mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-10-06 03:27:38 +00:00
iceman1001andClaude Opus 5
31d05aef53
ChangeFileSettings is answered by the simulation now. Which form it takes is decided by the file's own "change access rights" right, not by the reader: never refuses the command outright, free means the settings arrive as plain text with no security mechanism at all, and anything else names the key that has to be authenticated and the settings arrive enciphered under it (M134034 9.5.4). That enciphered form is the first command whose parameters the reader secured rather than the card, so it shares the unwrapping the writes use: the file number stays in the clear, the rest is one CBC run under the session key, and the CRC32 behind the plaintext is checked before anything is changed. A command that unwraps its own parameters also has to be kept away from the blanket command CMAC, or the IV moves twice. Tested against the simulation: a file whose change right is free goes from rights eeee to 1234 with no session at all, a file whose change right is key 0 goes from 1200 to 3210 authenticated and enciphered, and a file whose change right has been set to F refuses every later change and keeps its settings, which is the point of that value. Separately, `hf mfdes esave` grew a `--keep` flag. A deleted application or file stays in the card image as a tombstone, because the memory it held stays spent until a FormatPICC, and esave was writing those out as though they still existed. They are now left out by default, so a dump is the card as a reader sees it, and `--keep` puts them back for when what a reader did is the interesting part rather than the result it left. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>