Skip to content

Commit

Permalink
Refactor Mifare fuzzer to new API
Browse files Browse the repository at this point in the history
  • Loading branch information
Sil333033 committed Nov 25, 2023
1 parent 66bb02e commit ac57443
Show file tree
Hide file tree
Showing 7 changed files with 92 additions and 61 deletions.
2 changes: 1 addition & 1 deletion applications/external/mifare_fuzzer/application.fam
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
App(
appid=".mifare_fuzzer",
appid="mifare_fuzzer",
name="Mifare Fuzzer",
apptype=FlipperAppType.EXTERNAL,
entry_point="mifare_fuzzer_app",
Expand Down
1 change: 0 additions & 1 deletion applications/external/mifare_fuzzer/mifare_fuzzer_i.h
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,6 @@ struct MifareFuzzerApp {

MifareCard card;
MifareFuzzerAttack attack;
FuriHalNfcDevData nfc_dev_data;
FuriString* app_folder;
FuriString* file_path;
FuriString* uid_str;
Expand Down
47 changes: 34 additions & 13 deletions applications/external/mifare_fuzzer/mifare_fuzzer_worker.c
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@

#include "mifare_fuzzer_worker.h"

/// @brief mifare_fuzzer_worker_alloc()
Expand All @@ -9,6 +8,10 @@ MifareFuzzerWorker* mifare_fuzzer_worker_alloc() {
mifare_fuzzer_worker->thread = furi_thread_alloc_ex(
"MifareFuzzerWorker", 8192, mifare_fuzzer_worker_task, mifare_fuzzer_worker);
mifare_fuzzer_worker->state = MifareFuzzerWorkerStateStop;

mifare_fuzzer_worker->nfc = nfc_alloc();
mifare_fuzzer_worker->nfc_device = nfc_device_alloc();

return mifare_fuzzer_worker;
}

Expand All @@ -17,6 +20,10 @@ MifareFuzzerWorker* mifare_fuzzer_worker_alloc() {
void mifare_fuzzer_worker_free(MifareFuzzerWorker* mifare_fuzzer_worker) {
furi_assert(mifare_fuzzer_worker);
furi_thread_free(mifare_fuzzer_worker->thread);

nfc_free(mifare_fuzzer_worker->nfc);
nfc_device_free(mifare_fuzzer_worker->nfc_device);

free(mifare_fuzzer_worker);
}

Expand Down Expand Up @@ -45,14 +52,19 @@ int32_t mifare_fuzzer_worker_task(void* context) {
MifareFuzzerWorker* mifare_fuzzer_worker = context;

if(mifare_fuzzer_worker->state == MifareFuzzerWorkerStateEmulate) {
FuriHalNfcDevData params = mifare_fuzzer_worker->nfc_dev_data;
const Iso14443_3aData* data =
nfc_device_get_data(mifare_fuzzer_worker->nfc_device, NfcProtocolIso14443_3a);

mifare_fuzzer_worker->nfc_listener =
nfc_listener_alloc(mifare_fuzzer_worker->nfc, NfcProtocolIso14443_3a, data);
nfc_listener_start(mifare_fuzzer_worker->nfc_listener, NULL, NULL);

furi_hal_nfc_exit_sleep();
while(mifare_fuzzer_worker->state == MifareFuzzerWorkerStateEmulate) {
furi_hal_nfc_listen(params.uid, params.uid_len, params.atqa, params.sak, false, 500);
furi_delay_ms(50);
}
furi_hal_nfc_sleep();

nfc_listener_stop(mifare_fuzzer_worker->nfc_listener);
nfc_listener_free(mifare_fuzzer_worker->nfc_listener);
}

mifare_fuzzer_worker->state = MifareFuzzerWorkerStateStop;
Expand All @@ -70,18 +82,27 @@ bool mifare_fuzzer_worker_is_emulating(MifareFuzzerWorker* mifare_fuzzer_worker)
return false;
}

/// @brief mifare_fuzzer_worker_set_nfc_dev_data()
/// @brief mifare_fuzzer_worker_set_nfc_data()
/// @param mifare_fuzzer_worker
/// @param nfc_dev_data
void mifare_fuzzer_worker_set_nfc_dev_data(
/// @param nfc_data
void mifare_fuzzer_worker_set_nfc_data(
MifareFuzzerWorker* mifare_fuzzer_worker,
FuriHalNfcDevData nfc_dev_data) {
mifare_fuzzer_worker->nfc_dev_data = nfc_dev_data;
Iso14443_3aData nfc_data) {
Iso14443_3aData* nfc_14a_data = iso14443_3a_alloc();
nfc_14a_data->uid_len = nfc_data.uid_len;
memcpy(nfc_14a_data->uid, nfc_data.uid, nfc_data.uid_len);
memcpy(nfc_14a_data->atqa, nfc_data.atqa, ATQA_LEN);
nfc_14a_data->sak = nfc_data.sak;

nfc_device_clear(mifare_fuzzer_worker->nfc_device);
nfc_device_set_data(mifare_fuzzer_worker->nfc_device, NfcProtocolIso14443_3a, nfc_14a_data);

iso14443_3a_free(nfc_14a_data);
}

/// @brief mifare_fuzzer_worker_get_nfc_dev_data()
/// @brief mifare_fuzzer_worker_get_nfc_data()
/// @param mifare_fuzzer_worker
/// @return
FuriHalNfcDevData mifare_fuzzer_worker_get_nfc_dev_data(MifareFuzzerWorker* mifare_fuzzer_worker) {
return mifare_fuzzer_worker->nfc_dev_data;
Iso14443_3aData mifare_fuzzer_worker_get_nfc_data(MifareFuzzerWorker* mifare_fuzzer_worker) {
return mifare_fuzzer_worker->nfc_data;
}
15 changes: 11 additions & 4 deletions applications/external/mifare_fuzzer/mifare_fuzzer_worker.h
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@
#include <furi.h>
#include <furi_hal.h>

#include <nfc/nfc_device.h>
#include <nfc/nfc_listener.h>
#include <nfc/protocols/iso14443_3a/iso14443_3a.h>

typedef enum MifareFuzzerWorkerState {
MifareFuzzerWorkerStateEmulate,
MifareFuzzerWorkerStateStop,
Expand All @@ -13,7 +17,10 @@ typedef enum MifareFuzzerWorkerState {
typedef struct MifareFuzzerWorker {
FuriThread* thread;
MifareFuzzerWorkerState state;
FuriHalNfcDevData nfc_dev_data;
Iso14443_3aData nfc_data;
NfcListener* nfc_listener;
NfcDevice* nfc_device;
Nfc* nfc;
} MifareFuzzerWorker;

// worker
Expand All @@ -25,7 +32,7 @@ void mifare_fuzzer_worker_start(MifareFuzzerWorker* mifare_fuzzer_worker);
int32_t mifare_fuzzer_worker_task(void* context);
//
bool mifare_fuzzer_worker_is_emulating(MifareFuzzerWorker* mifare_fuzzer_worker);
void mifare_fuzzer_worker_set_nfc_dev_data(
void mifare_fuzzer_worker_set_nfc_data(
MifareFuzzerWorker* mifare_fuzzer_worker,
FuriHalNfcDevData nfc_dev_data);
FuriHalNfcDevData mifare_fuzzer_worker_get_nfc_dev_data(MifareFuzzerWorker* mifare_fuzzer_worker);
Iso14443_3aData nfc_data);
Iso14443_3aData mifare_fuzzer_worker_get_nfc_data(MifareFuzzerWorker* mifare_fuzzer_worker);
Original file line number Diff line number Diff line change
Expand Up @@ -41,19 +41,21 @@ void mifare_fuzzer_scene_emulator_on_enter(void* context) {
mifare_fuzzer_emulator_set_ticks_between_cards(
app->emulator_view, emulator->ticks_between_cards);
// init default card data
FuriHalNfcDevData nfc_dev_data;
nfc_dev_data.atqa[0] = 0x00;
nfc_dev_data.atqa[1] = 0x00;
nfc_dev_data.sak = 0x00;
Iso14443_3aData nfc_data;
nfc_data.atqa[0] = 0x00;
nfc_data.atqa[1] = 0x00;
nfc_data.sak = 0x00;
if(app->card == MifareCardUltralight) {
nfc_dev_data.uid_len = 0x07;
nfc_data.uid_len = 0x07;
} else {
nfc_dev_data.uid_len = 0x04;
nfc_data.uid_len = 0x04;
}
for(uint32_t i = 0; i < nfc_dev_data.uid_len; i++) {
nfc_dev_data.uid[i] = 0x00;
for(uint32_t i = 0; i < nfc_data.uid_len; i++) {
nfc_data.uid[i] = 0x00;
}
mifare_fuzzer_emulator_set_nfc_dev_data(app->emulator_view, nfc_dev_data);

mifare_fuzzer_emulator_set_nfc_data(app->emulator_view, nfc_data);

// init other vars
attack_step = 0;

Expand All @@ -67,7 +69,7 @@ void mifare_fuzzer_scene_emulator_on_enter(void* context) {
/// @return
bool mifare_fuzzer_scene_emulator_on_event(void* context, SceneManagerEvent event) {
//FURI_LOG_D(TAG, "mifare_fuzzer_scene_emulator_on_event()");
FuriHalNfcDevData nfc_dev_data;
Iso14443_3aData nfc_data;

MifareFuzzerApp* app = context;
MifareFuzzerEmulator* emulator = app->emulator_view;
Expand All @@ -84,27 +86,27 @@ bool mifare_fuzzer_scene_emulator_on_event(void* context, SceneManagerEvent even
// Set card type
// TODO: Move somewhere else, I do not like this to be there
if(app->card == MifareCardClassic1k) {
nfc_dev_data.atqa[0] = 0x04;
nfc_dev_data.atqa[1] = 0x00;
nfc_dev_data.sak = 0x08;
nfc_dev_data.uid_len = 0x04;
nfc_data.atqa[0] = 0x04;
nfc_data.atqa[1] = 0x00;
nfc_data.sak = 0x08;
nfc_data.uid_len = 0x04;
} else if(app->card == MifareCardClassic4k) {
nfc_dev_data.atqa[0] = 0x02;
nfc_dev_data.atqa[1] = 0x00;
nfc_dev_data.sak = 0x18;
nfc_dev_data.uid_len = 0x04;
nfc_data.atqa[0] = 0x02;
nfc_data.atqa[1] = 0x00;
nfc_data.sak = 0x18;
nfc_data.uid_len = 0x04;
} else if(app->card == MifareCardUltralight) {
nfc_dev_data.atqa[0] = 0x44;
nfc_dev_data.atqa[1] = 0x00;
nfc_dev_data.sak = 0x00;
nfc_dev_data.uid_len = 0x07;
nfc_data.atqa[0] = 0x44;
nfc_data.atqa[1] = 0x00;
nfc_data.sak = 0x00;
nfc_data.uid_len = 0x07;
}

// Set UIDs
if(app->attack == MifareFuzzerAttackTestValues) {
// Load test UIDs
for(uint8_t i = 0; i < nfc_dev_data.uid_len; i++) {
nfc_dev_data.uid[i] = id_uid_test[attack_step][i];
for(uint8_t i = 0; i < nfc_data.uid_len; i++) {
nfc_data.uid[i] = id_uid_test[attack_step][i];
}
// Next UIDs on next loop
if(attack_step >= 8) {
Expand All @@ -121,13 +123,13 @@ bool mifare_fuzzer_scene_emulator_on_event(void* context, SceneManagerEvent even

// TODO: Manufacture-code must be selectable from a list
// use a fixed manufacture-code for now: 0x04 = NXP Semiconductors Germany
nfc_dev_data.uid[0] = 0x04;
for(uint8_t i = 1; i < nfc_dev_data.uid_len; i++) {
nfc_dev_data.uid[i] = (furi_hal_random_get() & 0xFF);
nfc_data.uid[0] = 0x04;
for(uint8_t i = 1; i < nfc_data.uid_len; i++) {
nfc_data.uid[i] = (furi_hal_random_get() & 0xFF);
}
} else {
for(uint8_t i = 0; i < nfc_dev_data.uid_len; i++) {
nfc_dev_data.uid[i] = (furi_hal_random_get() & 0xFF);
for(uint8_t i = 0; i < nfc_data.uid_len; i++) {
nfc_data.uid[i] = (furi_hal_random_get() & 0xFF);
}
}
} else if(app->attack == MifareFuzzerAttackLoadUidsFromFile) {
Expand Down Expand Up @@ -155,21 +157,21 @@ bool mifare_fuzzer_scene_emulator_on_event(void* context, SceneManagerEvent even

// parse string to UID
// TODO: a better validation on input?
for(uint8_t i = 0; i < nfc_dev_data.uid_len; i++) {
for(uint8_t i = 0; i < nfc_data.uid_len; i++) {
if(i <= ((furi_string_size(app->uid_str) - 1) / 2)) {
char temp_str[3];
temp_str[0] = furi_string_get_cstr(app->uid_str)[i * 2];
temp_str[1] = furi_string_get_cstr(app->uid_str)[i * 2 + 1];
temp_str[2] = '\0';
nfc_dev_data.uid[i] = (uint8_t)strtol(temp_str, NULL, 16);
nfc_data.uid[i] = (uint8_t)strtol(temp_str, NULL, 16);
} else {
nfc_dev_data.uid[i] = 0x00;
nfc_data.uid[i] = 0x00;
}
}
}

mifare_fuzzer_worker_set_nfc_dev_data(app->worker, nfc_dev_data);
mifare_fuzzer_emulator_set_nfc_dev_data(app->emulator_view, nfc_dev_data);
mifare_fuzzer_worker_set_nfc_data(app->worker, nfc_data);
mifare_fuzzer_emulator_set_nfc_data(app->emulator_view, nfc_data);

// Reset tick_counter
tick_counter = 0;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -39,12 +39,12 @@ static void mifare_fuzzer_emulator_draw_callback(Canvas* canvas, void* _model) {
char uid[25];
char uid_char[3];
cpos = 0;
for(uint8_t i = 0; i < model->nfc_dev_data.uid_len; i++) {
for(uint8_t i = 0; i < model->nfc_data.uid_len; i++) {
if(i > 0) {
uid[cpos] = ':';
cpos++;
}
snprintf(uid_char, sizeof(uid_char), "%02X", model->nfc_dev_data.uid[i]);
snprintf(uid_char, sizeof(uid_char), "%02X", model->nfc_data.uid[i]);
uid[cpos] = uid_char[0];
cpos++;
uid[cpos] = uid_char[1];
Expand Down Expand Up @@ -258,15 +258,15 @@ void mifare_fuzzer_emulator_set_attack(
/// @brief mifare_fuzzer_emulator_set_nfc_dev_data
/// @param mifare_fuzzer_emulator
/// @param nfc_dev_data
void mifare_fuzzer_emulator_set_nfc_dev_data(
void mifare_fuzzer_emulator_set_nfc_data(
MifareFuzzerEmulator* mifare_fuzzer_emulator,
FuriHalNfcDevData nfc_dev_data) {
Iso14443_3aData nfc_data) {
furi_assert(mifare_fuzzer_emulator);

with_view_model(
mifare_fuzzer_emulator->view,
MifareFuzzerEmulatorModel * model,
{ model->nfc_dev_data = nfc_dev_data; },
{ model->nfc_data = nfc_data; },
true);
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@
#include <gui/view.h>
#include <gui/elements.h>

#include "lib/nfc/protocols/iso14443_3a/iso14443_3a.h"

typedef void (*MifareFuzzerEmulatorCallback)(MifareFuzzerEvent event, void* context);

typedef enum MifareCard {
Expand Down Expand Up @@ -33,7 +35,7 @@ typedef struct MifareFuzzerEmulatorModel {
const char* mifare_card_dsc;
MifareFuzzerAttack attack;
const char* attack_dsc;
FuriHalNfcDevData nfc_dev_data;
Iso14443_3aData nfc_data;
bool is_attacking;
uint8_t tick_num;
uint8_t ticks_between_cards;
Expand All @@ -57,9 +59,9 @@ void mifare_fuzzer_emulator_set_callback(
MifareFuzzerEmulatorCallback callback,
void* context);

void mifare_fuzzer_emulator_set_nfc_dev_data(
void mifare_fuzzer_emulator_set_nfc_data(
MifareFuzzerEmulator* mifare_fuzzer_emulator,
FuriHalNfcDevData nfc_dev_data);
Iso14443_3aData nfc_data);

void mifare_fuzzer_emulator_set_ticks_between_cards(
MifareFuzzerEmulator* mifare_fuzzer_emulator,
Expand Down

0 comments on commit ac57443

Please sign in to comment.