search

flipperdevices / flipperzero-firmware

Flipper Zero firmware source code
https://flipperzero.one
GNU General Public License v3.0
12.62k stars 2.69k forks source link

[FL-3811] Write to ultralight cards is now possible #3684

Closed RebornedBrain closed 3 months ago

RebornedBrain commented 3 months ago

What's new

Related issue: https://github.com/flipperdevices/flipperzero-firmware/issues/3592

Verification

First way:

  1. On Flipper read any MFU11 card
  2. Then download dump and adjust user memory in vscode, after that upload it back to Flipper
  3. Open dump in NFC app and choose 'Write'
  4. Apply the card from step 1 to Flipper's back

Second way (need two Flippers):

  1. On the first one run an emulation of any MFU11 card
  2. Read emulation on the second Flipper
  3. Then download dump from 2nd Flipper and adjust user memory in vscode, after that upload it back to Flipper
  4. Open dump in NFC app and choose 'Write'
  5. Apply second Flipper back to the first one
  6. After write complete, stop emulation on the 1st one, open 'Info' -> 'More' and check that new data has been written

Checklist (For Reviewer)

klkvsk commented 3 months ago

Writing stored dump back to password-protected UL11 card results in "Card protected by password, AUTH0 or lock bits". As seen in debug log, the password from dump (page 18) is never used:

4198784 [D][MfUltralightPoller] Read version success
4198786 [D][MfUltralightPoller] Mifare Ultralight 11 detected. Total pages: 20
4198790 [D][MfUltralightPoller] Reading signature
4198799 [D][MfUltralightPoller] Read page 0 success
4198801 [D][MfUltralightPoller] Read page 1 success
4198804 [D][MfUltralightPoller] Read page 2 success
...
4198847 [D][MfUltralightPoller] Read page 15 success
4198850 [D][MfUltralightPoller] Read page 16 failed
4198853 [D][MfUltralightPoller] Reading counter 0
4198860 [D][Nfc] FWT Timeout
4198862 [D][MfUltralightPoller] Failed to read 0 counter
4198865 [D][MfUltralightPoller] Reading tearing flag 0
4198873 [D][Nfc] FWT Timeout
4198874 [D][MfUltralightPoller] Reading tearing flag 0 failed
4198989 [D][MfUltralightPoller] No limits in authentication. Trying default password
4198998 [D][Nfc] FWT Timeout
4199000 [D][MfUltralightPoller] Read success
4199002 [D][MfUltralightPoller] Check writing capability
4199005 [D][MfUltralightPoller] Unknown password

Not sure why does it need to re-read the card before write, but it seems like auth context is not set before any operations.

RebornedBrain commented 3 months ago

It's a correct behaviour, because currently Flipper writes only initial cards, for example with NTAG213 it will behave the same