RfidResearchGroup / ChameleonUltra

The new generation chameleon based on NRF52840 makes the performance of card emulation more stable. And gave the chameleon the ability to read, write, and decrypt cards.

https://chameleonultra.com

GNU General Public License v3.0

838 stars 144 forks source link

Adding NXP id types for guesses and MIFARE Ultralight Classic reading #143

Closed FlUxIuS closed 10 months ago

FlUxIuS commented 11 months ago

Just a first and simple guessing features + reorganization of client code on the client side:

[USB] chameleon --> hf 14a info
- UID  Size: 4
- UID  Hex : 2Axxxxx
- SAK  Hex : 08
- ATQA Hex : 0400
Guessed type(s) from SAK: MIFARE Classic 1K | Plus SE 1K | Plug S 2K | Plus X 2K
- Mifare Classic technology
  # Prng attack: Weak

And adding MIFARE Ultralight reading abilities:

[USB] chameleon --> hf mfu rdpg -p 1
 - Data: c2e71d80

github-actions[bot] commented 11 months ago

You are welcome to add an entry to the CHANGELOG.md as well

github-actions[bot] commented 11 months ago

Built artifacts for commit 6edbad904677922d84574ed8c5b5fee64c049c14

Firmware

Client

doegox commented 11 months ago

Hi @FlUxIuS ! As I'm busy with a major PR, I took the liberty to merge your PR manually, you'll see it here https://github.com/RfidResearchGroup/ChameleonUltra/compare/42db1f8055491a7815fda661b00c3a8e69a3e826..19854340bfcb92b72cb6b3a676dcad06d29ca186 with other changes related to the MFC detection. I took only part of the client code reorganization because I think tests should not be chained conditionally. 2 examples:

some toys use a MFC with non-standard SAK and we still want to test for MFC prng
tests to be done like ATS should be done even if earlier test succeeded, here MFC prng because some cards support both MFC and ATS (e.g. MFP)

FlUxIuS commented 11 months ago

Roger Philip!

Sorry, I though the commit closed and pushed some more content with MIFARE Ultralight reading feature in the firmware as well. How do want me to proceed?

doegox commented 11 months ago

Hi @FlUxIuS Could you remove the SAK part (already merged in the other PR) and keep this PR only for the MFUL additions? It will be easier for me to merge it on top of the other PR. Thanks! (you can squash and force-push your commits so there will be just one commit with MFUL to integrate)

doegox commented 11 months ago

hi, I started integrating your MFU changes, but I don't understand the protocol you proposed for the command: type_value|page with type_value=0x60 by default. What type_value will be used for ?

doegox commented 10 months ago

Hi, I rewrote MFU support (again) to use the new hf 14a raw, so now it does not need any new support in the fw. cf https://github.com/RfidResearchGroup/ChameleonUltra/commit/790399350477875b75004de4eff52be8a7f1421b Also

BaseMFUAuthOpera is there only for parameters related to authentication (TODO), parameter -p now moved to mfu read.
BaseMFUDMP removed as parameters are solely for mfu dump, which is now subclass of BaseMFUAuthOpera
I reused the pm3 args for mfu dump: -p and -q
supports dumps into EML or binary

doegox commented 10 months ago

I think everything was ported and merged in the other PR, I'm closing it now, thanks!