update ofw plugins, add new plugins

base_pack/avr_isp_programmer/application.fam

@@ -5,7 +5,8 @@ App(
     entry_point="avr_isp_app",
     requires=["gui"],
     stack_size=4 * 1024,
-    order=20,
+    fap_description="Application for flashing AVR microcontrollers",
+    fap_version="1.0",
     fap_icon="avr_app_icon_10x10.png",
     fap_category="GPIO",
     fap_icon_assets="images",

base_pack/avr_isp_programmer/helpers/avr_isp_worker_rw.c

@@ -350,12 +350,12 @@ static void avr_isp_worker_rw_get_dump_flash(AvrIspWorkerRW* instance, const cha
             sizeof(data));
         flipper_i32hex_file_bin_to_i32hex_set_data(
             flipper_hex_flash, data, avr_isp_chip_arr[instance->chip_arr_ind].pagesize);
-        //FURI_LOG_D(TAG, "%s", flipper_i32hex_file_get_string(flipper_hex_flash));
+        FURI_LOG_D(TAG, "%s", flipper_i32hex_file_get_string(flipper_hex_flash));
         instance->progress_flash =
             (float)(i) / ((float)avr_isp_chip_arr[instance->chip_arr_ind].flashsize / 2.0f);
     }
     flipper_i32hex_file_bin_to_i32hex_set_end_line(flipper_hex_flash);
-    //FURI_LOG_D(TAG, "%s", flipper_i32hex_file_get_string(flipper_hex_flash));
+    FURI_LOG_D(TAG, "%s", flipper_i32hex_file_get_string(flipper_hex_flash));
     flipper_i32hex_file_close(flipper_hex_flash);
     instance->progress_flash = 1.0f;
 }

base_pack/avr_isp_programmer/lib/driver/avr_isp_prog.c

@@ -196,7 +196,7 @@ static void avr_isp_prog_set_cfg(AvrIspProg* instance) {
     instance->cfg->lockbytes = instance->buff[6];
     instance->cfg->fusebytes = instance->buff[7];
     instance->cfg->flashpoll = instance->buff[8];
-    // ignore (instance->buff[9] == instance->buff[8]) //FLASH polling value. Same as �flashpoll�
+    // ignore (instance->buff[9] == instance->buff[8]) //FLASH polling value. Same as “flashpoll”
     instance->cfg->eeprompoll = instance->buff[10] << 8 | instance->buff[11];
     instance->cfg->pagesize = instance->buff[12] << 8 | instance->buff[13];
     instance->cfg->eepromsize = instance->buff[14] << 8 | instance->buff[15];

base_pack/dap_link/README.md

@@ -1,7 +1,9 @@
 # Flipper Zero as CMSIS DAP/DAP Link
+
 Flipper Zero as a [Free-DAP](https://github.com/ataradov/free-dap) based SWD\JTAG debugger. Free-DAP is a free and open source firmware implementation of the [CMSIS-DAP](https://www.keil.com/pack/doc/CMSIS_Dev/DAP/html/index.html) debugger.
 
 ## Protocols
+
 SWD, JTAG , CMSIS-DAP v1 (18 KiB/s), CMSIS-DAP v2 (46 KiB/s), VCP (USB-UART).
 
 WinUSB for driverless installation for Windows 8 and above.
@@ -9,6 +11,7 @@ WinUSB for driverless installation for Windows 8 and above.
 ## Usage
 
 ### VSCode + Cortex-Debug
+
   Set `"device": "cmsis-dap"`
   
 <details>

base_pack/dap_link/application.fam

@@ -8,7 +8,8 @@ App(
         "dialogs",
     ],
     stack_size=4 * 1024,
-    order=20,
+    fap_description="Enables use of Flipper as a debug probe for ARM devices, implements the CMSIS-DAP protocol",
+    fap_version="1.0",
     fap_icon="dap_link.png",
     fap_category="GPIO",
     fap_private_libs=[

base_pack/mass_storage/application.fam

@@ -0,0 +1,16 @@
+App(
+    appid="mass_storage",
+    name="Mass Storage",
+    apptype=FlipperAppType.EXTERNAL,
+    entry_point="mass_storage_app",
+    requires=[
+        "gui",
+        "dialogs",
+    ],
+    stack_size=2 * 1024,
+    fap_description="Implements a mass storage device over USB for disk images",
+    fap_version="1.1",
+    fap_icon="assets/mass_storage_10px.png",
+    fap_icon_assets="assets",
+    fap_category="USB",
+)

base_pack/mass_storage/helpers/mass_storage_scsi.c

@@ -0,0 +1,266 @@
+#include "mass_storage_scsi.h"
+
+#include <core/log.h>
+
+#define TAG "MassStorageSCSI"
+
+#define SCSI_TEST_UNIT_READY (0x00)
+#define SCSI_REQUEST_SENSE (0x03)
+#define SCSI_INQUIRY (0x12)
+#define SCSI_READ_FORMAT_CAPACITIES (0x23)
+#define SCSI_READ_CAPACITY_10 (0x25)
+#define SCSI_MODE_SENSE_6 (0x1A)
+#define SCSI_READ_10 (0x28)
+#define SCSI_PREVENT_MEDIUM_REMOVAL (0x1E)
+#define SCSI_START_STOP_UNIT (0x1B)
+#define SCSI_WRITE_10 (0x2A)
+
+bool scsi_cmd_start(SCSISession* scsi, uint8_t* cmd, uint8_t len) {
+    if(!len) {
+        scsi->sk = SCSI_SK_ILLEGAL_REQUEST;
+        scsi->asc = SCSI_ASC_INVALID_COMMAND_OPERATION_CODE;
+        return false;
+    }
+    FURI_LOG_T(TAG, "START %02X", cmd[0]);
+    scsi->cmd = cmd;
+    scsi->cmd_len = len;
+    scsi->rx_done = false;
+    scsi->tx_done = false;
+    switch(cmd[0]) {
+    case SCSI_WRITE_10: {
+        if(len < 10) return false;
+        scsi->write_10.lba = cmd[2] << 24 | cmd[3] << 16 | cmd[4] << 8 | cmd[5];
+        scsi->write_10.count = cmd[7] << 8 | cmd[8];
+        FURI_LOG_D(TAG, "SCSI_WRITE_10 %08lX %04X", scsi->write_10.lba, scsi->write_10.count);
+        return true;
+    }; break;
+    case SCSI_READ_10: {
+        if(len < 10) return false;
+        scsi->read_10.lba = cmd[2] << 24 | cmd[3] << 16 | cmd[4] << 8 | cmd[5];
+        scsi->read_10.count = cmd[7] << 8 | cmd[8];
+        FURI_LOG_D(TAG, "SCSI_READ_10 %08lX %04X", scsi->read_10.lba, scsi->read_10.count);
+        return true;
+    }; break;
+    }
+    return true;
+}
+
+bool scsi_cmd_rx_data(SCSISession* scsi, uint8_t* data, uint32_t len) {
+    FURI_LOG_T(TAG, "RX %02X len %lu", scsi->cmd[0], len);
+    if(scsi->rx_done) return false;
+    switch(scsi->cmd[0]) {
+    case SCSI_WRITE_10: {
+        uint32_t block_size = SCSI_BLOCK_SIZE;
+        uint16_t blocks = len / block_size;
+        bool result =
+            scsi->fn.write(scsi->fn.ctx, scsi->write_10.lba, blocks, data, blocks * block_size);
+        scsi->write_10.lba += blocks;
+        scsi->write_10.count -= blocks;
+        if(!scsi->write_10.count) {
+            scsi->rx_done = true;
+        }
+        return result;
+    }; break;
+    default: {
+        FURI_LOG_W(TAG, "unexpected scsi rx data cmd=%02X", scsi->cmd[0]);
+        scsi->sk = SCSI_SK_ILLEGAL_REQUEST;
+        scsi->asc = SCSI_ASC_INVALID_COMMAND_OPERATION_CODE;
+        return false;
+    }; break;
+    }
+}
+
+bool scsi_cmd_tx_data(SCSISession* scsi, uint8_t* data, uint32_t* len, uint32_t cap) {
+    FURI_LOG_T(TAG, "TX %02X cap %lu", scsi->cmd[0], cap);
+    if(scsi->tx_done) return false;
+    switch(scsi->cmd[0]) {
+    case SCSI_REQUEST_SENSE: {
+        FURI_LOG_D(TAG, "SCSI_REQUEST_SENSE");
+        if(cap < 18) return false;
+        memset(data, 0, cap);
+        data[0] = 0x70; // fixed format sense data
+        data[1] = 0; // obsolete
+        data[2] = scsi->sk; // sense key
+        data[3] = 0; // information
+        data[4] = 0; // information
+        data[5] = 0; // information
+        data[6] = 0; // information
+        data[7] = 10; // additional sense length (len-8)
+        data[8] = 0; // command specific information
+        data[9] = 0; // command specific information
+        data[10] = 0; // command specific information
+        data[11] = 0; // command specific information
+        data[12] = scsi->asc; // additional sense code
+        data[13] = 0; // additional sense code qualifier
+        data[14] = 0; // field replaceable unit code
+        data[15] = 0; // sense key specific information
+        data[16] = 0; // sense key specific information
+        data[17] = 0; // sense key specific information
+        *len = 18;
+        scsi->sk = 0;
+        scsi->asc = 0;
+        scsi->tx_done = true;
+        return true;
+    }; break;
+    case SCSI_INQUIRY: {
+        FURI_LOG_D(TAG, "SCSI_INQUIRY");
+        if(scsi->cmd_len < 5) return false;
+
+        if(cap < 36) return false;
+
+        bool evpd = scsi->cmd[1] & 1;
+        uint8_t page_code = scsi->cmd[2];
+        if(evpd == 0) {
+            if(page_code != 0) return false;
+
+            data[0] = 0x00; // device type: direct access block device
+            data[1] = 0x80; // removable: true
+            data[2] = 0x04; // version
+            data[3] = 0x02; // response data format
+            data[4] = 31; // additional length (len - 5)
+            data[5] = 0; // flags
+            data[6] = 0; // flags
+            data[7] = 0; // flags
+            memcpy(data + 8, "Flipper ", 8); // vendor id
+            memcpy(data + 16, "Mass Storage    ", 16); // product id
+            memcpy(data + 32, "0001", 4); // product revision level
+            *len = 36;
+            scsi->tx_done = true;
+            return true;
+        } else {
+            if(page_code != 0x80) {
+                FURI_LOG_W(TAG, "Unsupported VPD code %02X", page_code);
+                return false;
+            }
+            data[0] = 0x00;
+            data[1] = 0x80;
+            data[2] = 0x00;
+            data[3] = 0x01; // Serial len
+            data[4] = '0';
+            *len = 5;
+            scsi->tx_done = true;
+            return true;
+        }
+    }; break;
+    case SCSI_READ_FORMAT_CAPACITIES: {
+        FURI_LOG_D(TAG, "SCSI_READ_FORMAT_CAPACITIES");
+        if(cap < 12) {
+            return false;
+        }
+        uint32_t n_blocks = scsi->fn.num_blocks(scsi->fn.ctx);
+        uint32_t block_size = SCSI_BLOCK_SIZE;
+        // Capacity List Header
+        data[0] = 0;
+        data[1] = 0;
+        data[2] = 0;
+        data[3] = 8;
+
+        // Capacity Descriptor
+        data[4] = (n_blocks - 1) >> 24;
+        data[5] = (n_blocks - 1) >> 16;
+        data[6] = (n_blocks - 1) >> 8;
+        data[7] = (n_blocks - 1) & 0xFF;
+        data[8] = 0x02; // Formatted media
+        data[9] = block_size >> 16;
+        data[10] = block_size >> 8;
+        data[11] = block_size & 0xFF;
+        *len = 12;
+        scsi->tx_done = true;
+        return true;
+    }; break;
+    case SCSI_READ_CAPACITY_10: {
+        FURI_LOG_D(TAG, "SCSI_READ_CAPACITY_10");
+        if(cap < 8) return false;
+        uint32_t n_blocks = scsi->fn.num_blocks(scsi->fn.ctx);
+        uint32_t block_size = SCSI_BLOCK_SIZE;
+        data[0] = (n_blocks - 1) >> 24;
+        data[1] = (n_blocks - 1) >> 16;
+        data[2] = (n_blocks - 1) >> 8;
+        data[3] = (n_blocks - 1) & 0xFF;
+        data[4] = block_size >> 24;
+        data[5] = block_size >> 16;
+        data[6] = block_size >> 8;
+        data[7] = block_size & 0xFF;
+        *len = 8;
+        scsi->tx_done = true;
+        return true;
+    }; break;
+    case SCSI_MODE_SENSE_6: {
+        FURI_LOG_D(TAG, "SCSI_MODE_SENSE_6 %lu", cap);
+        if(cap < 4) return false;
+        data[0] = 3; // mode data length (len - 1)
+        data[1] = 0; // medium type
+        data[2] = 0; // device-specific parameter
+        data[3] = 0; // block descriptor length
+        *len = 4;
+        scsi->tx_done = true;
+        return true;
+    }; break;
+    case SCSI_READ_10: {
+        uint32_t block_size = SCSI_BLOCK_SIZE;
+        bool result =
+            scsi->fn.read(scsi->fn.ctx, scsi->read_10.lba, scsi->read_10.count, data, len, cap);
+        *len -= *len % block_size;
+        uint16_t blocks = *len / block_size;
+        scsi->read_10.lba += blocks;
+        scsi->read_10.count -= blocks;
+        if(!scsi->read_10.count) {
+            scsi->tx_done = true;
+        }
+        return result;
+    }; break;
+    default: {
+        FURI_LOG_W(TAG, "unexpected scsi tx data cmd=%02X", scsi->cmd[0]);
+        scsi->sk = SCSI_SK_ILLEGAL_REQUEST;
+        scsi->asc = SCSI_ASC_INVALID_COMMAND_OPERATION_CODE;
+        return false;
+    }; break;
+    }
+}
+
+bool scsi_cmd_end(SCSISession* scsi) {
+    FURI_LOG_T(TAG, "END %02X", scsi->cmd[0]);
+    uint8_t* cmd = scsi->cmd;
+    uint8_t len = scsi->cmd_len;
+    scsi->cmd = NULL;
+    scsi->cmd_len = 0;
+    switch(cmd[0]) {
+    case SCSI_WRITE_10:
+        return scsi->rx_done;
+
+    case SCSI_REQUEST_SENSE:
+    case SCSI_INQUIRY:
+    case SCSI_READ_FORMAT_CAPACITIES:
+    case SCSI_READ_CAPACITY_10:
+    case SCSI_MODE_SENSE_6:
+    case SCSI_READ_10:
+        return scsi->tx_done;
+
+    case SCSI_TEST_UNIT_READY: {
+        FURI_LOG_D(TAG, "SCSI_TEST_UNIT_READY");
+        return true;
+    }; break;
+    case SCSI_PREVENT_MEDIUM_REMOVAL: {
+        if(len < 6) return false;
+        bool prevent = cmd[5];
+        FURI_LOG_D(TAG, "SCSI_PREVENT_MEDIUM_REMOVAL prevent=%d", prevent);
+        return !prevent;
+    }; break;
+    case SCSI_START_STOP_UNIT: {
+        if(len < 6) return false;
+        bool eject = (cmd[4] & 2) != 0;
+        bool start = (cmd[4] & 1) != 0;
+        FURI_LOG_D(TAG, "SCSI_START_STOP_UNIT eject=%d start=%d", eject, start);
+        if(eject) {
+            scsi->fn.eject(scsi->fn.ctx);
+        }
+        return true;
+    }; break;
+    default: {
+        FURI_LOG_W(TAG, "unexpected scsi cmd=%02X", cmd[0]);
+        scsi->sk = SCSI_SK_ILLEGAL_REQUEST;
+        scsi->asc = SCSI_ASC_INVALID_COMMAND_OPERATION_CODE;
+        return false;
+    }; break;
+    }
+}

base_pack/mass_storage/helpers/mass_storage_scsi.h

@@ -0,0 +1,56 @@
+#pragma once
+
+#include <furi.h>
+
+#define SCSI_BLOCK_SIZE (0x200UL)
+
+#define SCSI_SK_ILLEGAL_REQUEST (5)
+
+#define SCSI_ASC_INVALID_COMMAND_OPERATION_CODE (0x20)
+#define SCSI_ASC_LBA_OOB (0x21)
+#define SCSI_ASC_INVALID_FIELD_IN_CDB (0x24)
+
+typedef struct {
+    void* ctx;
+    bool (*read)(
+        void* ctx,
+        uint32_t lba,
+        uint16_t count,
+        uint8_t* out,
+        uint32_t* out_len,
+        uint32_t out_cap);
+    bool (*write)(void* ctx, uint32_t lba, uint16_t count, uint8_t* buf, uint32_t len);
+    uint32_t (*num_blocks)(void* ctx);
+    void (*eject)(void* ctx);
+} SCSIDeviceFunc;
+
+typedef struct {
+    SCSIDeviceFunc fn;
+
+    uint8_t* cmd;
+    uint8_t cmd_len;
+    bool rx_done;
+    bool tx_done;
+
+    uint8_t sk; // sense key
+    uint8_t asc; // additional sense code
+
+    // command-specific data
+    // valid from cmd_start to cmd_end
+    union {
+        struct {
+            uint16_t count;
+            uint32_t lba;
+        } read_10; // SCSI_READ_10
+
+        struct {
+            uint16_t count;
+            uint32_t lba;
+        } write_10; // SCSI_WRITE_10
+    };
+} SCSISession;
+
+bool scsi_cmd_start(SCSISession* scsi, uint8_t* cmd, uint8_t len);
+bool scsi_cmd_rx_data(SCSISession* scsi, uint8_t* data, uint32_t len);
+bool scsi_cmd_tx_data(SCSISession* scsi, uint8_t* data, uint32_t* len, uint32_t cap);
+bool scsi_cmd_end(SCSISession* scsi);

base_pack/mass_storage/helpers/mass_storage_usb.c

@@ -0,0 +1,482 @@
+#include "mass_storage_usb.h"
+#include <furi_hal.h>
+
+#define TAG "MassStorageUsb"
+
+#define USB_MSC_RX_EP (0x01)
+#define USB_MSC_TX_EP (0x82)
+
+#define USB_MSC_RX_EP_SIZE (64UL)
+#define USB_MSC_TX_EP_SIZE (64UL)
+
+#define USB_MSC_BOT_GET_MAX_LUN (0xFE)
+#define USB_MSC_BOT_RESET (0xFF)
+
+#define CBW_SIG (0x43425355)
+#define CBW_FLAGS_DEVICE_TO_HOST (0x80)
+
+#define CSW_SIG (0x53425355)
+#define CSW_STATUS_OK (0)
+#define CSW_STATUS_NOK (1)
+#define CSW_STATUS_PHASE_ERROR (2)
+
+// must be SCSI_BLOCK_SIZE aligned
+// larger than 0x10000 exceeds size_t, storage_file_* ops fail
+#define USB_MSC_BUF_MAX (0x10000UL - SCSI_BLOCK_SIZE)
+
+static usbd_respond usb_ep_config(usbd_device* dev, uint8_t cfg);
+static usbd_respond usb_control(usbd_device* dev, usbd_ctlreq* req, usbd_rqc_callback* callback);
+
+typedef enum {
+    EventExit = 1 << 0,
+    EventReset = 1 << 1,
+    EventRxTx = 1 << 2,
+
+    EventAll = EventExit | EventReset | EventRxTx,
+} MassStorageEvent;
+
+typedef struct {
+    uint32_t sig;
+    uint32_t tag;
+    uint32_t len;
+    uint8_t flags;
+    uint8_t lun;
+    uint8_t cmd_len;
+    uint8_t cmd[16];
+} __attribute__((packed)) CBW;
+
+typedef struct {
+    uint32_t sig;
+    uint32_t tag;
+    uint32_t residue;
+    uint8_t status;
+} __attribute__((packed)) CSW;
+
+struct MassStorageUsb {
+    FuriHalUsbInterface usb;
+    FuriHalUsbInterface* usb_prev;
+
+    FuriThread* thread;
+    usbd_device* dev;
+    SCSIDeviceFunc fn;
+};
+
+static int32_t mass_thread_worker(void* context) {
+    MassStorageUsb* mass = context;
+    usbd_device* dev = mass->dev;
+    SCSISession scsi = {
+        .fn = mass->fn,
+    };
+    CBW cbw = {0};
+    CSW csw = {0};
+    uint8_t* buf = NULL;
+    uint32_t buf_len = 0, buf_cap = 0, buf_sent = 0;
+    enum {
+        StateReadCBW,
+        StateReadData,
+        StateWriteData,
+        StateBuildCSW,
+        StateWriteCSW,
+    } state = StateReadCBW;
+    while(true) {
+        uint32_t flags = furi_thread_flags_wait(EventAll, FuriFlagWaitAny, FuriWaitForever);
+        if(flags & EventExit) {
+            FURI_LOG_D(TAG, "exit");
+            break;
+        }
+        if(flags & EventReset) {
+            FURI_LOG_D(TAG, "reset");
+            scsi.sk = 0;
+            scsi.asc = 0;
+            memset(&cbw, 0, sizeof(cbw));
+            memset(&csw, 0, sizeof(csw));
+            if(buf) {
+                free(buf);
+                buf = NULL;
+            }
+            buf_len = buf_cap = buf_sent = 0;
+            state = StateReadCBW;
+        }
+        if(flags & EventRxTx) do {
+                switch(state) {
+                case StateReadCBW: {
+                    FURI_LOG_T(TAG, "StateReadCBW");
+                    int32_t len = usbd_ep_read(dev, USB_MSC_RX_EP, &cbw, sizeof(cbw));
+                    if(len <= 0) {
+                        FURI_LOG_T(TAG, "cbw not ready");
+                        break;
+                    }
+                    if(len != sizeof(cbw) || cbw.sig != CBW_SIG) {
+                        FURI_LOG_W(TAG, "bad cbw sig=%08lx", cbw.sig);
+                        usbd_ep_stall(dev, USB_MSC_TX_EP);
+                        usbd_ep_stall(dev, USB_MSC_RX_EP);
+                        continue;
+                    }
+                    if(!scsi_cmd_start(&scsi, cbw.cmd, cbw.cmd_len)) {
+                        FURI_LOG_W(TAG, "bad cmd");
+                        usbd_ep_stall(dev, USB_MSC_RX_EP);
+                        csw.sig = CSW_SIG;
+                        csw.tag = cbw.tag;
+                        csw.status = CSW_STATUS_NOK;
+                        state = StateWriteCSW;
+                        continue;
+                    }
+                    if(cbw.flags & CBW_FLAGS_DEVICE_TO_HOST) {
+                        buf_len = 0;
+                        buf_sent = 0;
+                        state = StateWriteData;
+                    } else {
+                        buf_len = 0;
+                        state = StateReadData;
+                    }
+                    continue;
+                }; break;
+                case StateReadData: {
+                    FURI_LOG_T(TAG, "StateReadData %lu/%lu", buf_len, cbw.len);
+                    if(!cbw.len) {
+                        state = StateBuildCSW;
+                        continue;
+                    }
+                    uint32_t buf_clamp = MIN(cbw.len, USB_MSC_BUF_MAX);
+                    if(buf_clamp > buf_cap) {
+                        FURI_LOG_T(TAG, "growing buf %lu -> %lu", buf_cap, buf_clamp);
+                        if(buf) {
+                            free(buf);
+                        }
+                        buf_cap = buf_clamp;
+                        buf = malloc(buf_cap);
+                    }
+                    if(buf_len < buf_clamp) {
+                        int32_t len =
+                            usbd_ep_read(dev, USB_MSC_RX_EP, buf + buf_len, buf_clamp - buf_len);
+                        if(len < 0) {
+                            FURI_LOG_T(TAG, "rx not ready %ld", len);
+                            break;
+                        }
+                        FURI_LOG_T(TAG, "clamp %lu len %ld", buf_clamp, len);
+                        buf_len += len;
+                    }
+                    if(buf_len == buf_clamp) {
+                        if(!scsi_cmd_rx_data(&scsi, buf, buf_len)) {
+                            FURI_LOG_W(TAG, "short rx");
+                            usbd_ep_stall(dev, USB_MSC_RX_EP);
+                            csw.sig = CSW_SIG;
+                            csw.tag = cbw.tag;
+                            csw.status = CSW_STATUS_NOK;
+                            csw.residue = cbw.len;
+                            state = StateWriteCSW;
+                            continue;
+                        }
+                        cbw.len -= buf_len;
+                        buf_len = 0;
+                    }
+                    continue;
+                }; break;
+                case StateWriteData: {
+                    FURI_LOG_T(TAG, "StateWriteData %lu", cbw.len);
+                    if(!cbw.len) {
+                        state = StateBuildCSW;
+                        continue;
+                    }
+                    uint32_t buf_clamp = MIN(cbw.len, USB_MSC_BUF_MAX);
+                    if(buf_clamp > buf_cap) {
+                        FURI_LOG_T(TAG, "growing buf %lu -> %lu", buf_cap, buf_clamp);
+                        if(buf) {
+                            free(buf);
+                        }
+                        buf_cap = buf_clamp;
+                        buf = malloc(buf_cap);
+                    }
+                    if(!buf_len && !scsi_cmd_tx_data(&scsi, buf, &buf_len, buf_clamp)) {
+                        FURI_LOG_W(TAG, "short tx");
+                        // usbd_ep_stall(dev, USB_MSC_TX_EP);
+                        state = StateBuildCSW;
+                        continue;
+                    }
+                    int32_t len = usbd_ep_write(
+                        dev,
+                        USB_MSC_TX_EP,
+                        buf + buf_sent,
+                        MIN(USB_MSC_TX_EP_SIZE, buf_len - buf_sent));
+                    if(len < 0) {
+                        FURI_LOG_T(TAG, "tx not ready %ld", len);
+                        break;
+                    }
+                    buf_sent += len;
+                    if(buf_sent == buf_len) {
+                        cbw.len -= buf_len;
+                        buf_len = 0;
+                        buf_sent = 0;
+                    }
+                    continue;
+                }; break;
+                case StateBuildCSW: {
+                    FURI_LOG_T(TAG, "StateBuildCSW");
+                    csw.sig = CSW_SIG;
+                    csw.tag = cbw.tag;
+                    if(scsi_cmd_end(&scsi)) {
+                        csw.status = CSW_STATUS_OK;
+                    } else {
+                        csw.status = CSW_STATUS_NOK;
+                    }
+                    csw.residue = cbw.len;
+                    state = StateWriteCSW;
+                    continue;
+                }; break;
+                case StateWriteCSW: {
+                    FURI_LOG_T(TAG, "StateWriteCSW");
+                    if(csw.status) {
+                        FURI_LOG_W(
+                            TAG,
+                            "csw sig=%08lx tag=%08lx residue=%08lx status=%02x",
+                            csw.sig,
+                            csw.tag,
+                            csw.residue,
+                            csw.status);
+                    }
+                    int32_t len = usbd_ep_write(dev, USB_MSC_TX_EP, &csw, sizeof(csw));
+                    if(len < 0) {
+                        FURI_LOG_T(TAG, "csw not ready");
+                        break;
+                    }
+                    if(len != sizeof(csw)) {
+                        FURI_LOG_W(TAG, "bad csw write %ld", len);
+                        usbd_ep_stall(dev, USB_MSC_TX_EP);
+                        break;
+                    }
+                    memset(&cbw, 0, sizeof(cbw));
+                    memset(&csw, 0, sizeof(csw));
+                    state = StateReadCBW;
+                    continue;
+                }; break;
+                }
+                break;
+            } while(true);
+    }
+    if(buf) {
+        free(buf);
+    }
+    return 0;
+}
+
+// needed in usb_deinit, usb_suspend, usb_rxtx_ep_callback, usb_control,
+// where if_ctx isn't passed
+static MassStorageUsb* mass_cur = NULL;
+
+static void usb_init(usbd_device* dev, FuriHalUsbInterface* intf, void* ctx) {
+    UNUSED(intf);
+    MassStorageUsb* mass = ctx;
+    mass_cur = mass;
+    mass->dev = dev;
+
+    usbd_reg_config(dev, usb_ep_config);
+    usbd_reg_control(dev, usb_control);
+    usbd_connect(dev, true);
+
+    mass->thread = furi_thread_alloc();
+    furi_thread_set_name(mass->thread, "MassStorageUsb");
+    furi_thread_set_stack_size(mass->thread, 1024);
+    furi_thread_set_context(mass->thread, ctx);
+    furi_thread_set_callback(mass->thread, mass_thread_worker);
+    furi_thread_start(mass->thread);
+}
+
+static void usb_deinit(usbd_device* dev) {
+    usbd_reg_config(dev, NULL);
+    usbd_reg_control(dev, NULL);
+
+    MassStorageUsb* mass = mass_cur;
+    if(!mass || mass->dev != dev) {
+        FURI_LOG_E(TAG, "deinit mass_cur leak");
+        return;
+    }
+    mass_cur = NULL;
+
+    furi_assert(mass->thread);
+    furi_thread_flags_set(furi_thread_get_id(mass->thread), EventExit);
+    furi_thread_join(mass->thread);
+    furi_thread_free(mass->thread);
+    mass->thread = NULL;
+
+    free(mass->usb.str_prod_descr);
+    mass->usb.str_prod_descr = NULL;
+    free(mass->usb.str_serial_descr);
+    mass->usb.str_serial_descr = NULL;
+    free(mass);
+}
+
+static void usb_wakeup(usbd_device* dev) {
+    UNUSED(dev);
+}
+
+static void usb_suspend(usbd_device* dev) {
+    MassStorageUsb* mass = mass_cur;
+    if(!mass || mass->dev != dev) return;
+    furi_thread_flags_set(furi_thread_get_id(mass->thread), EventReset);
+}
+
+static void usb_rxtx_ep_callback(usbd_device* dev, uint8_t event, uint8_t ep) {
+    UNUSED(ep);
+    UNUSED(event);
+    MassStorageUsb* mass = mass_cur;
+    if(!mass || mass->dev != dev) return;
+    furi_thread_flags_set(furi_thread_get_id(mass->thread), EventRxTx);
+}
+
+static usbd_respond usb_ep_config(usbd_device* dev, uint8_t cfg) {
+    switch(cfg) {
+    case 0: // deconfig
+        usbd_ep_deconfig(dev, USB_MSC_RX_EP);
+        usbd_ep_deconfig(dev, USB_MSC_TX_EP);
+        usbd_reg_endpoint(dev, USB_MSC_RX_EP, NULL);
+        usbd_reg_endpoint(dev, USB_MSC_TX_EP, NULL);
+        return usbd_ack;
+    case 1: // config
+        usbd_ep_config(
+            dev, USB_MSC_RX_EP, USB_EPTYPE_BULK /* | USB_EPTYPE_DBLBUF*/, USB_MSC_RX_EP_SIZE);
+        usbd_ep_config(
+            dev, USB_MSC_TX_EP, USB_EPTYPE_BULK /* | USB_EPTYPE_DBLBUF*/, USB_MSC_TX_EP_SIZE);
+        usbd_reg_endpoint(dev, USB_MSC_RX_EP, usb_rxtx_ep_callback);
+        usbd_reg_endpoint(dev, USB_MSC_TX_EP, usb_rxtx_ep_callback);
+        return usbd_ack;
+    }
+    return usbd_fail;
+}
+
+static usbd_respond usb_control(usbd_device* dev, usbd_ctlreq* req, usbd_rqc_callback* callback) {
+    UNUSED(callback);
+    if(((USB_REQ_RECIPIENT | USB_REQ_TYPE) & req->bmRequestType) !=
+       (USB_REQ_INTERFACE | USB_REQ_CLASS)) {
+        return usbd_fail;
+    }
+    switch(req->bRequest) {
+    case USB_MSC_BOT_GET_MAX_LUN: {
+        static uint8_t max_lun = 0;
+        dev->status.data_ptr = &max_lun;
+        dev->status.data_count = 1;
+        return usbd_ack;
+    }; break;
+    case USB_MSC_BOT_RESET: {
+        MassStorageUsb* mass = mass_cur;
+        if(!mass || mass->dev != dev) return usbd_fail;
+        furi_thread_flags_set(furi_thread_get_id(mass->thread), EventReset);
+        return usbd_ack;
+    }; break;
+    }
+    return usbd_fail;
+}
+
+static const struct usb_string_descriptor dev_manuf_desc = USB_STRING_DESC("Flipper Devices Inc.");
+
+struct MassStorageDescriptor {
+    struct usb_config_descriptor config;
+    struct usb_interface_descriptor intf;
+    struct usb_endpoint_descriptor ep_rx;
+    struct usb_endpoint_descriptor ep_tx;
+} __attribute__((packed));
+
+static const struct usb_device_descriptor usb_mass_dev_descr = {
+    .bLength = sizeof(struct usb_device_descriptor),
+    .bDescriptorType = USB_DTYPE_DEVICE,
+    .bcdUSB = VERSION_BCD(2, 0, 0),
+    .bDeviceClass = USB_CLASS_PER_INTERFACE,
+    .bDeviceSubClass = USB_SUBCLASS_NONE,
+    .bDeviceProtocol = USB_PROTO_NONE,
+    .bMaxPacketSize0 = 8, // USB_EP0_SIZE
+    .idVendor = 0x0483,
+    .idProduct = 0x5720,
+    .bcdDevice = VERSION_BCD(1, 0, 0),
+    .iManufacturer = 1, // UsbDevManuf
+    .iProduct = 2, // UsbDevProduct
+    .iSerialNumber = 3, // UsbDevSerial
+    .bNumConfigurations = 1,
+};
+
+static const struct MassStorageDescriptor usb_mass_cfg_descr = {
+    .config =
+        {
+            .bLength = sizeof(struct usb_config_descriptor),
+            .bDescriptorType = USB_DTYPE_CONFIGURATION,
+            .wTotalLength = sizeof(struct MassStorageDescriptor),
+            .bNumInterfaces = 1,
+            .bConfigurationValue = 1,
+            .iConfiguration = NO_DESCRIPTOR,
+            .bmAttributes = USB_CFG_ATTR_RESERVED | USB_CFG_ATTR_SELFPOWERED,
+            .bMaxPower = USB_CFG_POWER_MA(100),
+        },
+    .intf =
+        {
+            .bLength = sizeof(struct usb_interface_descriptor),
+            .bDescriptorType = USB_DTYPE_INTERFACE,
+            .bInterfaceNumber = 0,
+            .bAlternateSetting = 0,
+            .bNumEndpoints = 2,
+            .bInterfaceClass = USB_CLASS_MASS_STORAGE,
+            .bInterfaceSubClass = 0x06, // scsi transparent
+            .bInterfaceProtocol = 0x50, // bulk only
+            .iInterface = NO_DESCRIPTOR,
+        },
+    .ep_rx =
+        {
+            .bLength = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress = USB_MSC_RX_EP,
+            .bmAttributes = USB_EPTYPE_BULK,
+            .wMaxPacketSize = USB_MSC_RX_EP_SIZE,
+            .bInterval = 0,
+        },
+    .ep_tx =
+        {
+            .bLength = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress = USB_MSC_TX_EP,
+            .bmAttributes = USB_EPTYPE_BULK,
+            .wMaxPacketSize = USB_MSC_TX_EP_SIZE,
+            .bInterval = 0,
+        },
+};
+
+MassStorageUsb* mass_storage_usb_start(const char* filename, SCSIDeviceFunc fn) {
+    MassStorageUsb* mass = malloc(sizeof(MassStorageUsb));
+    mass->usb_prev = furi_hal_usb_get_config();
+    mass->usb.init = usb_init;
+    mass->usb.deinit = usb_deinit;
+    mass->usb.wakeup = usb_wakeup;
+    mass->usb.suspend = usb_suspend;
+    mass->usb.dev_descr = (struct usb_device_descriptor*)&usb_mass_dev_descr;
+    mass->usb.str_manuf_descr = (void*)&dev_manuf_desc;
+    mass->usb.str_prod_descr = NULL;
+    mass->usb.str_serial_descr = NULL;
+    mass->usb.cfg_descr = (void*)&usb_mass_cfg_descr;
+
+    const char* name = furi_hal_version_get_device_name_ptr();
+    if(!name) name = "Flipper Zero";
+    size_t len = strlen(name);
+    struct usb_string_descriptor* str_prod_descr = malloc(len * 2 + 2);
+    str_prod_descr->bLength = len * 2 + 2;
+    str_prod_descr->bDescriptorType = USB_DTYPE_STRING;
+    for(uint8_t i = 0; i < len; i++) str_prod_descr->wString[i] = name[i];
+    mass->usb.str_prod_descr = str_prod_descr;
+
+    len = strlen(filename);
+    struct usb_string_descriptor* str_serial_descr = malloc(len * 2 + 2);
+    str_serial_descr->bLength = len * 2 + 2;
+    str_serial_descr->bDescriptorType = USB_DTYPE_STRING;
+    for(uint8_t i = 0; i < len; i++) str_serial_descr->wString[i] = filename[i];
+    mass->usb.str_serial_descr = str_serial_descr;
+
+    mass->fn = fn;
+    if(!furi_hal_usb_set_config(&mass->usb, mass)) {
+        FURI_LOG_E(TAG, "USB locked, cannot start Mass Storage");
+        free(mass->usb.str_prod_descr);
+        free(mass->usb.str_serial_descr);
+        free(mass);
+        return NULL;
+    }
+    return mass;
+}
+
+void mass_storage_usb_stop(MassStorageUsb* mass) {
+    furi_hal_usb_set_config(mass->usb_prev, NULL);
+    // freed by usb_deinit asynchronously from usb thread
+}

base_pack/mass_storage/helpers/mass_storage_usb.h

@@ -0,0 +1,9 @@
+#pragma once
+
+#include <storage/storage.h>
+#include "mass_storage_scsi.h"
+
+typedef struct MassStorageUsb MassStorageUsb;
+
+MassStorageUsb* mass_storage_usb_start(const char* filename, SCSIDeviceFunc fn);
+void mass_storage_usb_stop(MassStorageUsb* mass);

base_pack/mass_storage/mass_storage_app.c

@@ -0,0 +1,128 @@
+#include "mass_storage_app_i.h"
+#include <furi.h>
+#include <storage/storage.h>
+#include <lib/toolbox/path.h>
+
+static bool mass_storage_app_custom_event_callback(void* context, uint32_t event) {
+    furi_assert(context);
+    MassStorageApp* app = context;
+    return scene_manager_handle_custom_event(app->scene_manager, event);
+}
+
+static bool mass_storage_app_back_event_callback(void* context) {
+    furi_assert(context);
+    MassStorageApp* app = context;
+    return scene_manager_handle_back_event(app->scene_manager);
+}
+
+static void mass_storage_app_tick_event_callback(void* context) {
+    furi_assert(context);
+    MassStorageApp* app = context;
+    scene_manager_handle_tick_event(app->scene_manager);
+}
+
+void mass_storage_app_show_loading_popup(MassStorageApp* app, bool show) {
+    TaskHandle_t timer_task = xTaskGetHandle(configTIMER_SERVICE_TASK_NAME);
+
+    if(show) {
+        // Raise timer priority so that animations can play
+        vTaskPrioritySet(timer_task, configMAX_PRIORITIES - 1);
+        view_dispatcher_switch_to_view(app->view_dispatcher, MassStorageAppViewLoading);
+    } else {
+        // Restore default timer priority
+        vTaskPrioritySet(timer_task, configTIMER_TASK_PRIORITY);
+    }
+}
+
+MassStorageApp* mass_storage_app_alloc(char* arg) {
+    MassStorageApp* app = malloc(sizeof(MassStorageApp));
+    app->file_path = furi_string_alloc();
+
+    if(arg != NULL) {
+        furi_string_set_str(app->file_path, arg);
+    } else {
+        furi_string_set_str(app->file_path, MASS_STORAGE_APP_PATH_FOLDER);
+    }
+
+    app->gui = furi_record_open(RECORD_GUI);
+    app->fs_api = furi_record_open(RECORD_STORAGE);
+    app->dialogs = furi_record_open(RECORD_DIALOGS);
+
+    app->view_dispatcher = view_dispatcher_alloc();
+    view_dispatcher_enable_queue(app->view_dispatcher);
+
+    app->scene_manager = scene_manager_alloc(&mass_storage_scene_handlers, app);
+
+    view_dispatcher_set_event_callback_context(app->view_dispatcher, app);
+    view_dispatcher_set_tick_event_callback(
+        app->view_dispatcher, mass_storage_app_tick_event_callback, 500);
+    view_dispatcher_set_custom_event_callback(
+        app->view_dispatcher, mass_storage_app_custom_event_callback);
+    view_dispatcher_set_navigation_event_callback(
+        app->view_dispatcher, mass_storage_app_back_event_callback);
+
+    app->mass_storage_view = mass_storage_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher,
+        MassStorageAppViewWork,
+        mass_storage_get_view(app->mass_storage_view));
+
+    app->text_input = text_input_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher, MassStorageAppViewTextInput, text_input_get_view(app->text_input));
+
+    app->loading = loading_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher, MassStorageAppViewLoading, loading_get_view(app->loading));
+
+    app->variable_item_list = variable_item_list_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher,
+        MassStorageAppViewStart,
+        variable_item_list_get_view(app->variable_item_list));
+
+    view_dispatcher_attach_to_gui(app->view_dispatcher, app->gui, ViewDispatcherTypeFullscreen);
+
+    if(storage_file_exists(app->fs_api, furi_string_get_cstr(app->file_path))) {
+        scene_manager_next_scene(app->scene_manager, MassStorageSceneWork);
+    } else {
+        scene_manager_next_scene(app->scene_manager, MassStorageSceneStart);
+    }
+
+    return app;
+}
+
+void mass_storage_app_free(MassStorageApp* app) {
+    furi_assert(app);
+
+    // Views
+    view_dispatcher_remove_view(app->view_dispatcher, MassStorageAppViewWork);
+    view_dispatcher_remove_view(app->view_dispatcher, MassStorageAppViewTextInput);
+    view_dispatcher_remove_view(app->view_dispatcher, MassStorageAppViewStart);
+    view_dispatcher_remove_view(app->view_dispatcher, MassStorageAppViewLoading);
+
+    mass_storage_free(app->mass_storage_view);
+    text_input_free(app->text_input);
+    variable_item_list_free(app->variable_item_list);
+    loading_free(app->loading);
+
+    // View dispatcher
+    view_dispatcher_free(app->view_dispatcher);
+    scene_manager_free(app->scene_manager);
+
+    furi_string_free(app->file_path);
+
+    // Close records
+    furi_record_close("gui");
+    furi_record_close("storage");
+    furi_record_close("dialogs");
+
+    free(app);
+}
+
+int32_t mass_storage_app(void* p) {
+    MassStorageApp* mass_storage_app = mass_storage_app_alloc((char*)p);
+    view_dispatcher_run(mass_storage_app->view_dispatcher);
+    mass_storage_app_free(mass_storage_app);
+    return 0;
+}

base_pack/mass_storage/mass_storage_app.h

@@ -0,0 +1,11 @@
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct MassStorageApp MassStorageApp;
+
+#ifdef __cplusplus
+}
+#endif

base_pack/mass_storage/mass_storage_app_i.h

@@ -0,0 +1,62 @@
+#pragma once
+
+#include "mass_storage_app.h"
+#include "scenes/mass_storage_scene.h"
+#include "helpers/mass_storage_usb.h"
+
+#include <furi_hal.h>
+#include <gui/gui.h>
+#include <gui/view_dispatcher.h>
+#include <gui/scene_manager.h>
+#include <gui/modules/submenu.h>
+#include <dialogs/dialogs.h>
+#include <gui/modules/variable_item_list.h>
+#include <gui/modules/text_input.h>
+#include <gui/modules/loading.h>
+#include <storage/storage.h>
+#include "views/mass_storage_view.h"
+
+#define MASS_STORAGE_APP_PATH_FOLDER STORAGE_APP_DATA_PATH_PREFIX
+#define MASS_STORAGE_APP_EXTENSION ".img"
+#define MASS_STORAGE_FILE_NAME_LEN 40
+
+struct MassStorageApp {
+    Gui* gui;
+    Storage* fs_api;
+    ViewDispatcher* view_dispatcher;
+    SceneManager* scene_manager;
+    DialogsApp* dialogs;
+    TextInput* text_input;
+    VariableItemList* variable_item_list;
+    Loading* loading;
+
+    FuriString* file_path;
+    File* file;
+    MassStorage* mass_storage_view;
+
+    FuriMutex* usb_mutex;
+    MassStorageUsb* usb;
+
+    char new_file_name[MASS_STORAGE_FILE_NAME_LEN + 1];
+    uint32_t new_file_size;
+
+    uint32_t bytes_read, bytes_written;
+};
+
+typedef enum {
+    MassStorageAppViewStart,
+    MassStorageAppViewTextInput,
+    MassStorageAppViewWork,
+    MassStorageAppViewLoading,
+} MassStorageAppView;
+
+enum MassStorageCustomEvent {
+    // Reserve first 100 events for button types and indexes, starting from 0
+    MassStorageCustomEventReserved = 100,
+
+    MassStorageCustomEventFileSelect,
+    MassStorageCustomEventNewImage,
+    MassStorageCustomEventNameInput,
+};
+
+void mass_storage_app_show_loading_popup(MassStorageApp* app, bool show);

base_pack/mass_storage/scenes/mass_storage_scene.c

@@ -0,0 +1,30 @@
+#include "mass_storage_scene.h"
+
+// Generate scene on_enter handlers array
+#define ADD_SCENE(prefix, name, id) prefix##_scene_##name##_on_enter,
+void (*const mass_storage_scene_on_enter_handlers[])(void*) = {
+#include "mass_storage_scene_config.h"
+};
+#undef ADD_SCENE
+
+// Generate scene on_event handlers array
+#define ADD_SCENE(prefix, name, id) prefix##_scene_##name##_on_event,
+bool (*const mass_storage_scene_on_event_handlers[])(void* context, SceneManagerEvent event) = {
+#include "mass_storage_scene_config.h"
+};
+#undef ADD_SCENE
+
+// Generate scene on_exit handlers array
+#define ADD_SCENE(prefix, name, id) prefix##_scene_##name##_on_exit,
+void (*const mass_storage_scene_on_exit_handlers[])(void* context) = {
+#include "mass_storage_scene_config.h"
+};
+#undef ADD_SCENE
+
+// Initialize scene handlers configuration structure
+const SceneManagerHandlers mass_storage_scene_handlers = {
+    .on_enter_handlers = mass_storage_scene_on_enter_handlers,
+    .on_event_handlers = mass_storage_scene_on_event_handlers,
+    .on_exit_handlers = mass_storage_scene_on_exit_handlers,
+    .scene_num = MassStorageSceneNum,
+};

base_pack/mass_storage/scenes/mass_storage_scene.h

@@ -0,0 +1,29 @@
+#pragma once
+
+#include <gui/scene_manager.h>
+
+// Generate scene id and total number
+#define ADD_SCENE(prefix, name, id) MassStorageScene##id,
+typedef enum {
+#include "mass_storage_scene_config.h"
+    MassStorageSceneNum,
+} MassStorageScene;
+#undef ADD_SCENE
+
+extern const SceneManagerHandlers mass_storage_scene_handlers;
+
+// Generate scene on_enter handlers declaration
+#define ADD_SCENE(prefix, name, id) void prefix##_scene_##name##_on_enter(void*);
+#include "mass_storage_scene_config.h"
+#undef ADD_SCENE
+
+// Generate scene on_event handlers declaration
+#define ADD_SCENE(prefix, name, id) \
+    bool prefix##_scene_##name##_on_event(void* context, SceneManagerEvent event);
+#include "mass_storage_scene_config.h"
+#undef ADD_SCENE
+
+// Generate scene on_exit handlers declaration
+#define ADD_SCENE(prefix, name, id) void prefix##_scene_##name##_on_exit(void* context);
+#include "mass_storage_scene_config.h"
+#undef ADD_SCENE

base_pack/mass_storage/scenes/mass_storage_scene_config.h

@@ -0,0 +1,4 @@
+ADD_SCENE(mass_storage, start, Start)
+ADD_SCENE(mass_storage, file_select, FileSelect)
+ADD_SCENE(mass_storage, work, Work)
+ADD_SCENE(mass_storage, file_name, FileName)

base_pack/mass_storage/scenes/mass_storage_scene_file_name.c

@@ -0,0 +1,83 @@
+#include "../mass_storage_app_i.h"
+
+#define WRITE_BUF_LEN 4096
+
+static void mass_storage_file_name_text_callback(void* context) {
+    furi_assert(context);
+
+    MassStorageApp* app = context;
+    view_dispatcher_send_custom_event(app->view_dispatcher, MassStorageCustomEventNameInput);
+}
+
+static bool mass_storage_create_image(Storage* storage, const char* file_path, uint32_t size) {
+    FURI_LOG_I("TAG", "Creating image %s, len:%lu", file_path, size);
+    File* file = storage_file_alloc(storage);
+
+    bool success = false;
+    uint8_t* buffer = malloc(WRITE_BUF_LEN);
+    do {
+        if(!storage_file_open(file, file_path, FSAM_WRITE, FSOM_CREATE_ALWAYS)) break;
+        if(!storage_file_seek(file, size, true)) break;
+        if(!storage_file_seek(file, 0, true)) break;
+        // Zero out first 4k - partition table and adjacent data
+        if(!storage_file_write(file, buffer, WRITE_BUF_LEN)) break;
+
+        success = true;
+    } while(false);
+
+    free(buffer);
+    storage_file_close(file);
+    storage_file_free(file);
+    return success;
+}
+
+void mass_storage_scene_file_name_on_enter(void* context) {
+    MassStorageApp* app = context;
+
+    text_input_set_header_text(app->text_input, "Enter image name");
+    ValidatorIsFile* validator_is_file =
+        validator_is_file_alloc_init(MASS_STORAGE_APP_PATH_FOLDER, MASS_STORAGE_APP_EXTENSION, "");
+    text_input_set_validator(app->text_input, validator_is_file_callback, validator_is_file);
+
+    text_input_set_result_callback(
+        app->text_input,
+        mass_storage_file_name_text_callback,
+        app,
+        app->new_file_name,
+        MASS_STORAGE_FILE_NAME_LEN,
+        true);
+    view_dispatcher_switch_to_view(app->view_dispatcher, MassStorageAppViewTextInput);
+}
+
+bool mass_storage_scene_file_name_on_event(void* context, SceneManagerEvent event) {
+    UNUSED(event);
+    MassStorageApp* app = context;
+
+    bool consumed = false;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == MassStorageCustomEventNameInput) {
+            mass_storage_app_show_loading_popup(app, true);
+            furi_string_printf(
+                app->file_path,
+                "%s/%s%s",
+                MASS_STORAGE_APP_PATH_FOLDER,
+                app->new_file_name,
+                MASS_STORAGE_APP_EXTENSION);
+            if(mass_storage_create_image(
+                   app->fs_api, furi_string_get_cstr(app->file_path), app->new_file_size)) {
+                scene_manager_next_scene(app->scene_manager, MassStorageSceneWork);
+            } // TODO: error message screen
+        }
+    }
+    return consumed;
+}
+
+void mass_storage_scene_file_name_on_exit(void* context) {
+    UNUSED(context);
+    MassStorageApp* app = context;
+    void* validator_context = text_input_get_validator_callback_context(app->text_input);
+    text_input_set_validator(app->text_input, NULL, NULL);
+    validator_is_file_free(validator_context);
+    text_input_reset(app->text_input);
+}

base_pack/mass_storage/scenes/mass_storage_scene_file_select.c

@@ -0,0 +1,39 @@
+#include "../mass_storage_app_i.h"
+#include "furi_hal_power.h"
+#include <mass_storage_icons.h>
+
+static bool mass_storage_file_select(MassStorageApp* mass_storage) {
+    furi_assert(mass_storage);
+
+    DialogsFileBrowserOptions browser_options;
+    dialog_file_browser_set_basic_options(
+        &browser_options, MASS_STORAGE_APP_EXTENSION, &I_mass_storage_10px);
+    browser_options.base_path = MASS_STORAGE_APP_PATH_FOLDER;
+    browser_options.hide_ext = false;
+
+    // Input events and views are managed by file_select
+    bool res = dialog_file_browser_show(
+        mass_storage->dialogs, mass_storage->file_path, mass_storage->file_path, &browser_options);
+    return res;
+}
+
+void mass_storage_scene_file_select_on_enter(void* context) {
+    MassStorageApp* mass_storage = context;
+
+    if(mass_storage_file_select(mass_storage)) {
+        scene_manager_next_scene(mass_storage->scene_manager, MassStorageSceneWork);
+    } else {
+        scene_manager_previous_scene(mass_storage->scene_manager);
+    }
+}
+
+bool mass_storage_scene_file_select_on_event(void* context, SceneManagerEvent event) {
+    UNUSED(context);
+    UNUSED(event);
+    // MassStorageApp* mass_storage = context;
+    return false;
+}
+
+void mass_storage_scene_file_select_on_exit(void* context) {
+    UNUSED(context);
+}

base_pack/mass_storage/scenes/mass_storage_scene_start.c

@@ -0,0 +1,74 @@
+#include "../mass_storage_app_i.h"
+
+static const struct {
+    char* name;
+    uint32_t value;
+} image_size[] = {
+    {"1.44M", 1440 * 1024},
+    {"2M", 2 * 1024 * 1024},
+    {"4M", 4 * 1024 * 1024},
+    {"8M", 8 * 1024 * 1024},
+    {"16M", 16 * 1024 * 1024},
+    {"32M", 32 * 1024 * 1024},
+    {"64M", 64 * 1024 * 1024},
+    {"128M", 128 * 1024 * 1024},
+    {"256M", 256 * 1024 * 1024},
+    {"512M", 512 * 1024 * 1024},
+    {"700M", 700 * 1024 * 1024},
+    {"1G", 1024 * 1024 * 1024},
+    {"2G", 2u * 1024 * 1024 * 1024},
+};
+
+static void mass_storage_item_select(void* context, uint32_t index) {
+    MassStorageApp* app = context;
+    if(index == 0) {
+        view_dispatcher_send_custom_event(app->view_dispatcher, MassStorageCustomEventFileSelect);
+    } else {
+        view_dispatcher_send_custom_event(app->view_dispatcher, MassStorageCustomEventNewImage);
+    }
+}
+
+static void mass_storage_image_size(VariableItem* item) {
+    MassStorageApp* app = variable_item_get_context(item);
+    uint8_t index = variable_item_get_current_value_index(item);
+    variable_item_set_current_value_text(item, image_size[index].name);
+    app->new_file_size = image_size[index].value;
+}
+
+void mass_storage_scene_start_on_enter(void* context) {
+    MassStorageApp* app = context;
+
+    VariableItem* item =
+        variable_item_list_add(app->variable_item_list, "Select disk image", 0, NULL, NULL);
+
+    item = variable_item_list_add(
+        app->variable_item_list, "New image", COUNT_OF(image_size), mass_storage_image_size, app);
+
+    variable_item_list_set_enter_callback(app->variable_item_list, mass_storage_item_select, app);
+
+    variable_item_set_current_value_index(item, 2);
+    variable_item_set_current_value_text(item, image_size[2].name);
+    app->new_file_size = image_size[2].value;
+    view_dispatcher_switch_to_view(app->view_dispatcher, MassStorageAppViewStart);
+}
+
+bool mass_storage_scene_start_on_event(void* context, SceneManagerEvent event) {
+    UNUSED(context);
+    UNUSED(event);
+    MassStorageApp* app = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == MassStorageCustomEventFileSelect) {
+            scene_manager_next_scene(app->scene_manager, MassStorageSceneFileSelect);
+        } else if(event.event == MassStorageCustomEventNewImage) {
+            scene_manager_next_scene(app->scene_manager, MassStorageSceneFileName);
+        }
+    }
+    return false;
+}
+
+void mass_storage_scene_start_on_exit(void* context) {
+    UNUSED(context);
+    MassStorageApp* app = context;
+    variable_item_list_reset(app->variable_item_list);
+}

base_pack/mass_storage/scenes/mass_storage_scene_work.c

@@ -0,0 +1,141 @@
+#include "../mass_storage_app_i.h"
+#include "../views/mass_storage_view.h"
+#include "../helpers/mass_storage_usb.h"
+#include <lib/toolbox/path.h>
+
+#define TAG "MassStorageSceneWork"
+
+static bool file_read(
+    void* ctx,
+    uint32_t lba,
+    uint16_t count,
+    uint8_t* out,
+    uint32_t* out_len,
+    uint32_t out_cap) {
+    MassStorageApp* app = ctx;
+    FURI_LOG_T(TAG, "file_read lba=%08lX count=%04X out_cap=%08lX", lba, count, out_cap);
+    if(!storage_file_seek(app->file, lba * SCSI_BLOCK_SIZE, true)) {
+        FURI_LOG_W(TAG, "seek failed");
+        return false;
+    }
+    uint16_t clamp = MIN(out_cap, count * SCSI_BLOCK_SIZE);
+    *out_len = storage_file_read(app->file, out, clamp);
+    FURI_LOG_T(TAG, "%lu/%lu", *out_len, count * SCSI_BLOCK_SIZE);
+    app->bytes_read += *out_len;
+    return *out_len == clamp;
+}
+
+static bool file_write(void* ctx, uint32_t lba, uint16_t count, uint8_t* buf, uint32_t len) {
+    MassStorageApp* app = ctx;
+    FURI_LOG_T(TAG, "file_write lba=%08lX count=%04X len=%08lX", lba, count, len);
+    if(len != count * SCSI_BLOCK_SIZE) {
+        FURI_LOG_W(TAG, "bad write params count=%u len=%lu", count, len);
+        return false;
+    }
+    if(!storage_file_seek(app->file, lba * SCSI_BLOCK_SIZE, true)) {
+        FURI_LOG_W(TAG, "seek failed");
+        return false;
+    }
+    app->bytes_written += len;
+    return storage_file_write(app->file, buf, len) == len;
+}
+
+static uint32_t file_num_blocks(void* ctx) {
+    MassStorageApp* app = ctx;
+    return storage_file_size(app->file) / SCSI_BLOCK_SIZE;
+}
+
+static void file_eject(void* ctx) {
+    MassStorageApp* app = ctx;
+    FURI_LOG_D(TAG, "EJECT");
+    furi_check(furi_mutex_acquire(app->usb_mutex, FuriWaitForever) == FuriStatusOk);
+    mass_storage_usb_stop(app->usb);
+    app->usb = NULL;
+    furi_check(furi_mutex_release(app->usb_mutex) == FuriStatusOk);
+}
+
+bool mass_storage_scene_work_on_event(void* context, SceneManagerEvent event) {
+    MassStorageApp* app = context;
+    bool consumed = false;
+    if(event.type == SceneManagerEventTypeTick) {
+        // Update stats
+        mass_storage_set_stats(app->mass_storage_view, app->bytes_read, app->bytes_written);
+        // Handle eject
+        bool ejected;
+        furi_check(furi_mutex_acquire(app->usb_mutex, FuriWaitForever) == FuriStatusOk);
+        ejected = app->usb == NULL;
+        furi_check(furi_mutex_release(app->usb_mutex) == FuriStatusOk);
+        if(ejected) {
+            scene_manager_previous_scene(app->scene_manager);
+            consumed = true;
+        }
+    } else if(event.type == SceneManagerEventTypeBack) {
+        consumed = scene_manager_search_and_switch_to_previous_scene(
+            app->scene_manager, MassStorageSceneFileSelect);
+        if(!consumed) {
+            consumed = scene_manager_search_and_switch_to_previous_scene(
+                app->scene_manager, MassStorageSceneStart);
+        }
+    }
+    return consumed;
+}
+
+void mass_storage_scene_work_on_enter(void* context) {
+    MassStorageApp* app = context;
+    app->bytes_read = app->bytes_written = 0;
+
+    if(!storage_file_exists(app->fs_api, furi_string_get_cstr(app->file_path))) {
+        scene_manager_search_and_switch_to_previous_scene(
+            app->scene_manager, MassStorageSceneStart);
+        return;
+    }
+
+    mass_storage_app_show_loading_popup(app, true);
+
+    app->usb_mutex = furi_mutex_alloc(FuriMutexTypeNormal);
+
+    FuriString* file_name = furi_string_alloc();
+    path_extract_filename(app->file_path, file_name, true);
+
+    mass_storage_set_file_name(app->mass_storage_view, file_name);
+    app->file = storage_file_alloc(app->fs_api);
+    furi_assert(storage_file_open(
+        app->file,
+        furi_string_get_cstr(app->file_path),
+        FSAM_READ | FSAM_WRITE,
+        FSOM_OPEN_EXISTING));
+
+    SCSIDeviceFunc fn = {
+        .ctx = app,
+        .read = file_read,
+        .write = file_write,
+        .num_blocks = file_num_blocks,
+        .eject = file_eject,
+    };
+
+    app->usb = mass_storage_usb_start(furi_string_get_cstr(file_name), fn);
+
+    furi_string_free(file_name);
+
+    mass_storage_app_show_loading_popup(app, false);
+    view_dispatcher_switch_to_view(app->view_dispatcher, MassStorageAppViewWork);
+}
+
+void mass_storage_scene_work_on_exit(void* context) {
+    MassStorageApp* app = context;
+    mass_storage_app_show_loading_popup(app, true);
+
+    if(app->usb_mutex) {
+        furi_mutex_free(app->usb_mutex);
+        app->usb_mutex = NULL;
+    }
+    if(app->usb) {
+        mass_storage_usb_stop(app->usb);
+        app->usb = NULL;
+    }
+    if(app->file) {
+        storage_file_free(app->file);
+        app->file = NULL;
+    }
+    mass_storage_app_show_loading_popup(app, false);
+}

base_pack/mass_storage/views/mass_storage_view.c

@@ -0,0 +1,122 @@
+#include "mass_storage_view.h"
+#include <gui/elements.h>
+#include <mass_storage_icons.h>
+
+struct MassStorage {
+    View* view;
+};
+
+typedef struct {
+    FuriString *file_name, *status_string;
+    uint32_t read_speed, write_speed;
+    uint32_t bytes_read, bytes_written;
+    uint32_t update_time;
+} MassStorageModel;
+
+static void append_suffixed_byte_count(FuriString* string, uint32_t count) {
+    if(count < 1024) {
+        furi_string_cat_printf(string, "%luB", count);
+    } else if(count < 1024 * 1024) {
+        furi_string_cat_printf(string, "%luK", count / 1024);
+    } else if(count < 1024 * 1024 * 1024) {
+        furi_string_cat_printf(string, "%.3fM", (double)count / (1024 * 1024));
+    } else {
+        furi_string_cat_printf(string, "%.3fG", (double)count / (1024 * 1024 * 1024));
+    }
+}
+
+static void mass_storage_draw_callback(Canvas* canvas, void* _model) {
+    MassStorageModel* model = _model;
+
+    canvas_draw_icon(canvas, 8, 14, &I_Drive_112x35);
+
+    canvas_set_font(canvas, FontPrimary);
+    canvas_draw_str_aligned(
+        canvas, canvas_width(canvas) / 2, 0, AlignCenter, AlignTop, "USB Mass Storage");
+
+    canvas_set_font(canvas, FontSecondary);
+    elements_string_fit_width(canvas, model->file_name, 89 - 2);
+    canvas_draw_str_aligned(
+        canvas, 50, 23, AlignCenter, AlignBottom, furi_string_get_cstr(model->file_name));
+
+    furi_string_set_str(model->status_string, "R:");
+    append_suffixed_byte_count(model->status_string, model->bytes_read);
+    if(model->read_speed) {
+        furi_string_cat_str(model->status_string, "; ");
+        append_suffixed_byte_count(model->status_string, model->read_speed);
+        furi_string_cat_str(model->status_string, "ps");
+    }
+    canvas_draw_str(canvas, 12, 34, furi_string_get_cstr(model->status_string));
+
+    furi_string_set_str(model->status_string, "W:");
+    append_suffixed_byte_count(model->status_string, model->bytes_written);
+    if(model->write_speed) {
+        furi_string_cat_str(model->status_string, "; ");
+        append_suffixed_byte_count(model->status_string, model->write_speed);
+        furi_string_cat_str(model->status_string, "ps");
+    }
+    canvas_draw_str(canvas, 12, 44, furi_string_get_cstr(model->status_string));
+}
+
+MassStorage* mass_storage_alloc() {
+    MassStorage* mass_storage = malloc(sizeof(MassStorage));
+
+    mass_storage->view = view_alloc();
+    view_allocate_model(mass_storage->view, ViewModelTypeLocking, sizeof(MassStorageModel));
+    with_view_model(
+        mass_storage->view,
+        MassStorageModel * model,
+        {
+            model->file_name = furi_string_alloc();
+            model->status_string = furi_string_alloc();
+        },
+        false);
+    view_set_context(mass_storage->view, mass_storage);
+    view_set_draw_callback(mass_storage->view, mass_storage_draw_callback);
+
+    return mass_storage;
+}
+
+void mass_storage_free(MassStorage* mass_storage) {
+    furi_assert(mass_storage);
+    with_view_model(
+        mass_storage->view,
+        MassStorageModel * model,
+        {
+            furi_string_free(model->file_name);
+            furi_string_free(model->status_string);
+        },
+        false);
+    view_free(mass_storage->view);
+    free(mass_storage);
+}
+
+View* mass_storage_get_view(MassStorage* mass_storage) {
+    furi_assert(mass_storage);
+    return mass_storage->view;
+}
+
+void mass_storage_set_file_name(MassStorage* mass_storage, FuriString* name) {
+    furi_assert(name);
+    with_view_model(
+        mass_storage->view,
+        MassStorageModel * model,
+        { furi_string_set(model->file_name, name); },
+        true);
+}
+
+void mass_storage_set_stats(MassStorage* mass_storage, uint32_t read, uint32_t written) {
+    with_view_model(
+        mass_storage->view,
+        MassStorageModel * model,
+        {
+            uint32_t now = furi_get_tick();
+            model->read_speed = (read - model->bytes_read) * 1000 / (now - model->update_time);
+            model->write_speed =
+                (written - model->bytes_written) * 1000 / (now - model->update_time);
+            model->bytes_read = read;
+            model->bytes_written = written;
+            model->update_time = now;
+        },
+        true);
+}

base_pack/mass_storage/views/mass_storage_view.h

@@ -0,0 +1,15 @@
+#pragma once
+
+#include <gui/view.h>
+
+typedef struct MassStorage MassStorage;
+
+MassStorage* mass_storage_alloc();
+
+void mass_storage_free(MassStorage* mass_storage);
+
+View* mass_storage_get_view(MassStorage* mass_storage);
+
+void mass_storage_set_file_name(MassStorage* mass_storage, FuriString* name);
+
+void mass_storage_set_stats(MassStorage* mass_storage, uint32_t read, uint32_t written);

base_pack/mfkey32/application.fam

@@ -9,9 +9,11 @@ App(
         "storage",
     ],
     stack_size=1 * 1024,
+    fap_description="Mf Classic key finder",
+    fap_version="1.0",
     fap_icon="mfkey.png",
     fap_category="NFC",
-    fap_author="noproto",
+    fap_author="@noproto",
     fap_icon_assets="images",
     fap_weburl="https://github.com/noproto/FlipperMfkey",
 )

base_pack/nfc_rfid_detector/application.fam

@@ -6,8 +6,10 @@ App(
     entry_point="nfc_rfid_detector_app",
     requires=["gui"],
     stack_size=4 * 1024,
-    order=50,
+    fap_description="Identify the reader type: NFC (13 MHz) and/or RFID (125 KHz).",
+    fap_version="1.0",
     fap_icon="nfc_rfid_detector_10px.png",
     fap_category="Tools",
     fap_icon_assets="images",
+    fap_author="SkorP",
 )

base_pack/picopass/application.fam

@@ -9,7 +9,8 @@ App(
         "gui",
     ],
     stack_size=4 * 1024,
-    order=30,
+    fap_description="App to communicate with NFC tags using the PicoPass format",
+    fap_version="1.0",
     fap_icon="125_10px.png",
     fap_category="NFC",
     fap_libs=["mbedtls"],

base_pack/picopass/lib/loclass/optimized_cipher.c

@@ -280,7 +280,22 @@ void loclass_opt_doTagMAC_2(
     loclass_opt_output(div_key_p, &_init, mac);
 }
 
-void loclass_iclass_calc_div_key(uint8_t* csn, uint8_t* key, uint8_t* div_key, bool elite) {
+void loclass_opt_doBothMAC_2(
+    LoclassState_t _init,
+    uint8_t* nr,
+    uint8_t rmac[4],
+    uint8_t tmac[4],
+    const uint8_t* div_key_p) {
+    loclass_opt_suc(div_key_p, &_init, nr, 4, false);
+    // Save internal state for reuse before outputting
+    LoclassState_t nr_state = _init;
+    loclass_opt_output(div_key_p, &_init, rmac);
+    // Feed the 32 0 bits for the tag mac
+    loclass_opt_suc(div_key_p, &nr_state, NULL, 0, true);
+    loclass_opt_output(div_key_p, &nr_state, tmac);
+}
+
+void loclass_iclass_calc_div_key(uint8_t* csn, const uint8_t* key, uint8_t* div_key, bool elite) {
     if(elite) {
         uint8_t keytable[128] = {0};
         uint8_t key_index[8] = {0};

base_pack/picopass/lib/loclass/optimized_cipher.h

@@ -93,6 +93,21 @@ void loclass_opt_doTagMAC_2(
     uint8_t mac[4],
     const uint8_t* div_key_p);
 
+/**
+ * The same as loclass_opt_doTagMAC_2, but calculates both the reader and tag MACs at the same time
+ * @param _init - precalculated cipher state
+ * @param nr - the reader challenge
+ * @param rmac - where to store the reader MAC
+ * @param tmac - where to store the tag MAC
+ * @param div_key_p - the key to use
+ */
+void loclass_opt_doBothMAC_2(
+    LoclassState_t _init,
+    uint8_t* nr,
+    uint8_t rmac[4],
+    uint8_t tmac[4],
+    const uint8_t* div_key_p);
+
 void loclass_doMAC_N(uint8_t* in_p, uint8_t in_size, uint8_t* div_key_p, uint8_t mac[4]);
-void loclass_iclass_calc_div_key(uint8_t* csn, uint8_t* key, uint8_t* div_key, bool elite);
+void loclass_iclass_calc_div_key(uint8_t* csn, const uint8_t* key, uint8_t* div_key, bool elite);
 #endif // OPTIMIZED_CIPHER_H

base_pack/picopass/lib/loclass/optimized_elite.c

@@ -153,7 +153,7 @@ Definition 14. Define the rotate key function loclass_rk : (F 82 ) 8 × N → (F
 loclass_rk(x [0] . . . x [7] , 0) = x [0] . . . x [7]
 loclass_rk(x [0] . . . x [7] , n + 1) = loclass_rk(loclass_rl(x [0] ) . . . loclass_rl(x [7] ), n)
 **/
-static void loclass_rk(uint8_t* key, uint8_t n, uint8_t* outp_key) {
+static void loclass_rk(const uint8_t* key, uint8_t n, uint8_t* outp_key) {
     memcpy(outp_key, key, 8);
     uint8_t j;
     while(n-- > 0) {
@@ -172,7 +172,7 @@ static void loclass_desdecrypt_iclass(uint8_t* iclass_key, uint8_t* input, uint8
     mbedtls_des_crypt_ecb(&loclass_ctx_dec, input, output);
 }
 
-static void loclass_desencrypt_iclass(uint8_t* iclass_key, uint8_t* input, uint8_t* output) {
+static void loclass_desencrypt_iclass(const uint8_t* iclass_key, uint8_t* input, uint8_t* output) {
     uint8_t key_std_format[8] = {0};
     loclass_permutekey_rev(iclass_key, key_std_format);
     mbedtls_des_setkey_enc(&loclass_ctx_enc, key_std_format);
@@ -185,7 +185,7 @@ static void loclass_desencrypt_iclass(uint8_t* iclass_key, uint8_t* input, uint8
  * @param loclass_hash1 loclass_hash1
  * @param key_sel output key_sel=h[loclass_hash1[i]]
  */
-void loclass_hash2(uint8_t* key64, uint8_t* outp_keytable) {
+void loclass_hash2(const uint8_t* key64, uint8_t* outp_keytable) {
     /**
      *Expected:
      * High Security Key Table

base_pack/picopass/lib/loclass/optimized_elite.h

@@ -53,6 +53,6 @@ void loclass_permutekey_rev(const uint8_t key[8], uint8_t dest[8]);
  * @param k output
  */
 void loclass_hash1(const uint8_t* csn, uint8_t* k);
-void loclass_hash2(uint8_t* key64, uint8_t* outp_keytable);
+void loclass_hash2(const uint8_t* key64, uint8_t* outp_keytable);
 
 #endif

base_pack/picopass/loclass_writer.c

@@ -0,0 +1,100 @@
+#include "loclass_writer.h"
+
+#include <furi/furi.h>
+#include <furi_hal.h>
+#include <storage/storage.h>
+#include <stream/stream.h>
+#include <stream/buffered_file_stream.h>
+
+struct LoclassWriter {
+    Stream* file_stream;
+};
+
+#define LOCLASS_LOGS_PATH EXT_PATH("apps_data/picopass/.loclass.log")
+
+LoclassWriter* loclass_writer_alloc() {
+    LoclassWriter* instance = malloc(sizeof(LoclassWriter));
+    Storage* storage = furi_record_open(RECORD_STORAGE);
+    instance->file_stream = buffered_file_stream_alloc(storage);
+    if(!buffered_file_stream_open(
+           instance->file_stream, LOCLASS_LOGS_PATH, FSAM_WRITE, FSOM_OPEN_APPEND)) {
+        buffered_file_stream_close(instance->file_stream);
+        stream_free(instance->file_stream);
+        free(instance);
+        instance = NULL;
+    }
+
+    furi_record_close(RECORD_STORAGE);
+
+    return instance;
+}
+
+void loclass_writer_free(LoclassWriter* instance) {
+    furi_assert(instance != NULL);
+
+    buffered_file_stream_close(instance->file_stream);
+    stream_free(instance->file_stream);
+    free(instance);
+}
+
+bool loclass_writer_write_start_stop(LoclassWriter* instance, bool start) {
+    FuriHalRtcDateTime curr_dt;
+    furi_hal_rtc_get_datetime(&curr_dt);
+    uint32_t curr_ts = furi_hal_rtc_datetime_to_timestamp(&curr_dt);
+
+    FuriString* str = furi_string_alloc_printf(
+        "loclass-v1-info ts %lu %s\n", curr_ts, start ? "started" : "finished");
+    bool write_success = stream_write_string(instance->file_stream, str);
+    furi_string_free(str);
+    return write_success;
+}
+
+bool loclass_writer_write_params(
+    LoclassWriter* instance,
+    uint8_t log_no,
+    const uint8_t csn[8],
+    const uint8_t epurse[8],
+    const uint8_t nr[4],
+    const uint8_t mac[4]) {
+    furi_assert(instance != NULL);
+
+    FuriHalRtcDateTime curr_dt;
+    furi_hal_rtc_get_datetime(&curr_dt);
+    uint32_t curr_ts = furi_hal_rtc_datetime_to_timestamp(&curr_dt);
+
+    FuriString* str = furi_string_alloc_printf(
+        "loclass-v1-mac ts %lu no %u "
+        "csn %02x%02x%02x%02x%02x%02x%02x%02x "
+        "cc %02x%02x%02x%02x%02x%02x%02x%02x "
+        "nr %02x%02x%02x%02x "
+        "mac %02x%02x%02x%02x\n",
+        curr_ts,
+        log_no,
+        csn[0],
+        csn[1],
+        csn[2],
+        csn[3],
+        csn[4],
+        csn[5],
+        csn[6],
+        csn[7],
+        epurse[0],
+        epurse[1],
+        epurse[2],
+        epurse[3],
+        epurse[4],
+        epurse[5],
+        epurse[6],
+        epurse[7],
+        nr[0],
+        nr[1],
+        nr[2],
+        nr[3],
+        mac[0],
+        mac[1],
+        mac[2],
+        mac[3]);
+    bool write_success = stream_write_string(instance->file_stream, str);
+    furi_string_free(str);
+    return write_success;
+}

base_pack/picopass/loclass_writer.h

@@ -0,0 +1,20 @@
+#pragma once
+
+#include <stdint.h>
+#include <stdbool.h>
+
+typedef struct LoclassWriter LoclassWriter;
+
+LoclassWriter* loclass_writer_alloc();
+
+void loclass_writer_free(LoclassWriter* instance);
+
+bool loclass_writer_write_start_stop(LoclassWriter* instance, bool start);
+
+bool loclass_writer_write_params(
+    LoclassWriter* instance,
+    uint8_t log_no,
+    const uint8_t csn[8],
+    const uint8_t epurse[8],
+    const uint8_t nr[4],
+    const uint8_t mac[4]);

base_pack/picopass/picopass.c

@@ -68,6 +68,13 @@ Picopass* picopass_alloc() {
         PicopassViewTextInput,
         text_input_get_view(picopass->text_input));
 
+    // Byte Input
+    picopass->byte_input = byte_input_alloc();
+    view_dispatcher_add_view(
+        picopass->view_dispatcher,
+        PicopassViewByteInput,
+        byte_input_get_view(picopass->byte_input));
+
     // Custom Widget
     picopass->widget = widget_alloc();
     view_dispatcher_add_view(
@@ -79,6 +86,10 @@ Picopass* picopass_alloc() {
         PicopassViewDictAttack,
         dict_attack_get_view(picopass->dict_attack));
 
+    picopass->loclass = loclass_alloc();
+    view_dispatcher_add_view(
+        picopass->view_dispatcher, PicopassViewLoclass, loclass_get_view(picopass->loclass));
+
     return picopass;
 }
 
@@ -105,6 +116,10 @@ void picopass_free(Picopass* picopass) {
     view_dispatcher_remove_view(picopass->view_dispatcher, PicopassViewTextInput);
     text_input_free(picopass->text_input);
 
+    // ByteInput
+    view_dispatcher_remove_view(picopass->view_dispatcher, PicopassViewByteInput);
+    byte_input_free(picopass->byte_input);
+
     // Custom Widget
     view_dispatcher_remove_view(picopass->view_dispatcher, PicopassViewWidget);
     widget_free(picopass->widget);
@@ -112,6 +127,9 @@ void picopass_free(Picopass* picopass) {
     view_dispatcher_remove_view(picopass->view_dispatcher, PicopassViewDictAttack);
     dict_attack_free(picopass->dict_attack);
 
+    view_dispatcher_remove_view(picopass->view_dispatcher, PicopassViewLoclass);
+    loclass_free(picopass->loclass);
+
     // Worker
     picopass_worker_stop(picopass->worker);
     picopass_worker_free(picopass->worker);
@@ -153,6 +171,13 @@ static const NotificationSequence picopass_sequence_blink_start_cyan = {
     NULL,
 };
 
+static const NotificationSequence picopass_sequence_blink_start_magenta = {
+    &message_blink_start_10,
+    &message_blink_set_color_magenta,
+    &message_do_not_reset,
+    NULL,
+};
+
 static const NotificationSequence picopass_sequence_blink_stop = {
     &message_blink_stop,
     NULL,
@@ -162,6 +187,10 @@ void picopass_blink_start(Picopass* picopass) {
     notification_message(picopass->notifications, &picopass_sequence_blink_start_cyan);
 }
 
+void picopass_blink_emulate_start(Picopass* picopass) {
+    notification_message(picopass->notifications, &picopass_sequence_blink_start_magenta);
+}
+
 void picopass_blink_stop(Picopass* picopass) {
     notification_message(picopass->notifications, &picopass_sequence_blink_stop);
 }
@@ -209,4 +238,4 @@ int32_t picopass_app(void* p) {
     picopass_free(picopass);
 
     return 0;
-}
+}

base_pack/picopass/picopass_device.c

@@ -68,13 +68,14 @@ static bool picopass_device_save_file(
                 if(!flipper_format_write_uint32(file, "Facility Code", &fc, 1)) break;
                 if(!flipper_format_write_uint32(file, "Card Number", &cn, 1)) break;
                 if(!flipper_format_write_hex(
-                       file, "Credential", pacs->credential, PICOPASS_BLOCK_LEN))
+                       file, "Credential", pacs->credential, RFAL_PICOPASS_BLOCK_LEN))
                     break;
                 if(pacs->pin_length > 0) {
-                    if(!flipper_format_write_hex(file, "PIN\t\t", pacs->pin0, PICOPASS_BLOCK_LEN))
+                    if(!flipper_format_write_hex(
+                           file, "PIN\t\t", pacs->pin0, RFAL_PICOPASS_BLOCK_LEN))
                         break;
                     if(!flipper_format_write_hex(
-                           file, "PIN(cont.)\t", pacs->pin1, PICOPASS_BLOCK_LEN))
+                           file, "PIN(cont.)\t", pacs->pin1, RFAL_PICOPASS_BLOCK_LEN))
                         break;
                 }
             }
@@ -88,7 +89,10 @@ static bool picopass_device_save_file(
             for(size_t i = 0; i < app_limit; i++) {
                 furi_string_printf(temp_str, "Block %d", i);
                 if(!flipper_format_write_hex(
-                       file, furi_string_get_cstr(temp_str), AA1[i].data, PICOPASS_BLOCK_LEN)) {
+                       file,
+                       furi_string_get_cstr(temp_str),
+                       AA1[i].data,
+                       RFAL_PICOPASS_BLOCK_LEN)) {
                     block_saved = false;
                     break;
                 }
@@ -162,7 +166,7 @@ static bool picopass_device_load_data(PicopassDevice* dev, FuriString* path, boo
         for(size_t i = 0; i < 6; i++) {
             furi_string_printf(temp_str, "Block %d", i);
             if(!flipper_format_read_hex(
-                   file, furi_string_get_cstr(temp_str), AA1[i].data, PICOPASS_BLOCK_LEN)) {
+                   file, furi_string_get_cstr(temp_str), AA1[i].data, RFAL_PICOPASS_BLOCK_LEN)) {
                 block_read = false;
                 break;
             }
@@ -174,7 +178,7 @@ static bool picopass_device_load_data(PicopassDevice* dev, FuriString* path, boo
         for(size_t i = 6; i < app_limit; i++) {
             furi_string_printf(temp_str, "Block %d", i);
             if(!flipper_format_read_hex(
-                   file, furi_string_get_cstr(temp_str), AA1[i].data, PICOPASS_BLOCK_LEN)) {
+                   file, furi_string_get_cstr(temp_str), AA1[i].data, RFAL_PICOPASS_BLOCK_LEN)) {
                 block_read = false;
                 break;
             }
@@ -338,9 +342,9 @@ ReturnCode picopass_device_parse_credential(PicopassBlock* AA1, PicopassPacs* pa
         }
     } else if(pacs->encryption == PicopassDeviceEncryptionNone) {
         FURI_LOG_D(TAG, "No Encryption");
-        memcpy(pacs->credential, AA1[7].data, PICOPASS_BLOCK_LEN);
-        memcpy(pacs->pin0, AA1[8].data, PICOPASS_BLOCK_LEN);
-        memcpy(pacs->pin1, AA1[9].data, PICOPASS_BLOCK_LEN);
+        memcpy(pacs->credential, AA1[7].data, RFAL_PICOPASS_BLOCK_LEN);
+        memcpy(pacs->pin0, AA1[8].data, RFAL_PICOPASS_BLOCK_LEN);
+        memcpy(pacs->pin1, AA1[9].data, RFAL_PICOPASS_BLOCK_LEN);
     } else if(pacs->encryption == PicopassDeviceEncryptionDES) {
         FURI_LOG_D(TAG, "DES Encrypted");
     } else {

base_pack/picopass/picopass_device.h

@@ -7,23 +7,38 @@
 #include <mbedtls/des.h>
 
 #include "rfal_picopass.h"
+#include "loclass_writer.h"
 #include <optimized_ikeys.h>
 #include <optimized_cipher.h>
 #include "helpers/iclass_elite_dict.h"
 
 #define PICOPASS_DEV_NAME_MAX_LEN 22
 #define PICOPASS_READER_DATA_MAX_SIZE 64
-#define PICOPASS_BLOCK_LEN 8
 #define PICOPASS_MAX_APP_LIMIT 32
 
 #define PICOPASS_CSN_BLOCK_INDEX 0
 #define PICOPASS_CONFIG_BLOCK_INDEX 1
-#define PICOPASS_EPURSE_BLOCK_INDEX 2
-#define PICOPASS_KD_BLOCK_INDEX 3
-#define PICOPASS_KC_BLOCK_INDEX 4
-#define PICOPASS_AIA_BLOCK_INDEX 5
-#define PICOPASS_PACS_CFG_BLOCK_INDEX 6
-
+// These definitions for blocks above 2 only hold for secure cards.
+#define PICOPASS_SECURE_EPURSE_BLOCK_INDEX 2
+#define PICOPASS_SECURE_KD_BLOCK_INDEX 3
+#define PICOPASS_SECURE_KC_BLOCK_INDEX 4
+#define PICOPASS_SECURE_AIA_BLOCK_INDEX 5
+// Non-secure cards instead have an AIA at block 2
+#define PICOPASS_NONSECURE_AIA_BLOCK_INDEX 2
+// Only iClass cards
+#define PICOPASS_ICLASS_PACS_CFG_BLOCK_INDEX 6
+
+// Personalization Mode
+#define PICOPASS_FUSE_PERS 0x80
+// Crypt1 // 1+1 (crypt1+crypt0) means secured and keys changable
+#define PICOPASS_FUSE_CRYPT1 0x10
+// Crypt0 // 1+0 means secure and keys locked, 0+1 means not secured, 0+0 means disable auth entirely
+#define PICOPASS_FUSE_CRTPT0 0x08
+#define PICOPASS_FUSE_CRYPT10 (PICOPASS_FUSE_CRYPT1 | PICOPASS_FUSE_CRTPT0)
+// Read Access, 1 meanns anonymous read enabled, 0 means must auth to read applicaion
+#define PICOPASS_FUSE_RA 0x01
+
+#define PICOPASS_APP_FOLDER ANY_PATH("picopass")
 #define PICOPASS_APP_EXTENSION ".picopass"
 #define PICOPASS_APP_SHADOW_EXTENSION ".pas"
 
@@ -49,6 +64,13 @@ typedef enum {
     PicopassDeviceSaveFormatLF,
 } PicopassDeviceSaveFormat;
 
+typedef enum {
+    PicopassEmulatorStateHalt,
+    PicopassEmulatorStateIdle,
+    PicopassEmulatorStateActive,
+    PicopassEmulatorStateSelected,
+} PicopassEmulatorState;
+
 typedef struct {
     bool valid;
     uint8_t bitLength;
@@ -72,7 +94,7 @@ typedef struct {
 } PicopassPacs;
 
 typedef struct {
-    uint8_t data[PICOPASS_BLOCK_LEN];
+    uint8_t data[RFAL_PICOPASS_BLOCK_LEN];
 } PicopassBlock;
 
 typedef struct {
@@ -81,6 +103,15 @@ typedef struct {
     IclassEliteDictAttackData iclass_elite_dict_attack_data;
 } PicopassDeviceData;
 
+typedef struct {
+    PicopassEmulatorState state;
+    LoclassState_t cipher_state;
+    uint8_t key_block_num; // in loclass mode used to store csn#
+    bool loclass_mode;
+    bool loclass_got_std_key;
+    LoclassWriter* loclass_writer;
+} PicopassEmulatorCtx;
+
 typedef struct {
     Storage* storage;
     DialogsApp* dialogs;

base_pack/picopass/picopass_i.h

@@ -16,12 +16,14 @@
 #include <gui/modules/popup.h>
 #include <gui/modules/loading.h>
 #include <gui/modules/text_input.h>
+#include <gui/modules/byte_input.h>
 #include <gui/modules/widget.h>
 
 #include <input/input.h>
 
 #include "scenes/picopass_scene.h"
 #include "views/dict_attack.h"
+#include "views/loclass.h"
 
 #include <storage/storage.h>
 #include <lib/toolbox/path.h>
@@ -29,6 +31,10 @@
 
 #define PICOPASS_TEXT_STORE_SIZE 128
 
+#define LOCLASS_NUM_CSNS 9
+// Collect 2 MACs per CSN to account for keyroll modes
+#define LOCLASS_MACS_TO_COLLECT (LOCLASS_NUM_CSNS * 2)
+
 enum PicopassCustomEvent {
     // Reserve first 100 events for button types and indexes, starting from 0
     PicopassCustomEventReserved = 100,
@@ -55,14 +61,17 @@ struct Picopass {
 
     char text_store[PICOPASS_TEXT_STORE_SIZE + 1];
     FuriString* text_box_store;
+    uint8_t byte_input_store[RFAL_PICOPASS_BLOCK_LEN];
 
     // Common Views
     Submenu* submenu;
     Popup* popup;
     Loading* loading;
     TextInput* text_input;
+    ByteInput* byte_input;
     Widget* widget;
     DictAttack* dict_attack;
+    Loclass* loclass;
 };
 
 typedef enum {
@@ -70,8 +79,10 @@ typedef enum {
     PicopassViewPopup,
     PicopassViewLoading,
     PicopassViewTextInput,
+    PicopassViewByteInput,
     PicopassViewWidget,
     PicopassViewDictAttack,
+    PicopassViewLoclass,
 } PicopassView;
 
 Picopass* picopass_alloc();
@@ -82,6 +93,8 @@ void picopass_text_store_clear(Picopass* picopass);
 
 void picopass_blink_start(Picopass* picopass);
 
+void picopass_blink_emulate_start(Picopass* picopass);
+
 void picopass_blink_stop(Picopass* picopass);
 
 void picopass_show_loading_popup(void* context, bool show);

base_pack/picopass/picopass_keys.h

@@ -2,9 +2,9 @@
 
 #include "picopass_device.h"
 
-extern const uint8_t picopass_iclass_key[PICOPASS_BLOCK_LEN];
-extern const uint8_t picopass_factory_credit_key[PICOPASS_BLOCK_LEN];
-extern const uint8_t picopass_factory_debit_key[PICOPASS_BLOCK_LEN];
-extern const uint8_t picopass_xice_key[PICOPASS_BLOCK_LEN];
-extern const uint8_t picopass_xicl_key[PICOPASS_BLOCK_LEN];
-extern const uint8_t picopass_xics_key[PICOPASS_BLOCK_LEN];
+extern const uint8_t picopass_iclass_key[RFAL_PICOPASS_BLOCK_LEN];
+extern const uint8_t picopass_factory_credit_key[RFAL_PICOPASS_BLOCK_LEN];
+extern const uint8_t picopass_factory_debit_key[RFAL_PICOPASS_BLOCK_LEN];
+extern const uint8_t picopass_xice_key[RFAL_PICOPASS_BLOCK_LEN];
+extern const uint8_t picopass_xicl_key[RFAL_PICOPASS_BLOCK_LEN];
+extern const uint8_t picopass_xics_key[RFAL_PICOPASS_BLOCK_LEN];

base_pack/picopass/picopass_worker.c

@@ -1,12 +1,28 @@
 #include "picopass_worker_i.h"
 
 #include <flipper_format/flipper_format.h>
+#include <lib/nfc/protocols/nfcv.h>
 
 #define TAG "PicopassWorker"
 
+#define HAS_MASK(x, b) ((x & b) == b)
+
+// CSNs from Proxmark3 repo
+static const uint8_t loclass_csns[LOCLASS_NUM_CSNS][RFAL_PICOPASS_BLOCK_LEN] = {
+    {0x01, 0x0A, 0x0F, 0xFF, 0xF7, 0xFF, 0x12, 0xE0},
+    {0x0C, 0x06, 0x0C, 0xFE, 0xF7, 0xFF, 0x12, 0xE0},
+    {0x10, 0x97, 0x83, 0x7B, 0xF7, 0xFF, 0x12, 0xE0},
+    {0x13, 0x97, 0x82, 0x7A, 0xF7, 0xFF, 0x12, 0xE0},
+    {0x07, 0x0E, 0x0D, 0xF9, 0xF7, 0xFF, 0x12, 0xE0},
+    {0x14, 0x96, 0x84, 0x76, 0xF7, 0xFF, 0x12, 0xE0},
+    {0x17, 0x96, 0x85, 0x71, 0xF7, 0xFF, 0x12, 0xE0},
+    {0xCE, 0xC5, 0x0F, 0x77, 0xF7, 0xFF, 0x12, 0xE0},
+    {0xD2, 0x5A, 0x82, 0xF8, 0xF7, 0xFF, 0x12, 0xE0},
+};
+
 static void picopass_worker_enable_field() {
-    furi_hal_nfc_ll_txrx_on();
     furi_hal_nfc_exit_sleep();
+    furi_hal_nfc_ll_txrx_on();
     furi_hal_nfc_ll_poll();
 }
 
@@ -68,6 +84,21 @@ void picopass_worker_stop(PicopassWorker* picopass_worker) {
     furi_assert(picopass_worker);
     furi_assert(picopass_worker->thread);
 
+    if(furi_thread_get_state(picopass_worker->thread) == FuriThreadStateStopped) {
+        return;
+    }
+
+    if(picopass_worker->state == PicopassWorkerStateBroken ||
+       picopass_worker->state == PicopassWorkerStateReady) {
+        return;
+    }
+
+    if(picopass_worker->state != PicopassWorkerStateEmulate &&
+       picopass_worker->state != PicopassWorkerStateLoclass) {
+        // Can't do this while emulating in transparent mode as SPI isn't active
+        picopass_worker_disable_field(ERR_NONE);
+    }
+
     if(furi_thread_get_state(picopass_worker->thread) != FuriThreadStateStopped) {
         picopass_worker_change_state(picopass_worker, PicopassWorkerStateStop);
         furi_thread_join(picopass_worker->thread);
@@ -99,7 +130,7 @@ ReturnCode picopass_detect_card(int timeout) {
 
     err = rfalPicoPassPollerCheckPresence();
     if(err != ERR_RF_COLLISION) {
-        //FURI_LOG_E(TAG, "rfalPicoPassPollerCheckPresence error %d", err);
+        FURI_LOG_E(TAG, "rfalPicoPassPollerCheckPresence error %d", err);
         return err;
     }
 
@@ -153,19 +184,19 @@ ReturnCode picopass_read_preauth(PicopassBlock* AA1) {
         AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[7]);
 
     rfalPicoPassReadBlockRes aia;
-    rfalPicoPassPollerReadBlock(PICOPASS_AIA_BLOCK_INDEX, &aia);
-    memcpy(AA1[PICOPASS_AIA_BLOCK_INDEX].data, aia.data, sizeof(aia.data));
+    rfalPicoPassPollerReadBlock(PICOPASS_SECURE_AIA_BLOCK_INDEX, &aia);
+    memcpy(AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data, aia.data, sizeof(aia.data));
     FURI_LOG_D(
         TAG,
         "aia %02x%02x%02x%02x%02x%02x%02x%02x",
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[0],
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[1],
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[2],
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[3],
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[4],
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[5],
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[6],
-        AA1[PICOPASS_AIA_BLOCK_INDEX].data[7]);
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[0],
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[1],
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[2],
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[3],
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[4],
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[5],
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[6],
+        AA1[PICOPASS_SECURE_AIA_BLOCK_INDEX].data[7]);
 
     return ERR_NONE;
 }
@@ -181,7 +212,7 @@ static ReturnCode
     PicopassPacs* pacs = &dev_data->pacs;
 
     uint8_t* csn = AA1[PICOPASS_CSN_BLOCK_INDEX].data;
-    uint8_t* div_key = AA1[PICOPASS_KD_BLOCK_INDEX].data;
+    uint8_t* div_key = AA1[PICOPASS_SECURE_KD_BLOCK_INDEX].data;
 
     ReturnCode err = ERR_PARAM;
 
@@ -189,7 +220,7 @@ static ReturnCode
     uint8_t ccnr[12] = {0};
 
     size_t index = 0;
-    uint8_t key[PICOPASS_BLOCK_LEN] = {0};
+    uint8_t key[RFAL_PICOPASS_BLOCK_LEN] = {0};
 
     if(!iclass_elite_dict_check_presence(dict_type)) {
         FURI_LOG_E(TAG, "Dictionary not found");
@@ -230,7 +261,7 @@ static ReturnCode
 
         err = rfalPicoPassPollerCheck(mac, &chkRes);
         if(err == ERR_NONE) {
-            memcpy(pacs->key, key, PICOPASS_BLOCK_LEN);
+            memcpy(pacs->key, key, RFAL_PICOPASS_BLOCK_LEN);
             break;
         }
 
@@ -274,7 +305,7 @@ ReturnCode picopass_read_card(PicopassBlock* AA1) {
                            PICOPASS_MAX_APP_LIMIT;
 
     for(size_t i = 2; i < app_limit; i++) {
-        if(i == PICOPASS_KD_BLOCK_INDEX) {
+        if(i == PICOPASS_SECURE_KD_BLOCK_INDEX) {
             // Skip over Kd block which is populated earlier (READ of Kd returns all FF's)
             continue;
         }
@@ -349,7 +380,7 @@ ReturnCode picopass_write_card(PicopassBlock* AA1) {
         FURI_LOG_D(TAG, "rfalPicoPassPollerWriteBlock %d", i);
         uint8_t data[9] = {0};
         data[0] = i;
-        memcpy(data + 1, AA1[i].data, RFAL_PICOPASS_MAX_BLOCK_LEN);
+        memcpy(data + 1, AA1[i].data, RFAL_PICOPASS_BLOCK_LEN);
         loclass_doMAC_N(data, sizeof(data), div_key, mac);
         FURI_LOG_D(
             TAG,
@@ -408,12 +439,12 @@ ReturnCode picopass_write_block(PicopassBlock* AA1, uint8_t blockNo, uint8_t* ne
     }
     memcpy(ccnr, rcRes.CCNR, sizeof(rcRes.CCNR)); // last 4 bytes left 0
 
-    if(memcmp(selRes.CSN, AA1[PICOPASS_CSN_BLOCK_INDEX].data, PICOPASS_BLOCK_LEN) != 0) {
+    if(memcmp(selRes.CSN, AA1[PICOPASS_CSN_BLOCK_INDEX].data, RFAL_PICOPASS_BLOCK_LEN) != 0) {
         FURI_LOG_E(TAG, "Wrong CSN for write");
         return ERR_REQUEST;
     }
 
-    loclass_opt_doReaderMAC(ccnr, AA1[PICOPASS_KD_BLOCK_INDEX].data, mac);
+    loclass_opt_doReaderMAC(ccnr, AA1[PICOPASS_SECURE_KD_BLOCK_INDEX].data, mac);
     err = rfalPicoPassPollerCheck(mac, &chkRes);
     if(err != ERR_NONE) {
         FURI_LOG_E(TAG, "rfalPicoPassPollerCheck error %d", err);
@@ -431,7 +462,7 @@ ReturnCode picopass_write_block(PicopassBlock* AA1, uint8_t blockNo, uint8_t* ne
         newBlock[5],
         newBlock[6],
         newBlock[7]};
-    loclass_doMAC_N(data, sizeof(data), AA1[PICOPASS_KD_BLOCK_INDEX].data, mac);
+    loclass_doMAC_N(data, sizeof(data), AA1[PICOPASS_SECURE_KD_BLOCK_INDEX].data, mac);
     FURI_LOG_D(
         TAG,
         "loclass_doMAC_N %d %02x%02x%02x%02x%02x%02x%02x%02x %02x%02x%02x%02x",
@@ -484,7 +515,7 @@ void picopass_worker_elite_dict_attack(PicopassWorker* picopass_worker) {
     uint8_t ccnr[12] = {0};
 
     size_t index = 0;
-    uint8_t key[PICOPASS_BLOCK_LEN] = {0};
+    uint8_t key[RFAL_PICOPASS_BLOCK_LEN] = {0};
 
     // Load dictionary
     IclassEliteDict* dict = dict_attack_data->dict;
@@ -541,7 +572,7 @@ void picopass_worker_elite_dict_attack(PicopassWorker* picopass_worker) {
         memcpy(ccnr, rcRes.CCNR, sizeof(rcRes.CCNR)); // last 4 bytes left 0
 
         uint8_t* csn = AA1[PICOPASS_CSN_BLOCK_INDEX].data;
-        uint8_t* div_key = AA1[PICOPASS_KD_BLOCK_INDEX].data;
+        uint8_t* div_key = AA1[PICOPASS_SECURE_KD_BLOCK_INDEX].data;
 
         loclass_iclass_calc_div_key(csn, key, div_key, elite);
         loclass_opt_doReaderMAC(ccnr, div_key, mac);
@@ -549,7 +580,7 @@ void picopass_worker_elite_dict_attack(PicopassWorker* picopass_worker) {
         err = rfalPicoPassPollerCheck(mac, &chkRes);
         if(err == ERR_NONE) {
             FURI_LOG_I(TAG, "Found key");
-            memcpy(pacs->key, key, PICOPASS_BLOCK_LEN);
+            memcpy(pacs->key, key, RFAL_PICOPASS_BLOCK_LEN);
             pacs->elite_kdf = elite;
             err = picopass_read_card(AA1);
             if(err != ERR_NONE) {
@@ -588,15 +619,22 @@ void picopass_worker_elite_dict_attack(PicopassWorker* picopass_worker) {
 int32_t picopass_worker_task(void* context) {
     PicopassWorker* picopass_worker = context;
 
-    picopass_worker_enable_field();
     if(picopass_worker->state == PicopassWorkerStateDetect) {
+        picopass_worker_enable_field();
         picopass_worker_detect(picopass_worker);
     } else if(picopass_worker->state == PicopassWorkerStateWrite) {
+        picopass_worker_enable_field();
         picopass_worker_write(picopass_worker);
     } else if(picopass_worker->state == PicopassWorkerStateWriteKey) {
+        picopass_worker_enable_field();
         picopass_worker_write_key(picopass_worker);
     } else if(picopass_worker->state == PicopassWorkerStateEliteDictAttack) {
+        picopass_worker_enable_field();
         picopass_worker_elite_dict_attack(picopass_worker);
+    } else if(picopass_worker->state == PicopassWorkerStateEmulate) {
+        picopass_worker_emulate(picopass_worker, false);
+    } else if(picopass_worker->state == PicopassWorkerStateLoclass) {
+        picopass_worker_emulate(picopass_worker, true);
     } else if(picopass_worker->state == PicopassWorkerStateStop) {
         FURI_LOG_D(TAG, "Worker state stop");
         // no-op
@@ -718,9 +756,9 @@ void picopass_worker_write_key(PicopassWorker* picopass_worker) {
     uint8_t* csn = AA1[PICOPASS_CSN_BLOCK_INDEX].data;
     uint8_t* configBlock = AA1[PICOPASS_CONFIG_BLOCK_INDEX].data;
     uint8_t fuses = configBlock[7];
-    uint8_t* oldKey = AA1[PICOPASS_KD_BLOCK_INDEX].data;
+    uint8_t* oldKey = AA1[PICOPASS_SECURE_KD_BLOCK_INDEX].data;
 
-    uint8_t newKey[PICOPASS_BLOCK_LEN] = {0};
+    uint8_t newKey[RFAL_PICOPASS_BLOCK_LEN] = {0};
     loclass_iclass_calc_div_key(csn, pacs->key, newKey, pacs->elite_kdf);
 
     if((fuses & 0x80) == 0x80) {
@@ -728,14 +766,14 @@ void picopass_worker_write_key(PicopassWorker* picopass_worker) {
     } else {
         FURI_LOG_D(TAG, "XOR write for application mode key change");
         // XOR when in application mode
-        for(size_t i = 0; i < PICOPASS_BLOCK_LEN; i++) {
+        for(size_t i = 0; i < RFAL_PICOPASS_BLOCK_LEN; i++) {
             newKey[i] ^= oldKey[i];
         }
     }
 
     while(picopass_worker->state == PicopassWorkerStateWriteKey) {
         if(picopass_detect_card(1000) == ERR_NONE) {
-            err = picopass_write_block(AA1, PICOPASS_KD_BLOCK_INDEX, newKey);
+            err = picopass_write_block(AA1, PICOPASS_SECURE_KD_BLOCK_INDEX, newKey);
             if(err != ERR_NONE) {
                 FURI_LOG_E(TAG, "picopass_write_block error %d", err);
                 nextState = PicopassWorkerEventFail;
@@ -750,3 +788,488 @@ void picopass_worker_write_key(PicopassWorker* picopass_worker) {
         furi_delay_ms(100);
     }
 }
+
+// from proxmark3 armsrc/iclass.c rotateCSN
+static void picopass_anticoll_csn(uint8_t* rotated_csn, const uint8_t* original_csn) {
+    for(uint8_t i = 0; i < 8; i++) {
+        rotated_csn[i] = (original_csn[i] >> 3) | (original_csn[(i + 1) % 8] << 5);
+    }
+}
+
+static void picopass_append_crc(uint8_t* buf, uint16_t size) {
+    uint16_t crc = rfalPicoPassCalculateCcitt(0xE012, buf, size);
+
+    buf[size] = crc & 0xFF;
+    buf[size + 1] = crc >> 8;
+}
+
+static inline void picopass_emu_read_blocks(
+    NfcVData* nfcv_data,
+    uint8_t* buf,
+    uint8_t block_num,
+    uint8_t block_count) {
+    memcpy(
+        buf,
+        nfcv_data->data + (block_num * RFAL_PICOPASS_BLOCK_LEN),
+        block_count * RFAL_PICOPASS_BLOCK_LEN);
+}
+
+static inline void picopass_emu_write_blocks(
+    NfcVData* nfcv_data,
+    const uint8_t* buf,
+    uint8_t block_num,
+    uint8_t block_count) {
+    memcpy(
+        nfcv_data->data + (block_num * RFAL_PICOPASS_BLOCK_LEN),
+        buf,
+        block_count * RFAL_PICOPASS_BLOCK_LEN);
+}
+
+static void picopass_init_cipher_state(NfcVData* nfcv_data, PicopassEmulatorCtx* ctx) {
+    uint8_t cc[RFAL_PICOPASS_BLOCK_LEN];
+    uint8_t key[RFAL_PICOPASS_BLOCK_LEN];
+
+    picopass_emu_read_blocks(nfcv_data, cc, PICOPASS_SECURE_EPURSE_BLOCK_INDEX, 1);
+    picopass_emu_read_blocks(nfcv_data, key, ctx->key_block_num, 1);
+
+    ctx->cipher_state = loclass_opt_doTagMAC_1(cc, key);
+}
+
+static void
+    loclass_update_csn(FuriHalNfcDevData* nfc_data, NfcVData* nfcv_data, PicopassEmulatorCtx* ctx) {
+    // collect two nonces in a row for each CSN
+    uint8_t csn_num = (ctx->key_block_num / 2) % LOCLASS_NUM_CSNS;
+    memcpy(nfc_data->uid, loclass_csns[csn_num], RFAL_PICOPASS_BLOCK_LEN);
+    picopass_emu_write_blocks(nfcv_data, loclass_csns[csn_num], PICOPASS_CSN_BLOCK_INDEX, 1);
+}
+
+static void picopass_emu_handle_packet(
+    FuriHalNfcTxRxContext* tx_rx,
+    FuriHalNfcDevData* nfc_data,
+    void* nfcv_data_in) {
+    NfcVData* nfcv_data = (NfcVData*)nfcv_data_in;
+    PicopassEmulatorCtx* ctx = nfcv_data->emu_protocol_ctx;
+    uint8_t response[34];
+    uint8_t response_length = 0;
+    uint8_t key_block_num = PICOPASS_SECURE_KD_BLOCK_INDEX;
+
+    const uint8_t block_ff[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+
+    if(nfcv_data->frame_length < 1) {
+        return;
+    }
+
+    switch(nfcv_data->frame[0]) {
+    case RFAL_PICOPASS_CMD_ACTALL: // No args
+        if(nfcv_data->frame_length != 1) {
+            return;
+        }
+
+        if(ctx->state != PicopassEmulatorStateHalt) {
+            ctx->state = PicopassEmulatorStateActive;
+        }
+
+        // Send SOF only
+        break;
+    case RFAL_PICOPASS_CMD_ACT: // No args
+        if(nfcv_data->frame_length != 1 || ctx->state != PicopassEmulatorStateActive) {
+            return;
+        }
+
+        // Send SOF only
+        break;
+    case RFAL_PICOPASS_CMD_HALT: // No args
+        if(nfcv_data->frame_length != 1 || ctx->state != PicopassEmulatorStateSelected) {
+            return;
+        }
+
+        // Technically we should go to StateHalt, but since we can't detect the field dropping we drop to idle instead
+        ctx->state = PicopassEmulatorStateIdle;
+
+        // Send SOF only
+        break;
+    case RFAL_PICOPASS_CMD_READ_OR_IDENTIFY:
+        if(nfcv_data->frame_length == 1 &&
+           ctx->state == PicopassEmulatorStateActive) { // PICOPASS_CMD_IDENTIFY
+            // ASNB(8) CRC16(2)
+            picopass_anticoll_csn(response, nfc_data->uid);
+            picopass_append_crc(response, RFAL_PICOPASS_BLOCK_LEN);
+            response_length = RFAL_PICOPASS_BLOCK_LEN + 2;
+            break;
+        } else if(
+            nfcv_data->frame_length == 4 &&
+            ctx->state == PicopassEmulatorStateSelected) { // PICOPASS_CMD_READ ADDRESS(1) CRC16(2)
+            if(nfcv_data->frame[1] >= PICOPASS_MAX_APP_LIMIT) {
+                return;
+            }
+
+            // TODO: Check CRC?
+            // TODO: Check auth?
+
+            // DATA(8) CRC16(2)
+            if(nfcv_data->frame[1] == PICOPASS_SECURE_KD_BLOCK_INDEX ||
+               nfcv_data->frame[1] == PICOPASS_SECURE_KC_BLOCK_INDEX) {
+                // Reading Kd or Kc blocks always returns FF's
+                memcpy(response, block_ff, RFAL_PICOPASS_BLOCK_LEN);
+            } else {
+                picopass_emu_read_blocks(nfcv_data, response, nfcv_data->frame[1], 1);
+            }
+            picopass_append_crc(response, RFAL_PICOPASS_BLOCK_LEN);
+            response_length = RFAL_PICOPASS_BLOCK_LEN + 2;
+            break;
+        }
+
+        return;
+    case RFAL_PICOPASS_CMD_READ4: // ADDRESS(1) CRC16(2)
+        if(nfcv_data->frame_length != 4 || ctx->state != PicopassEmulatorStateSelected ||
+           nfcv_data->frame[1] + 4 >= PICOPASS_MAX_APP_LIMIT) {
+            return;
+        }
+
+        // TODO: Check CRC?
+        // TODO: Check auth?
+
+        uint8_t blockNum = nfcv_data->frame[1];
+
+        // DATA(32) CRC16(2)
+        picopass_emu_read_blocks(nfcv_data, response, blockNum, 4);
+        if(blockNum == 4) {
+            // Kc is block 4, so just redact first block of response
+            memcpy(response, block_ff, RFAL_PICOPASS_BLOCK_LEN);
+        } else if(blockNum < 4) {
+            // Kd is block 3
+            uint8_t* kdOffset = response + ((3 - blockNum) * RFAL_PICOPASS_BLOCK_LEN);
+            memcpy(kdOffset, block_ff, RFAL_PICOPASS_BLOCK_LEN);
+            if(blockNum != 0) {
+                // Redact Kc
+                memcpy(kdOffset + RFAL_PICOPASS_BLOCK_LEN, block_ff, RFAL_PICOPASS_BLOCK_LEN);
+            }
+        }
+        picopass_append_crc(response, RFAL_PICOPASS_BLOCK_LEN * 4);
+        response_length = (RFAL_PICOPASS_BLOCK_LEN * 4) + 2;
+        break;
+    case RFAL_PICOPASS_CMD_SELECT: // ASNB(8)|SERIALNB(8)
+        if(nfcv_data->frame_length != 9) {
+            return;
+        }
+
+        uint8_t select_csn[RFAL_PICOPASS_BLOCK_LEN];
+        if(ctx->state == PicopassEmulatorStateHalt || ctx->state == PicopassEmulatorStateIdle) {
+            memcpy(select_csn, nfc_data->uid, RFAL_PICOPASS_BLOCK_LEN);
+        } else {
+            picopass_anticoll_csn(select_csn, nfc_data->uid);
+        }
+
+        if(memcmp(nfcv_data->frame + 1, select_csn, RFAL_PICOPASS_BLOCK_LEN)) {
+            if(ctx->state == PicopassEmulatorStateActive) {
+                ctx->state = PicopassEmulatorStateIdle;
+            } else if(ctx->state == PicopassEmulatorStateSelected) {
+                // Technically we should go to StateHalt, but since we can't detect the field dropping we drop to idle instead
+                ctx->state = PicopassEmulatorStateIdle;
+            }
+
+            return;
+        }
+
+        ctx->state = PicopassEmulatorStateSelected;
+
+        // SERIALNB(8) CRC16(2)
+        memcpy(response, nfc_data->uid, RFAL_PICOPASS_BLOCK_LEN);
+        picopass_append_crc(response, RFAL_PICOPASS_BLOCK_LEN);
+
+        response_length = RFAL_PICOPASS_BLOCK_LEN + 2;
+        break;
+    case RFAL_PICOPASS_CMD_READCHECK_KC: // ADDRESS(1)
+        key_block_num = PICOPASS_SECURE_KC_BLOCK_INDEX;
+        // fallthrough
+    case RFAL_PICOPASS_CMD_READCHECK_KD: // ADDRESS(1)
+        if(nfcv_data->frame_length != 2 ||
+           nfcv_data->frame[1] != PICOPASS_SECURE_EPURSE_BLOCK_INDEX ||
+           ctx->state != PicopassEmulatorStateSelected) {
+            return;
+        }
+
+        if(ctx->key_block_num != key_block_num && !ctx->loclass_mode) {
+            ctx->key_block_num = key_block_num;
+            picopass_init_cipher_state(nfcv_data, ctx);
+        }
+
+        // DATA(8)
+        picopass_emu_read_blocks(nfcv_data, response, nfcv_data->frame[1], 1);
+        response_length = RFAL_PICOPASS_BLOCK_LEN;
+        break;
+    case RFAL_PICOPASS_CMD_CHECK: // CHALLENGE(4) READERSIGNATURE(4)
+        if(nfcv_data->frame_length != 9 || ctx->state != PicopassEmulatorStateSelected) {
+            return;
+        }
+
+        if(ctx->loclass_mode) {
+            // LOCLASS Reader attack mode
+
+            // Copy EPURSE
+            uint8_t cc[RFAL_PICOPASS_BLOCK_LEN];
+            picopass_emu_read_blocks(nfcv_data, cc, PICOPASS_SECURE_EPURSE_BLOCK_INDEX, 1);
+
+            // Check if the nonce is from a standard key
+            uint8_t key[RFAL_PICOPASS_BLOCK_LEN];
+            loclass_iclass_calc_div_key(nfc_data->uid, picopass_iclass_key, key, false);
+            ctx->cipher_state = loclass_opt_doTagMAC_1(cc, key);
+
+            uint8_t rmac[4];
+            loclass_opt_doBothMAC_2(ctx->cipher_state, nfcv_data->frame + 1, rmac, response, key);
+
+            if(!memcmp(nfcv_data->frame + 5, rmac, 4)) {
+                // MAC from reader matches Standard Key, keyroll mode or non-elite keyed reader.
+                // Either way no point logging it.
+
+                FURI_LOG_W(TAG, "loclass: standard key detected during collection");
+                ctx->loclass_got_std_key = true;
+
+                ctx->state = PicopassEmulatorStateIdle;
+                return;
+            }
+
+            // Copy CHALLENGE (nr) and READERSIGNATURE (mac) from frame
+            uint8_t nr[4];
+            memcpy(nr, nfcv_data->frame + 1, 4);
+            uint8_t mac[4];
+            memcpy(mac, nfcv_data->frame + 5, 4);
+
+            FURI_LOG_I(TAG, "loclass: got nr/mac pair");
+            loclass_writer_write_params(
+                ctx->loclass_writer, ctx->key_block_num, nfc_data->uid, cc, nr, mac);
+
+            // Rotate to the next CSN
+            ctx->key_block_num = (ctx->key_block_num + 1) % (LOCLASS_NUM_CSNS * 2);
+            loclass_update_csn(nfc_data, nfcv_data, ctx);
+
+            ctx->state = PicopassEmulatorStateIdle;
+
+            return;
+        }
+
+        uint8_t key[RFAL_PICOPASS_BLOCK_LEN];
+        picopass_emu_read_blocks(nfcv_data, key, ctx->key_block_num, 1);
+
+        uint8_t rmac[4];
+        loclass_opt_doBothMAC_2(ctx->cipher_state, nfcv_data->frame + 1, rmac, response, key);
+
+        if(memcmp(nfcv_data->frame + 5, rmac, 4)) {
+            // Bad MAC from reader, do not send a response.
+            FURI_LOG_I(TAG, "Got bad MAC from reader");
+#ifndef PICOPASS_DEBUG_IGNORE_BAD_RMAC
+            return;
+#endif
+        }
+
+        // CHIPRESPONSE(4)
+        response_length = 4;
+        break;
+    case RFAL_PICOPASS_CMD_UPDATE: // ADDRESS(1) DATA(8) SIGN(4)|CRC16(2)
+        if((nfcv_data->frame_length != 12 && nfcv_data->frame_length != 14) ||
+           ctx->state != PicopassEmulatorStateSelected) {
+            return;
+        }
+
+        if(nfcv_data->frame[1] >= PICOPASS_MAX_APP_LIMIT) {
+            return;
+        }
+
+        uint8_t cfgBlock[RFAL_PICOPASS_BLOCK_LEN];
+        picopass_emu_read_blocks(nfcv_data, cfgBlock, PICOPASS_CONFIG_BLOCK_INDEX, 1);
+        bool persMode = HAS_MASK(cfgBlock[7], PICOPASS_FUSE_PERS);
+
+        if((nfcv_data->frame[1] == PICOPASS_CSN_BLOCK_INDEX) // CSN is always read only
+           ||
+           (!persMode &&
+            !HAS_MASK(cfgBlock[3], 0x80)) // Chip is in RO mode, no updated possible (even ePurse)
+           || (!persMode &&
+               nfcv_data->frame[1] ==
+                   PICOPASS_SECURE_AIA_BLOCK_INDEX) // AIA can only be set in personalisation mode
+           || (!persMode &&
+               (nfcv_data->frame[1] == PICOPASS_SECURE_KD_BLOCK_INDEX ||
+                nfcv_data->frame[1] == PICOPASS_SECURE_KC_BLOCK_INDEX) &&
+               (!HAS_MASK(cfgBlock[7], PICOPASS_FUSE_CRYPT10)))) {
+            return; // TODO: Is this the right response?
+        }
+
+        if(nfcv_data->frame[1] >= 6 && nfcv_data->frame[1] <= 12) {
+            if(!HAS_MASK(
+                   cfgBlock[3],
+                   1 << (nfcv_data->frame[1] - 6))) { // bit0 is block6, up to bit6 being block12
+                // Block is marked as read-only, deny writing
+                return; // TODO: Is this the right response?
+            }
+        }
+
+        // TODO: Check CRC/SIGN depending on if in secure mode
+        // Check correct key
+        // -> Kd only allows decrementing e-Purse
+        // -> per-app controlled by key access config
+        //bool keyAccess = HAS_MASK(cfgBlock[5], 0x01);
+        // -> must auth with that key to change it
+
+        uint8_t blockOffset = nfcv_data->frame[1];
+        uint8_t block[RFAL_PICOPASS_BLOCK_LEN];
+        switch(nfcv_data->frame[1]) {
+        case PICOPASS_CONFIG_BLOCK_INDEX:
+            block[0] = cfgBlock[0]; // Applications Limit
+            block[1] = cfgBlock[1] & nfcv_data->frame[3]; // OTP
+            block[2] = cfgBlock[2] & nfcv_data->frame[4]; // OTP
+            block[3] = cfgBlock[3] & nfcv_data->frame[5]; // Block Write Lock
+            block[4] = cfgBlock[4]; // Chip Config
+            block[5] = cfgBlock[5]; // Memory Config
+            block[6] = nfcv_data->frame[8]; // EAS
+            block[7] = cfgBlock[7]; // Fuses
+
+            // Some parts allow w (but not e) if in persMode
+            if(persMode) {
+                block[0] &= nfcv_data->frame[2]; // Applications Limit
+                block[4] &= nfcv_data->frame[6]; // Chip Config
+                block[5] &= nfcv_data->frame[7]; // Memory Config
+                block[7] &= nfcv_data->frame[9]; // Fuses
+            } else {
+                // Fuses allows setting Crypt1/0 from 1 to 0 only during application mode
+                block[7] &= nfcv_data->frame[9] | ~PICOPASS_FUSE_CRYPT10;
+            }
+            break;
+        case PICOPASS_SECURE_EPURSE_BLOCK_INDEX:
+            // ePurse updates swap first and second half of the block each update
+            memcpy(block + 4, nfcv_data->frame + 2, 4);
+            memcpy(block, nfcv_data->frame + 6, 4);
+            break;
+        case PICOPASS_SECURE_KD_BLOCK_INDEX:
+            // fallthrough
+        case PICOPASS_SECURE_KC_BLOCK_INDEX:
+            if(!persMode) {
+                picopass_emu_read_blocks(nfcv_data, block, blockOffset, 1);
+                for(uint8_t i = 0; i < sizeof(RFAL_PICOPASS_BLOCK_LEN); i++)
+                    block[i] ^= nfcv_data->frame[i + 2];
+                break;
+            }
+            // Use default case when in personalisation mode
+            // fallthrough
+        default:
+            memcpy(block, nfcv_data->frame + 2, RFAL_PICOPASS_BLOCK_LEN);
+            break;
+        }
+
+        picopass_emu_write_blocks(nfcv_data, block, blockOffset, 1);
+
+        if((nfcv_data->frame[1] == ctx->key_block_num ||
+            nfcv_data->frame[1] == PICOPASS_SECURE_EPURSE_BLOCK_INDEX) &&
+           !ctx->loclass_mode)
+            picopass_init_cipher_state(nfcv_data, ctx);
+
+        // DATA(8) CRC16(2)
+        if(nfcv_data->frame[1] == PICOPASS_SECURE_KD_BLOCK_INDEX ||
+           nfcv_data->frame[1] == PICOPASS_SECURE_KD_BLOCK_INDEX) {
+            // Key updates always return FF's
+            memcpy(response, block_ff, RFAL_PICOPASS_BLOCK_LEN);
+        } else {
+            memcpy(response, block, RFAL_PICOPASS_BLOCK_LEN);
+        }
+        picopass_append_crc(response, RFAL_PICOPASS_BLOCK_LEN);
+        response_length = RFAL_PICOPASS_BLOCK_LEN + 2;
+        break;
+    case RFAL_PICOPASS_CMD_PAGESEL: // PAGE(1) CRC16(2)
+        // Chips with a single page do not answer to this command
+        // BLOCK1(8) CRC16(2)
+        return;
+    case RFAL_PICOPASS_CMD_DETECT:
+        // TODO - not used by iClass though
+        return;
+    default:
+        return;
+    }
+
+    NfcVSendFlags flags = NfcVSendFlagsSof | NfcVSendFlagsOneSubcarrier | NfcVSendFlagsHighRate;
+    if(response_length > 0) {
+        flags |= NfcVSendFlagsEof;
+    }
+
+    nfcv_emu_send(
+        tx_rx,
+        nfcv_data,
+        response,
+        response_length,
+        flags,
+        nfcv_data->eof_timestamp + NFCV_FDT_FC(4000)); // 3650 is ~254uS 4000 is ~283uS
+}
+
+void picopass_worker_emulate(PicopassWorker* picopass_worker, bool loclass_mode) {
+    furi_hal_nfc_exit_sleep();
+
+    FuriHalNfcTxRxContext tx_rx = {};
+    PicopassEmulatorCtx emu_ctx = {
+        .state = PicopassEmulatorStateIdle,
+        .key_block_num = PICOPASS_SECURE_KD_BLOCK_INDEX,
+        .loclass_mode = loclass_mode,
+        .loclass_got_std_key = false,
+        .loclass_writer = NULL,
+    };
+    FuriHalNfcDevData nfc_data = {
+        .uid_len = RFAL_PICOPASS_UID_LEN,
+    };
+    NfcVData* nfcv_data = malloc(sizeof(NfcVData));
+    nfcv_data->block_size = RFAL_PICOPASS_BLOCK_LEN;
+    nfcv_data->emu_protocol_ctx = &emu_ctx;
+    nfcv_data->emu_protocol_handler = &picopass_emu_handle_packet;
+
+    PicopassDeviceData* dev_data = picopass_worker->dev_data;
+    PicopassBlock* blocks = dev_data->AA1;
+
+    if(loclass_mode) {
+        // Setup blocks for loclass attack
+        emu_ctx.key_block_num = 0;
+        loclass_update_csn(&nfc_data, nfcv_data, &emu_ctx);
+
+        uint8_t conf[8] = {0x12, 0xFF, 0xFF, 0xFF, 0x7F, 0x1F, 0xFF, 0x3C};
+        picopass_emu_write_blocks(nfcv_data, conf, PICOPASS_CONFIG_BLOCK_INDEX, 1);
+
+        uint8_t epurse[8] = {0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+        picopass_emu_write_blocks(nfcv_data, epurse, PICOPASS_SECURE_EPURSE_BLOCK_INDEX, 1);
+
+        uint8_t aia[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+        picopass_emu_write_blocks(nfcv_data, aia, PICOPASS_SECURE_AIA_BLOCK_INDEX, 1);
+
+        emu_ctx.loclass_writer = loclass_writer_alloc();
+        loclass_writer_write_start_stop(emu_ctx.loclass_writer, true);
+    } else {
+        memcpy(nfc_data.uid, blocks[PICOPASS_CSN_BLOCK_INDEX].data, RFAL_PICOPASS_BLOCK_LEN);
+        memcpy(nfcv_data->data, blocks, sizeof(dev_data->AA1));
+        picopass_init_cipher_state(nfcv_data, &emu_ctx);
+    }
+
+    uint8_t last_loclass_csn_num = 0;
+    bool loclass_got_std_key = false;
+
+    nfcv_emu_init(&nfc_data, nfcv_data);
+    while(picopass_worker->state == PicopassWorkerStateEmulate ||
+          picopass_worker->state == PicopassWorkerStateLoclass) {
+        if(nfcv_emu_loop(&tx_rx, &nfc_data, nfcv_data, 500)) {
+            if(picopass_worker->callback) {
+                if((loclass_mode) && (last_loclass_csn_num != emu_ctx.key_block_num)) {
+                    last_loclass_csn_num = emu_ctx.key_block_num;
+                    picopass_worker->callback(
+                        PicopassWorkerEventLoclassGotMac, picopass_worker->context);
+                } else if((loclass_mode) && !loclass_got_std_key && emu_ctx.loclass_got_std_key) {
+                    loclass_got_std_key = true;
+                    picopass_worker->callback(
+                        PicopassWorkerEventLoclassGotStandardKey, picopass_worker->context);
+                } else {
+                    picopass_worker->callback(
+                        PicopassWorkerEventSuccess, picopass_worker->context);
+                }
+            }
+        }
+    }
+
+    if(emu_ctx.loclass_writer) {
+        loclass_writer_write_start_stop(emu_ctx.loclass_writer, false);
+        loclass_writer_free(emu_ctx.loclass_writer);
+    }
+
+    nfcv_emu_deinit(nfcv_data);
+    free(nfcv_data);
+}

base_pack/picopass/picopass_worker.h

@@ -15,6 +15,8 @@ typedef enum {
     PicopassWorkerStateWrite,
     PicopassWorkerStateWriteKey,
     PicopassWorkerStateEliteDictAttack,
+    PicopassWorkerStateEmulate,
+    PicopassWorkerStateLoclass,
     // Transition
     PicopassWorkerStateStop,
 } PicopassWorkerState;
@@ -32,6 +34,8 @@ typedef enum {
     PicopassWorkerEventCardDetected,
     PicopassWorkerEventNewDictKeyBatch,
     PicopassWorkerEventNoDictFound,
+    PicopassWorkerEventLoclassGotMac,
+    PicopassWorkerEventLoclassGotStandardKey,
 } PicopassWorkerEvent;
 
 typedef void (*PicopassWorkerCallback)(PicopassWorkerEvent event, void* context);

base_pack/picopass/picopass_worker_i.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include "picopass_worker.h"
+#include "loclass_writer.h"
 #include "picopass_i.h"
 
 #include <furi.h>
@@ -32,3 +33,4 @@ int32_t picopass_worker_task(void* context);
 void picopass_worker_detect(PicopassWorker* picopass_worker);
 void picopass_worker_write(PicopassWorker* picopass_worker);
 void picopass_worker_write_key(PicopassWorker* picopass_worker);
+void picopass_worker_emulate(PicopassWorker* picopass_worker, bool loclass_mode);

base_pack/picopass/rfal_picopass.c

@@ -29,8 +29,7 @@ static uint16_t rfalPicoPassUpdateCcitt(uint16_t crcSeed, uint8_t dataByte) {
     return crc;
 }
 
-static uint16_t
-    rfalPicoPassCalculateCcitt(uint16_t preloadValue, const uint8_t* buf, uint16_t length) {
+uint16_t rfalPicoPassCalculateCcitt(uint16_t preloadValue, const uint8_t* buf, uint16_t length) {
     uint16_t crc = preloadValue;
     uint16_t index;
 
@@ -73,7 +72,7 @@ FuriHalNfcReturn rfalPicoPassPollerCheckPresence(void) {
 FuriHalNfcReturn rfalPicoPassPollerIdentify(rfalPicoPassIdentifyRes* idRes) {
     FuriHalNfcReturn ret;
 
-    uint8_t txBuf[1] = {RFAL_PICOPASS_CMD_IDENTIFY};
+    uint8_t txBuf[1] = {RFAL_PICOPASS_CMD_READ_OR_IDENTIFY};
     uint16_t recvLen = 0;
     uint32_t flags = RFAL_PICOPASS_TXRX_FLAGS;
     uint32_t fwt = furi_hal_nfc_ll_ms2fc(20);
@@ -119,7 +118,7 @@ FuriHalNfcReturn rfalPicoPassPollerSelect(uint8_t* csn, rfalPicoPassSelectRes* s
 
 FuriHalNfcReturn rfalPicoPassPollerReadCheck(rfalPicoPassReadCheckRes* rcRes) {
     FuriHalNfcReturn ret;
-    uint8_t txBuf[2] = {RFAL_PICOPASS_CMD_READCHECK, 0x02};
+    uint8_t txBuf[2] = {RFAL_PICOPASS_CMD_READCHECK_KD, 0x02};
     uint16_t recvLen = 0;
     uint32_t flags = RFAL_PICOPASS_TXRX_FLAGS;
     uint32_t fwt = furi_hal_nfc_ll_ms2fc(20);
@@ -171,7 +170,7 @@ FuriHalNfcReturn rfalPicoPassPollerCheck(uint8_t* mac, rfalPicoPassCheckRes* chk
 FuriHalNfcReturn rfalPicoPassPollerReadBlock(uint8_t blockNum, rfalPicoPassReadBlockRes* readRes) {
     FuriHalNfcReturn ret;
 
-    uint8_t txBuf[4] = {RFAL_PICOPASS_CMD_READ, 0, 0, 0};
+    uint8_t txBuf[4] = {RFAL_PICOPASS_CMD_READ_OR_IDENTIFY, 0, 0, 0};
     txBuf[1] = blockNum;
     uint16_t crc = rfalPicoPassCalculateCcitt(0xE012, txBuf + 1, 1);
     memcpy(txBuf + 2, &crc, sizeof(uint16_t));
@@ -194,8 +193,8 @@ FuriHalNfcReturn rfalPicoPassPollerReadBlock(uint8_t blockNum, rfalPicoPassReadB
 FuriHalNfcReturn rfalPicoPassPollerWriteBlock(uint8_t blockNum, uint8_t data[8], uint8_t mac[4]) {
     FuriHalNfcReturn ret;
 
-    uint8_t txBuf[14] = {RFAL_PICOPASS_CMD_WRITE, blockNum, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-    memcpy(txBuf + 2, data, RFAL_PICOPASS_MAX_BLOCK_LEN);
+    uint8_t txBuf[14] = {RFAL_PICOPASS_CMD_UPDATE, blockNum, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+    memcpy(txBuf + 2, data, RFAL_PICOPASS_BLOCK_LEN);
     memcpy(txBuf + 10, mac, 4);
 
     uint16_t recvLen = 0;

base_pack/picopass/rfal_picopass.h

@@ -3,16 +3,41 @@
 #include <furi_hal_nfc.h>
 
 #define RFAL_PICOPASS_UID_LEN 8
-#define RFAL_PICOPASS_MAX_BLOCK_LEN 8
+#define RFAL_PICOPASS_BLOCK_LEN 8
 
 enum {
+    // PicoPass command bytes:
+    // Low nibble used for command
+    // High nibble used for options and checksum (MSB)
+    // The only option we care about in 15693 mode is the key
+    // which is only used by READCHECK, so for simplicity we
+    // don't bother breaking down the command and flags into parts
+
+    // READ: ADDRESS(1) CRC16(2) -> DATA(8) CRC16(2)
+    // IDENTIFY: No args -> ASNB(8) CRC16(2)
+    RFAL_PICOPASS_CMD_READ_OR_IDENTIFY = 0x0C,
+    // ADDRESS(1) CRC16(2) -> DATA(32) CRC16(2)
+    RFAL_PICOPASS_CMD_READ4 = 0x06,
+    // ADDRESS(1) DATA(8) SIGN(4)|CRC16(2) -> DATA(8) CRC16(2)
+    RFAL_PICOPASS_CMD_UPDATE = 0x87,
+    // ADDRESS(1) -> DATA(8)
+    RFAL_PICOPASS_CMD_READCHECK_KD = 0x88,
+    // ADDRESS(1) -> DATA(8)
+    RFAL_PICOPASS_CMD_READCHECK_KC = 0x18,
+    // CHALLENGE(4) READERSIGNATURE(4) -> CHIPRESPONSE(4)
+    RFAL_PICOPASS_CMD_CHECK = 0x05,
+    // No args -> SOF
     RFAL_PICOPASS_CMD_ACTALL = 0x0A,
-    RFAL_PICOPASS_CMD_IDENTIFY = 0x0C,
+    // No args -> SOF
+    RFAL_PICOPASS_CMD_ACT = 0x8E,
+    // ASNB(8)|SERIALNB(8) -> SERIALNB(8) CRC16(2)
     RFAL_PICOPASS_CMD_SELECT = 0x81,
-    RFAL_PICOPASS_CMD_READCHECK = 0x88,
-    RFAL_PICOPASS_CMD_CHECK = 0x05,
-    RFAL_PICOPASS_CMD_READ = 0x0C,
-    RFAL_PICOPASS_CMD_WRITE = 0x87,
+    // No args -> SERIALNB(8) CRC16(2)
+    RFAL_PICOPASS_CMD_DETECT = 0x0F,
+    // No args -> SOF
+    RFAL_PICOPASS_CMD_HALT = 0x00,
+    // PAGE(1) CRC16(2) -> BLOCK1(8) CRC16(2)
+    RFAL_PICOPASS_CMD_PAGESEL = 0x84,
 };
 
 typedef struct {
@@ -34,10 +59,12 @@ typedef struct {
 } rfalPicoPassCheckRes;
 
 typedef struct {
-    uint8_t data[RFAL_PICOPASS_MAX_BLOCK_LEN];
+    uint8_t data[RFAL_PICOPASS_BLOCK_LEN];
     uint8_t crc[2];
 } rfalPicoPassReadBlockRes;
 
+uint16_t rfalPicoPassCalculateCcitt(uint16_t preloadValue, const uint8_t* buf, uint16_t length);
+
 FuriHalNfcReturn rfalPicoPassPollerInitialize(void);
 FuriHalNfcReturn rfalPicoPassPollerCheckPresence(void);
 FuriHalNfcReturn rfalPicoPassPollerIdentify(rfalPicoPassIdentifyRes* idRes);

base_pack/picopass/scenes/picopass_scene_config.h

@@ -11,7 +11,11 @@ ADD_SCENE(picopass, delete, Delete)
 ADD_SCENE(picopass, delete_success, DeleteSuccess)
 ADD_SCENE(picopass, write_card, WriteCard)
 ADD_SCENE(picopass, write_card_success, WriteCardSuccess)
+ADD_SCENE(picopass, write_card_failure, WriteCardFailure)
 ADD_SCENE(picopass, read_factory_success, ReadFactorySuccess)
 ADD_SCENE(picopass, write_key, WriteKey)
 ADD_SCENE(picopass, key_menu, KeyMenu)
 ADD_SCENE(picopass, elite_dict_attack, EliteDictAttack)
+ADD_SCENE(picopass, emulate, Emulate)
+ADD_SCENE(picopass, loclass, Loclass)
+ADD_SCENE(picopass, key_input, KeyInput)

base_pack/picopass/scenes/picopass_scene_device_info.c

@@ -26,9 +26,9 @@ void picopass_scene_device_info_on_enter(void* context) {
     PicopassPacs* pacs = &picopass->dev->dev_data.pacs;
     Widget* widget = picopass->widget;
 
-    uint8_t csn[PICOPASS_BLOCK_LEN] = {0};
-    memcpy(csn, AA1[PICOPASS_CSN_BLOCK_INDEX].data, PICOPASS_BLOCK_LEN);
-    for(uint8_t i = 0; i < PICOPASS_BLOCK_LEN; i++) {
+    uint8_t csn[RFAL_PICOPASS_BLOCK_LEN] = {0};
+    memcpy(csn, AA1[PICOPASS_CSN_BLOCK_INDEX].data, RFAL_PICOPASS_BLOCK_LEN);
+    for(uint8_t i = 0; i < RFAL_PICOPASS_BLOCK_LEN; i++) {
         furi_string_cat_printf(csn_str, "%02X ", csn[i]);
     }
 
@@ -42,7 +42,7 @@ void picopass_scene_device_info_on_enter(void* context) {
             bytesLength++;
         }
         furi_string_set(credential_str, "");
-        for(uint8_t i = PICOPASS_BLOCK_LEN - bytesLength; i < PICOPASS_BLOCK_LEN; i++) {
+        for(uint8_t i = RFAL_PICOPASS_BLOCK_LEN - bytesLength; i < RFAL_PICOPASS_BLOCK_LEN; i++) {
             furi_string_cat_printf(credential_str, " %02X", pacs->credential[i]);
         }
 

base_pack/picopass/scenes/picopass_scene_emulate.c

@@ -0,0 +1,58 @@
+#include "../picopass_i.h"
+#include <dolphin/dolphin.h>
+
+void picopass_emulate_worker_callback(PicopassWorkerEvent event, void* context) {
+    furi_assert(context);
+    Picopass* picopass = context;
+    view_dispatcher_send_custom_event(picopass->view_dispatcher, event);
+}
+
+void picopass_scene_emulate_on_enter(void* context) {
+    Picopass* picopass = context;
+    dolphin_deed(DolphinDeedNfcEmulate);
+
+    Widget* widget = picopass->widget;
+    widget_reset(widget);
+    widget_add_icon_element(widget, 0, 3, &I_RFIDDolphinSend_97x61);
+    widget_add_string_element(widget, 89, 32, AlignCenter, AlignTop, FontPrimary, "Emulating");
+    widget_add_string_element(widget, 89, 42, AlignCenter, AlignTop, FontPrimary, "PicoPass");
+
+    // Setup view
+    view_dispatcher_switch_to_view(picopass->view_dispatcher, PicopassViewWidget);
+
+    // Start worker
+    picopass_worker_start(
+        picopass->worker,
+        PicopassWorkerStateEmulate,
+        &picopass->dev->dev_data,
+        picopass_emulate_worker_callback,
+        picopass);
+
+    picopass_blink_emulate_start(picopass);
+}
+
+bool picopass_scene_emulate_on_event(void* context, SceneManagerEvent event) {
+    Picopass* picopass = context;
+    bool consumed = false;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == PicopassCustomEventWorkerExit) {
+            consumed = true;
+        }
+    } else if(event.type == SceneManagerEventTypeBack) {
+        consumed = scene_manager_previous_scene(picopass->scene_manager);
+    }
+    return consumed;
+}
+
+void picopass_scene_emulate_on_exit(void* context) {
+    Picopass* picopass = context;
+
+    picopass_blink_stop(picopass);
+
+    // Stop worker
+    picopass_worker_stop(picopass->worker);
+
+    // Clear view
+    widget_reset(picopass->widget);
+}

base_pack/picopass/scenes/picopass_scene_key_input.c

@@ -0,0 +1,48 @@
+#include "../picopass_i.h"
+#include <lib/toolbox/random_name.h>
+#include <gui/modules/validators.h>
+#include <toolbox/path.h>
+
+void picopass_scene_key_input_text_input_callback(void* context) {
+    Picopass* picopass = context;
+
+    picopass->dev->dev_data.pacs.elite_kdf = true;
+    memcpy(picopass->dev->dev_data.pacs.key, picopass->byte_input_store, RFAL_PICOPASS_BLOCK_LEN);
+    view_dispatcher_send_custom_event(picopass->view_dispatcher, PicopassCustomEventByteInputDone);
+}
+
+void picopass_scene_key_input_on_enter(void* context) {
+    Picopass* picopass = context;
+
+    ByteInput* byte_input = picopass->byte_input;
+    byte_input_set_header_text(byte_input, "Enter The Key In Hex");
+    byte_input_set_result_callback(
+        byte_input,
+        picopass_scene_key_input_text_input_callback,
+        NULL,
+        picopass,
+        picopass->byte_input_store,
+        RFAL_PICOPASS_BLOCK_LEN);
+    view_dispatcher_switch_to_view(picopass->view_dispatcher, PicopassViewByteInput);
+}
+
+bool picopass_scene_key_input_on_event(void* context, SceneManagerEvent event) {
+    Picopass* picopass = context;
+    bool consumed = false;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == PicopassCustomEventByteInputDone) {
+            scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteKey);
+            consumed = true;
+        }
+    }
+    return consumed;
+}
+
+void picopass_scene_key_input_on_exit(void* context) {
+    Picopass* picopass = context;
+
+    // Clear view
+    byte_input_set_result_callback(picopass->byte_input, NULL, NULL, NULL, NULL, 0);
+    byte_input_set_header_text(picopass->byte_input, "");
+}

base_pack/picopass/scenes/picopass_scene_key_menu.c

@@ -6,7 +6,7 @@ enum SubmenuIndex {
     SubmenuIndexWriteiCE,
     SubmenuIndexWriteiCL,
     SubmenuIndexWriteiCS,
-    SubmenuIndexWriteCustom, //TODO: user input of key
+    SubmenuIndexWriteCustom,
 };
 
 void picopass_scene_key_menu_submenu_callback(void* context, uint32_t index) {
@@ -43,6 +43,12 @@ void picopass_scene_key_menu_on_enter(void* context) {
         SubmenuIndexWriteiCS,
         picopass_scene_key_menu_submenu_callback,
         picopass);
+    submenu_add_item(
+        submenu,
+        "Write Elite",
+        SubmenuIndexWriteCustom,
+        picopass_scene_key_menu_submenu_callback,
+        picopass);
 
     submenu_set_selected_item(
         picopass->submenu,
@@ -59,31 +65,37 @@ bool picopass_scene_key_menu_on_event(void* context, SceneManagerEvent event) {
         if(event.event == SubmenuIndexWriteStandard) {
             scene_manager_set_scene_state(
                 picopass->scene_manager, PicopassSceneKeyMenu, SubmenuIndexWriteStandard);
-            memcpy(picopass->dev->dev_data.pacs.key, picopass_iclass_key, PICOPASS_BLOCK_LEN);
+            memcpy(picopass->dev->dev_data.pacs.key, picopass_iclass_key, RFAL_PICOPASS_BLOCK_LEN);
             picopass->dev->dev_data.pacs.elite_kdf = false;
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteKey);
             consumed = true;
         } else if(event.event == SubmenuIndexWriteiCE) {
             scene_manager_set_scene_state(
                 picopass->scene_manager, PicopassSceneKeyMenu, SubmenuIndexWriteiCE);
-            memcpy(picopass->dev->dev_data.pacs.key, picopass_xice_key, PICOPASS_BLOCK_LEN);
+            memcpy(picopass->dev->dev_data.pacs.key, picopass_xice_key, RFAL_PICOPASS_BLOCK_LEN);
             picopass->dev->dev_data.pacs.elite_kdf = true;
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteKey);
             consumed = true;
         } else if(event.event == SubmenuIndexWriteiCL) {
             scene_manager_set_scene_state(
                 picopass->scene_manager, PicopassSceneKeyMenu, SubmenuIndexWriteiCL);
-            memcpy(picopass->dev->dev_data.pacs.key, picopass_xicl_key, PICOPASS_BLOCK_LEN);
+            memcpy(picopass->dev->dev_data.pacs.key, picopass_xicl_key, RFAL_PICOPASS_BLOCK_LEN);
             picopass->dev->dev_data.pacs.elite_kdf = false;
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteKey);
             consumed = true;
         } else if(event.event == SubmenuIndexWriteiCS) {
             scene_manager_set_scene_state(
                 picopass->scene_manager, PicopassSceneKeyMenu, SubmenuIndexWriteiCS);
-            memcpy(picopass->dev->dev_data.pacs.key, picopass_xics_key, PICOPASS_BLOCK_LEN);
+            memcpy(picopass->dev->dev_data.pacs.key, picopass_xics_key, RFAL_PICOPASS_BLOCK_LEN);
             picopass->dev->dev_data.pacs.elite_kdf = false;
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteKey);
             consumed = true;
+        } else if(event.event == SubmenuIndexWriteCustom) {
+            scene_manager_set_scene_state(
+                picopass->scene_manager, PicopassSceneKeyMenu, SubmenuIndexWriteCustom);
+            // Key and elite_kdf = true are both set in key_input scene
+            scene_manager_next_scene(picopass->scene_manager, PicopassSceneKeyInput);
+            consumed = true;
         }
     } else if(event.type == SceneManagerEventTypeBack) {
         consumed = scene_manager_search_and_switch_to_previous_scene(

base_pack/picopass/scenes/picopass_scene_loclass.c

@@ -0,0 +1,80 @@
+#include "../picopass_i.h"
+#include <dolphin/dolphin.h>
+
+void picopass_loclass_worker_callback(PicopassWorkerEvent event, void* context) {
+    furi_assert(context);
+    Picopass* picopass = context;
+    view_dispatcher_send_custom_event(picopass->view_dispatcher, event);
+}
+
+void picopass_loclass_result_callback(void* context) {
+    furi_assert(context);
+    Picopass* picopass = context;
+    view_dispatcher_send_custom_event(picopass->view_dispatcher, PicopassCustomEventViewExit);
+}
+
+void picopass_scene_loclass_on_enter(void* context) {
+    Picopass* picopass = context;
+    dolphin_deed(DolphinDeedNfcEmulate);
+
+    scene_manager_set_scene_state(picopass->scene_manager, PicopassSceneLoclass, 0);
+
+    loclass_set_callback(picopass->loclass, picopass_loclass_result_callback, picopass);
+
+    // Start worker
+    picopass_worker_start(
+        picopass->worker,
+        PicopassWorkerStateLoclass,
+        &picopass->dev->dev_data,
+        picopass_loclass_worker_callback,
+        picopass);
+
+    picopass_blink_emulate_start(picopass);
+
+    loclass_set_header(picopass->loclass, "Loclass");
+
+    view_dispatcher_switch_to_view(picopass->view_dispatcher, PicopassViewLoclass);
+}
+
+bool picopass_scene_loclass_on_event(void* context, SceneManagerEvent event) {
+    Picopass* picopass = context;
+    bool consumed = false;
+
+    uint32_t loclass_macs_collected =
+        scene_manager_get_scene_state(picopass->scene_manager, PicopassSceneLoclass);
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == PicopassWorkerEventLoclassGotMac) {
+            loclass_macs_collected++;
+            scene_manager_set_scene_state(
+                picopass->scene_manager, PicopassSceneLoclass, loclass_macs_collected);
+            loclass_set_num_macs(picopass->loclass, loclass_macs_collected);
+            if(loclass_macs_collected >= LOCLASS_MACS_TO_COLLECT) {
+                scene_manager_previous_scene(picopass->scene_manager);
+            }
+            consumed = true;
+        } else if(event.event == PicopassWorkerEventLoclassGotStandardKey) {
+            loclass_set_header(picopass->loclass, "Loclass (Got Std Key)");
+            consumed = true;
+        } else if(event.event == PicopassCustomEventViewExit) {
+            consumed = scene_manager_previous_scene(picopass->scene_manager);
+        }
+    } else if(event.type == SceneManagerEventTypeBack) {
+        consumed = scene_manager_previous_scene(picopass->scene_manager);
+    }
+    return consumed;
+}
+
+void picopass_scene_loclass_on_exit(void* context) {
+    Picopass* picopass = context;
+
+    picopass_blink_stop(picopass);
+
+    // Stop worker
+    picopass_worker_stop(picopass->worker);
+
+    loclass_reset(picopass->loclass);
+
+    // Clear view
+    widget_reset(picopass->widget);
+}

base_pack/picopass/scenes/picopass_scene_read_card.c

@@ -38,7 +38,7 @@ bool picopass_scene_read_card_on_event(void* context, SceneManagerEvent event) {
             if(memcmp(
                    picopass->dev->dev_data.pacs.key,
                    picopass_factory_debit_key,
-                   PICOPASS_BLOCK_LEN) == 0) {
+                   RFAL_PICOPASS_BLOCK_LEN) == 0) {
                 scene_manager_next_scene(picopass->scene_manager, PicopassSceneReadFactorySuccess);
             } else {
                 scene_manager_next_scene(picopass->scene_manager, PicopassSceneReadCardSuccess);

base_pack/picopass/scenes/picopass_scene_read_card_success.c

@@ -31,15 +31,15 @@ void picopass_scene_read_card_success_on_enter(void* context) {
     PicopassPacs* pacs = &picopass->dev->dev_data.pacs;
     Widget* widget = picopass->widget;
 
-    uint8_t csn[PICOPASS_BLOCK_LEN] = {0};
-    memcpy(csn, AA1[PICOPASS_CSN_BLOCK_INDEX].data, PICOPASS_BLOCK_LEN);
-    for(uint8_t i = 0; i < PICOPASS_BLOCK_LEN; i++) {
+    uint8_t csn[RFAL_PICOPASS_BLOCK_LEN] = {0};
+    memcpy(csn, AA1[PICOPASS_CSN_BLOCK_INDEX].data, RFAL_PICOPASS_BLOCK_LEN);
+    for(uint8_t i = 0; i < RFAL_PICOPASS_BLOCK_LEN; i++) {
         furi_string_cat_printf(csn_str, "%02X", csn[i]);
     }
 
-    bool no_key = picopass_is_memset(pacs->key, 0x00, PICOPASS_BLOCK_LEN);
-    bool empty =
-        picopass_is_memset(AA1[PICOPASS_PACS_CFG_BLOCK_INDEX].data, 0xFF, PICOPASS_BLOCK_LEN);
+    bool no_key = picopass_is_memset(pacs->key, 0x00, RFAL_PICOPASS_BLOCK_LEN);
+    bool empty = picopass_is_memset(
+        AA1[PICOPASS_ICLASS_PACS_CFG_BLOCK_INDEX].data, 0xFF, RFAL_PICOPASS_BLOCK_LEN);
 
     if(no_key) {
         furi_string_cat_printf(wiegand_str, "Read Failed");
@@ -78,7 +78,7 @@ void picopass_scene_read_card_success_on_enter(void* context) {
     } else {
         size_t bytesLength = 1 + pacs->record.bitLength / 8;
         furi_string_set(credential_str, "");
-        for(uint8_t i = PICOPASS_BLOCK_LEN - bytesLength; i < PICOPASS_BLOCK_LEN; i++) {
+        for(uint8_t i = RFAL_PICOPASS_BLOCK_LEN - bytesLength; i < RFAL_PICOPASS_BLOCK_LEN; i++) {
             furi_string_cat_printf(credential_str, " %02X", pacs->credential[i]);
         }
 
@@ -99,9 +99,9 @@ void picopass_scene_read_card_success_on_enter(void* context) {
             }
             furi_string_cat_printf(sio_str, "Key: ");
 
-            uint8_t key[PICOPASS_BLOCK_LEN];
-            memcpy(key, &pacs->key, PICOPASS_BLOCK_LEN);
-            for(uint8_t i = 0; i < PICOPASS_BLOCK_LEN; i++) {
+            uint8_t key[RFAL_PICOPASS_BLOCK_LEN];
+            memcpy(key, &pacs->key, RFAL_PICOPASS_BLOCK_LEN);
+            for(uint8_t i = 0; i < RFAL_PICOPASS_BLOCK_LEN; i++) {
                 furi_string_cat_printf(sio_str, "%02X", key[i]);
             }
         }

base_pack/picopass/scenes/picopass_scene_read_factory_success.c

@@ -64,7 +64,7 @@ bool picopass_scene_read_factory_success_on_event(void* context, SceneManagerEve
         if(event.event == GuiButtonTypeLeft) {
             consumed = scene_manager_previous_scene(picopass->scene_manager);
         } else if(event.event == GuiButtonTypeCenter) {
-            memcpy(picopass->dev->dev_data.pacs.key, picopass_iclass_key, PICOPASS_BLOCK_LEN);
+            memcpy(picopass->dev->dev_data.pacs.key, picopass_iclass_key, RFAL_PICOPASS_BLOCK_LEN);
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteKey);
             consumed = true;
         }

base_pack/picopass/scenes/picopass_scene_saved_menu.c

@@ -4,6 +4,7 @@ enum SubmenuIndex {
     SubmenuIndexDelete,
     SubmenuIndexInfo,
     SubmenuIndexWrite,
+    SubmenuIndexEmulate,
 };
 
 void picopass_scene_saved_menu_submenu_callback(void* context, uint32_t index) {
@@ -26,6 +27,12 @@ void picopass_scene_saved_menu_on_enter(void* context) {
         submenu, "Info", SubmenuIndexInfo, picopass_scene_saved_menu_submenu_callback, picopass);
     submenu_add_item(
         submenu, "Write", SubmenuIndexWrite, picopass_scene_saved_menu_submenu_callback, picopass);
+    submenu_add_item(
+        submenu,
+        "Emulate",
+        SubmenuIndexEmulate,
+        picopass_scene_saved_menu_submenu_callback,
+        picopass);
 
     submenu_set_selected_item(
         picopass->submenu,
@@ -51,6 +58,9 @@ bool picopass_scene_saved_menu_on_event(void* context, SceneManagerEvent event)
         } else if(event.event == SubmenuIndexWrite) {
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteCard);
             consumed = true;
+        } else if(event.event == SubmenuIndexEmulate) {
+            scene_manager_next_scene(picopass->scene_manager, PicopassSceneEmulate);
+            consumed = true;
         }
     }
 

base_pack/picopass/scenes/picopass_scene_start.c

@@ -3,6 +3,7 @@ enum SubmenuIndex {
     SubmenuIndexRead,
     SubmenuIndexEliteDictAttack,
     SubmenuIndexSaved,
+    SubmenuIndexLoclass,
 };
 
 void picopass_scene_start_submenu_callback(void* context, uint32_t index) {
@@ -24,6 +25,9 @@ void picopass_scene_start_on_enter(void* context) {
     submenu_add_item(
         submenu, "Saved", SubmenuIndexSaved, picopass_scene_start_submenu_callback, picopass);
 
+    submenu_add_item(
+        submenu, "Loclass", SubmenuIndexLoclass, picopass_scene_start_submenu_callback, picopass);
+
     submenu_set_selected_item(
         submenu, scene_manager_get_scene_state(picopass->scene_manager, PicopassSceneStart));
     picopass_device_clear(picopass->dev);
@@ -52,6 +56,11 @@ bool picopass_scene_start_on_event(void* context, SceneManagerEvent event) {
                 picopass->scene_manager, PicopassSceneStart, SubmenuIndexEliteDictAttack);
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneEliteDictAttack);
             consumed = true;
+        } else if(event.event == SubmenuIndexLoclass) {
+            scene_manager_set_scene_state(
+                picopass->scene_manager, PicopassSceneStart, PicopassSceneLoclass);
+            scene_manager_next_scene(picopass->scene_manager, PicopassSceneLoclass);
+            consumed = true;
         }
     }
 

base_pack/picopass/scenes/picopass_scene_write_card.c

@@ -4,7 +4,7 @@
 void picopass_write_card_worker_callback(PicopassWorkerEvent event, void* context) {
     UNUSED(event);
     Picopass* picopass = context;
-    view_dispatcher_send_custom_event(picopass->view_dispatcher, PicopassCustomEventWorkerExit);
+    view_dispatcher_send_custom_event(picopass->view_dispatcher, event);
 }
 
 void picopass_scene_write_card_on_enter(void* context) {
@@ -33,7 +33,10 @@ bool picopass_scene_write_card_on_event(void* context, SceneManagerEvent event)
     bool consumed = false;
 
     if(event.type == SceneManagerEventTypeCustom) {
-        if(event.event == PicopassCustomEventWorkerExit) {
+        if(event.event == PicopassWorkerEventFail) {
+            scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteCardFailure);
+            consumed = true;
+        } else if(event.event == PicopassWorkerEventSuccess) {
             scene_manager_next_scene(picopass->scene_manager, PicopassSceneWriteCardSuccess);
             consumed = true;
         }

base_pack/picopass/scenes/picopass_scene_write_card_failure.c

@@ -0,0 +1,65 @@
+#include "../picopass_i.h"
+#include <dolphin/dolphin.h>
+
+void picopass_scene_write_card_failure_widget_callback(
+    GuiButtonType result,
+    InputType type,
+    void* context) {
+    furi_assert(context);
+    Picopass* picopass = context;
+
+    if(type == InputTypeShort) {
+        view_dispatcher_send_custom_event(picopass->view_dispatcher, result);
+    }
+}
+
+void picopass_scene_write_card_failure_on_enter(void* context) {
+    Picopass* picopass = context;
+    Widget* widget = picopass->widget;
+    FuriString* str = furi_string_alloc_set("Write Failure!");
+
+    widget_add_button_element(
+        widget,
+        GuiButtonTypeLeft,
+        "Retry",
+        picopass_scene_write_card_failure_widget_callback,
+        picopass);
+
+    widget_add_button_element(
+        widget,
+        GuiButtonTypeRight,
+        "Menu",
+        picopass_scene_write_card_failure_widget_callback,
+        picopass);
+
+    widget_add_string_element(
+        widget, 64, 5, AlignCenter, AlignCenter, FontSecondary, furi_string_get_cstr(str));
+
+    furi_string_free(str);
+
+    view_dispatcher_switch_to_view(picopass->view_dispatcher, PicopassViewWidget);
+}
+
+bool picopass_scene_write_card_failure_on_event(void* context, SceneManagerEvent event) {
+    Picopass* picopass = context;
+    bool consumed = false;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == GuiButtonTypeLeft) {
+            consumed = scene_manager_previous_scene(picopass->scene_manager);
+        } else if(event.event == GuiButtonTypeRight) {
+            // Clear device name
+            picopass_device_set_name(picopass->dev, "");
+            consumed = scene_manager_search_and_switch_to_previous_scene(
+                picopass->scene_manager, PicopassSceneStart);
+        }
+    }
+    return consumed;
+}
+
+void picopass_scene_write_card_failure_on_exit(void* context) {
+    Picopass* picopass = context;
+
+    // Clear view
+    widget_reset(picopass->widget);
+}

base_pack/picopass/scenes/picopass_scene_write_card_success.c

@@ -55,8 +55,8 @@ bool picopass_scene_write_card_success_on_event(void* context, SceneManagerEvent
         } else if(event.event == GuiButtonTypeRight) {
             // Clear device name
             picopass_device_set_name(picopass->dev, "");
-            scene_manager_next_scene(picopass->scene_manager, PicopassSceneCardMenu);
-            consumed = true;
+            consumed = scene_manager_search_and_switch_to_previous_scene(
+                picopass->scene_manager, PicopassSceneStart);
         }
     }
     return consumed;

base_pack/picopass/views/loclass.c

@@ -0,0 +1,106 @@
+#include "loclass.h"
+#include "../picopass_worker_i.h"
+
+#include <gui/elements.h>
+
+struct Loclass {
+    View* view;
+    LoclassCallback callback;
+    void* context;
+};
+
+typedef struct {
+    FuriString* header;
+    uint8_t num_macs;
+} LoclassViewModel;
+
+static void loclass_draw_callback(Canvas* canvas, void* model) {
+    LoclassViewModel* m = model;
+
+    char draw_str[32] = {};
+    canvas_set_font(canvas, FontSecondary);
+    canvas_draw_str_aligned(canvas, 64, 0, AlignCenter, AlignTop, furi_string_get_cstr(m->header));
+
+    float progress = m->num_macs == 0 ? 0 :
+                                        (float)(m->num_macs) / (float)(LOCLASS_MACS_TO_COLLECT);
+
+    if(progress > 1.0) {
+        progress = 1.0;
+    }
+
+    snprintf(draw_str, sizeof(draw_str), "%d/%d", m->num_macs, LOCLASS_MACS_TO_COLLECT);
+
+    elements_progress_bar_with_text(canvas, 0, 20, 128, progress, draw_str);
+
+    elements_button_center(canvas, "Skip");
+}
+
+static bool loclass_input_callback(InputEvent* event, void* context) {
+    Loclass* loclass = context;
+    bool consumed = false;
+    if(event->type == InputTypeShort && event->key == InputKeyOk) {
+        if(loclass->callback) {
+            loclass->callback(loclass->context);
+        }
+        consumed = true;
+    }
+    return consumed;
+}
+
+Loclass* loclass_alloc() {
+    Loclass* loclass = malloc(sizeof(Loclass));
+    loclass->view = view_alloc();
+    view_allocate_model(loclass->view, ViewModelTypeLocking, sizeof(LoclassViewModel));
+    view_set_draw_callback(loclass->view, loclass_draw_callback);
+    view_set_input_callback(loclass->view, loclass_input_callback);
+    view_set_context(loclass->view, loclass);
+    with_view_model(
+        loclass->view, LoclassViewModel * model, { model->header = furi_string_alloc(); }, false);
+    return loclass;
+}
+
+void loclass_free(Loclass* loclass) {
+    furi_assert(loclass);
+    with_view_model(
+        loclass->view, LoclassViewModel * model, { furi_string_free(model->header); }, false);
+    view_free(loclass->view);
+    free(loclass);
+}
+
+void loclass_reset(Loclass* loclass) {
+    furi_assert(loclass);
+    with_view_model(
+        loclass->view,
+        LoclassViewModel * model,
+        {
+            model->num_macs = 0;
+            furi_string_reset(model->header);
+        },
+        false);
+}
+
+View* loclass_get_view(Loclass* loclass) {
+    furi_assert(loclass);
+    return loclass->view;
+}
+
+void loclass_set_callback(Loclass* loclass, LoclassCallback callback, void* context) {
+    furi_assert(loclass);
+    furi_assert(callback);
+    loclass->callback = callback;
+    loclass->context = context;
+}
+
+void loclass_set_header(Loclass* loclass, const char* header) {
+    furi_assert(loclass);
+    furi_assert(header);
+
+    with_view_model(
+        loclass->view, LoclassViewModel * model, { furi_string_set(model->header, header); }, true);
+}
+
+void loclass_set_num_macs(Loclass* loclass, uint16_t num_macs) {
+    furi_assert(loclass);
+    with_view_model(
+        loclass->view, LoclassViewModel * model, { model->num_macs = num_macs; }, true);
+}

base_pack/picopass/views/loclass.h

@@ -0,0 +1,22 @@
+#pragma once
+#include <stdint.h>
+#include <gui/view.h>
+#include <gui/modules/widget.h>
+
+typedef struct Loclass Loclass;
+
+typedef void (*LoclassCallback)(void* context);
+
+Loclass* loclass_alloc();
+
+void loclass_free(Loclass* loclass);
+
+void loclass_reset(Loclass* loclass);
+
+View* loclass_get_view(Loclass* loclass);
+
+void loclass_set_callback(Loclass* loclass, LoclassCallback callback, void* context);
+
+void loclass_set_header(Loclass* loclass, const char* header);
+
+void loclass_set_num_macs(Loclass* loclass, uint16_t num_macs);

base_pack/signal_generator/application.fam

@@ -5,7 +5,8 @@ App(
     entry_point="signal_gen_app",
     requires=["gui"],
     stack_size=1 * 1024,
-    order=50,
+    fap_description="Control GPIO pins to generate digital signals",
+    fap_version="1.0",
     fap_icon="signal_gen_10px.png",
     fap_category="GPIO",
     fap_icon_assets="icons",

base_pack/spi_mem_manager/application.fam

@@ -5,7 +5,8 @@ App(
     entry_point="spi_mem_app",
     requires=["gui"],
     stack_size=1 * 2048,
-    order=30,
+    fap_description="Application for reading and writing 25-series SPI memory chips",
+    fap_version="1.0",
     fap_icon="images/Dip8_10px.png",
     fap_category="GPIO",
     fap_icon_assets="images",

base_pack/weather_station/application.fam

@@ -6,7 +6,8 @@ App(
     entry_point="weather_station_app",
     requires=["gui"],
     stack_size=4 * 1024,
-    order=50,
+    fap_description="Receive weather data from a wide range of supported Sub-1GHz remote sensor",
+    fap_version="1.1",
     fap_icon="weather_station_10px.png",
     fap_category="Sub-GHz",
     fap_icon_assets="images",

base_pack/weather_station/helpers/weather_station_types.h

@@ -3,7 +3,7 @@
 #include <furi.h>
 #include <furi_hal.h>
 
-#define WS_VERSION_APP "0.8"
+#define WS_VERSION_APP "1.1"
 #define WS_DEVELOPED "SkorP"
 #define WS_GITHUB "https://github.com/flipperdevices/flipperzero-firmware"
 

base_pack/weather_station/protocols/auriol_ahfl.c

@@ -0,0 +1,254 @@
+#include "auriol_ahfl.h"
+
+#define TAG "WSProtocolAuriol_AHFL"
+
+/*
+ *
+Auriol AHFL 433B2 IPX4 sensor.
+
+Data layout:
+        IIIIIIII-B-X-CC-TTTTTTTTTTTT-HHHHHHH0-FFFF-SSSSSS
+Exmpl.: 10111100-1-0-00-000011101000-01101100-0100-001011
+
+- I: id, 8 bit
+- B: where B is the battery status: 1=OK, 0=LOW, 1 bit
+- X: tx-button, 1 bit (might not work)
+- C: CC is the channel: 00=CH1, 01=CH2, 11=CH3, 2bit
+- T: temperature, 12 bit: 2's complement, scaled by 10
+- H: humidity, 7 bits data, 1 bit 0
+- F: always 0x4 (0100)
+- S: nibble sum, 6 bits
+
+ * The sensor sends 42 bits 5 times,
+ * the packets are ppm modulated (distance coding) with a pulse of ~500 us
+ * followed by a short gap of ~1000 us for a 0 bit or a long ~2000 us gap for a
+ * 1 bit, the sync gap is ~4000 us.
+ * 
+ */
+
+#define AURIOL_AHFL_CONST_DATA 0b0100
+
+static const SubGhzBlockConst ws_protocol_auriol_ahfl_const = {
+    .te_short = 500,
+    .te_long = 2000,
+    .te_delta = 150,
+    .min_count_bit_for_found = 42,
+};
+
+struct WSProtocolDecoderAuriol_AHFL {
+    SubGhzProtocolDecoderBase base;
+
+    SubGhzBlockDecoder decoder;
+    WSBlockGeneric generic;
+};
+
+struct WSProtocolEncoderAuriol_AHFL {
+    SubGhzProtocolEncoderBase base;
+
+    SubGhzProtocolEncoder encoder;
+    WSBlockGeneric generic;
+};
+
+typedef enum {
+    auriol_AHFLDecoderStepReset = 0,
+    auriol_AHFLDecoderStepSaveDuration,
+    auriol_AHFLDecoderStepCheckDuration,
+} auriol_AHFLDecoderStep;
+
+const SubGhzProtocolDecoder ws_protocol_auriol_ahfl_decoder = {
+    .alloc = ws_protocol_decoder_auriol_ahfl_alloc,
+    .free = ws_protocol_decoder_auriol_ahfl_free,
+
+    .feed = ws_protocol_decoder_auriol_ahfl_feed,
+    .reset = ws_protocol_decoder_auriol_ahfl_reset,
+
+    .get_hash_data = ws_protocol_decoder_auriol_ahfl_get_hash_data,
+    .serialize = ws_protocol_decoder_auriol_ahfl_serialize,
+    .deserialize = ws_protocol_decoder_auriol_ahfl_deserialize,
+    .get_string = ws_protocol_decoder_auriol_ahfl_get_string,
+};
+
+const SubGhzProtocolEncoder ws_protocol_auriol_ahfl_encoder = {
+    .alloc = NULL,
+    .free = NULL,
+
+    .deserialize = NULL,
+    .stop = NULL,
+    .yield = NULL,
+};
+
+const SubGhzProtocol ws_protocol_auriol_ahfl = {
+    .name = WS_PROTOCOL_AURIOL_AHFL_NAME,
+    .type = SubGhzProtocolWeatherStation,
+    .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_315 | SubGhzProtocolFlag_868 |
+            SubGhzProtocolFlag_AM | SubGhzProtocolFlag_Decodable,
+
+    .decoder = &ws_protocol_auriol_ahfl_decoder,
+    .encoder = &ws_protocol_auriol_ahfl_encoder,
+};
+
+void* ws_protocol_decoder_auriol_ahfl_alloc(SubGhzEnvironment* environment) {
+    UNUSED(environment);
+    WSProtocolDecoderAuriol_AHFL* instance = malloc(sizeof(WSProtocolDecoderAuriol_AHFL));
+    instance->base.protocol = &ws_protocol_auriol_ahfl;
+    instance->generic.protocol_name = instance->base.protocol->name;
+    return instance;
+}
+
+void ws_protocol_decoder_auriol_ahfl_free(void* context) {
+    furi_assert(context);
+    WSProtocolDecoderAuriol_AHFL* instance = context;
+    free(instance);
+}
+
+void ws_protocol_decoder_auriol_ahfl_reset(void* context) {
+    furi_assert(context);
+    WSProtocolDecoderAuriol_AHFL* instance = context;
+    instance->decoder.parser_step = auriol_AHFLDecoderStepReset;
+}
+
+static bool ws_protocol_auriol_ahfl_check(WSProtocolDecoderAuriol_AHFL* instance) {
+    uint8_t type = (instance->decoder.decode_data >> 6) & 0x0F;
+
+    if(type != AURIOL_AHFL_CONST_DATA) {
+        // Fail const data check
+        return false;
+    }
+
+    uint64_t payload = instance->decoder.decode_data >> 6;
+    // Checksum is the last 6 bits of data
+    uint8_t checksum_received = instance->decoder.decode_data & 0x3F;
+    uint8_t checksum_calculated = 0;
+    for(uint8_t i = 0; i < 9; i++) {
+        checksum_calculated += (payload >> (i * 4)) & 0xF;
+    }
+    return checksum_received == checksum_calculated;
+}
+
+/**
+ * Analysis of received data
+ * @param instance Pointer to a WSBlockGeneric* instance
+ */
+static void ws_protocol_auriol_ahfl_remote_controller(WSBlockGeneric* instance) {
+    instance->id = instance->data >> 34;
+    instance->battery_low = (instance->data >> 33) & 1;
+    instance->btn = (instance->data >> 32) & 1;
+    instance->channel = ((instance->data >> 30) & 0x3) + 1;
+    if(!((instance->data >> 29) & 1)) {
+        instance->temp = (float)((instance->data >> 18) & 0x07FF) / 10.0f;
+    } else {
+        instance->temp = (float)((~(instance->data >> 18) & 0x07FF) + 1) / -10.0f;
+    }
+    instance->humidity = (instance->data >> 11) & 0x7F;
+}
+
+void ws_protocol_decoder_auriol_ahfl_feed(void* context, bool level, uint32_t duration) {
+    furi_assert(context);
+    WSProtocolDecoderAuriol_AHFL* instance = context;
+
+    switch(instance->decoder.parser_step) {
+    case auriol_AHFLDecoderStepReset:
+        if((!level) && (DURATION_DIFF(duration, ws_protocol_auriol_ahfl_const.te_short * 18) <
+                        ws_protocol_auriol_ahfl_const.te_delta)) {
+            //Found syncPrefix
+            instance->decoder.parser_step = auriol_AHFLDecoderStepSaveDuration;
+            instance->decoder.decode_data = 0;
+            instance->decoder.decode_count_bit = 0;
+        }
+        break;
+    case auriol_AHFLDecoderStepSaveDuration:
+        if(level) {
+            instance->decoder.te_last = duration;
+            instance->decoder.parser_step = auriol_AHFLDecoderStepCheckDuration;
+        } else {
+            instance->decoder.parser_step = auriol_AHFLDecoderStepReset;
+        }
+        break;
+    case auriol_AHFLDecoderStepCheckDuration:
+        if(!level) {
+            if(DURATION_DIFF(instance->decoder.te_last, ws_protocol_auriol_ahfl_const.te_short) <
+               ws_protocol_auriol_ahfl_const.te_delta) {
+                if(DURATION_DIFF(duration, ws_protocol_auriol_ahfl_const.te_short * 18) <
+                   ws_protocol_auriol_ahfl_const.te_delta * 8) {
+                    //Found syncPostfix
+                    instance->decoder.parser_step = auriol_AHFLDecoderStepReset;
+                    if((instance->decoder.decode_count_bit ==
+                        ws_protocol_auriol_ahfl_const.min_count_bit_for_found) &&
+                       ws_protocol_auriol_ahfl_check(instance)) {
+                        instance->generic.data = instance->decoder.decode_data;
+                        instance->generic.data_count_bit = instance->decoder.decode_count_bit;
+                        ws_protocol_auriol_ahfl_remote_controller(&instance->generic);
+                        if(instance->base.callback) {
+                            instance->base.callback(&instance->base, instance->base.context);
+                        }
+                    } else if(instance->decoder.decode_count_bit == 1) {
+                        instance->decoder.parser_step = auriol_AHFLDecoderStepSaveDuration;
+                    }
+                    instance->decoder.decode_data = 0;
+                    instance->decoder.decode_count_bit = 0;
+                } else if(
+                    DURATION_DIFF(duration, ws_protocol_auriol_ahfl_const.te_long) <
+                    ws_protocol_auriol_ahfl_const.te_delta * 2) {
+                    subghz_protocol_blocks_add_bit(&instance->decoder, 0);
+                    instance->decoder.parser_step = auriol_AHFLDecoderStepSaveDuration;
+                } else if(
+                    DURATION_DIFF(duration, ws_protocol_auriol_ahfl_const.te_long * 2) <
+                    ws_protocol_auriol_ahfl_const.te_delta * 4) {
+                    subghz_protocol_blocks_add_bit(&instance->decoder, 1);
+                    instance->decoder.parser_step = auriol_AHFLDecoderStepSaveDuration;
+                } else {
+                    instance->decoder.parser_step = auriol_AHFLDecoderStepReset;
+                }
+            } else {
+                instance->decoder.parser_step = auriol_AHFLDecoderStepReset;
+            }
+        } else {
+            instance->decoder.parser_step = auriol_AHFLDecoderStepReset;
+        }
+        break;
+    }
+}
+
+uint8_t ws_protocol_decoder_auriol_ahfl_get_hash_data(void* context) {
+    furi_assert(context);
+    WSProtocolDecoderAuriol_AHFL* instance = context;
+    return subghz_protocol_blocks_get_hash_data(
+        &instance->decoder, (instance->decoder.decode_count_bit / 8) + 1);
+}
+
+SubGhzProtocolStatus ws_protocol_decoder_auriol_ahfl_serialize(
+    void* context,
+    FlipperFormat* flipper_format,
+    SubGhzRadioPreset* preset) {
+    furi_assert(context);
+    WSProtocolDecoderAuriol_AHFL* instance = context;
+    return ws_block_generic_serialize(&instance->generic, flipper_format, preset);
+}
+
+SubGhzProtocolStatus
+    ws_protocol_decoder_auriol_ahfl_deserialize(void* context, FlipperFormat* flipper_format) {
+    furi_assert(context);
+    WSProtocolDecoderAuriol_AHFL* instance = context;
+    return ws_block_generic_deserialize_check_count_bit(
+        &instance->generic, flipper_format, ws_protocol_auriol_ahfl_const.min_count_bit_for_found);
+}
+
+void ws_protocol_decoder_auriol_ahfl_get_string(void* context, FuriString* output) {
+    furi_assert(context);
+    WSProtocolDecoderAuriol_AHFL* instance = context;
+    furi_string_printf(
+        output,
+        "%s %dbit\r\n"
+        "Key:0x%lX%08lX\r\n"
+        "Sn:0x%lX Ch:%d  Bat:%d\r\n"
+        "Temp:%3.1f C Hum:%d%%",
+        instance->generic.protocol_name,
+        instance->generic.data_count_bit,
+        (uint32_t)(instance->generic.data >> 32),
+        (uint32_t)(instance->generic.data),
+        instance->generic.id,
+        instance->generic.channel,
+        instance->generic.battery_low,
+        (double)instance->generic.temp,
+        instance->generic.humidity);
+}

base_pack/weather_station/protocols/auriol_ahfl.h

@@ -0,0 +1,80 @@
+#pragma once
+
+#include <lib/subghz/protocols/base.h>
+
+#include <lib/subghz/blocks/const.h>
+#include <lib/subghz/blocks/decoder.h>
+#include <lib/subghz/blocks/encoder.h>
+#include "ws_generic.h"
+#include <lib/subghz/blocks/math.h>
+
+#define WS_PROTOCOL_AURIOL_AHFL_NAME "Auriol AHFL" //Auriol AHFL 433B2 IPX4
+
+typedef struct WSProtocolDecoderAuriol_AHFL WSProtocolDecoderAuriol_AHFL;
+typedef struct WSProtocolEncoderAuriol_AHFL WSProtocolEncoderAuriol_AHFL;
+
+extern const SubGhzProtocolDecoder ws_protocol_auriol_ahfl_decoder;
+extern const SubGhzProtocolEncoder ws_protocol_auriol_ahfl_encoder;
+extern const SubGhzProtocol ws_protocol_auriol_ahfl;
+
+/**
+ * Allocate WSProtocolDecoderAuriol_AHFL.
+ * @param environment Pointer to a SubGhzEnvironment instance
+ * @return WSProtocolDecoderAuriol_AHFL* pointer to a WSProtocolDecoderAuriol_AHFL instance
+ */
+void* ws_protocol_decoder_auriol_ahfl_alloc(SubGhzEnvironment* environment);
+
+/**
+ * Free WSProtocolDecoderAuriol_AHFL.
+ * @param context Pointer to a WSProtocolDecoderAuriol_AHFL instance
+ */
+void ws_protocol_decoder_auriol_ahfl_free(void* context);
+
+/**
+ * Reset decoder WSProtocolDecoderAuriol_AHFL.
+ * @param context Pointer to a WSProtocolDecoderAuriol_AHFL instance
+ */
+void ws_protocol_decoder_auriol_ahfl_reset(void* context);
+
+/**
+ * Parse a raw sequence of levels and durations received from the air.
+ * @param context Pointer to a WSProtocolDecoderAuriol_AHFL instance
+ * @param level Signal level true-high false-low
+ * @param duration Duration of this level in, us
+ */
+void ws_protocol_decoder_auriol_ahfl_feed(void* context, bool level, uint32_t duration);
+
+/**
+ * Getting the hash sum of the last randomly received parcel.
+ * @param context Pointer to a WSProtocolDecoderAuriol_AHFL instance
+ * @return hash Hash sum
+ */
+uint8_t ws_protocol_decoder_auriol_ahfl_get_hash_data(void* context);
+
+/**
+ * Serialize data WSProtocolDecoderAuriol_AHFL.
+ * @param context Pointer to a WSProtocolDecoderAuriol_AHFL instance
+ * @param flipper_format Pointer to a FlipperFormat instance
+ * @param preset The modulation on which the signal was received, SubGhzRadioPreset
+ * @return status
+ */
+SubGhzProtocolStatus ws_protocol_decoder_auriol_ahfl_serialize(
+    void* context,
+    FlipperFormat* flipper_format,
+    SubGhzRadioPreset* preset);
+
+/**
+ * Deserialize data WSProtocolDecoderAuriol_AHFL.
+ * @param context Pointer to a WSProtocolDecoderAuriol_AHFL instance
+ * @param flipper_format Pointer to a FlipperFormat instance
+ * @return status
+ */
+SubGhzProtocolStatus
+    ws_protocol_decoder_auriol_ahfl_deserialize(void* context, FlipperFormat* flipper_format);
+
+/**
+ * Getting a textual representation of the received data.
+ * @param context Pointer to a WSProtocolDecoderAuriol_AHFL instance
+ * @param output Resulting text
+ */
+void ws_protocol_decoder_auriol_ahfl_get_string(void* context, FuriString* output);

base_pack/weather_station/protocols/protocol_items.c

@@ -18,6 +18,7 @@ const SubGhzProtocol* weather_station_protocol_registry_items[] = {
     &ws_protocol_oregon_v1,
     &ws_protocol_tx_8300,
     &ws_protocol_wendox_w6726,
+    &ws_protocol_auriol_ahfl,
 };
 
 const SubGhzProtocolRegistry weather_station_protocol_registry = {

base_pack/weather_station/protocols/protocol_items.h

@@ -18,5 +18,6 @@
 #include "oregon_v1.h"
 #include "tx_8300.h"
 #include "wendox_w6726.h"
+#include "auriol_ahfl.h"
 
 extern const SubGhzProtocolRegistry weather_station_protocol_registry;