search

flipperdevices / flipperzero-firmware

Flipper Zero firmware source code
https://flipperzero.one
GNU General Public License v3.0
12.95k stars 2.74k forks source link

Saving NFC key crashes Flipper Zero #3432

Closed RoBoneHead22 closed 7 months ago

RoBoneHead22 commented 9 months ago

Describe the bug.

I am attempting to save a Mifare DESFire NFC key fob and it crashes my flipper. After the reboot the key cannot be emulated I have attached Screenshots from the Flipper iOS app as well as the debug log. IMG_6688 IMG_6689

Reproduction

Main Menu --> NFC --> Read --> Save

Target

No response

Logs

_.-------.._                    -,
          .-""--..,,_/ /`-,               -,  \ 
       .:"          /:/  /'\  \     ,_...,  `. |  |
      /       ,----/:/  /`\ _\~`_-"`     _;
     '      / /`"""'\ \ \.~`_-'      ,-"'/ 
    |      | |  0    | | .-'      ,/`  /
   |    ,..\ \     ,.-"`       ,/`    /
  ;    :    `/`""\`           ,/--==,/-----,
  |    `-...|        -.___-Z:_______J...---;
  :         `                           _-'
 _L_  _     ___  ___  ___  ___  ____--"`___  _     ___
| __|| |   |_ _|| _ \| _ \| __|| _ \   / __|| |   |_ _|
| _| | |__  | | |  _/|  _/| _| |   /  | (__ | |__  | |
|_|  |____||___||_|  |_|  |___||_|_\   \___||____||___|

Welcome to Flipper Zero Command Line Interface!
Read the manual: https://docs.flipper.net/development/cli
Run `help` or `?` to list available commands

Firmware version: 0.98.2 0.98.2 (9744fd8f built on 01-02-2024)

>: log debug
Current log level: debug
Use <log ?> to list available log levels
Press CTRL+C to stop...
214180 [I][Loader] Loading /ext/apps/NFC/nfc.fap
214313 [I][Elf] Total size of loaded sections: 55725
214316 [I][Loader] Loaded in 136ms
214320 [I][AnimationManager] Unload animation 'L1_Cry_128x64'
216134 [D][NfcScanner] Found 5 base protocols
216140 [D][DolphinState] icounter 183, butthurt 11
216154 [D][Nfc] FWT Timeout
216191 [D][Nfc] FWT Timeout
216216 [D][Nfc] FWT Timeout
216268 [D][Nfc] FWT Timeout
216296 [D][Nfc] FWT Timeout
216319 [D][Nfc] FWT Timeout
216344 [D][Nfc] FWT Timeout
216369 [D][Nfc] FWT Timeout
216421 [D][Nfc] FWT Timeout
216449 [D][Nfc] FWT Timeout
216472 [D][Nfc] FWT Timeout
216497 [D][Nfc] FWT Timeout
216533 [D][Nfc] FWT Timeout
216585 [D][Nfc] FWT Timeout
216613 [D][Nfc] FWT Timeout
216636 [D][Nfc] FWT Timeout
216661 [D][Nfc] FWT Timeout
216686 [D][Nfc] FWT Timeout
216738 [D][Nfc] FWT Timeout
216766 [D][Nfc] FWT Timeout
216826 [D][Nfc] FWT Timeout
216862 [D][Nfc] FWT Timeout
216914 [D][Nfc] FWT Timeout
216942 [D][Nfc] FWT Timeout
216957 [D][NfcScanner] Found 4 children
217003 [D][Nfc] FWT Timeout
217005 [D][Nfc] FWT Timeout
217039 [D][Nfc] FWT Timeout
217072 [D][Iso14443_4aPoller] Read ATS success
217104 [I][NfcScanner] Detected 1 protocols
217266 [I][Elf] Total size of loaded sections: 888
217269 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217308 [I][Elf] Total size of loaded sections: 420
217311 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217348 [I][Elf] Total size of loaded sections: 836
217351 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217391 [I][Elf] Total size of loaded sections: 924
217394 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217442 [I][Elf] Total size of loaded sections: 1244
217445 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217487 [I][Elf] Total size of loaded sections: 1324
217490 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217536 [I][Elf] Total size of loaded sections: 1724
217539 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217581 [I][Elf] Total size of loaded sections: 1768
217584 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217626 [I][Elf] Total size of loaded sections: 1464
217629 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217669 [I][Elf] Total size of loaded sections: 636
217672 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217714 [I][Elf] Total size of loaded sections: 1028
217717 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
217721 [D][NfcSupportedCards] Loaded 11 plugins
217738 [D][Iso14443_4aPoller] Read ATS success
217748 [D][MfDesfirePoller] Read version success
217753 [D][MfDesfirePoller] Read free memory success
217757 [D][MfDesfirePoller] Read master key settings success
217762 [D][MfDesfirePoller] Read master key version success
217769 [D][MfDesfirePoller] Read application ids success
217916 [D][MfDesfirePoller] Read applications success
217918 [D][MfDesfirePoller] Read success.
217921 [D][Nfc] FWT Timeout
217992 [I][Elf] Total size of loaded sections: 1244
217995 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
218036 [I][Elf] Total size of loaded sections: 1324
218039 [D][Fap] Library for NfcSupportedCardPlugin, API v. 1 loaded
218155 [D][DolphinState] icounter 183, butthurt 11
225908 [D][GattChar] Updating Battery Level char

Anything else?

No response

skotopes commented 9 months ago

@RoBoneHead22 can you try dev? we have couple desfire fixes in it.

ArkBrj commented 9 months ago

Got the same problem with the same type of NFC. Per suggestion, installed the latest dev firmware and tried again. The situation is worse now. When I press Save, Flipper displays an hourglass and hangs in this state forever. The log is attached. cli-dump.txt

RoBoneHead22 commented 8 months ago

@skotopes Hello, I tried release, RC, and dev Channels. Same result. Currently updated to Release Channel 0.98.3 and same issue

skotopes commented 8 months ago

@RoBoneHead22 how about now?

ArkBrj commented 8 months ago

@skotopes Tried 0.99.1-RC and dev 022fccf0. Same as before. RC build crashes with null pointer dereference, the dev build hangs forever.

RoBoneHead22 commented 7 months ago

I am starting to believe that this issue is deeper than just the firmware. I even tried the XFW firmware and had the same results. Reverted back to the release firmware now, still no change.

skotopes commented 7 months ago

@RoBoneHead22 @ArkBrj we need someone to provide us backtrace. Anyone of you have debugger(wifi board/st-link/j-link/etc)?

ArkBrj commented 7 months ago

@RoBoneHead22 I have a cheap ST-Link clone bought on AliExpress few years back. I also have Flipper's wi-fi board, but I have not tried it yet and have no idea what software to use with it. I can try to collect the info you need, but I need detailed instructions how to do this. I would prefer to use Windows software on the host if it is an option.

ArkBrj commented 7 months ago

@skotopes Just realized that I tagged a wrong person in my previous post. Correcting the mistake....

@RoBoneHead22 I have a cheap ST-Link clone bought on AliExpress few years back. I also have Flipper's wi-fi board, but I have not tried it yet and have no idea what software to use with it. I can try to collect the info you need, but I need detailed instructions how to do this. I would prefer to use Windows software on the host if it is an option.

gornekich commented 7 months ago

3576 should fix the issue

gornekich commented 7 months ago

Please try latest dev and reopen if issue persists.

ArkBrj commented 7 months ago

@gornekich I confirm that flipper does not crash anymore. Thanks for the fix! However, there might be some other problem with such cards - when I replay the recording, the door does not open. I recorded the same NFC twice and both recording do not work as the original NFC. Compared them - they are identical, so there might be a problem with how flipper emulates (or how it records for that matter). I have a friend who also has a flipper, I will try to use that one to record what mine produces and compare them.

ArkBrj commented 7 months ago

@gornekich Hello, I need some advise. Should I reopen this issue or create a completely new one? Here is what I found.

On my FZ1 I recorded the original NFC. The resultant file consists of 2 parts (I removed most of the lines for brevity and privacy):

1) 15 lines looking like this:

Filetype: Flipper NFC device
Version: 4
# Device type can be ISO14443-3A, ISO14443-3B, ISO14443-4A, ISO14443-4B, ISO15693-3, FeliCa, NTAG/Ultralight, Mifare Classic, Mifare DESFire, SLIX, ST25TB
Device type: Mifare DESFire
...
T1...Tk: 80

2) 157 lines starting with:

# Mifare DESFire specific data

I replayed this recording and recorded on another FZ2 (also updated to the latest dev build). The recording on FZ2 shows only 15 lines looking like this:

Filetype: Flipper NFC device
Version: 4
# Device type can be ISO14443-3A, ISO14443-3B, ISO14443-4A, ISO14443-4B, ISO15693-3, FeliCa, NTAG/Ultralight, Mifare Classic, Mifare DESFire, SLIX, ST25TB
Device type: ISO14443-4A
...
T1...Tk: 80

Not only the second recording is much shorter and missing all "Mifare DESFire specific data" portion, the Device Type is not "Mifare DESFire" anymore. Seems like a problem with replaying such recordings.

gornekich commented 7 months ago

Hello @ArkBrj Flipper doesn't support full Mifare DESFire emulation. When you emulate your card, you can see only "Emulate UID" option. That's why when you read emulation with the other flipper, it shows ISO14443-4A data.

Basically, Mifare DESFire is very secure protocol. If you don't know keys from your card, it's almost impossible to find them. And without these keys you can't emulate your card

ArkBrj commented 7 months ago

@gornekich Thank you very much for the detailed explanation. I missed this part in the doc.