nfc_worker.c 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659
  1. #include "nfc_worker_i.h"
  2. #include <furi_hal.h>
  3. #include "nfc_protocols/emv_decoder.h"
  4. #include "nfc_protocols/mifare_ultralight.h"
  5. #define TAG "NfcWorker"
  6. /***************************** NFC Worker API *******************************/
  7. NfcWorker* nfc_worker_alloc() {
  8. NfcWorker* nfc_worker = furi_alloc(sizeof(NfcWorker));
  9. // Worker thread attributes
  10. nfc_worker->thread_attr.name = "NfcWorker";
  11. nfc_worker->thread_attr.stack_size = 8192;
  12. nfc_worker->callback = NULL;
  13. nfc_worker->context = NULL;
  14. // Initialize rfal
  15. if(!furi_hal_nfc_is_busy()) {
  16. nfc_worker_change_state(nfc_worker, NfcWorkerStateReady);
  17. } else {
  18. nfc_worker_change_state(nfc_worker, NfcWorkerStateBroken);
  19. }
  20. return nfc_worker;
  21. }
  22. void nfc_worker_free(NfcWorker* nfc_worker) {
  23. furi_assert(nfc_worker);
  24. free(nfc_worker);
  25. }
  26. NfcWorkerState nfc_worker_get_state(NfcWorker* nfc_worker) {
  27. return nfc_worker->state;
  28. }
  29. void nfc_worker_start(
  30. NfcWorker* nfc_worker,
  31. NfcWorkerState state,
  32. NfcDeviceData* dev_data,
  33. NfcWorkerCallback callback,
  34. void* context) {
  35. furi_assert(nfc_worker);
  36. furi_assert(dev_data);
  37. while(nfc_worker->state != NfcWorkerStateReady) {
  38. osDelay(10);
  39. }
  40. nfc_worker->callback = callback;
  41. nfc_worker->context = context;
  42. nfc_worker->dev_data = dev_data;
  43. nfc_worker_change_state(nfc_worker, state);
  44. nfc_worker->thread = osThreadNew(nfc_worker_task, nfc_worker, &nfc_worker->thread_attr);
  45. }
  46. void nfc_worker_stop(NfcWorker* nfc_worker) {
  47. furi_assert(nfc_worker);
  48. if(nfc_worker->state == NfcWorkerStateBroken || nfc_worker->state == NfcWorkerStateReady) {
  49. return;
  50. }
  51. furi_hal_nfc_stop();
  52. nfc_worker_change_state(nfc_worker, NfcWorkerStateStop);
  53. }
  54. void nfc_worker_change_state(NfcWorker* nfc_worker, NfcWorkerState state) {
  55. nfc_worker->state = state;
  56. }
  57. /***************************** NFC Worker Thread *******************************/
  58. void nfc_worker_task(void* context) {
  59. NfcWorker* nfc_worker = context;
  60. furi_hal_power_insomnia_enter();
  61. furi_hal_nfc_exit_sleep();
  62. if(nfc_worker->state == NfcWorkerStateDetect) {
  63. nfc_worker_detect(nfc_worker);
  64. } else if(nfc_worker->state == NfcWorkerStateEmulate) {
  65. nfc_worker_emulate(nfc_worker);
  66. } else if(nfc_worker->state == NfcWorkerStateReadEMVApp) {
  67. nfc_worker_read_emv_app(nfc_worker);
  68. } else if(nfc_worker->state == NfcWorkerStateReadEMV) {
  69. nfc_worker_read_emv(nfc_worker);
  70. } else if(nfc_worker->state == NfcWorkerStateEmulateApdu) {
  71. nfc_worker_emulate_apdu(nfc_worker);
  72. } else if(nfc_worker->state == NfcWorkerStateReadMifareUl) {
  73. nfc_worker_read_mifare_ul(nfc_worker);
  74. } else if(nfc_worker->state == NfcWorkerStateEmulateMifareUl) {
  75. nfc_worker_emulate_mifare_ul(nfc_worker);
  76. } else if(nfc_worker->state == NfcWorkerStateField) {
  77. nfc_worker_field(nfc_worker);
  78. }
  79. furi_hal_nfc_deactivate();
  80. nfc_worker_change_state(nfc_worker, NfcWorkerStateReady);
  81. furi_hal_power_insomnia_exit();
  82. osThreadExit();
  83. }
  84. void nfc_worker_detect(NfcWorker* nfc_worker) {
  85. rfalNfcDevice* dev_list;
  86. rfalNfcDevice* dev;
  87. uint8_t dev_cnt;
  88. NfcDeviceCommonData* result = &nfc_worker->dev_data->nfc_data;
  89. while(nfc_worker->state == NfcWorkerStateDetect) {
  90. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, true)) {
  91. // Process first found device
  92. dev = &dev_list[0];
  93. result->uid_len = dev->nfcidLen;
  94. memcpy(result->uid, dev->nfcid, dev->nfcidLen);
  95. if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCA) {
  96. result->device = NfcDeviceNfca;
  97. result->atqa[0] = dev->dev.nfca.sensRes.anticollisionInfo;
  98. result->atqa[1] = dev->dev.nfca.sensRes.platformInfo;
  99. result->sak = dev->dev.nfca.selRes.sak;
  100. if(mf_ul_check_card_type(
  101. dev->dev.nfca.sensRes.anticollisionInfo,
  102. dev->dev.nfca.sensRes.platformInfo,
  103. dev->dev.nfca.selRes.sak)) {
  104. result->protocol = NfcDeviceProtocolMifareUl;
  105. } else if(dev->rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  106. result->protocol = NfcDeviceProtocolEMV;
  107. } else {
  108. result->protocol = NfcDeviceProtocolUnknown;
  109. }
  110. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCB) {
  111. result->device = NfcDeviceNfcb;
  112. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCF) {
  113. result->device = NfcDeviceNfcf;
  114. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCV) {
  115. result->device = NfcDeviceNfcv;
  116. }
  117. // Notify caller and exit
  118. if(nfc_worker->callback) {
  119. nfc_worker->callback(nfc_worker->context);
  120. }
  121. break;
  122. }
  123. osDelay(100);
  124. }
  125. }
  126. bool nfc_worker_emulate_uid_callback(
  127. uint8_t* buff_rx,
  128. uint16_t buff_rx_len,
  129. uint8_t* buff_tx,
  130. uint16_t* buff_tx_len,
  131. uint32_t* data_type,
  132. void* context) {
  133. furi_assert(context);
  134. NfcWorker* nfc_worker = context;
  135. NfcReaderRequestData* reader_data = &nfc_worker->dev_data->reader_data;
  136. reader_data->size = buff_rx_len / 8;
  137. if(reader_data->size > 0) {
  138. memcpy(reader_data->data, buff_rx, reader_data->size);
  139. if(nfc_worker->callback) {
  140. nfc_worker->callback(nfc_worker->context);
  141. }
  142. }
  143. return true;
  144. }
  145. void nfc_worker_emulate(NfcWorker* nfc_worker) {
  146. NfcDeviceCommonData* data = &nfc_worker->dev_data->nfc_data;
  147. while(nfc_worker->state == NfcWorkerStateEmulate) {
  148. furi_hal_nfc_emulate_nfca(
  149. data->uid,
  150. data->uid_len,
  151. data->atqa,
  152. data->sak,
  153. nfc_worker_emulate_uid_callback,
  154. nfc_worker,
  155. 1000);
  156. }
  157. }
  158. void nfc_worker_read_emv_app(NfcWorker* nfc_worker) {
  159. ReturnCode err;
  160. rfalNfcDevice* dev_list;
  161. EmvApplication emv_app = {};
  162. uint8_t dev_cnt = 0;
  163. uint8_t tx_buff[255] = {};
  164. uint16_t tx_len = 0;
  165. uint8_t* rx_buff;
  166. uint16_t* rx_len;
  167. NfcDeviceData* result = nfc_worker->dev_data;
  168. while(nfc_worker->state == NfcWorkerStateReadEMVApp) {
  169. memset(&emv_app, 0, sizeof(emv_app));
  170. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, false)) {
  171. // Card was found. Check that it supports EMV
  172. if(dev_list[0].rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  173. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  174. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  175. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  176. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  177. memcpy(
  178. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  179. result->nfc_data.protocol = NfcDeviceProtocolEMV;
  180. FURI_LOG_D(TAG, "Send select PPSE command");
  181. tx_len = emv_prepare_select_ppse(tx_buff);
  182. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  183. if(err != ERR_NONE) {
  184. FURI_LOG_D(TAG, "Error during selection PPSE request: %d", err);
  185. furi_hal_nfc_deactivate();
  186. continue;
  187. }
  188. FURI_LOG_D(TAG, "Select PPSE response received. Start parsing response");
  189. if(emv_decode_ppse_response(rx_buff, *rx_len, &emv_app)) {
  190. FURI_LOG_D(TAG, "Select PPSE responce parced");
  191. // Notify caller and exit
  192. result->emv_data.aid_len = emv_app.aid_len;
  193. memcpy(result->emv_data.aid, emv_app.aid, emv_app.aid_len);
  194. if(nfc_worker->callback) {
  195. nfc_worker->callback(nfc_worker->context);
  196. }
  197. break;
  198. } else {
  199. FURI_LOG_D(TAG, "Can't find pay application");
  200. furi_hal_nfc_deactivate();
  201. continue;
  202. }
  203. } else {
  204. // Can't find EMV card
  205. FURI_LOG_W(TAG, "Card doesn't support EMV");
  206. furi_hal_nfc_deactivate();
  207. }
  208. } else {
  209. // Can't find EMV card
  210. FURI_LOG_D(TAG, "Can't find any cards");
  211. furi_hal_nfc_deactivate();
  212. }
  213. osDelay(20);
  214. }
  215. }
  216. void nfc_worker_read_emv(NfcWorker* nfc_worker) {
  217. ReturnCode err;
  218. rfalNfcDevice* dev_list;
  219. EmvApplication emv_app = {};
  220. uint8_t dev_cnt = 0;
  221. uint8_t tx_buff[255] = {};
  222. uint16_t tx_len = 0;
  223. uint8_t* rx_buff;
  224. uint16_t* rx_len;
  225. NfcDeviceData* result = nfc_worker->dev_data;
  226. while(nfc_worker->state == NfcWorkerStateReadEMV) {
  227. memset(&emv_app, 0, sizeof(emv_app));
  228. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, false)) {
  229. // Card was found. Check that it supports EMV
  230. if(dev_list[0].rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  231. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  232. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  233. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  234. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  235. memcpy(
  236. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  237. result->nfc_data.protocol = NfcDeviceProtocolEMV;
  238. FURI_LOG_D(TAG, "Send select PPSE command");
  239. tx_len = emv_prepare_select_ppse(tx_buff);
  240. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  241. if(err != ERR_NONE) {
  242. FURI_LOG_D(TAG, "Error during selection PPSE request: %d", err);
  243. furi_hal_nfc_deactivate();
  244. continue;
  245. }
  246. FURI_LOG_D(TAG, "Select PPSE response received. Start parsing response");
  247. if(emv_decode_ppse_response(rx_buff, *rx_len, &emv_app)) {
  248. FURI_LOG_D(TAG, "Select PPSE responce parced");
  249. result->emv_data.aid_len = emv_app.aid_len;
  250. memcpy(result->emv_data.aid, emv_app.aid, emv_app.aid_len);
  251. } else {
  252. FURI_LOG_D(TAG, "Can't find pay application");
  253. furi_hal_nfc_deactivate();
  254. continue;
  255. }
  256. FURI_LOG_D(TAG, "Starting application ...");
  257. tx_len = emv_prepare_select_app(tx_buff, &emv_app);
  258. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  259. if(err != ERR_NONE) {
  260. FURI_LOG_D(TAG, "Error during application selection request: %d", err);
  261. furi_hal_nfc_deactivate();
  262. continue;
  263. }
  264. FURI_LOG_D(TAG, "Select application response received. Start parsing response");
  265. if(emv_decode_select_app_response(rx_buff, *rx_len, &emv_app)) {
  266. FURI_LOG_D(TAG, "Card name: %s", emv_app.name);
  267. memcpy(result->emv_data.name, emv_app.name, sizeof(emv_app.name));
  268. } else if(emv_app.pdol.size > 0) {
  269. FURI_LOG_D(TAG, "Can't find card name, but PDOL is present.");
  270. } else {
  271. FURI_LOG_D(TAG, "Can't find card name or PDOL");
  272. furi_hal_nfc_deactivate();
  273. continue;
  274. }
  275. FURI_LOG_D(TAG, "Starting Get Processing Options command ...");
  276. tx_len = emv_prepare_get_proc_opt(tx_buff, &emv_app);
  277. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  278. if(err != ERR_NONE) {
  279. FURI_LOG_D(TAG, "Error during Get Processing Options command: %d", err);
  280. furi_hal_nfc_deactivate();
  281. continue;
  282. }
  283. if(emv_decode_get_proc_opt(rx_buff, *rx_len, &emv_app)) {
  284. FURI_LOG_D(TAG, "Card number parsed");
  285. result->emv_data.number_len = emv_app.card_number_len;
  286. memcpy(result->emv_data.number, emv_app.card_number, emv_app.card_number_len);
  287. // Notify caller and exit
  288. if(nfc_worker->callback) {
  289. nfc_worker->callback(nfc_worker->context);
  290. }
  291. break;
  292. } else {
  293. // Mastercard doesn't give PAN / card number as GPO response
  294. // Iterate over all files found in application
  295. bool pan_found = false;
  296. for(uint8_t i = 0; (i < emv_app.afl.size) && !pan_found; i += 4) {
  297. uint8_t sfi = emv_app.afl.data[i] >> 3;
  298. uint8_t record_start = emv_app.afl.data[i + 1];
  299. uint8_t record_end = emv_app.afl.data[i + 2];
  300. // Iterate over all records in file
  301. for(uint8_t record = record_start; record <= record_end; ++record) {
  302. tx_len = emv_prepare_read_sfi_record(tx_buff, sfi, record);
  303. err = furi_hal_nfc_data_exchange(
  304. tx_buff, tx_len, &rx_buff, &rx_len, false);
  305. if(err != ERR_NONE) {
  306. FURI_LOG_D(
  307. TAG,
  308. "Error reading application sfi %d, record %d",
  309. sfi,
  310. record);
  311. }
  312. if(emv_decode_read_sfi_record(rx_buff, *rx_len, &emv_app)) {
  313. pan_found = true;
  314. break;
  315. }
  316. }
  317. }
  318. if(pan_found) {
  319. FURI_LOG_D(TAG, "Card PAN found");
  320. result->emv_data.number_len = emv_app.card_number_len;
  321. memcpy(
  322. result->emv_data.number,
  323. emv_app.card_number,
  324. result->emv_data.number_len);
  325. if(emv_app.exp_month) {
  326. result->emv_data.exp_mon = emv_app.exp_month;
  327. result->emv_data.exp_year = emv_app.exp_year;
  328. }
  329. if(emv_app.country_code) {
  330. result->emv_data.country_code = emv_app.country_code;
  331. }
  332. if(emv_app.currency_code) {
  333. result->emv_data.currency_code = emv_app.currency_code;
  334. }
  335. // Notify caller and exit
  336. if(nfc_worker->callback) {
  337. nfc_worker->callback(nfc_worker->context);
  338. }
  339. break;
  340. } else {
  341. FURI_LOG_D(TAG, "Can't read card number");
  342. }
  343. furi_hal_nfc_deactivate();
  344. }
  345. } else {
  346. // Can't find EMV card
  347. FURI_LOG_W(TAG, "Card doesn't support EMV");
  348. furi_hal_nfc_deactivate();
  349. }
  350. } else {
  351. // Can't find EMV card
  352. FURI_LOG_D(TAG, "Can't find any cards");
  353. furi_hal_nfc_deactivate();
  354. }
  355. osDelay(20);
  356. }
  357. }
  358. void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
  359. ReturnCode err;
  360. uint8_t tx_buff[255] = {};
  361. uint16_t tx_len = 0;
  362. uint8_t* rx_buff;
  363. uint16_t* rx_len;
  364. NfcDeviceCommonData params = {
  365. .uid = {0xCF, 0x72, 0xd4, 0x40},
  366. .uid_len = 4,
  367. .atqa = {0x00, 0x04},
  368. .sak = 0x20,
  369. .device = NfcDeviceNfca,
  370. .protocol = NfcDeviceProtocolEMV,
  371. };
  372. // Test RX data
  373. const uint8_t debug_rx[] = {
  374. 0xba, 0x0b, 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca,
  375. 0xca, 0xfe, 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
  376. 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba,
  377. 0x0b, 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca,
  378. 0xfe, 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
  379. 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b,
  380. 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe,
  381. 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa,
  382. 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba,
  383. 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa,
  384. 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb,
  385. 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba, 0xba,
  386. 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa, 0xce,
  387. 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc,
  388. 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba, 0xba, 0x20,
  389. 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa, 0xce, 0x14,
  390. 0x88, 0x00};
  391. // Test TX data
  392. const uint8_t debug_tx[] = {
  393. 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32,
  394. 0x10, 0x14, 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad,
  395. 0xbe, 0xef, 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12,
  396. 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
  397. 0x14, 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe,
  398. 0xef, 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34,
  399. 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14,
  400. 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef,
  401. 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56,
  402. 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88,
  403. 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef, 0xce,
  404. 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56, 0x78,
  405. 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88, 0x02,
  406. 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef, 0xce, 0xee,
  407. 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56, 0x78, 0x9a,
  408. 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88, 0x02, 0x28,
  409. 0x00, 0x00};
  410. while(nfc_worker->state == NfcWorkerStateEmulateApdu) {
  411. if(furi_hal_nfc_listen(params.uid, params.uid_len, params.atqa, params.sak, false, 300)) {
  412. FURI_LOG_D(TAG, "POS terminal detected");
  413. // Read data from POS terminal
  414. err = furi_hal_nfc_data_exchange(NULL, 0, &rx_buff, &rx_len, false);
  415. if(err == ERR_NONE) {
  416. FURI_LOG_D(TAG, "Received Select PPSE");
  417. } else {
  418. FURI_LOG_D(TAG, "Error in 1st data exchange: select PPSE");
  419. furi_hal_nfc_deactivate();
  420. continue;
  421. }
  422. FURI_LOG_D(TAG, "Transive SELECT PPSE ANS");
  423. tx_len = emv_select_ppse_ans(tx_buff);
  424. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  425. if(err == ERR_NONE) {
  426. FURI_LOG_D(TAG, "Received Select APP");
  427. } else {
  428. FURI_LOG_D(TAG, "Error in 2nd data exchange: select APP");
  429. furi_hal_nfc_deactivate();
  430. continue;
  431. }
  432. FURI_LOG_D(TAG, "Transive SELECT APP ANS");
  433. tx_len = emv_select_app_ans(tx_buff);
  434. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  435. if(err == ERR_NONE) {
  436. FURI_LOG_D(TAG, "Received PDOL");
  437. } else {
  438. FURI_LOG_D(TAG, "Error in 3rd data exchange: receive PDOL");
  439. furi_hal_nfc_deactivate();
  440. continue;
  441. }
  442. FURI_LOG_D(TAG, "Transive PDOL ANS");
  443. tx_len = emv_get_proc_opt_ans(tx_buff);
  444. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  445. if(err == ERR_NONE) {
  446. FURI_LOG_D(TAG, "Transive PDOL ANS");
  447. } else {
  448. FURI_LOG_D(TAG, "Error in 4rd data exchange: Transive PDOL ANS");
  449. furi_hal_nfc_deactivate();
  450. continue;
  451. }
  452. if(*rx_len != sizeof(debug_rx) || memcmp(rx_buff, debug_rx, sizeof(debug_rx))) {
  453. FURI_LOG_D(TAG, "Failed long message test");
  454. } else {
  455. FURI_LOG_D(TAG, "Correct debug message received");
  456. tx_len = sizeof(debug_tx);
  457. err = furi_hal_nfc_data_exchange(
  458. (uint8_t*)debug_tx, tx_len, &rx_buff, &rx_len, false);
  459. if(err == ERR_NONE) {
  460. FURI_LOG_D(TAG, "Transive Debug message");
  461. }
  462. }
  463. furi_hal_nfc_deactivate();
  464. } else {
  465. FURI_LOG_D(TAG, "Can't find reader");
  466. }
  467. osDelay(20);
  468. }
  469. }
  470. void nfc_worker_read_mifare_ul(NfcWorker* nfc_worker) {
  471. ReturnCode err;
  472. rfalNfcDevice* dev_list;
  473. uint8_t dev_cnt = 0;
  474. uint8_t tx_buff[255] = {};
  475. uint16_t tx_len = 0;
  476. uint8_t* rx_buff;
  477. uint16_t* rx_len;
  478. MifareUlDevice mf_ul_read;
  479. NfcDeviceData* result = nfc_worker->dev_data;
  480. while(nfc_worker->state == NfcWorkerStateReadMifareUl) {
  481. furi_hal_nfc_deactivate();
  482. memset(&mf_ul_read, 0, sizeof(mf_ul_read));
  483. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 300, false)) {
  484. if(dev_list[0].type == RFAL_NFC_LISTEN_TYPE_NFCA &&
  485. mf_ul_check_card_type(
  486. dev_list[0].dev.nfca.sensRes.anticollisionInfo,
  487. dev_list[0].dev.nfca.sensRes.platformInfo,
  488. dev_list[0].dev.nfca.selRes.sak)) {
  489. // Get Mifare Ultralight version
  490. FURI_LOG_D(TAG, "Found Mifare Ultralight tag. Reading tag version");
  491. tx_len = mf_ul_prepare_get_version(tx_buff);
  492. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  493. if(err == ERR_NONE) {
  494. mf_ul_parse_get_version_response(rx_buff, &mf_ul_read);
  495. FURI_LOG_D(
  496. TAG,
  497. "Mifare Ultralight Type: %d, Pages: %d",
  498. mf_ul_read.data.type,
  499. mf_ul_read.pages_to_read);
  500. FURI_LOG_D(TAG, "Reading signature ...");
  501. tx_len = mf_ul_prepare_read_signature(tx_buff);
  502. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  503. FURI_LOG_D(TAG, "Failed reading signature");
  504. memset(mf_ul_read.data.signature, 0, sizeof(mf_ul_read.data.signature));
  505. } else {
  506. mf_ul_parse_read_signature_response(rx_buff, &mf_ul_read);
  507. }
  508. } else if(err == ERR_TIMEOUT) {
  509. FURI_LOG_D(
  510. TAG,
  511. "Card doesn't respond to GET VERSION command. Setting default read parameters");
  512. err = ERR_NONE;
  513. mf_ul_set_default_version(&mf_ul_read);
  514. // Reinit device
  515. furi_hal_nfc_deactivate();
  516. if(!furi_hal_nfc_detect(&dev_list, &dev_cnt, 300, false)) {
  517. FURI_LOG_D(TAG, "Lost connection. Restarting search");
  518. continue;
  519. }
  520. } else {
  521. FURI_LOG_D(
  522. TAG, "Error getting Mifare Ultralight version. Error code: %d", err);
  523. continue;
  524. }
  525. if(mf_ul_read.support_fast_read) {
  526. FURI_LOG_D(TAG, "Reading pages ...");
  527. tx_len = mf_ul_prepare_fast_read(tx_buff, 0x00, mf_ul_read.pages_to_read - 1);
  528. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  529. FURI_LOG_D(TAG, "Failed reading pages");
  530. continue;
  531. } else {
  532. mf_ul_parse_fast_read_response(
  533. rx_buff, 0x00, mf_ul_read.pages_to_read - 1, &mf_ul_read);
  534. }
  535. FURI_LOG_D(TAG, "Reading 3 counters ...");
  536. for(uint8_t i = 0; i < 3; i++) {
  537. tx_len = mf_ul_prepare_read_cnt(tx_buff, i);
  538. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  539. FURI_LOG_W(TAG, "Failed reading Counter %d", i);
  540. mf_ul_read.data.counter[i] = 0;
  541. } else {
  542. mf_ul_parse_read_cnt_response(rx_buff, i, &mf_ul_read);
  543. }
  544. }
  545. FURI_LOG_D(TAG, "Checking tearing flags ...");
  546. for(uint8_t i = 0; i < 3; i++) {
  547. tx_len = mf_ul_prepare_check_tearing(tx_buff, i);
  548. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  549. FURI_LOG_D(TAG, "Error checking tearing flag %d", i);
  550. mf_ul_read.data.tearing[i] = MF_UL_TEARING_FLAG_DEFAULT;
  551. } else {
  552. mf_ul_parse_check_tearing_response(rx_buff, i, &mf_ul_read);
  553. }
  554. }
  555. } else {
  556. // READ card with READ command (4 pages at a time)
  557. for(uint8_t page = 0; page < mf_ul_read.pages_to_read; page += 4) {
  558. FURI_LOG_D(TAG, "Reading pages %d - %d ...", page, page + 3);
  559. tx_len = mf_ul_prepare_read(tx_buff, page);
  560. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  561. FURI_LOG_D(TAG, "Read pages %d - %d failed", page, page + 3);
  562. continue;
  563. } else {
  564. mf_ul_parse_read_response(rx_buff, page, &mf_ul_read);
  565. }
  566. }
  567. }
  568. // Fill result data
  569. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  570. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  571. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  572. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  573. result->nfc_data.protocol = NfcDeviceProtocolMifareUl;
  574. memcpy(
  575. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  576. result->mf_ul_data = mf_ul_read.data;
  577. // Notify caller and exit
  578. if(nfc_worker->callback) {
  579. nfc_worker->callback(nfc_worker->context);
  580. }
  581. break;
  582. } else {
  583. FURI_LOG_W(TAG, "Tag does not support Mifare Ultralight");
  584. }
  585. } else {
  586. FURI_LOG_D(TAG, "Can't find any tags");
  587. }
  588. osDelay(100);
  589. }
  590. }
  591. void nfc_worker_emulate_mifare_ul(NfcWorker* nfc_worker) {
  592. NfcDeviceCommonData* nfc_common = &nfc_worker->dev_data->nfc_data;
  593. MifareUlDevice mf_ul_emulate;
  594. mf_ul_prepare_emulation(&mf_ul_emulate, &nfc_worker->dev_data->mf_ul_data);
  595. while(nfc_worker->state == NfcWorkerStateEmulateMifareUl) {
  596. furi_hal_nfc_emulate_nfca(
  597. nfc_common->uid,
  598. nfc_common->uid_len,
  599. nfc_common->atqa,
  600. nfc_common->sak,
  601. mf_ul_prepare_emulation_response,
  602. &mf_ul_emulate,
  603. 5000);
  604. // Check if data was modified
  605. if(mf_ul_emulate.data_changed) {
  606. nfc_worker->dev_data->mf_ul_data = mf_ul_emulate.data;
  607. if(nfc_worker->callback) {
  608. nfc_worker->callback(nfc_worker->context);
  609. }
  610. mf_ul_emulate.data_changed = false;
  611. }
  612. }
  613. }
  614. void nfc_worker_field(NfcWorker* nfc_worker) {
  615. furi_hal_nfc_field_on();
  616. while(nfc_worker->state == NfcWorkerStateField) {
  617. osDelay(50);
  618. }
  619. furi_hal_nfc_field_off();
  620. }