flipperdevices / flipperzero-firmware

Flipper Zero firmware source code
https://flipperzero.one
GNU General Public License v3.0
12.03k stars 2.63k forks source link

NFC Magic app doesn't duplicate inconsistent SAK value on Mifare Classic 1k #2699

Closed nothsa closed 1 year ago

nothsa commented 1 year ago

Describe the bug.

When using the NFC Magic app to write to a NFC magic tag (gen 1a), it does not correctly duplicate the SAK value if the value is inconsistent with Block 0 on the original fob.

.nfc file from Original fob:

...
UID: [REDACTED UID #1]
ATQA: 00 04
SAK: 08
Mifare Classic type: 1K
Data format version: 2
Block 0: [REDACTED UID #1] [REDACTED BCC #1] 88 04 00 [REDACTED MANUFACTURER DATA #1]
...

We can see a SAK value of 08, and in Block 0 we see a SAK value of 88 on the Original fob

.nfc file from Magic fob (before copy, for reference):

...
UID: [REDACTED UID #2]
ATQA: 00 04
SAK: 08
Mifare Classic type: 1K
Data format version: 2
Block 0: [REDACTED UID #2] [REDACTED BCC #2] 08 04 00 [REDACTED MANUFACTURER DATA #2]
...

The Magic fob in its default state has a SAK value of 08 and a Block 0 SAK value of 08

.nfc file from Magic fob (after copy):

...
UID: [REDACTED UID #1]
ATQA: 00 04
SAK: 88
Mifare Classic type: 1K
Data format version: 2
Block 0: [REDACTED UID #1] [REDACTED BCC #1] 88 04 00 [REDACTED MANUFACTURER DATA #1]
...

After using the NFC Magic app to clone the Original tag to the Magic tag, it has a SAK value of 88 and a Block 0 SAK value of 88

When writing to the Magic tag, it should exactly duplicate the original tag with the inconsistent SAK value of 08 and 88

Reproduction

  1. Open "NFC" on Flipper
  2. "Read" a Mifare Classic 1K NFC tag with an inconsistent SAK value
  3. "Save" to a .nfc file
  4. Open the "NFC Magic" application on the Flipper
  5. Select the "Write Gen1A" option to write the saved .nfc file to the Magic tag

Target

No response

Logs

No response

Anything else?

No response

nothsa commented 1 year ago

After reading up some more, this might be a limitation of the Magic tag itself (where it will just show the SAK value as whatever the Block 0 value is set to). Closing.