protocol_pyramid_add_wiegand_parity() computes the trailing odd-parity
bit with protocol_pyramid_get_parity(source + length / 2, ...). length is
a bit count (24), so source + length / 2 moves the pointer 12 bytes,
but wiegand[] in protocol_pyramid_encode() is 3 bytes. It should read
bits 12..23 of the same buffer.
So the parity bit we transmit comes from stack memory past wiegand[]
instead of the card number. Checked every 8-bit FC against every 16-bit
card number: the bit is wrong for essentially half of them, which a
reader that validates 26-bit Wiegand parity rejects. Our own decoder only
checks the CRC-8 and the format length, so reading a written card back
with a Flipper doesn't show it.
Give get_parity an explicit start position instead of doing pointer
arithmetic with a bit count. The even-parity call keeps reading bits
0..11 and is unchanged.
Signed-off-by: Cole Munz <colemunz@gmail.com>
protocol_pac_stanley_decode() fills an 8-byte asciiCardId[] and hands it
to hex_chars_to_uint8(), which takes no length and loops
while(*value_str && value_str[1]) - it stops at a terminator the buffer
doesn't have. So every successful decode reads asciiCardId[8] and [9] off
the end of the array, and if those two stack bytes happen to be hex
digits it also writes past protocol->data, which is 4 bytes.
Made the buffer 9 bytes and zeroed it. The loop still fills [0..7] and
the parse now stops after exactly 4 bytes, which is what
PAC_STANLEY_DECODED_DATA_SIZE expects.
Signed-off-by: Cole Munz <colemunz@gmail.com>
* [LFRFID]: Fix reading T5577 tags that hold multiple EM4100 IDs
A T5577 configured to emit more than one EM4100 frame per cycle (e.g. two IDs
written by the T5577 Multi Writer app) hung on Read.
The Electra protocol (2024) gave the EM4100 decoder a 64-bit "the frame must be
followed by a header" lookahead to tell EM4100 and Electra apart. That pushed
each decode ~128 bits past the read worker's per-decode reset, so a two-frame
tag locked into rigid A/B alternation and never produced the 3 identical decodes
in a row that Read requires.
Only a 9-bit lookahead is actually needed (Electra's epilogue never begins with
9 ones), so shrink the epilogue register to 9 bits. This restores the
pre-Electra decode timing while keeping EM4100/Electra disambiguation. Also reset
encoded_epilogue in decoder_start, which the original change omitted.
Fixes#1024
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [LFRFID]: Reset encoded_data in PAC/Stanley decoder_start
protocol_pac_stanley_decoder_start reset data/inverted/got_preamble but never
the encoded_data shift buffer - missing since the protocol was added, and unlike
every sibling decoder. Latent in practice (the buffer self-refreshes and
decoding is preamble/parity/checksum-gated), fixed for consistency.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [LFRFID]: Changelog for multi-EM4100 T5577 read fix (#1025)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fix the 2nd-consecutive-write failure (same tag, not moved): a successful
write leaves the chip warm and emitting (its read-back verify holds the
field on, and the post-write latch cycles drive TTF emission), but the next
write's open-loop select chain assumed a cold power-on reset. Add a leading
cold field-off (HITAGMICRO_COLD_RESET_US) at the start of hitagmicro_write
so every session starts from a known cold state.
Review + simplify cleanup:
- pass the LOGIN password as an explicit hitagmicro_write(data, password)
argument instead of a struct field the worker patched in; normalize the
API version to 87.9 (a single bump over dev)
- collapse the variant password/name parallel arrays into one table
- use bit_lib_set_bit/get_bit instead of hand-rolled bit twiddling
- factor the field power-cycle into hitagmicro_field_on/off helpers
- guard the debug frame dump behind the log level
- name the write_chip_name buffer size; one scene status-text helper
- revert the global MAX_UNSUCCESSFUL_READS 10->5 (the too-long timer already
shows the same "Still Trying" popup); fix a stale docstring + comments
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add an open-loop writer (lib/lfrfid/tools/hitagmicro.c) that clones an
EM4100 ID onto ID82xx / Hitag micro 8265 magic chips, mirroring
Proxmark3 `lf em 410x clone --htu`. Folded into the existing sequential
Write flow (no UI picker): each target (T5577, EM4305, Hitag micro x3
passwords) is written then verified by read-back, and the chip/variant
that actually took is reported on the success screen.
- New firmware API 87.10: hitagmicro_write, hitagmicro_variant_password,
hitagmicro_variant_name, lfrfid_worker_get_write_chip_name.
- Detection verifies after each write (perf trade-off, see PR notes).
- Open-loop port of a closed-loop PM3 path; a few frame constants
(flags 0x04/0x05, config byte1) still need on-tag validation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Country list header and printf
* off load country list to asset
* lint
* Field specific getters
* check string length before cutting
* lfrfid: minor iso3166 cleanup
---------
Co-authored-by: hedger <hedger@users.noreply.github.com>
Co-authored-by: hedger <hedger@nanode.su>
* libs: stricter constness for saving RAM with .rodata section; fbt: sdk: fixed signature generation for nested const params
* hal: additional fixes for constness in USB subsystem
* debug apps: additional usb-related fixes
* mjs: more consts for token parser
* fatfs: const driver struct
* hal: more consts for ble & nfc vars
* hal: made FuriHalSpiBusHandle static
* hal: made FuriHalI2cBusHandle static
* usb: restored previous api
* linter fixes
* API fixes
* Update protocol_gproxii.c
* 36 bit format parsing fix
* Update protocol_gproxii.c
* wiegand checks as single function
* LfRfid: simplify gprox wiegand payload validation flow
* LfRfid: extra furi_check in gprox wiegand validation code
Co-authored-by: Aleksandr Kutuzov <alleteam@gmail.com>
* Fix detection of GProx II cards and false detection of other cards as GProx II
* Fix incorrect parity starting bit
Co-authored-by: あく <alleteam@gmail.com>
* Add lfrfid GProxII support
* Add rfid GProxII support and correct linting issues.
* Add GProxII support for 26 and 36 bit cards
* Add GProxII 26 and 36 bit key - fixing minor typos
* Add GProxII 26 and 36 bit key - fix typo
* Add GProxII 26 and 36 Bit support - Change comment to not fail lint checking on XOR Value
Co-authored-by: あく <alleteam@gmail.com>
* Create protocol_securakey.c
* decode and render done
* Support for Radio Key Securakey
Support both 26- and 32-bit format
Solves issue #2619
* debugs and improvements
* Formatting in response to requested changes
* fixed wiegand parity bit calculation
* format
* debug unnecessary assert
* LfRfid: swap vendor and protocol names in securakey
* fixed manually generated keys issues
* fix bit length render error caused by bit length fix
* 1.0
* edit the citation in comments
* backward compatibility
* debug
* debug preamble false positives
* temporary fix: writing RKKTH causes second to last byte not encoded. unknown reason
* slightly more elegant solution to the weird bug
* plausible solution, much more elegant
* finally fixed it. stupid mistake
* clean up and format. ready for new PR
Co-authored-by: あく <alleteam@gmail.com>
* Create protocol_securakey.c
* decode and render done
* Support for Radio Key Securakey
Support both 26- and 32-bit format
Solves issue #2619
* debugs and improvements
* Formatting in response to requested changes
* fixed wiegand parity bit calculation
* format
* debug unnecessary assert
* LfRfid: swap vendor and protocol names in securakey
* fixed manually generated keys issues
* fix bit length render error caused by bit length fix
Co-authored-by: あく <alleteam@gmail.com>
MX