* NFC: Fix two reboots on protocols the CLI and Add Manually did not expect
* NFC: Texkom (Техком) key support - read, emulate, save
* NFC: Texkom in Add Manually and the emulate CLI
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BR7WSui94mnbwav1bFZvvT
* NFC: Fix handling of FeliCa system key version
* FeliCa: bump data format version to 4
---------
Co-authored-by: Štefan Croitoru <66339601+turbospok@users.noreply.github.com>
* Expose some useful BLE/USB enums/macros
* Allow max possible length of BLE name
* BadUSB: Full customization of USB/BLE parameters
* BadUSB: Allow pressing modifier with no key combo
* BadUSB: Show current line numbers, simplify draw code
* BadUSB: Show script elapsed/run timer
* Some cleanup
* BadUSB: Add de-DE-mac and fi-FI keyboard layouts
* Update docs for BLE_ID and BT_ID
* Use __builtin_bswap16()
* Update naming
* Mark as Random Static Address
* Validate before copying to user config
* Show Done popup for randomize options
* Options to restore USB and BLE defaults
* Naming
* Focus top of config menu when entering
* Simpler HID profile name generation
* Use a BLE profile wrapper for just setting parameters
---------
Co-authored-by: Willy-JL <49810075+Willy-JL@users.noreply.github.com>
Co-authored-by: hedger <hedger@users.noreply.github.com>
* NFC: Implement Type 4 Tag reading
* Fix reading empty NDEF message
* NFC: Implement Type 4 Tag saving
* Fix reading NLEN header in NDEF message
* NFC: Implement Type 4 Tag NDEF parsing
* Sort and add missing protocol mentions
* Fix event struct passed to callbacks
* Add more specific error types
* Cleanup includes
* NFC: Expose iso14443_3a_listener functions (OFW issue 4059)
* BitBuffer: Allow copy right/left on same instance
* NFC: Rudimentary iso14443_4a_listener_send_block() (no PCB handling) (OFW issue 4059)
* NFC: Implement Type 4 Tag rudimentary emulation
* Support larger NDEF messages
* Fix sending error responses
* NFC: Initial ISO14443-4 PCB listener handling
* Fix chunk sizes
* Fix ISO READ BINARY params definitions
* Fix emulate after save
* Allow selecting PICC level too
* Refactor CC parsing and dumping
* Use flags for ISO14443-4 layer decode result
* For now send NACK to all R blocks
* NFC: Handle writes to Type 4 Tag while emulating
* Refactor ISO APDUs in T4T poller
* Keep prev selection when new selection fails
* NFC: Implement Type 4 Tag writing biolerplate and structure
* Improve ISO SELECT naming and handling
* Make APDU arrays static
* Better handling of read/write failure
* NFC: Implement Type 4 Tag writing to initialized tags
* NFC: Detect Type 4 Tag platform (eg DESFire)
* Fix writing with platform detect
* NFC: Support creating NDEF AID on DESFire
* Rename mf_desfire_send_chunks() to mf_desfire_poller_send_chunks()
* NFC: Implement DESFire ISO 7816 command wrapping
* NFC: T4T interact with DESFire without state reset
* Fix some message strings
* Static define T4T DESFire app ids
* Simplify return here
* Fix some edge cases with max NDEF size
* NFC: Support creating CC and NDEF files on DESFire
* GUI: Add submenu_remove_item()
* NFC: Refactor Write actions into ProtocolSupport
* NFC: Pressing back on MFC Update doesn't retry
* NFC: Fix duplicated ProtocolSupport handling, fix some inconsistent naming
* Fix writing retrying after success
* NFC: Implement basic NTAG4xx detection
* Small cleanup
* Check HWMajorVersion like NXP commands \o/
See: https://www.nxp.com/docs/en/application-note/AN10833.pdf
* NFC: Detect NTAG4xx in Type 4 Tag poller
* NFC: Refactor common NXP Native command handling
* NFC: Show version info for MIFARE Plus (was implemented but not shown)
* NFC: Only show MFP GetVersion info when available
* NFC: Fix detecting MIFARE Plus SE 1K SL1/3
See: https://www.nxp.com/docs/en/application-note/AN10833.pdf
* Expose dESFire NDEF size
* Stop poller and blinking on write success/fail
* GUI: Add submenu_remove_item()
* NFC: Refactor write scenes into protocol support
* NFC: Cleanup duplicate event handling
* NFC: Refactor DESFire poller to NxpNativeCommand helper
* NFC: Sort protocol defs and add missing ones
* NFC: Support NTAG4xx detection and basic info
* NFC: Allow choosing DESFire poller cmd mode, fix send_chunks() naming
* NFC: Check MIFARE types with HWType lower nibble
See: https://www.nxp.com/docs/en/application-note/AN10833.pdf
* NFC: Refactor MIFARE Plus with NxpNativeCommand helper
* NFC: Fix detecting MIFARE Plus SE 1K SL1/3
See: https://www.nxp.com/docs/en/application-note/AN10833.pdf
* NFC: Show MIFARE Plus EV1/2 GetVersion info like DESFire
* Revert "BitBuffer: Allow copy right/left on same instance"
This reverts commit cfeddbf8b6320a21749238d648eff7e69450d850.
* Use dedicated buffer
* Simpler naming scheme
* Update TODOs that are out of scope for the project
* Fix typos
* Fix merge
* NFC: Handle PPS request in ISO14443-4 layer
* NFC: Fix some typos in Type4Tag protocol
* NFC: Fix CLI with NTAG4xx and Type 4 Tag support
* Keep mf_desfire_send_chunks symbol, regenerate API tables
* Reword TODO comments as plain notes
---------
Co-authored-by: Willy-JL <49810075+Willy-JL@users.noreply.github.com>
Co-authored-by: hedger <hedger@users.noreply.github.com>
Co-authored-by: Štefan Croitoru <66339601+turbospok@users.noreply.github.com>
* feat: add Indala 224-bit (long format) RFID protocol support
Add complete Indala 224-bit protocol: decode, encode, emulate, and
write/clone via T5577. Uses PSK2 modulation (RF/32, bitrate 2) with
a 30-bit preamble (1 + 29 zeros) and 224-bit data payload.
Decoder performs PSK2 differential decoding (data = phase XOR next_phase)
from the shift register, handles both normal and inverted preambles for
phase-alternating cards, and validates across 6 consecutive frames.
Writer configures T5577 with block 0 = 0x000820E0 matching Proxmark3
reference implementation. Encoder uses PSK2 carrier-flip modulation
where carrier phase inverts on data bit = 1.
Verified against Proxmark3 lf indala clone output:
80000001B23523A6C2E31EBA3CBEE4AFB3C6AD1FCF649393928C14E5
Includes unit tests for roundtrip encode/decode and PSK2 phase
alternation edge case.
* Append Indala224 to protocol enum, move its test registration
* fbt format
* Indala224: don't drop a full-frame phase run
---------
Co-authored-by: Štefan Croitoru <66339601+turbospok@users.noreply.github.com>
* appmanifest: validate fap_version type; accept int, reject float
* appmanifest: narrow fap_version validation
* appmanifest: normalize list fap_version, reject other types clearly
Lists like fap_version=[2, 3] are used by six catalog apps and must keep
building, so accept them and convert to a tuple. Anything that is not a
str, tuple or list now raises FlipperManifestException naming the type
instead of failing later with a TypeError from len().
* NFC FeliCa: Support Polling, Search Service Code, Request System Code, Read / Write without Encryption
* NFC FeliCa: Support Request Service
* NFC FeliCa: Delete comment and Add Test
* NFC FeliCa Fix: Add Request Service max nodes limit
* NFC FeliCa: Add Mode and Request Response command
* NFC FeliCa: Add Standard card test fixture
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* NFC FeliCa Fix: Init Key version
* NFC FeliCa Fix: Correct multi-System reading and emulation on real hardware
Reading: drop the invalid 0xFFFF sentinel from the Request Service key
version query - it broke traversal of every System after the first on
real cards. System key version is now sourced from Area 0000 instead.
Emulation: track the currently selected System and use it consistently
across Read/Write/Request Service/Search Service Code/Request System
Code handlers instead of always assuming System 0. Derive each
System's IDm from the base IDm (unchanged for System 0, index encoded
in the upper nibble otherwise). Widen PMm response-time bytes so real
readers don't time out waiting on the slower software emulation.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* NFC FeliCa Fix: Select multi-System reads via real Polling, not IDm patching
Locally rewriting the upper nibble of the base IDm to "select" a System
happened to work against one physical card but times out against
stricter implementations (e.g. Android HCE FeliCa emulation), since
that IDm was never actually granted by the card for that System.
Poll again with each System's own Code to obtain its real IDm/PMm
before traversing it, matching the FeliCa spec. If Polling for a
System fails, leave that System empty and continue with the rest
instead of failing the whole read. Restore the card's own IDm/PMm
(from the initial activation) once reading finishes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fbt format
* NFC FeliCa: bump data format version to 3
The Standard card format gained area end codes and system/area/service
key versions, so bump the FeliCa data format version from 2 to 3.
Loading older files keeps working through the existing fallbacks.
Update the Standard test fixture to v3 and drop the leftover key lines
that no loader reads. Area 0000 represents the system itself, so its key
version now matches the system one, which is what the poller expects.
Add felica_standard_file_test: a minimal parse-only check of the v3
fields, with no poller or listener involved.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* NFC FeliCa: branch the loader on the data format version
The Standard parser used to sniff the format instead of trusting the
version it had just read: three nested sscanf fallbacks for areas, and a
strstr for the system and service key versions. That left the version
number decorative and turned malformed lines into silent defaults.
Read the version once and branch on it, so every field has a single
expected format. Version 2 files keep loading, with the fields they
predate filled in with FELICA_KEY_VERSION_UNKNOWN and
FELICA_AREA_END_CODE_UNKNOWN.
Also fix the sscanf result checks: !sscanf(...) treats the EOF return as
success, so a completely unparsable line went through unnoticed.
Add a version 2 fixture and felica_standard_v2_file_test to cover the
legacy branch.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The capture channels latch edge instants in hardware, but the counter had no hardware zero as
slave-mode reset is disabled, so the origin was written by software inside the ISR. That happens
at edge + L, not at the edge, while CCR4 was latched AT the edge, so every reported duration
came out short by one interrupt latency.
Letting the counter free-run and differencing consecutive CCR4 latches removes it. CCR4 already
holds the exact instant of the rising edge, so the difference is exact and carries no latency.
Reported values keep their existing meaning - true is the high width, false is the
rising-to-rising period - so no consumer needs changing. uint32_t arithmetic makes wraparound
self-correcting. At the timer's 1 MHz the counter wraps every ~71 minutes against captures
measured in hundreds of milliseconds.
L is small but it is a bias, not noise. It has the same sign every cycle. A consumer that
quantises each duration independently rounds it away, one that integrates durations into an
absolute time axis accumulates it linearly. Measured on the LF read path: 1.46 us, spread
0.05 us, which over a 72-half-bit frame at RF/32 accumulates to ~48 us against a 64 us sampling
budget.
Tested the LF protocol matrix before and after on three firmware trees - OFW 24/24 protocols,
Momentum 26/26, Unleashed 6 targeted rows where the decoders differ - with identical decodes
throughout, each tag written and verified by a Proxmark immediately before each read. Read rate
unchanged (21/40 vs 32/70, p=0.55). This is a correctness and jitter-immunity fix, not a
performance fix.
`rfid read` cannot read a Keri tag. It will not even read back a Keri
card the Flipper itself just wrote. Every decode it produces from a
genuine T5577 Keri card is wrong; validate_count usually stops those
reaching the UI, but `rfid raw_analyze` has no such gate and prints the
wrong value as a credential, with a plausible facility code and card
number.
A Keri frame is never DC balanced -- its preamble alone carries a run of
29 zeros, and on the tag measured here only 10 of 64 bits are set. On a
frame that unbalanced the PSK slicer reports every high run ~135 us long
and every low run ~135 us short, past the +/-127 us that the decoder's
bit-period rounding tolerates, so every run of ones decodes one bit too
long. Long runs of zeros survive, because the true bit period is nearer
256 us than KERI_US_PER_BIT's 255 and over a long enough run that
difference offsets the skew. The same T5577 rewritten as Idteck, whose
frame is near half ones, shows a skew of only +40/-42 us, which is why
the other PSK protocols are unaffected.
The "wrong phase synced data" correction was meant for exactly this, but
it shifts the boundary the wrong way: it lengthens the high level, which
here is already too long, by a further 120 us. That adds a bit to every
run of ones and takes one off every short run of zeros, which keeps the
frame 64 bits long -- close enough that jitter on a marginal capture
lets both preamble checks pass over a mangled payload, turning a failed
read into a printed credential whose value varies from read to read.
Correct the skew in both directions instead.
Keri has no parity and no checksum, so also require the two frames in
the shift register to carry the same ID before accepting a decode.
Because the mis-slicing is not identical from frame to frame -- which is
why the wrong values varied between reads of one card -- frame-to-frame
agreement is what turns a marginal read into a failed read rather than a
credential. That needs the register to hold two whole frames, 16 bytes
rather than 13; at 13 the second frame's ID would have been a three byte
read past the end of the buffer. The wider buffers also align every
preamble load, which at the old 13 byte stride were misaligned 32-bit
reads on three buffers in four.
Two unit tests cover the two changes. The first replays one frame of a
captured tag and asserts 80 00 30 39; uncorrected those runs total 66
bits, the preamble never aligns, and nothing decodes. The second
alternates that frame with one whose 2H/6L run pair reads as 3H/5L,
carrying 0x80003839 -- each frame decodes on its own, so only frame to
frame disagreement can reject the alternation, and without the ID check
it reads out as 80 00 30 39.
Costs 44 bytes of RAM. On a signal both versions can read, time to a
validated read does not regress: first sync needs 128 bit periods rather
than 104, but the decoder then settles into a clean 64 period cadence
instead of alternating 120 and 8, so validate_count = 6 is satisfied
after 448 bit periods rather than 506.
Also drops KERI_PREAMBLE_DATA_SIZE, whose only use was the old buffer
sizing, and the two commented out bit_lib_get_bit lines copied from
protocol_indala26.c. The latter were not merely dead: the bit 60 test
would have rejected this very tag.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Closes#1158.
The top bit of the Casi-Rusco card field decides whether the offset
applies. A field below 2^18 is the card number as is; a field from 2^18
up is the card number plus 66606. The decoder no longer refuses fields
195538-262143, which left real cards 195534-195543 with no C10106 line
and no way to enter them. The encoder adds the offset from card 262144
instead of 195538.
Fields emulated from the Flipper read exactly that way on a Telaeris
XPID and on a genuine GE Casi-Rusco panel. The vendor's card range,
0-457681, is 2^19 - 1 - 66606. Some cards printed 262144 and up carry a
plain field, so they read 66606 low; that is the card programmer's
error, not the format.
Ten cards ordered with facility code 42 confirm the S10401 facility
code as six bits at bit 1. That part changes a comment only.
No CHANGELOG entry: the Casi-Rusco format from #1149 is unreleased and
its entry covers this.
Co-authored-by: matthewb-worthe <135917560+matthewb-worthe@users.noreply.github.com>
Co-authored-by: Mykhailo Shevchuk <myte@ukr.net>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
DESFire Light takes only ISO 7816-wrapped commands. A plain native frame gets
SW 6700 ("wrong length"), so every command the DESFire poller sent was refused,
detection died at GetVersion and nothing in the ISO14443-4A family claimed the
card. mf_desfire_poller_read_version_any_mode() now settles on the mode the card
answers and keeps it for the session; only a refusal of the frame itself earns a
second attempt, so the EV series keeps its plain frames and MIFARE Plus / NTAG
4xx still cost one exchange. The wrapped path and its 0xAF chaining already
existed in nxp_native_command.c for type_4_tag and ntag4xx.
Light also reports its own hardware type (0x08), which mf_desfire_version_parse
rejected, and its hw_major 0x30 is outside the EV1/EV2/EV3 series, so the type is
classified from hw_type first. It reads as "Mifare DESFire Light".
Light answers 0x1C to GetFreeMemory, GetKeySettings and GetKeyVersion, so the
read has to survive those refusals. Unmodelled status codes became
MfDesfireErrorRejected (mirroring MfPlusErrorRejected) instead of sharing
MfDesfireErrorProtocol with a broken exchange, and the two handlers that each
tolerated one specific refusal now tolerate any refusal via
mf_desfire_error_is_refusal(), which also covers an EV card with a locked PICC.
A transport failure still fails the read.
Detection no longer sends GetKeyVersion(0) ahead of GetVersion: the 28-byte
layout plus the hardware type nibble already separate the families, and the probe
only answered whether key 0 was readable.
Also fixed: the key-version refusal path zeroes max_keys with the array it
empties (save writes one line per element, load reads max_keys of them, so a
stale count made the file the app had just written unloadable) and honours
is_free_directory_list; mf_desfire_reset clears master_key_settings; read_success
fills the event error field; refusals log at FURI_LOG_W, which release builds keep;
the device name appends the size only when known.
mf_desfire_get_type_from_version is exported for the NFC app, as ntag4xx, slix and
mf_ultralight already do. API 88.16.
Hardware-verified on a 7-byte-UID MF2DL(H)x0: nfc scanner reports "Mifare DESFire"
where it reported "Iso14443-4a", and nfc dump -p des saves a complete file whose
PICC Version matches the Proxmark3 reading byte for byte.
Reading the Light's file contents is not part of this.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
MX