flipperdevices / flipperzero-good-faps

Flipper Zero Official Apps maintained by Flipper Team and Friends
GNU General Public License v3.0
241 stars 46 forks source link

[NFC Magic] Issuing GEN4_CMD_GET_CFG may not be safe #204

Open Pwntastic opened 2 months ago

Pwntastic commented 2 months ago

Reading through the proxmark magic card notes, there's a note that using the UMC C6 / GEN4_CMD_GET_CFG command to retrieve a gen4 card's config may cause the actual config to change on some buggy cards:

👉 TODO Using C6 command can change config due to a bug in some cards. CC should be used instead. https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/magic_cards_notes.md#identify-26

It looks like the nfc_magic tool is issuing that C6 command when attempting to detect gen4 cards: https://github.com/flipperdevices/flipperzero-good-faps/blob/dev/nfc_magic/magic/protocols/gen4/gen4_poller.c#L107

#define GEN4_CMD_GET_CFG (0xC6)
...

NfcCommand gen4_poller_detect_callback(NfcGenericEvent event, void* context) {
...
            bit_buffer_append_byte(gen4_poller_detect_ctx->tx_buffer, GEN4_CMD_GET_CFG);

Perhaps it should instead just issue a CC / GEN4_CMD_GET_REVISION command instead?

#define GEN4_CMD_GET_REVISION (0xCC)