:24:31 +03:00
kormax
1a4fdbeffb
Improve DESFire type detection logic
2026-06-07 16:15:15 +03:00
michael
0b84d3bd3c
Made the PACK handling dynamic based on UMC version.... 06a0 gets 0x13 otherwise 0xe6
2026-06-06 17:24:40 -07:00
michael
7e7774c56d
Corrected the hf_mf_ultimatecard lua script to handle the PACK such that the UG4 will use it.
2026-06-06 14:20:11 -07:00
kormax
007e1f87d4
Add new Sofia transit cards to relevant resources
2026-06-06 18:27:33 +03:00
Iceman and GitHub
22f16c27a0
Merge pull request #3358 from YoungJules/fix/legic_write
...
LEGIC: clarify restore/clone flow and add explicit migration helper
2026-06-05 23:09:47 +02:00
YoungJules
8462363e61
legic: clarify restore and migration flow
2026-06-05 21:08:18 +02:00
Philippe Teuwen
fb238015fa
hf mfu sim --1a2-mirror
2026-06-04 20:19:15 +02:00
Alexandre CHAZAL and GitHub
94b8ff88f5
Merge branch 'master' into mad-security-rewrite
...
Signed-off-by: Alexandre CHAZAL <AlxCzl@users.noreply.github.com >
2026-06-03 12:09:58 -07:00
achazal
c7ac39f376
mad: harden MAD parser with typed structs and fix memory safety bugs
2026-06-03 20:22:30 +02:00
Iceman and GitHub
458acf4fc6
Merge pull request #3353 from AlxCzl/fix-mad1-loop-oob
...
Fix MAD1 off-by-one in MADDecode: loop read Key A as 16th AID
2026-06-02 20:43:48 +02:00
Iceman and GitHub
b3f1913f18
Merge pull request #3354 from AlxCzl/fix-mad-cardholder-overread
...
Fix buffer over-read in MADCardHolderInfoDecode
2026-06-02 20:41:29 +02:00
achazal
10cd87175d
Fix buffer over-read in MADCardHolderInfoDecode
2026-06-02 19:04:11 +02:00
achazal
6aa8a2f892
Fix MAD1 off-by-one in MADDecode: loop read Key A as 16th AID
2026-06-02 19:02:05 +02:00
achazal
2c27d4fc10
Fix NULL dereference in MAD print_aid_description
2026-06-02 18:56:24 +02:00
Iceman and GitHub
c46b72ee2b
Merge pull request #3349 from AlxCzl/fix-3346
...
Fix MADDecode off-by-one (#3346 ): mad[] sized for 39 entries but 40 written when MAD2 present
2026-06-02 17:25:18 +02:00
Iceman and GitHub
e1228eed5d
Merge pull request #3350 from AlxCzl/fix-strcat
...
Fix -Werror=stringop-truncation build failure in fileutils.c
2026-06-02 17:22:09 +02:00
Iceman and GitHub
95b73e2605
Merge pull request #3351 from AlxCzl/fix-3347
...
Fix NULL dereference (#3347 ) in emv_pki_decode_message
2026-06-02 17:20:51 +02:00
orbisai0security and Philippe Teuwen
94c0fc2edd
Hardening: explicitly set shell=False on all subprocess.run() calls in fm11rf08s_recovery.py.
...
All four call sites already pass `cmd` as a Python list, so Python's default of `shell=False` means there is no active command-injection risk. This change makes the security intent explicit, prevents accidental future regression if a call site is later changed to pass a string, and improves code clarity.
No functional behaviour is changed.
2026-06-02 17:12:31 +02:00
achazal
8465ea9cba
fix NULL dereference ( #3347 ) in emv_pki_decode_message when crypto_pk_encrypt fails
2026-06-02 17:10:57 +02:00
achazal
d4c4ab30c7
fix MADDecode off-by-one ( #3346 ): mad[] sized for 39 entries but 40 written when MAD2 present
2026-06-02 17:03:50 +02:00
achazal
c29afcbe8c
Fix -Werror=stringop-truncation build failure in fileutils.c
2026-06-02 16:49:47 +02:00
