mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-09-27 11:28:43 +00:00
Mistial DeveloperandClaude Fable 5.1
e588085c10
The DESFire simulation could only be reached over the air. A conformance suite that has recorded a genuine card's session needs to replay it byte for byte, which takes two things the simulation did not have: a way in over USB, and control of the card's random draws. CMD_HF_DESFIRE_SIM_TEST carries one operation per packet into the same state machine the RF loop drives: BEGIN, SCAN, APDU, RANDOM, FIELDOFF, STATE, END. SCAN runs the RF-reset path (init, reset, random id, FSD) and APDU goes through desfire_sim_apdu(), so native and ISO 7816 wrapped commands answer exactly as they do on air. No FPGA involvement. Randomness goes through a small host-fed byte queue: RndB and the random id draw from it first and fall back to the existing fixed value or tick counter when it is short, raising a sticky underflow flag. With nothing queued the RF simulation is byte-identical to before; SimulateDesfireTag() clears the queue so a host session cannot leak into a reader session. Co-Authored-By: Claude Fable 5.1 (claude-fable-5-1) <noreply@anthropic.com>