[NFC Magic] Gen1 backdoor read support

nfc_magic/.catalog/changelog.md

@@ -1,3 +1,7 @@
+## 1.12
+ - Support for dumping Gen1 cards
+ - Minor error screen changes
+
 ## 1.11
  - Fixed Mifare Ultralight types with latest API update
 

nfc_magic/application.fam

@@ -10,7 +10,7 @@ App(
     ],
     stack_size=4 * 1024,
     fap_description="Application for writing to NFC tags with modifiable sector 0",
-    fap_version="1.11",
+    fap_version="1.12",
     fap_icon="assets/125_10px.png",
     fap_category="NFC",
     fap_icon_assets="assets",

nfc_magic/magic/protocols/gen1a/gen1a_poller.c

@@ -17,6 +17,24 @@
     bool detected;
 } Gen1aPollerDetectContext;
 
+Gen1aPollerError gen1a_poller_parse_block0(MfClassicBlock* block, MfClassicData* mf_data) {
+    furi_assert(mf_data);
+    furi_assert(block);
+
+    Gen1aPollerError ret = Gen1aPollerErrorNone;
+
+    // Get UID, SAK, and ATQA from block 0
+    memcpy(mf_data->iso14443_3a_data->uid, block->data, 4);
+    mf_data->iso14443_3a_data->uid_len = 4;
+    mf_data->iso14443_3a_data->sak = block->data[5];
+    memcpy(mf_data->iso14443_3a_data->atqa, &block->data[6], 2);
+
+    // Gen1 tags are always 1k
+    mf_data->type = MfClassicType1k;
+
+    return ret;
+}
+
 Gen1aPoller* gen1a_poller_alloc(Nfc* nfc) {
     furi_assert(nfc);
 
@@ -133,6 +151,8 @@
     command = instance->callback(instance->gen1a_event, instance->context);
     if(instance->gen1a_event_data.request_mode.mode == Gen1aPollerModeWipe) {
         instance->state = Gen1aPollerStateWipe;
+    } else if(instance->gen1a_event_data.request_mode.mode == Gen1aPollerModeDump) {
+        instance->state = Gen1aPollerStateDumpDataRequest;
     } else {
         instance->state = Gen1aPollerStateWriteDataRequest;
     }
@@ -213,6 +233,66 @@
     return command;
 }
 
+NfcCommand gen1a_poller_dump_data_request_handler(Gen1aPoller* instance) {
+    NfcCommand command = NfcCommandContinue;
+
+    instance->gen1a_event.type = Gen1aPollerEventTypeRequestDataToDump;
+    command = instance->callback(instance->gen1a_event, instance->context);
+    instance->state = Gen1aPollerStateDump;
+
+    return command;
+}
+
+NfcCommand gen1a_poller_dump_handler(Gen1aPoller* instance) {
+    NfcCommand command = NfcCommandContinue;
+    Gen1aPollerError error = Gen1aPollerErrorNone;
+
+    MfClassicData* mfc_data = instance->gen1a_event_data.data_to_dump.mfc_data;
+    MfClassicBlock block = {};
+    uint16_t total_block_num =
+        mf_classic_get_total_block_num(MfClassicType1k); // Gen1 can only be 1k
+
+    while(instance->current_block < total_block_num) {
+        if(instance->current_block == 0) {
+            error = gen1a_poller_data_access(instance);
+            if(error != Gen1aPollerErrorNone) {
+                instance->state = Gen1aPollerStateFail;
+                break;
+            }
+        }
+
+        error = gen1a_poller_read_block(instance, instance->current_block, &block);
+
+        if(error != Gen1aPollerErrorNone) {
+            instance->state = Gen1aPollerStateFail;
+            break;
+        } else {
+            mf_classic_set_block_read(mfc_data, instance->current_block, &block);
+
+            if(mf_classic_is_sector_trailer(instance->current_block)) {
+                mf_classic_set_sector_trailer_read(
+                    mfc_data, instance->current_block, (MfClassicSectorTrailer*)&block);
+            }
+        }
+
+        if(instance->current_block == 0) {
+            error = gen1a_poller_parse_block0(&mfc_data->block[instance->current_block], mfc_data);
+            if(error != Gen1aPollerErrorNone) {
+                instance->state = Gen1aPollerStateFail;
+                break;
+            }
+        }
+
+        instance->current_block++;
+    }
+
+    if(instance->current_block == total_block_num) {
+        instance->state = Gen1aPollerStateSuccess;
+    }
+
+    return command;
+}
+
 NfcCommand gen1a_poller_success_handler(Gen1aPoller* instance) {
     NfcCommand command = NfcCommandContinue;
 
@@ -239,6 +319,8 @@
     [Gen1aPollerStateWipe] = gen1a_poller_wipe_handler,
     [Gen1aPollerStateWriteDataRequest] = gen1a_poller_write_data_request_handler,
     [Gen1aPollerStateWrite] = gen1a_poller_write_handler,
+    [Gen1aPollerStateDumpDataRequest] = gen1a_poller_dump_data_request_handler,
+    [Gen1aPollerStateDump] = gen1a_poller_dump_handler,
     [Gen1aPollerStateSuccess] = gen1a_poller_success_handler,
     [Gen1aPollerStateFail] = gen1a_poller_fail_handler,
 

nfc_magic/magic/protocols/gen1a/gen1a_poller.h

@@ -12,13 +12,15 @@ typedef enum {
     Gen1aPollerEventTypeDetected,
     Gen1aPollerEventTypeRequestMode,
     Gen1aPollerEventTypeRequestDataToWrite,
+    Gen1aPollerEventTypeRequestDataToDump,
 
     Gen1aPollerEventTypeSuccess,
     Gen1aPollerEventTypeFail,
 } Gen1aPollerEventType;
 
 typedef enum {
     Gen1aPollerModeWipe,
+    Gen1aPollerModeDump,
     Gen1aPollerModeWrite,
 } Gen1aPollerMode;
 
@@ -30,9 +32,14 @@ typedef struct {
     const MfClassicData* mfc_data;
 } Gen1aPollerEventDataRequestDataToWrite;
 
+typedef struct {
+    MfClassicData* mfc_data;
+} Gen1aPollerEventDataRequestDataToDump;
+
 typedef union {
     Gen1aPollerEventDataRequestMode request_mode;
     Gen1aPollerEventDataRequestDataToWrite data_to_write;
+    Gen1aPollerEventDataRequestDataToDump data_to_dump;
 } Gen1aPollerEventData;
 
 typedef struct {

nfc_magic/magic/protocols/gen1a/gen1a_poller_i.c

@@ -3,6 +3,8 @@
 
 #include <furi/furi.h>
 
+#define TAG "GEN1A_POLLER"
+
 static Gen1aPollerError gen1a_poller_process_nfc_error(NfcError error) {
     Gen1aPollerError ret = Gen1aPollerErrorNone;
 
@@ -130,3 +132,37 @@ Gen1aPollerError gen1a_poller_write_block(
 
     return ret;
 }
+
+Gen1aPollerError
+    gen1a_poller_read_block(Gen1aPoller* instance, uint8_t block_num, MfClassicBlock* block) {
+    furi_assert(instance);
+    furi_assert(block);
+
+    Gen1aPollerError ret = Gen1aPollerErrorNone;
+    bit_buffer_reset(instance->tx_buffer);
+
+    do {
+        bit_buffer_reset(instance->tx_buffer);
+        bit_buffer_reset(instance->rx_buffer);
+        bit_buffer_append_byte(instance->tx_buffer, 0x30);
+        bit_buffer_append_byte(instance->tx_buffer, block_num);
+        iso14443_crc_append(Iso14443CrcTypeA, instance->tx_buffer);
+
+        NfcError error = nfc_poller_trx(
+            instance->nfc, instance->tx_buffer, instance->rx_buffer, GEN1A_POLLER_MAX_FWT);
+
+        if(error != NfcErrorNone) {
+            ret = gen1a_poller_process_nfc_error(error);
+            break;
+        }
+        if(bit_buffer_get_size(instance->rx_buffer) != 18 * 8) { // 18 bytes
+            ret = Gen1aPollerErrorProtocol;
+            FURI_LOG_D(TAG, "Expected 18 bytes, got %d", bit_buffer_get_size(instance->rx_buffer));
+            break;
+        }
+
+        memcpy(block->data, bit_buffer_get_data(instance->rx_buffer), 16);
+    } while(false);
+
+    return ret;
+}

nfc_magic/magic/protocols/gen1a/gen1a_poller_i.h

@@ -25,6 +25,8 @@ typedef enum {
     Gen1aPollerStateWipe,
     Gen1aPollerStateWriteDataRequest,
     Gen1aPollerStateWrite,
+    Gen1aPollerStateDumpDataRequest,
+    Gen1aPollerStateDump,
     Gen1aPollerStateSuccess,
     Gen1aPollerStateFail,
 
@@ -62,6 +64,9 @@ Gen1aPollerError gen1a_poller_data_access(Gen1aPoller* instance);
 Gen1aPollerError
     gen1a_poller_write_block(Gen1aPoller* instance, uint8_t block_num, const MfClassicBlock* block);
 
+Gen1aPollerError
+    gen1a_poller_read_block(Gen1aPoller* instance, uint8_t block_num, MfClassicBlock* block);
+
 #ifdef __cplusplus
 }
 #endif

nfc_magic/nfc_magic_app.c

@@ -49,16 +49,19 @@ NfcMagicApp* nfc_magic_app_alloc() {
     view_dispatcher_set_tick_event_callback(
         instance->view_dispatcher, nfc_magic_app_tick_event_callback, 100);
 
-    // NFC source device (file)
+    // NFC source device
     instance->source_dev = nfc_device_alloc();
     nfc_device_set_loading_callback(
         instance->source_dev, nfc_magic_app_show_loading_popup, instance);
     instance->file_path = furi_string_alloc_set(NFC_APP_FOLDER);
     instance->file_name = furi_string_alloc();
 
-    // NFC target device (tag)
+    // NFC target device
     instance->target_dev = nfc_device_alloc();
 
+    // NFC dump data
+    instance->dump_data = mf_classic_alloc();
+
     // Open GUI record
     instance->gui = furi_record_open(RECORD_GUI);
     view_dispatcher_attach_to_gui(
@@ -140,6 +143,9 @@ void nfc_magic_app_free(NfcMagicApp* instance) {
     // Nfc target device
     nfc_device_free(instance->target_dev);
 
+    // Nfc dump data
+    mf_classic_free(instance->dump_data);
+
     // Submenu
     view_dispatcher_remove_view(instance->view_dispatcher, NfcMagicAppViewMenu);
     submenu_free(instance->submenu);

nfc_magic/nfc_magic_app_i.h

@@ -25,6 +25,7 @@
 #include <storage/storage.h>
 #include <dialogs/dialogs.h>
 #include <lib/toolbox/path.h>
+#include <dolphin/dolphin.h>
 
 #include "nfc_magic_icons.h"
 
@@ -48,6 +49,11 @@
 #define NFC_APP_MF_CLASSIC_DICT_USER_PATH (NFC_APP_FOLDER "/assets/mf_classic_dict_user.nfc")
 #define NFC_APP_MF_CLASSIC_DICT_SYSTEM_PATH (NFC_APP_FOLDER "/assets/mf_classic_dict.nfc")
 
+#define NFC_MAGIC_APP_NAME_SIZE 22
+#define NFC_MAGIC_APP_TEXT_STORE_SIZE 128
+#define NFC_MAGIC_APP_FOLDER ANY_PATH("nfc")
+#define NFC_MAGIC_APP_EXTENSION ".nfc"
+#define NFC_MAGIC_APP_FILENAME_PREFIX "NFC"
 #define NFC_MAGIC_APP_BYTE_INPUT_STORE_SIZE (4)
 
 enum NfcMagicAppCustomEvent {
@@ -63,6 +69,7 @@ enum NfcMagicAppCustomEvent {
     NfcMagicAppCustomEventDictAttackDataUpdate,
     NfcMagicAppCustomEventDictAttackComplete,
     NfcMagicAppCustomEventDictAttackSkip,
+    NfcMagicCustomEventTextInputDone,
 };
 
 typedef struct {
@@ -95,8 +102,10 @@ struct NfcMagicApp {
     SceneManager* scene_manager;
     NfcDevice* source_dev;
     NfcDevice* target_dev;
+    char text_store[NFC_MAGIC_APP_TEXT_STORE_SIZE + 1];
     FuriString* file_name;
     FuriString* file_path;
+    MfClassicData* dump_data;
 
     Nfc* nfc;
     NfcMagicProtocol protocol;

nfc_magic/scenes/nfc_magic_scene_config.h

@@ -28,4 +28,7 @@ ADD_SCENE(nfc_magic, gen2_menu, Gen2Menu)
 ADD_SCENE(nfc_magic, mf_classic_menu, MfClassicMenu)
 ADD_SCENE(nfc_magic, mf_classic_dict_attack, MfClassicDictAttack)
 ADD_SCENE(nfc_magic, gen2_write_check, Gen2WriteCheck)
-ADD_SCENE(nfc_magic, mf_classic_write_check, MfClassicWriteCheck)
+ADD_SCENE(nfc_magic, mf_classic_write_check, MfClassicWriteCheck)
+ADD_SCENE(nfc_magic, dump, Dump)
+ADD_SCENE(nfc_magic, dump_fail, DumpFail)
+ADD_SCENE(nfc_magic, gen1_save_name, Gen1SaveName)