Skip to content

Conversation

mishamyte
Copy link
Contributor

What's new

That PR brings some refactoring and improvement:

  • Attempt to authenticate to UL-C with default key
  • UL-C authentication was extracted to helper method
  • Fixed logical bug where UL-C auth stages used instance->mfu_event.data->auth_context.tdes_key.data instead of instance->auth_context.tdes_key.data
  • For simplification of unlocking UL11/UL21/NTAGs (where pwd is applicable) and UL-C we are prepopulating input with default transport key for that chip type. I can be useful in cases where tag has transport key, but some pages locked and use need to enter default key. It's crucial for Ultralight C, where key size is 16 bytes

Verification

Attempt of authentication with default key for Ultralight C

New feature:

  • Take UL-C with default PWD and not changed auth conditions. Then try to read via NFC. 48/48 should be read

Regression

  • Use UL-C with non-default PWD. Read. 44/48 should be read (with default auth conditions)
  • Unlock and enter password manually. After unlock 48/48 should be read

Pre-populating default keys

New feature:

  • Read tag of corresponding type with locked pages
  • Chose unlock with manual input
  • Validate a value in input
  • (Optional) If you tag has default pwd - proceed with pre-populated value

Regression validation:

  • Ensure input accepts manually entered value and tries to unlock using it

Checklist (For Reviewer)

  • PR has description of feature/bug or link to Confluence/Jira task
  • Description contains actions to verify feature/bugfix
  • I've built this code, uploaded it to the device and verified feature/bugfix

@mishamyte
Copy link
Contributor Author

Please let me know if I should keep API version bumped or should I revert it. Thanks!

@hedger hedger added NFC NFC-related New Feature Contains an IMPLEMENTATION of a new feature labels May 2, 2025
@hedger
Copy link
Member

hedger commented May 2, 2025

Please also build f18 target and sync the API versions to match.
./fbt TARGET_HW=18

@mishamyte mishamyte changed the title [NFC]: Ultralight C. Attempt of authentication with default key + use default UL/UL-C pwd/key as default value for key input [NFC] Ultralight C. Attempt of authentication with default key + use default UL/UL-C pwd/key as default value for key input May 2, 2025
@noproto
Copy link
Contributor

noproto commented May 23, 2025

Before this is merged, I have a complete UL-C dictionary attack I'm planning on upstreaming. I've also included multiple fixes for the firmware in my changes to support it, and additional NFC app features that bring parity with MIFARE Classic.

For context there are multiple key recovery attacks we'll make available on the FZ and PM3 alongside the dictionary attack. We've just been working through disclosure.

@mishamyte
Copy link
Contributor Author

Before this is merged, I have a complete UL-C dictionary attack I'm planning on upstreaming. I've also included multiple fixes for the firmware in my changes to support it, and additional NFC app features that bring parity with MIFARE Classic.

For context there are multiple key recovery attacks we'll make available on the FZ and PM3 alongside the dictionary attack. We've just been working through disclosure.

  • Dictionary one will be more general (again, if with all standard default keys). That one was a quick fix (actually two) caz I was annoyed of partial read for tags with transport keys and need of manual enter
  • Sorry, didn't get for what that app will be for
  • About attacks, from our previous talks I came to conclusion it won't be a process for nearest future and will take a time, but those ones will be valuable to have

@noproto
Copy link
Contributor

noproto commented Aug 22, 2025

Update: Tomorrow the UL-C dictionary recovery method, Flipper-based UL-C key manager, UI etc will be complete. I will aim to upstream after that.

I reviewed this PR, and we should be able to close it after I open the next PR as I believe it captures everything in this PR

@noproto
Copy link
Contributor

noproto commented Sep 6, 2025

Update: Tomorrow the UL-C dictionary recovery method, Flipper-based UL-C key manager, UI etc will be complete. I will aim to upstream after that.

I reviewed this PR, and we should be able to close it after I open the next PR as I believe it captures everything in this PR

Done. PR #4271 should supersede this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
New Feature Contains an IMPLEMENTATION of a new feature NFC NFC-related
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants