This commit is contained in:
WillyJL
2025-09-06 03:35:15 +02:00
parent 3a35730a24
commit d97155eb2d
4 changed files with 34 additions and 58 deletions

View File

@@ -150,9 +150,9 @@ static NfcCommand
}
if(!mf_ultralight_event->data->auth_context.skip_auth) {
mf_ultralight_event->data->auth_context.password = instance->mf_ul_auth->password;
// Only set tdes_key for Manual/Reader auth types, not for dictionary attacks
if(instance->mf_ul_auth->type == MfUltralightAuthTypeManual ||
if(instance->mf_ul_auth->type == MfUltralightAuthTypeManual ||
instance->mf_ul_auth->type == MfUltralightAuthTypeReader) {
mf_ultralight_event->data->key_request_data.key = instance->mf_ul_auth->tdes_key;
mf_ultralight_event->data->key_request_data.key_provided = true;
@@ -182,7 +182,7 @@ bool nfc_scene_read_on_event_mf_ultralight(NfcApp* instance, SceneManagerEvent e
} else if(event.event == NfcCustomEventPollerIncomplete) {
const MfUltralightData* data =
nfc_device_get_data(instance->nfc_device, NfcProtocolMfUltralight);
if(data->type == MfUltralightTypeMfulC &&
if(data->type == MfUltralightTypeMfulC &&
instance->mf_ul_auth->type == MfUltralightAuthTypeNone) {
// Start dict attack for MFUL C cards only if no specific auth was attempted
scene_manager_next_scene(instance->scene_manager, NfcSceneMfUltralightCDictAttack);

View File

@@ -43,11 +43,11 @@ NfcCommand nfc_mf_ultralight_c_dict_attack_worker_callback(NfcGenericEvent event
instance->nfc_device, NfcProtocolMfUltralight, nfc_poller_get_data(instance->poller));
// Check if this is a successful authentication by looking at the poller's auth context
const MfUltralightData* data = nfc_poller_get_data(instance->poller);
// Update page information
dict_attack_set_pages_read(instance->dict_attack, data->pages_read);
dict_attack_set_pages_total(instance->dict_attack, data->pages_total);
if(data->pages_read == data->pages_total) {
// Full read indicates successful authentication in dict attack mode
instance->mf_ultralight_c_dict_context.auth_success = true;
@@ -73,10 +73,10 @@ void nfc_scene_mf_ultralight_c_dict_attack_dict_attack_result_callback(
void nfc_scene_mf_ultralight_c_dict_attack_prepare_view(NfcApp* instance) {
uint32_t state =
scene_manager_get_scene_state(instance->scene_manager, NfcSceneMfUltralightCDictAttack);
// Set attack type to Ultralight C
dict_attack_set_type(instance->dict_attack, DictAttackTypeMfUltralightC);
if(state == DictAttackStateUserDictInProgress) {
do {
if(!keys_dict_check_presence(NFC_APP_MF_ULTRALIGHT_C_DICT_USER_PATH)) {
@@ -110,12 +110,12 @@ void nfc_scene_mf_ultralight_c_dict_attack_prepare_view(NfcApp* instance) {
instance->mf_ultralight_c_dict_context.dict_keys_current = 0;
dict_attack_set_current_dict_key(
instance->dict_attack, instance->mf_ultralight_c_dict_context.dict_keys_current);
// Set initial Ultralight C specific values
dict_attack_set_key_found(instance->dict_attack, false);
dict_attack_set_pages_total(instance->dict_attack, 48); // Ultralight C page count
dict_attack_set_pages_read(instance->dict_attack, 0);
dict_attack_set_callback(
instance->dict_attack,
nfc_scene_mf_ultralight_c_dict_attack_dict_attack_result_callback,
@@ -174,7 +174,9 @@ bool nfc_scene_mf_ultralight_c_dict_attack_on_event(void* context, SceneManagerE
nfc_scene_mf_ultralight_c_dict_attack_prepare_view(instance);
instance->poller = nfc_poller_alloc(instance->nfc, NfcProtocolMfUltralight);
nfc_poller_start(
instance->poller, nfc_mf_ultralight_c_dict_attack_worker_callback, instance);
instance->poller,
nfc_mf_ultralight_c_dict_attack_worker_callback,
instance);
consumed = true;
}
} else {
@@ -204,9 +206,7 @@ bool nfc_scene_mf_ultralight_c_dict_attack_on_event(void* context, SceneManagerE
nfc_scene_mf_ultralight_c_dict_attack_prepare_view(instance);
instance->poller = nfc_poller_alloc(instance->nfc, NfcProtocolMfUltralight);
nfc_poller_start(
instance->poller,
nfc_mf_ultralight_c_dict_attack_worker_callback,
instance);
instance->poller, nfc_mf_ultralight_c_dict_attack_worker_callback, instance);
} else {
notification_message(instance->notifications, &sequence_semi_success);
scene_manager_next_scene(instance->scene_manager, NfcSceneReadSuccess);

View File

@@ -14,7 +14,7 @@ typedef struct {
FuriString* header;
bool card_detected;
DictAttackType attack_type;
// MIFARE Classic specific
uint8_t sectors_total;
uint8_t sectors_read;
@@ -27,12 +27,12 @@ typedef struct {
MfClassicBackdoor backdoor;
uint16_t nested_target_key;
uint16_t msb_count;
// Ultralight C specific
uint8_t pages_total;
uint8_t pages_read;
bool key_found;
// Common
size_t dict_keys_total;
size_t dict_keys_current;
@@ -123,11 +123,7 @@ static void dict_attack_draw_mf_classic(Canvas* canvas, DictAttackViewModel* m)
snprintf(draw_str, sizeof(draw_str), "%d/%zu", 1, m->dict_keys_total);
} else {
snprintf(
draw_str,
sizeof(draw_str),
"%zu/%zu",
m->dict_keys_current,
m->dict_keys_total);
draw_str, sizeof(draw_str), "%zu/%zu", m->dict_keys_current, m->dict_keys_total);
}
}
if(dict_progress > 1.0f) {
@@ -142,8 +138,7 @@ static void dict_attack_draw_mf_classic(Canvas* canvas, DictAttackViewModel* m)
m->keys_found,
m->sectors_total * NFC_CLASSIC_KEYS_PER_SECTOR);
canvas_draw_str_aligned(canvas, 0, 33, AlignLeft, AlignTop, draw_str);
snprintf(
draw_str, sizeof(draw_str), "Sectors Read: %d/%d", m->sectors_read, m->sectors_total);
snprintf(draw_str, sizeof(draw_str), "Sectors Read: %d/%d", m->sectors_read, m->sectors_total);
canvas_draw_str_aligned(canvas, 0, 43, AlignLeft, AlignTop, draw_str);
}
@@ -152,32 +147,26 @@ static void dict_attack_draw_mf_ultralight_c(Canvas* canvas, DictAttackViewModel
canvas_set_font(canvas, FontSecondary);
canvas_draw_str_aligned(canvas, 0, 0, AlignLeft, AlignTop, furi_string_get_cstr(m->header));
snprintf(draw_str, sizeof(draw_str), "Trying keys");
canvas_draw_str_aligned(canvas, 0, 10, AlignLeft, AlignTop, draw_str);
float dict_progress = m->dict_keys_total == 0 ?
0 :
(float)(m->dict_keys_current) / (float)(m->dict_keys_total);
float dict_progress =
m->dict_keys_total == 0 ? 0 : (float)(m->dict_keys_current) / (float)(m->dict_keys_total);
if(m->dict_keys_current == 0) {
snprintf(draw_str, sizeof(draw_str), "%d/%zu", 1, m->dict_keys_total);
} else {
snprintf(
draw_str,
sizeof(draw_str),
"%zu/%zu",
m->dict_keys_current,
m->dict_keys_total);
snprintf(draw_str, sizeof(draw_str), "%zu/%zu", m->dict_keys_current, m->dict_keys_total);
}
if(dict_progress > 1.0f) {
dict_progress = 1.0f;
}
elements_progress_bar_with_text(canvas, 0, 20, 128, dict_progress, draw_str);
canvas_set_font(canvas, FontSecondary);
snprintf(draw_str, sizeof(draw_str), "Key found: %s", m->key_found ? "Yes" : "No");
canvas_draw_str_aligned(canvas, 0, 33, AlignLeft, AlignTop, draw_str);
snprintf(draw_str, sizeof(draw_str), "Pages read: %d/%d", m->pages_read, m->pages_total);
canvas_draw_str_aligned(canvas, 0, 43, AlignLeft, AlignTop, draw_str);
}
@@ -248,7 +237,7 @@ void dict_attack_reset(DictAttack* instance) {
DictAttackViewModel * model,
{
model->attack_type = DictAttackTypeMfClassic;
// MIFARE Classic fields
model->sectors_total = 0;
model->sectors_read = 0;
@@ -260,12 +249,12 @@ void dict_attack_reset(DictAttack* instance) {
model->backdoor = MfClassicBackdoorUnknown;
model->nested_target_key = 0;
model->msb_count = 0;
// Ultralight C fields
model->pages_total = 0;
model->pages_read = 0;
model->key_found = false;
// Common fields
model->dict_keys_total = 0;
model->dict_keys_current = 0;
@@ -422,40 +411,26 @@ void dict_attack_set_type(DictAttack* instance, DictAttackType type) {
furi_assert(instance);
with_view_model(
instance->view,
DictAttackViewModel * model,
{
model->attack_type = type;
},
true);
instance->view, DictAttackViewModel * model, { model->attack_type = type; }, true);
}
void dict_attack_set_pages_total(DictAttack* instance, uint8_t pages_total) {
furi_assert(instance);
with_view_model(
instance->view,
DictAttackViewModel * model,
{ model->pages_total = pages_total; },
true);
instance->view, DictAttackViewModel * model, { model->pages_total = pages_total; }, true);
}
void dict_attack_set_pages_read(DictAttack* instance, uint8_t pages_read) {
furi_assert(instance);
with_view_model(
instance->view,
DictAttackViewModel * model,
{ model->pages_read = pages_read; },
true);
instance->view, DictAttackViewModel * model, { model->pages_read = pages_read; }, true);
}
void dict_attack_set_key_found(DictAttack* instance, bool key_found) {
furi_assert(instance);
with_view_model(
instance->view,
DictAttackViewModel * model,
{ model->key_found = key_found; },
true);
instance->view, DictAttackViewModel * model, { model->key_found = key_found; }, true);
}

View File

@@ -465,7 +465,8 @@ static NfcCommand mf_ultralight_poller_handler_auth_ultralight_c(MfUltralightPol
instance->state = MfUltralightPollerStateReadPages;
return command;
} else {
instance->auth_context.tdes_key = instance->mfu_event.data->key_request_data.key;
instance->auth_context.tdes_key =
instance->mfu_event.data->key_request_data.key;
}
} else {
FURI_LOG_D(TAG, "No key provided, skipping auth");