nfc: Add mifare classic value block commands (#2317)

Co-authored-by: gornekich <n.gorbadey@gmail.com>
Co-authored-by: あく <alleteam@gmail.com>

firmware/targets/f7/api_symbols.csv

@@ -1863,8 +1863,10 @@ Function,+,menu_reset,void,Menu*
 Function,+,menu_set_selected_item,void,"Menu*, uint32_t"
 Function,-,mf_classic_auth_attempt,_Bool,"FuriHalNfcTxRxContext*, MfClassicAuthContext*, uint64_t"
 Function,-,mf_classic_auth_init_context,void,"MfClassicAuthContext*, uint8_t"
+Function,-,mf_classic_auth_write_block,_Bool,"FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t"
 Function,-,mf_classic_authenticate,_Bool,"FuriHalNfcTxRxContext*, uint8_t, uint64_t, MfClassicKey"
 Function,-,mf_classic_authenticate_skip_activate,_Bool,"FuriHalNfcTxRxContext*, uint8_t, uint64_t, MfClassicKey, _Bool, uint32_t"
+Function,-,mf_classic_block_to_value,_Bool,"const uint8_t*, int32_t*, uint8_t*"
 Function,-,mf_classic_check_card_type,_Bool,"uint8_t, uint8_t, uint8_t"
 Function,-,mf_classic_dict_add_key,_Bool,"MfClassicDict*, uint8_t*"
 Function,-,mf_classic_dict_add_key_str,_Bool,"MfClassicDict*, FuriString*"
@@ -1891,6 +1893,7 @@ Function,-,mf_classic_get_sector_trailer_by_sector,MfClassicSectorTrailer*,"MfCl
 Function,-,mf_classic_get_total_block_num,uint16_t,MfClassicType
 Function,-,mf_classic_get_total_sectors_num,uint8_t,MfClassicType
 Function,-,mf_classic_get_type_str,const char*,MfClassicType
+Function,-,mf_classic_halt,void,"FuriHalNfcTxRxContext*, Crypto1*"
 Function,-,mf_classic_is_allowed_access_data_block,_Bool,"MfClassicData*, uint8_t, MfClassicKey, MfClassicAction"
 Function,-,mf_classic_is_allowed_access_sector_trailer,_Bool,"MfClassicData*, uint8_t, MfClassicKey, MfClassicAction"
 Function,-,mf_classic_is_block_read,_Bool,"MfClassicData*, uint8_t"
@@ -1899,6 +1902,8 @@ Function,-,mf_classic_is_key_found,_Bool,"MfClassicData*, uint8_t, MfClassicKey"
 Function,-,mf_classic_is_sector_data_read,_Bool,"MfClassicData*, uint8_t"
 Function,-,mf_classic_is_sector_read,_Bool,"MfClassicData*, uint8_t"
 Function,-,mf_classic_is_sector_trailer,_Bool,uint8_t
+Function,-,mf_classic_is_value_block,_Bool,"MfClassicData*, uint8_t"
+Function,-,mf_classic_read_block,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t, MfClassicBlock*"
 Function,-,mf_classic_read_card,uint8_t,"FuriHalNfcTxRxContext*, MfClassicReader*, MfClassicData*"
 Function,-,mf_classic_read_sector,void,"FuriHalNfcTxRxContext*, MfClassicData*, uint8_t"
 Function,-,mf_classic_reader_add_sector,void,"MfClassicReader*, uint8_t, uint64_t, uint64_t"
@@ -1906,8 +1911,12 @@ Function,-,mf_classic_set_block_read,void,"MfClassicData*, uint8_t, MfClassicBlo
 Function,-,mf_classic_set_key_found,void,"MfClassicData*, uint8_t, MfClassicKey, uint64_t"
 Function,-,mf_classic_set_key_not_found,void,"MfClassicData*, uint8_t, MfClassicKey"
 Function,-,mf_classic_set_sector_data_not_read,void,MfClassicData*
+Function,-,mf_classic_transfer,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t"
 Function,-,mf_classic_update_card,uint8_t,"FuriHalNfcTxRxContext*, MfClassicData*"
-Function,-,mf_classic_write_block,_Bool,"FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t"
+Function,-,mf_classic_value_cmd,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t, uint8_t, int32_t"
+Function,-,mf_classic_value_cmd_full,_Bool,"FuriHalNfcTxRxContext*, MfClassicBlock*, uint8_t, MfClassicKey, uint64_t, int32_t"
+Function,-,mf_classic_value_to_block,void,"int32_t, uint8_t, uint8_t*"
+Function,-,mf_classic_write_block,_Bool,"FuriHalNfcTxRxContext*, Crypto1*, uint8_t, MfClassicBlock*"
 Function,-,mf_classic_write_sector,_Bool,"FuriHalNfcTxRxContext*, MfClassicData*, MfClassicData*, uint8_t"
 Function,-,mf_df_cat_application,void,"MifareDesfireApplication*, FuriString*"
 Function,-,mf_df_cat_application_info,void,"MifareDesfireApplication*, FuriString*"

lib/nfc/protocols/mifare_classic.c

@@ -7,10 +7,17 @@
 
 #define TAG "MfClassic"
 
-#define MF_CLASSIC_AUTH_KEY_A_CMD (0x60U)
-#define MF_CLASSIC_AUTH_KEY_B_CMD (0x61U)
-#define MF_CLASSIC_READ_BLOCK_CMD (0x30)
-#define MF_CLASSIC_WRITE_BLOCK_CMD (0xA0)
+#define MF_CLASSIC_ACK_CMD 0xAU
+#define MF_CLASSIC_NACK_BUF_VALID_CMD 0x0U
+#define MF_CLASSIC_NACK_BUF_INVALID_CMD 0x4U
+#define MF_CLASSIC_AUTH_KEY_A_CMD 0x60U
+#define MF_CLASSIC_AUTH_KEY_B_CMD 0x61U
+#define MF_CLASSIC_READ_BLOCK_CMD 0x30U
+#define MF_CLASSIC_WRITE_BLOCK_CMD 0xA0U
+#define MF_CLASSIC_TRANSFER_CMD 0xB0U
+#define MF_CLASSIC_DECREMENT_CMD 0xC0U
+#define MF_CLASSIC_INCREMENT_CMD 0xC1U
+#define MF_CLASSIC_RESTORE_CMD 0xC2U
 
 const char* mf_classic_get_type_str(MfClassicType type) {
     if(type == MfClassicTypeMini) {
@@ -217,8 +224,8 @@ void mf_classic_get_read_sectors_and_keys(
         uint8_t first_block = mf_classic_get_first_block_num_of_sector(i);
         uint8_t total_blocks_in_sec = mf_classic_get_blocks_num_in_sector(i);
         bool blocks_read = true;
-        for(size_t i = first_block; i < first_block + total_blocks_in_sec; i++) {
-            blocks_read = mf_classic_is_block_read(data, i);
+        for(size_t j = first_block; j < first_block + total_blocks_in_sec; j++) {
+            blocks_read = mf_classic_is_block_read(data, j);
             if(!blocks_read) break;
         }
         if(blocks_read) {
@@ -353,6 +360,16 @@ static bool mf_classic_is_allowed_access(
     }
 }
 
+bool mf_classic_is_value_block(MfClassicData* data, uint8_t block_num) {
+    // Check if key A can write, if it can, it's transport configuration, not data block
+    return !mf_classic_is_allowed_access_data_block(
+               data, block_num, MfClassicKeyA, MfClassicActionDataWrite) &&
+           (mf_classic_is_allowed_access_data_block(
+                data, block_num, MfClassicKeyB, MfClassicActionDataInc) ||
+            mf_classic_is_allowed_access_data_block(
+                data, block_num, MfClassicKeyB, MfClassicActionDataDec));
+}
+
 bool mf_classic_check_card_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK) {
     UNUSED(ATQA1);
     if((ATQA0 == 0x44 || ATQA0 == 0x04) && (SAK == 0x08 || SAK == 0x88 || SAK == 0x09)) {
@@ -401,6 +418,36 @@ void mf_classic_reader_add_sector(
     }
 }
 
+bool mf_classic_block_to_value(const uint8_t* block, int32_t* value, uint8_t* addr) {
+    uint32_t v = *(uint32_t*)&block[0];
+    uint32_t v_inv = *(uint32_t*)&block[4];
+    uint32_t v1 = *(uint32_t*)&block[8];
+
+    bool val_checks =
+        ((v == v1) && (v == ~v_inv) && (block[12] == (~block[13] & 0xFF)) &&
+         (block[14] == (~block[15] & 0xFF)) && (block[12] == block[14]));
+    if(value) {
+        *value = (int32_t)v;
+    }
+    if(addr) {
+        *addr = block[12];
+    }
+    return val_checks;
+}
+
+void mf_classic_value_to_block(int32_t value, uint8_t addr, uint8_t* block) {
+    uint32_t v_inv = ~((uint32_t)value);
+
+    memcpy(block, &value, 4);
+    memcpy(block + 4, &v_inv, 4);
+    memcpy(block + 8, &value, 4);
+
+    block[12] = addr;
+    block[13] = ~addr & 0xFF;
+    block[14] = addr;
+    block[15] = ~addr & 0xFF;
+}
+
 void mf_classic_auth_init_context(MfClassicAuthContext* auth_ctx, uint8_t sector) {
     furi_assert(auth_ctx);
     auth_ctx->sector = sector;
@@ -553,8 +600,9 @@ bool mf_classic_read_block(
     uint8_t plain_cmd[4] = {MF_CLASSIC_READ_BLOCK_CMD, block_num, 0x00, 0x00};
     nfca_append_crc16(plain_cmd, 2);
 
-    crypto1_encrypt(crypto, NULL, plain_cmd, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
-    tx_rx->tx_bits = 4 * 9;
+    crypto1_encrypt(
+        crypto, NULL, plain_cmd, sizeof(plain_cmd) * 8, tx_rx->tx_data, tx_rx->tx_parity);
+    tx_rx->tx_bits = sizeof(plain_cmd) * 8;
     tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
 
     if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
@@ -779,6 +827,9 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
     bool is_encrypted = false;
     uint8_t plain_data[MF_CLASSIC_MAX_DATA_SIZE];
     MfClassicKey access_key = MfClassicKeyA;
+    // Used for decrement and increment - copy to block on transfer
+    uint8_t transfer_buf[MF_CLASSIC_BLOCK_SIZE] = {};
+    bool transfer_buf_valid = false;
 
     // Read command
     while(!command_processed) { //-V654
@@ -797,18 +848,25 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
             crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
         }
 
-        if(plain_data[0] == 0x50 && plain_data[1] == 0x00) {
+        // After increment, decrement or restore the only allowed command is transfer
+        uint8_t cmd = plain_data[0];
+        if(transfer_buf_valid && cmd != MF_CLASSIC_TRANSFER_CMD) {
+            break;
+        }
+
+        if(cmd == 0x50 && plain_data[1] == 0x00) {
             FURI_LOG_T(TAG, "Halt received");
             furi_hal_nfc_listen_sleep();
             command_processed = true;
             break;
-        } else if(plain_data[0] == 0x60 || plain_data[0] == 0x61) {
+        }
+        if(cmd == MF_CLASSIC_AUTH_KEY_A_CMD || cmd == MF_CLASSIC_AUTH_KEY_B_CMD) {
             uint8_t block = plain_data[1];
             uint64_t key = 0;
             uint8_t sector_trailer_block = mf_classic_get_sector_trailer_num_by_block(block);
             MfClassicSectorTrailer* sector_trailer =
                 (MfClassicSectorTrailer*)emulator->data.block[sector_trailer_block].value;
-            if(plain_data[0] == 0x60) {
+            if(cmd == MF_CLASSIC_AUTH_KEY_A_CMD) {
                 key = nfc_util_bytes2num(sector_trailer->key_a, 6);
                 access_key = MfClassicKeyA;
             } else {
@@ -826,9 +884,7 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
                 crypto1_word(&emulator->crypto, emulator->cuid ^ nonce, 0);
                 memcpy(tx_rx->tx_data, nt, sizeof(nt));
                 tx_rx->tx_parity[0] = 0;
-                for(size_t i = 0; i < sizeof(nt); i++) {
-                    tx_rx->tx_parity[0] |= nfc_util_odd_parity8(nt[i]) << (7 - i);
-                }
+                nfc_util_odd_parity(tx_rx->tx_data, tx_rx->tx_parity, sizeof(nt));
                 tx_rx->tx_bits = sizeof(nt) * 8;
                 tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
             } else {
@@ -849,7 +905,7 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
             }
 
             if(tx_rx->rx_bits != 64) {
-                FURI_LOG_W(TAG, "Incorrect nr + ar");
+                FURI_LOG_W(TAG, "Incorrect nr + ar length: %d", tx_rx->rx_bits);
                 command_processed = true;
                 break;
             }
@@ -857,16 +913,6 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
             uint32_t nr = nfc_util_bytes2num(tx_rx->rx_data, 4);
             uint32_t ar = nfc_util_bytes2num(&tx_rx->rx_data[4], 4);
 
-            FURI_LOG_D(
-                TAG,
-                "%08lx key%c block %d nt/nr/ar: %08lx %08lx %08lx",
-                emulator->cuid,
-                access_key == MfClassicKeyA ? 'A' : 'B',
-                sector_trailer_block,
-                nonce,
-                nr,
-                ar);
-
             crypto1_word(&emulator->crypto, nr, 1);
             uint32_t cardRr = ar ^ crypto1_word(&emulator->crypto, 0, 0);
             if(cardRr != prng_successor(nonce, 64)) {
@@ -877,22 +923,30 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
             }
 
             uint32_t ans = prng_successor(nonce, 96);
-            uint8_t responce[4] = {};
-            nfc_util_num2bytes(ans, 4, responce);
+            uint8_t response[4] = {};
+            nfc_util_num2bytes(ans, 4, response);
             crypto1_encrypt(
                 &emulator->crypto,
                 NULL,
-                responce,
-                sizeof(responce) * 8,
+                response,
+                sizeof(response) * 8,
                 tx_rx->tx_data,
                 tx_rx->tx_parity);
-            tx_rx->tx_bits = sizeof(responce) * 8;
+            tx_rx->tx_bits = sizeof(response) * 8;
             tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
 
             is_encrypted = true;
-        } else if(is_encrypted && plain_data[0] == 0x30) {
+            continue;
+        }
+
+        if(!is_encrypted) {
+            FURI_LOG_T(TAG, "Invalid command before auth session established: %02X", cmd);
+            break;
+        }
+
+        if(cmd == MF_CLASSIC_READ_BLOCK_CMD) {
             uint8_t block = plain_data[1];
-            uint8_t block_data[18] = {};
+            uint8_t block_data[MF_CLASSIC_BLOCK_SIZE + 2] = {};
             memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
             if(mf_classic_is_sector_trailer(block)) {
                 if(!mf_classic_is_allowed_access(
@@ -927,24 +981,24 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
                 sizeof(block_data) * 8,
                 tx_rx->tx_data,
                 tx_rx->tx_parity);
-            tx_rx->tx_bits = 18 * 8;
+            tx_rx->tx_bits = (MF_CLASSIC_BLOCK_SIZE + 2) * 8;
             tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
-        } else if(is_encrypted && plain_data[0] == 0xA0) {
+        } else if(cmd == MF_CLASSIC_WRITE_BLOCK_CMD) {
             uint8_t block = plain_data[1];
             if(block > mf_classic_get_total_block_num(emulator->data.type)) {
                 break;
             }
             // Send ACK
-            uint8_t ack = 0x0A;
+            uint8_t ack = MF_CLASSIC_ACK_CMD;
             crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
             tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
             tx_rx->tx_bits = 4;
 
             if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
-            if(tx_rx->rx_bits != 18 * 8) break;
+            if(tx_rx->rx_bits != (MF_CLASSIC_BLOCK_SIZE + 2) * 8) break;
 
             crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
-            uint8_t block_data[16] = {};
+            uint8_t block_data[MF_CLASSIC_BLOCK_SIZE] = {};
             memcpy(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE);
             if(mf_classic_is_sector_trailer(block)) {
                 if(mf_classic_is_allowed_access(
@@ -963,6 +1017,8 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
                 if(mf_classic_is_allowed_access(
                        emulator, block, access_key, MfClassicActionDataWrite)) {
                     memcpy(block_data, plain_data, MF_CLASSIC_BLOCK_SIZE);
+                } else {
+                    break;
                 }
             }
             if(memcmp(block_data, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) != 0) {
@@ -970,19 +1026,83 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
                 emulator->data_changed = true;
             }
             // Send ACK
-            ack = 0x0A;
+            ack = MF_CLASSIC_ACK_CMD;
+            crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
+            tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+            tx_rx->tx_bits = 4;
+        } else if(
+            cmd == MF_CLASSIC_DECREMENT_CMD || cmd == MF_CLASSIC_INCREMENT_CMD ||
+            cmd == MF_CLASSIC_RESTORE_CMD) {
+            uint8_t block = plain_data[1];
+
+            if(block > mf_classic_get_total_block_num(emulator->data.type)) {
+                break;
+            }
+
+            MfClassicAction action = MfClassicActionDataDec;
+            if(cmd == MF_CLASSIC_INCREMENT_CMD) {
+                action = MfClassicActionDataInc;
+            }
+            if(!mf_classic_is_allowed_access(emulator, block, access_key, action)) {
+                break;
+            }
+
+            int32_t prev_value;
+            uint8_t addr;
+            if(!mf_classic_block_to_value(emulator->data.block[block].value, &prev_value, &addr)) {
+                break;
+            }
+
+            // Send ACK
+            uint8_t ack = MF_CLASSIC_ACK_CMD;
+            crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
+            tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
+            tx_rx->tx_bits = 4;
+
+            if(!furi_hal_nfc_tx_rx(tx_rx, 300)) break;
+            if(tx_rx->rx_bits != (sizeof(int32_t) + 2) * 8) break;
+
+            crypto1_decrypt(&emulator->crypto, tx_rx->rx_data, tx_rx->rx_bits, plain_data);
+            int32_t value = *(int32_t*)&plain_data[0];
+            if(value < 0) {
+                value = -value;
+            }
+            if(cmd == MF_CLASSIC_DECREMENT_CMD) {
+                value = -value;
+            } else if(cmd == MF_CLASSIC_RESTORE_CMD) {
+                value = 0;
+            }
+
+            mf_classic_value_to_block(prev_value + value, addr, transfer_buf);
+            transfer_buf_valid = true;
+            // Commands do not ACK
+            tx_rx->tx_bits = 0;
+        } else if(cmd == MF_CLASSIC_TRANSFER_CMD) {
+            uint8_t block = plain_data[1];
+            if(!mf_classic_is_allowed_access(emulator, block, access_key, MfClassicActionDataDec)) {
+                break;
+            }
+            if(memcmp(transfer_buf, emulator->data.block[block].value, MF_CLASSIC_BLOCK_SIZE) !=
+               0) {
+                memcpy(emulator->data.block[block].value, transfer_buf, MF_CLASSIC_BLOCK_SIZE);
+                emulator->data_changed = true;
+            }
+            transfer_buf_valid = false;
+
+            uint8_t ack = MF_CLASSIC_ACK_CMD;
             crypto1_encrypt(&emulator->crypto, NULL, &ack, 4, tx_rx->tx_data, tx_rx->tx_parity);
             tx_rx->tx_rx_type = FuriHalNfcTxRxTransparent;
             tx_rx->tx_bits = 4;
         } else {
-            // Unknown command
+            FURI_LOG_T(TAG, "Unknown command: %02X", cmd);
             break;
         }
     }
 
     if(!command_processed) {
         // Send NACK
-        uint8_t nack = 0x04;
+        uint8_t nack = transfer_buf_valid ? MF_CLASSIC_NACK_BUF_VALID_CMD :
+                                            MF_CLASSIC_NACK_BUF_INVALID_CMD;
         if(is_encrypted) {
             crypto1_encrypt(&emulator->crypto, NULL, &nack, 4, tx_rx->tx_data, tx_rx->tx_parity);
         } else {
@@ -996,37 +1116,50 @@ bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_
     return true;
 }
 
+void mf_classic_halt(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto) {
+    furi_assert(tx_rx);
+
+    uint8_t plain_data[4] = {0x50, 0x00, 0x00, 0x00};
+
+    nfca_append_crc16(plain_data, 2);
+    if(crypto) {
+        crypto1_encrypt(
+            crypto, NULL, plain_data, sizeof(plain_data) * 8, tx_rx->tx_data, tx_rx->tx_parity);
+    } else {
+        memcpy(tx_rx->tx_data, plain_data, sizeof(plain_data));
+        nfc_util_odd_parity(tx_rx->tx_data, tx_rx->tx_parity, sizeof(plain_data));
+    }
+
+    tx_rx->tx_bits = sizeof(plain_data) * 8;
+    tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
+    furi_hal_nfc_tx_rx(tx_rx, 50);
+}
+
 bool mf_classic_write_block(
     FuriHalNfcTxRxContext* tx_rx,
-    MfClassicBlock* src_block,
+    Crypto1* crypto,
     uint8_t block_num,
-    MfClassicKey key_type,
-    uint64_t key) {
+    MfClassicBlock* src_block) {
     furi_assert(tx_rx);
+    furi_assert(crypto);
     furi_assert(src_block);
 
-    Crypto1 crypto = {};
-    uint8_t plain_data[18] = {};
-    uint8_t resp = 0;
     bool write_success = false;
+    uint8_t plain_data[MF_CLASSIC_BLOCK_SIZE + 2] = {};
+    uint8_t resp;
 
     do {
-        furi_hal_nfc_sleep();
-        if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
-            FURI_LOG_D(TAG, "Auth fail");
-            break;
-        }
         // Send write command
         plain_data[0] = MF_CLASSIC_WRITE_BLOCK_CMD;
         plain_data[1] = block_num;
         nfca_append_crc16(plain_data, 2);
-        crypto1_encrypt(&crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
+        crypto1_encrypt(crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
         tx_rx->tx_bits = 4 * 8;
         tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
 
         if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
             if(tx_rx->rx_bits == 4) {
-                crypto1_decrypt(&crypto, tx_rx->rx_data, 4, &resp);
+                crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
                 if(resp != 0x0A) {
                     FURI_LOG_D(TAG, "NACK received on write cmd: %02X", resp);
                     break;
@@ -1044,7 +1177,7 @@ bool mf_classic_write_block(
         memcpy(plain_data, src_block->value, MF_CLASSIC_BLOCK_SIZE);
         nfca_append_crc16(plain_data, MF_CLASSIC_BLOCK_SIZE);
         crypto1_encrypt(
-            &crypto,
+            crypto,
             NULL,
             plain_data,
             (MF_CLASSIC_BLOCK_SIZE + 2) * 8,
@@ -1054,8 +1187,8 @@ bool mf_classic_write_block(
         tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
         if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
             if(tx_rx->rx_bits == 4) {
-                crypto1_decrypt(&crypto, tx_rx->rx_data, 4, &resp);
-                if(resp != 0x0A) {
+                crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
+                if(resp != MF_CLASSIC_ACK_CMD) {
                     FURI_LOG_D(TAG, "NACK received on sending data");
                     break;
                 }
@@ -1067,20 +1200,198 @@ bool mf_classic_write_block(
             FURI_LOG_D(TAG, "Failed to send data");
             break;
         }
+
         write_success = true;
+    } while(false);
 
-        // Send Halt
-        plain_data[0] = 0x50;
-        plain_data[1] = 0x00;
+    return write_success;
+}
+
+bool mf_classic_auth_write_block(
+    FuriHalNfcTxRxContext* tx_rx,
+    MfClassicBlock* src_block,
+    uint8_t block_num,
+    MfClassicKey key_type,
+    uint64_t key) {
+    furi_assert(tx_rx);
+    furi_assert(src_block);
+
+    Crypto1 crypto = {};
+    bool write_success = false;
+
+    do {
+        furi_hal_nfc_sleep();
+        if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
+            FURI_LOG_D(TAG, "Auth fail");
+            break;
+        }
+
+        if(!mf_classic_write_block(tx_rx, &crypto, block_num, src_block)) {
+            FURI_LOG_D(TAG, "Write fail");
+            break;
+        }
+        write_success = true;
+
+        mf_classic_halt(tx_rx, &crypto);
+    } while(false);
+
+    return write_success;
+}
+
+bool mf_classic_transfer(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto, uint8_t block_num) {
+    furi_assert(tx_rx);
+    furi_assert(crypto);
+
+    // Send transfer command
+    uint8_t plain_data[4] = {MF_CLASSIC_TRANSFER_CMD, block_num, 0, 0};
+    uint8_t resp = 0;
+    bool transfer_success = false;
+
+    nfca_append_crc16(plain_data, 2);
+    crypto1_encrypt(
+        crypto, NULL, plain_data, sizeof(plain_data) * 8, tx_rx->tx_data, tx_rx->tx_parity);
+    tx_rx->tx_bits = sizeof(plain_data) * 8;
+    tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
+
+    do {
+        if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
+            if(tx_rx->rx_bits == 4) {
+                crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
+                if(resp != 0x0A) {
+                    FURI_LOG_D(TAG, "NACK received on transfer cmd: %02X", resp);
+                    break;
+                }
+            } else {
+                FURI_LOG_D(TAG, "Not ACK received");
+                break;
+            }
+        } else {
+            FURI_LOG_D(TAG, "Failed to send transfer cmd");
+            break;
+        }
+
+        transfer_success = true;
+    } while(false);
+
+    return transfer_success;
+}
+
+bool mf_classic_value_cmd(
+    FuriHalNfcTxRxContext* tx_rx,
+    Crypto1* crypto,
+    uint8_t block_num,
+    uint8_t cmd,
+    int32_t d_value) {
+    furi_assert(tx_rx);
+    furi_assert(crypto);
+    furi_assert(
+        cmd == MF_CLASSIC_INCREMENT_CMD || cmd == MF_CLASSIC_DECREMENT_CMD ||
+        cmd == MF_CLASSIC_RESTORE_CMD);
+    furi_assert(d_value >= 0);
+
+    uint8_t plain_data[sizeof(d_value) + 2] = {};
+    uint8_t resp = 0;
+    bool success = false;
+
+    do {
+        // Send cmd
+        plain_data[0] = cmd;
+        plain_data[1] = block_num;
         nfca_append_crc16(plain_data, 2);
-        crypto1_encrypt(&crypto, NULL, plain_data, 2 * 8, tx_rx->tx_data, tx_rx->tx_parity);
-        tx_rx->tx_bits = 2 * 8;
+        crypto1_encrypt(crypto, NULL, plain_data, 4 * 8, tx_rx->tx_data, tx_rx->tx_parity);
+        tx_rx->tx_bits = 4 * 8;
         tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
-        // No response is expected
-        furi_hal_nfc_tx_rx(tx_rx, 50);
+
+        if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
+            if(tx_rx->rx_bits == 4) {
+                crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
+                if(resp != 0x0A) {
+                    FURI_LOG_D(TAG, "NACK received on write cmd: %02X", resp);
+                    break;
+                }
+            } else {
+                FURI_LOG_D(TAG, "Not ACK received");
+                break;
+            }
+        } else {
+            FURI_LOG_D(TAG, "Failed to send write cmd");
+            break;
+        }
+
+        // Send data
+        memcpy(plain_data, &d_value, sizeof(d_value));
+        nfca_append_crc16(plain_data, sizeof(d_value));
+        crypto1_encrypt(
+            crypto, NULL, plain_data, (sizeof(d_value) + 2) * 8, tx_rx->tx_data, tx_rx->tx_parity);
+        tx_rx->tx_bits = (sizeof(d_value) + 2) * 8;
+        tx_rx->tx_rx_type = FuriHalNfcTxRxTypeRaw;
+        // inc, dec, restore do not ACK, but they do NACK
+        if(furi_hal_nfc_tx_rx(tx_rx, 50)) {
+            if(tx_rx->rx_bits == 4) {
+                crypto1_decrypt(crypto, tx_rx->rx_data, 4, &resp);
+                if(resp != 0x0A) {
+                    FURI_LOG_D(TAG, "NACK received on transfer cmd: %02X", resp);
+                    break;
+                }
+            } else {
+                FURI_LOG_D(TAG, "Not NACK received");
+                break;
+            }
+        }
+
+        success = true;
+
     } while(false);
 
-    return write_success;
+    return success;
+}
+
+bool mf_classic_value_cmd_full(
+    FuriHalNfcTxRxContext* tx_rx,
+    MfClassicBlock* src_block,
+    uint8_t block_num,
+    MfClassicKey key_type,
+    uint64_t key,
+    int32_t d_value) {
+    furi_assert(tx_rx);
+    furi_assert(src_block);
+
+    Crypto1 crypto = {};
+    uint8_t cmd;
+    bool success = false;
+
+    if(d_value > 0) {
+        cmd = MF_CLASSIC_INCREMENT_CMD;
+    } else if(d_value < 0) {
+        cmd = MF_CLASSIC_DECREMENT_CMD;
+        d_value = -d_value;
+    } else {
+        cmd = MF_CLASSIC_RESTORE_CMD;
+    }
+
+    do {
+        furi_hal_nfc_sleep();
+        if(!mf_classic_auth(tx_rx, block_num, key, key_type, &crypto, false, 0)) {
+            FURI_LOG_D(TAG, "Value cmd auth fail");
+            break;
+        }
+        if(!mf_classic_value_cmd(tx_rx, &crypto, block_num, cmd, d_value)) {
+            FURI_LOG_D(TAG, "Value cmd inc/dec/res fail");
+            break;
+        }
+
+        if(!mf_classic_transfer(tx_rx, &crypto, block_num)) {
+            FURI_LOG_D(TAG, "Value cmd transfer fail");
+            break;
+        }
+
+        success = true;
+
+        // Send Halt
+        mf_classic_halt(tx_rx, &crypto);
+    } while(false);
+
+    return success;
 }
 
 bool mf_classic_write_sector(
@@ -1103,31 +1414,99 @@ bool mf_classic_write_sector(
         // Compare blocks
         if(memcmp(dest_data->block[i].value, src_data->block[i].value, MF_CLASSIC_BLOCK_SIZE) !=
            0) {
-            bool key_a_write_allowed = mf_classic_is_allowed_access_data_block(
-                dest_data, i, MfClassicKeyA, MfClassicActionDataWrite);
-            bool key_b_write_allowed = mf_classic_is_allowed_access_data_block(
-                dest_data, i, MfClassicKeyB, MfClassicActionDataWrite);
-
-            if(key_a_found && key_a_write_allowed) {
-                FURI_LOG_I(TAG, "Writing block %d with key A", i);
-                uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
-                if(!mf_classic_write_block(tx_rx, &src_data->block[i], i, MfClassicKeyA, key)) {
-                    FURI_LOG_E(TAG, "Failed to write block %d", i);
-                    write_success = false;
-                    break;
+            if(mf_classic_is_value_block(dest_data, i)) {
+                bool key_a_inc_allowed = mf_classic_is_allowed_access_data_block(
+                    dest_data, i, MfClassicKeyA, MfClassicActionDataInc);
+                bool key_b_inc_allowed = mf_classic_is_allowed_access_data_block(
+                    dest_data, i, MfClassicKeyB, MfClassicActionDataInc);
+                bool key_a_dec_allowed = mf_classic_is_allowed_access_data_block(
+                    dest_data, i, MfClassicKeyA, MfClassicActionDataDec);
+                bool key_b_dec_allowed = mf_classic_is_allowed_access_data_block(
+                    dest_data, i, MfClassicKeyB, MfClassicActionDataDec);
+
+                int32_t src_value, dst_value;
+
+                mf_classic_block_to_value(src_data->block[i].value, &src_value, NULL);
+                mf_classic_block_to_value(dest_data->block[i].value, &dst_value, NULL);
+
+                int32_t diff = src_value - dst_value;
+
+                if(diff > 0) {
+                    if(key_a_found && key_a_inc_allowed) {
+                        FURI_LOG_I(TAG, "Incrementing block %d with key A by %ld", i, diff);
+                        uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
+                        if(!mf_classic_value_cmd_full(
+                               tx_rx, &src_data->block[i], i, MfClassicKeyA, key, diff)) {
+                            FURI_LOG_E(TAG, "Failed to increment block %d", i);
+                            write_success = false;
+                            break;
+                        }
+                    } else if(key_b_found && key_b_inc_allowed) {
+                        FURI_LOG_I(TAG, "Incrementing block %d with key B by %ld", i, diff);
+                        uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
+                        if(!mf_classic_value_cmd_full(
+                               tx_rx, &src_data->block[i], i, MfClassicKeyB, key, diff)) {
+                            FURI_LOG_E(TAG, "Failed to increment block %d", i);
+                            write_success = false;
+                            break;
+                        }
+                    } else {
+                        FURI_LOG_E(TAG, "Failed to increment block %d", i);
+                    }
+                } else if(diff < 0) {
+                    if(key_a_found && key_a_dec_allowed) {
+                        FURI_LOG_I(TAG, "Decrementing block %d with key A by %ld", i, -diff);
+                        uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
+                        if(!mf_classic_value_cmd_full(
+                               tx_rx, &src_data->block[i], i, MfClassicKeyA, key, diff)) {
+                            FURI_LOG_E(TAG, "Failed to decrement block %d", i);
+                            write_success = false;
+                            break;
+                        }
+                    } else if(key_b_found && key_b_dec_allowed) {
+                        FURI_LOG_I(TAG, "Decrementing block %d with key B by %ld", i, diff);
+                        uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
+                        if(!mf_classic_value_cmd_full(
+                               tx_rx, &src_data->block[i], i, MfClassicKeyB, key, diff)) {
+                            FURI_LOG_E(TAG, "Failed to decrement block %d", i);
+                            write_success = false;
+                            break;
+                        }
+                    } else {
+                        FURI_LOG_E(TAG, "Failed to decrement block %d", i);
+                    }
+                } else {
+                    FURI_LOG_E(TAG, "Value block %d address changed, cannot write it", i);
                 }
-            } else if(key_b_found && key_b_write_allowed) {
-                FURI_LOG_I(TAG, "Writing block %d with key A", i);
-                uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
-                if(!mf_classic_write_block(tx_rx, &src_data->block[i], i, MfClassicKeyB, key)) {
-                    FURI_LOG_E(TAG, "Failed to write block %d", i);
+            } else {
+                bool key_a_write_allowed = mf_classic_is_allowed_access_data_block(
+                    dest_data, i, MfClassicKeyA, MfClassicActionDataWrite);
+                bool key_b_write_allowed = mf_classic_is_allowed_access_data_block(
+                    dest_data, i, MfClassicKeyB, MfClassicActionDataWrite);
+
+                if(key_a_found && key_a_write_allowed) {
+                    FURI_LOG_I(TAG, "Writing block %d with key A", i);
+                    uint64_t key = nfc_util_bytes2num(sec_tr->key_a, 6);
+                    if(!mf_classic_auth_write_block(
+                           tx_rx, &src_data->block[i], i, MfClassicKeyA, key)) {
+                        FURI_LOG_E(TAG, "Failed to write block %d", i);
+                        write_success = false;
+                        break;
+                    }
+                } else if(key_b_found && key_b_write_allowed) {
+                    FURI_LOG_I(TAG, "Writing block %d with key A", i);
+                    uint64_t key = nfc_util_bytes2num(sec_tr->key_b, 6);
+                    if(!mf_classic_auth_write_block(
+                           tx_rx, &src_data->block[i], i, MfClassicKeyB, key)) {
+                        FURI_LOG_E(TAG, "Failed to write block %d", i);
+                        write_success = false;
+                        break;
+                    }
+                } else {
+                    FURI_LOG_E(TAG, "Failed to find key with write access");
                     write_success = false;
                     break;
                 }
-            } else {
-                FURI_LOG_E(TAG, "Failed to find key with write access");
-                write_success = false;
-                break;
             }
         } else {
             FURI_LOG_D(TAG, "Blocks %d are equal", i);

lib/nfc/protocols/mifare_classic.h

@@ -120,6 +120,12 @@ bool mf_classic_is_allowed_access_data_block(
     MfClassicKey key,
     MfClassicAction action);
 
+bool mf_classic_is_value_block(MfClassicData* data, uint8_t block_num);
+
+bool mf_classic_block_to_value(const uint8_t* block, int32_t* value, uint8_t* addr);
+
+void mf_classic_value_to_block(int32_t value, uint8_t addr, uint8_t* block);
+
 bool mf_classic_is_key_found(MfClassicData* data, uint8_t sector_num, MfClassicKey key_type);
 
 void mf_classic_set_key_found(
@@ -177,6 +183,12 @@ void mf_classic_reader_add_sector(
     uint64_t key_a,
     uint64_t key_b);
 
+bool mf_classic_read_block(
+    FuriHalNfcTxRxContext* tx_rx,
+    Crypto1* crypto,
+    uint8_t block_num,
+    MfClassicBlock* block);
+
 void mf_classic_read_sector(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data, uint8_t sec_num);
 
 uint8_t mf_classic_read_card(
@@ -188,13 +200,38 @@ uint8_t mf_classic_update_card(FuriHalNfcTxRxContext* tx_rx, MfClassicData* data
 
 bool mf_classic_emulator(MfClassicEmulator* emulator, FuriHalNfcTxRxContext* tx_rx);
 
+void mf_classic_halt(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto);
+
 bool mf_classic_write_block(
+    FuriHalNfcTxRxContext* tx_rx,
+    Crypto1* crypto,
+    uint8_t block_num,
+    MfClassicBlock* src_block);
+
+bool mf_classic_auth_write_block(
     FuriHalNfcTxRxContext* tx_rx,
     MfClassicBlock* src_block,
     uint8_t block_num,
     MfClassicKey key_type,
     uint64_t key);
 
+bool mf_classic_transfer(FuriHalNfcTxRxContext* tx_rx, Crypto1* crypto, uint8_t block_num);
+
+bool mf_classic_value_cmd(
+    FuriHalNfcTxRxContext* tx_rx,
+    Crypto1* crypto,
+    uint8_t block_num,
+    uint8_t cmd,
+    int32_t d_value);
+
+bool mf_classic_value_cmd_full(
+    FuriHalNfcTxRxContext* tx_rx,
+    MfClassicBlock* src_block,
+    uint8_t block_num,
+    MfClassicKey key_type,
+    uint64_t key,
+    int32_t d_value);
+
 bool mf_classic_write_sector(
     FuriHalNfcTxRxContext* tx_rx,
     MfClassicData* dest_data,

lib/nfc/protocols/nfc_util.c

@@ -23,7 +23,7 @@ void nfc_util_num2bytes(uint64_t src, uint8_t len, uint8_t* dest) {
     }
 }
 
-uint64_t nfc_util_bytes2num(uint8_t* src, uint8_t len) {
+uint64_t nfc_util_bytes2num(const uint8_t* src, uint8_t len) {
     furi_assert(src);
     furi_assert(len <= 8);
 
@@ -45,3 +45,26 @@ uint8_t nfc_util_even_parity32(uint32_t data) {
 uint8_t nfc_util_odd_parity8(uint8_t data) {
     return nfc_util_odd_byte_parity[data];
 }
+
+void nfc_util_odd_parity(const uint8_t* src, uint8_t* dst, uint8_t len) {
+    furi_assert(src);
+    furi_assert(dst);
+
+    uint8_t parity = 0;
+    uint8_t bit = 0;
+    while(len--) {
+        parity |= nfc_util_odd_parity8(*src) << (7 - bit); // parity is MSB first
+        bit++;
+        if(bit == 8) {
+            *dst = parity;
+            dst++;
+            parity = 0;
+            bit = 0;
+        }
+        src++;
+    }
+
+    if(bit) {
+        *dst = parity;
+    }
+}

lib/nfc/protocols/nfc_util.h

@@ -4,8 +4,10 @@
 
 void nfc_util_num2bytes(uint64_t src, uint8_t len, uint8_t* dest);
 
-uint64_t nfc_util_bytes2num(uint8_t* src, uint8_t len);
+uint64_t nfc_util_bytes2num(const uint8_t* src, uint8_t len);
 
 uint8_t nfc_util_even_parity32(uint32_t data);
 
 uint8_t nfc_util_odd_parity8(uint8_t data);
+
+void nfc_util_odd_parity(const uint8_t* src, uint8_t* dst, uint8_t len);