search

emsec / ChameleonMini

The ChameleonMini is a versatile contactless smartcard emulator compliant to NFC. The ChameleonMini was developed by https://kasper-oswald.de. The device is available at https://shop.kasper.it. For further information see the Getting Started Page https://rawgit.com/emsec/ChameleonMini/master/Doc/Doxygen/html/_page__getting_started.html or the Wiki tab above.
Other
1.75k stars 392 forks source link

Issues with Mifare DES-Fire Emulation #336

Closed flo-vienna closed 1 year ago

flo-vienna commented 1 year ago

Used Device: ChameleonMini RevG Used Firmware: DESFire-only Firmware Build 25e6545f9dd3cbf64ca6745db26663204684587a

ATS as reported by proxmark3: [+] ATS: 06 75 77 81 02 80 [ F0 00 ]

Steps to reproduce:

I tried to follow the instruction on this page: https://github.com/emsec/ChameleonMini/blob/master/Doc/DESFireSupportReadme.md

Executing the following command(s) does indeed work: CONFIG=MF_DESFIRE or CONFIG=MF_DESFIRE_2KEV1

Any subsequent requests like DF_SETHDR=ATS 067577810280

lead to an 201:INVALID COMMAND USAGE0 error no matter what I try, the same goes for DF_SETHDR? or DF_SETHDR=?

On a side-note, the UID is set via an ISO14443A command as this is not mentioned on the page but somehow in the code ?

tomaspre commented 1 year ago

Hi Flo,

I can confirm that I can reproduce the issues with the DF_SETHDR terminal command. I'll debug this and get back to you ASAP.

The command for changing UID is not DESFire-specific; therefore, that's not in the DESFire-specific readme. You can use the usual UID= and UID? commands.

tomaspre commented 1 year ago

Hi @flo-vienna,

I pushed a fix into the fix336 branch. The builds are below. You should now be able to set the ATS to any value as long as you set the first ATS byte to be the ATS size (as per DESFire specs). The updated DESFire-specific readme is here: https://github.com/emsec/ChameleonMini/blob/fix336/Doc/DESFireSupportReadme.md

Please let me know if these fixes work for you so I can merge them into master.

Builds with the fix from the fix336 branch: Chameleon-Mini-CustomBuild_DESFire-fix336.zip

flo-vienna commented 1 year ago

seems to work now :)