timmerk / libfreefare

Automatically exported from code.google.com/p/libfreefare
Other
0 stars 0 forks source link

Reading ultralightC: errors in handling read without auth #7

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
With ultralightC we could be in situations where read() is called without prior 
authentication and AUTH0 < MIFARE_ULTRALIGHT_C_PAGE_COUNT_READ + 1

Several situations may occur:
Let's put auth0 = value of AUTH0 at 0x2A

read(x) with x <= auth0 - 4:
  read done properly

read(x) with auth0 - 4 < x < auth0
  read result is wrapped
  bug in libfreefare: cached pages are not wrapped
  e.g. auth0=3, read(0) returns page0|page1|page2|page0 
  and libfreefare caches wrongly page4 with page0 content

read(x) with x >= auth0
  read fails properly

The difficulty to handle those cases, especially the early wrapping, is that 
0x2A cannot be read in such situations and must be deduced by trial & error.
E.g. by trying to access the latest cached page, we can see if we get an error 
or not and if cache is valid or not.
And probably we need to keep track of two other state values in the cache to 
avoid this extra check whenever it's possible:
* latest known valid page
* if we reach 0x2A we can remember its actual value
* if we're authenticated we don't need to check page validity

My proposal:
* use another temp buffer to hold read data
* reduce tag cache buffer to actual max size (today it's hacked =+3 to cope 
with wrapped read of last page)
* if (UL or (ULC and AUTHENTICATED)), copy data to cache with proper wrapping 
if required
* if (ULC and not AUTHENTICATED), copy one single page in cache and ignore rest 
of data

It's less efficient when reading without being authenticated but it keeps the 
code much clearer.
What do you think?

Original issue reported on code.google.com by yob...@gmail.com on 15 Jan 2013 at 8:18

GoogleCodeExporter commented 9 years ago
Original report: https://code.google.com/p/nfc-tools/issues/detail?id=106

Original comment by yob...@gmail.com on 15 Jan 2013 at 8:19

GoogleCodeExporter commented 9 years ago

Original comment by yob...@gmail.com on 15 Jan 2013 at 8:22