nfc_worker.c 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658
  1. #include "nfc_worker_i.h"
  2. #include <furi_hal.h>
  3. #include "nfc_protocols/emv_decoder.h"
  4. #include "nfc_protocols/mifare_ultralight.h"
  5. #define TAG "NfcWorker"
  6. /***************************** NFC Worker API *******************************/
  7. NfcWorker* nfc_worker_alloc() {
  8. NfcWorker* nfc_worker = malloc(sizeof(NfcWorker));
  9. // Worker thread attributes
  10. nfc_worker->thread_attr.name = "NfcWorker";
  11. nfc_worker->thread_attr.stack_size = 8192;
  12. nfc_worker->callback = NULL;
  13. nfc_worker->context = NULL;
  14. // Initialize rfal
  15. while(furi_hal_nfc_is_busy()) {
  16. osDelay(10);
  17. }
  18. nfc_worker_change_state(nfc_worker, NfcWorkerStateReady);
  19. return nfc_worker;
  20. }
  21. void nfc_worker_free(NfcWorker* nfc_worker) {
  22. furi_assert(nfc_worker);
  23. free(nfc_worker);
  24. }
  25. NfcWorkerState nfc_worker_get_state(NfcWorker* nfc_worker) {
  26. return nfc_worker->state;
  27. }
  28. void nfc_worker_start(
  29. NfcWorker* nfc_worker,
  30. NfcWorkerState state,
  31. NfcDeviceData* dev_data,
  32. NfcWorkerCallback callback,
  33. void* context) {
  34. furi_assert(nfc_worker);
  35. furi_assert(dev_data);
  36. while(furi_hal_nfc_is_busy()) {
  37. osDelay(10);
  38. }
  39. nfc_worker->callback = callback;
  40. nfc_worker->context = context;
  41. nfc_worker->dev_data = dev_data;
  42. nfc_worker_change_state(nfc_worker, state);
  43. nfc_worker->thread = osThreadNew(nfc_worker_task, nfc_worker, &nfc_worker->thread_attr);
  44. }
  45. void nfc_worker_stop(NfcWorker* nfc_worker) {
  46. furi_assert(nfc_worker);
  47. if(nfc_worker->state == NfcWorkerStateBroken || nfc_worker->state == NfcWorkerStateReady) {
  48. return;
  49. }
  50. furi_hal_nfc_stop();
  51. nfc_worker_change_state(nfc_worker, NfcWorkerStateStop);
  52. }
  53. void nfc_worker_change_state(NfcWorker* nfc_worker, NfcWorkerState state) {
  54. nfc_worker->state = state;
  55. }
  56. /***************************** NFC Worker Thread *******************************/
  57. void nfc_worker_task(void* context) {
  58. NfcWorker* nfc_worker = context;
  59. furi_hal_power_insomnia_enter();
  60. furi_hal_nfc_exit_sleep();
  61. if(nfc_worker->state == NfcWorkerStateDetect) {
  62. nfc_worker_detect(nfc_worker);
  63. } else if(nfc_worker->state == NfcWorkerStateEmulate) {
  64. nfc_worker_emulate(nfc_worker);
  65. } else if(nfc_worker->state == NfcWorkerStateReadEMVApp) {
  66. nfc_worker_read_emv_app(nfc_worker);
  67. } else if(nfc_worker->state == NfcWorkerStateReadEMV) {
  68. nfc_worker_read_emv(nfc_worker);
  69. } else if(nfc_worker->state == NfcWorkerStateEmulateApdu) {
  70. nfc_worker_emulate_apdu(nfc_worker);
  71. } else if(nfc_worker->state == NfcWorkerStateReadMifareUl) {
  72. nfc_worker_read_mifare_ul(nfc_worker);
  73. } else if(nfc_worker->state == NfcWorkerStateEmulateMifareUl) {
  74. nfc_worker_emulate_mifare_ul(nfc_worker);
  75. } else if(nfc_worker->state == NfcWorkerStateField) {
  76. nfc_worker_field(nfc_worker);
  77. }
  78. furi_hal_nfc_deactivate();
  79. nfc_worker_change_state(nfc_worker, NfcWorkerStateReady);
  80. furi_hal_power_insomnia_exit();
  81. osThreadExit();
  82. }
  83. void nfc_worker_detect(NfcWorker* nfc_worker) {
  84. rfalNfcDevice* dev_list;
  85. rfalNfcDevice* dev;
  86. uint8_t dev_cnt;
  87. NfcDeviceCommonData* result = &nfc_worker->dev_data->nfc_data;
  88. while(nfc_worker->state == NfcWorkerStateDetect) {
  89. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, true)) {
  90. // Process first found device
  91. dev = &dev_list[0];
  92. result->uid_len = dev->nfcidLen;
  93. memcpy(result->uid, dev->nfcid, dev->nfcidLen);
  94. if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCA) {
  95. result->device = NfcDeviceNfca;
  96. result->atqa[0] = dev->dev.nfca.sensRes.anticollisionInfo;
  97. result->atqa[1] = dev->dev.nfca.sensRes.platformInfo;
  98. result->sak = dev->dev.nfca.selRes.sak;
  99. if(mf_ul_check_card_type(
  100. dev->dev.nfca.sensRes.anticollisionInfo,
  101. dev->dev.nfca.sensRes.platformInfo,
  102. dev->dev.nfca.selRes.sak)) {
  103. result->protocol = NfcDeviceProtocolMifareUl;
  104. } else if(dev->rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  105. result->protocol = NfcDeviceProtocolEMV;
  106. } else {
  107. result->protocol = NfcDeviceProtocolUnknown;
  108. }
  109. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCB) {
  110. result->device = NfcDeviceNfcb;
  111. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCF) {
  112. result->device = NfcDeviceNfcf;
  113. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCV) {
  114. result->device = NfcDeviceNfcv;
  115. }
  116. // Notify caller and exit
  117. if(nfc_worker->callback) {
  118. nfc_worker->callback(nfc_worker->context);
  119. }
  120. break;
  121. }
  122. osDelay(100);
  123. }
  124. }
  125. bool nfc_worker_emulate_uid_callback(
  126. uint8_t* buff_rx,
  127. uint16_t buff_rx_len,
  128. uint8_t* buff_tx,
  129. uint16_t* buff_tx_len,
  130. uint32_t* data_type,
  131. void* context) {
  132. furi_assert(context);
  133. NfcWorker* nfc_worker = context;
  134. NfcReaderRequestData* reader_data = &nfc_worker->dev_data->reader_data;
  135. reader_data->size = buff_rx_len / 8;
  136. if(reader_data->size > 0) {
  137. memcpy(reader_data->data, buff_rx, reader_data->size);
  138. if(nfc_worker->callback) {
  139. nfc_worker->callback(nfc_worker->context);
  140. }
  141. }
  142. return true;
  143. }
  144. void nfc_worker_emulate(NfcWorker* nfc_worker) {
  145. NfcDeviceCommonData* data = &nfc_worker->dev_data->nfc_data;
  146. while(nfc_worker->state == NfcWorkerStateEmulate) {
  147. furi_hal_nfc_emulate_nfca(
  148. data->uid,
  149. data->uid_len,
  150. data->atqa,
  151. data->sak,
  152. nfc_worker_emulate_uid_callback,
  153. nfc_worker,
  154. 1000);
  155. }
  156. }
  157. void nfc_worker_read_emv_app(NfcWorker* nfc_worker) {
  158. ReturnCode err;
  159. rfalNfcDevice* dev_list;
  160. EmvApplication emv_app = {};
  161. uint8_t dev_cnt = 0;
  162. uint8_t tx_buff[255] = {};
  163. uint16_t tx_len = 0;
  164. uint8_t* rx_buff;
  165. uint16_t* rx_len;
  166. NfcDeviceData* result = nfc_worker->dev_data;
  167. while(nfc_worker->state == NfcWorkerStateReadEMVApp) {
  168. memset(&emv_app, 0, sizeof(emv_app));
  169. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, false)) {
  170. // Card was found. Check that it supports EMV
  171. if(dev_list[0].rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  172. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  173. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  174. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  175. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  176. memcpy(
  177. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  178. result->nfc_data.protocol = NfcDeviceProtocolEMV;
  179. FURI_LOG_D(TAG, "Send select PPSE command");
  180. tx_len = emv_prepare_select_ppse(tx_buff);
  181. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  182. if(err != ERR_NONE) {
  183. FURI_LOG_D(TAG, "Error during selection PPSE request: %d", err);
  184. furi_hal_nfc_deactivate();
  185. continue;
  186. }
  187. FURI_LOG_D(TAG, "Select PPSE response received. Start parsing response");
  188. if(emv_decode_ppse_response(rx_buff, *rx_len, &emv_app)) {
  189. FURI_LOG_D(TAG, "Select PPSE responce parced");
  190. // Notify caller and exit
  191. result->emv_data.aid_len = emv_app.aid_len;
  192. memcpy(result->emv_data.aid, emv_app.aid, emv_app.aid_len);
  193. if(nfc_worker->callback) {
  194. nfc_worker->callback(nfc_worker->context);
  195. }
  196. break;
  197. } else {
  198. FURI_LOG_D(TAG, "Can't find pay application");
  199. furi_hal_nfc_deactivate();
  200. continue;
  201. }
  202. } else {
  203. // Can't find EMV card
  204. FURI_LOG_W(TAG, "Card doesn't support EMV");
  205. furi_hal_nfc_deactivate();
  206. }
  207. } else {
  208. // Can't find EMV card
  209. FURI_LOG_D(TAG, "Can't find any cards");
  210. furi_hal_nfc_deactivate();
  211. }
  212. osDelay(20);
  213. }
  214. }
  215. void nfc_worker_read_emv(NfcWorker* nfc_worker) {
  216. ReturnCode err;
  217. rfalNfcDevice* dev_list;
  218. EmvApplication emv_app = {};
  219. uint8_t dev_cnt = 0;
  220. uint8_t tx_buff[255] = {};
  221. uint16_t tx_len = 0;
  222. uint8_t* rx_buff;
  223. uint16_t* rx_len;
  224. NfcDeviceData* result = nfc_worker->dev_data;
  225. while(nfc_worker->state == NfcWorkerStateReadEMV) {
  226. memset(&emv_app, 0, sizeof(emv_app));
  227. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, false)) {
  228. // Card was found. Check that it supports EMV
  229. if(dev_list[0].rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  230. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  231. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  232. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  233. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  234. memcpy(
  235. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  236. result->nfc_data.protocol = NfcDeviceProtocolEMV;
  237. FURI_LOG_D(TAG, "Send select PPSE command");
  238. tx_len = emv_prepare_select_ppse(tx_buff);
  239. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  240. if(err != ERR_NONE) {
  241. FURI_LOG_D(TAG, "Error during selection PPSE request: %d", err);
  242. furi_hal_nfc_deactivate();
  243. continue;
  244. }
  245. FURI_LOG_D(TAG, "Select PPSE response received. Start parsing response");
  246. if(emv_decode_ppse_response(rx_buff, *rx_len, &emv_app)) {
  247. FURI_LOG_D(TAG, "Select PPSE responce parced");
  248. result->emv_data.aid_len = emv_app.aid_len;
  249. memcpy(result->emv_data.aid, emv_app.aid, emv_app.aid_len);
  250. } else {
  251. FURI_LOG_D(TAG, "Can't find pay application");
  252. furi_hal_nfc_deactivate();
  253. continue;
  254. }
  255. FURI_LOG_D(TAG, "Starting application ...");
  256. tx_len = emv_prepare_select_app(tx_buff, &emv_app);
  257. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  258. if(err != ERR_NONE) {
  259. FURI_LOG_D(TAG, "Error during application selection request: %d", err);
  260. furi_hal_nfc_deactivate();
  261. continue;
  262. }
  263. FURI_LOG_D(TAG, "Select application response received. Start parsing response");
  264. if(emv_decode_select_app_response(rx_buff, *rx_len, &emv_app)) {
  265. FURI_LOG_D(TAG, "Card name: %s", emv_app.name);
  266. memcpy(result->emv_data.name, emv_app.name, sizeof(emv_app.name));
  267. } else if(emv_app.pdol.size > 0) {
  268. FURI_LOG_D(TAG, "Can't find card name, but PDOL is present.");
  269. } else {
  270. FURI_LOG_D(TAG, "Can't find card name or PDOL");
  271. furi_hal_nfc_deactivate();
  272. continue;
  273. }
  274. FURI_LOG_D(TAG, "Starting Get Processing Options command ...");
  275. tx_len = emv_prepare_get_proc_opt(tx_buff, &emv_app);
  276. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  277. if(err != ERR_NONE) {
  278. FURI_LOG_D(TAG, "Error during Get Processing Options command: %d", err);
  279. furi_hal_nfc_deactivate();
  280. continue;
  281. }
  282. if(emv_decode_get_proc_opt(rx_buff, *rx_len, &emv_app)) {
  283. FURI_LOG_D(TAG, "Card number parsed");
  284. result->emv_data.number_len = emv_app.card_number_len;
  285. memcpy(result->emv_data.number, emv_app.card_number, emv_app.card_number_len);
  286. // Notify caller and exit
  287. if(nfc_worker->callback) {
  288. nfc_worker->callback(nfc_worker->context);
  289. }
  290. break;
  291. } else {
  292. // Mastercard doesn't give PAN / card number as GPO response
  293. // Iterate over all files found in application
  294. bool pan_found = false;
  295. for(uint8_t i = 0; (i < emv_app.afl.size) && !pan_found; i += 4) {
  296. uint8_t sfi = emv_app.afl.data[i] >> 3;
  297. uint8_t record_start = emv_app.afl.data[i + 1];
  298. uint8_t record_end = emv_app.afl.data[i + 2];
  299. // Iterate over all records in file
  300. for(uint8_t record = record_start; record <= record_end; ++record) {
  301. tx_len = emv_prepare_read_sfi_record(tx_buff, sfi, record);
  302. err = furi_hal_nfc_data_exchange(
  303. tx_buff, tx_len, &rx_buff, &rx_len, false);
  304. if(err != ERR_NONE) {
  305. FURI_LOG_D(
  306. TAG,
  307. "Error reading application sfi %d, record %d",
  308. sfi,
  309. record);
  310. }
  311. if(emv_decode_read_sfi_record(rx_buff, *rx_len, &emv_app)) {
  312. pan_found = true;
  313. break;
  314. }
  315. }
  316. }
  317. if(pan_found) {
  318. FURI_LOG_D(TAG, "Card PAN found");
  319. result->emv_data.number_len = emv_app.card_number_len;
  320. memcpy(
  321. result->emv_data.number,
  322. emv_app.card_number,
  323. result->emv_data.number_len);
  324. if(emv_app.exp_month) {
  325. result->emv_data.exp_mon = emv_app.exp_month;
  326. result->emv_data.exp_year = emv_app.exp_year;
  327. }
  328. if(emv_app.country_code) {
  329. result->emv_data.country_code = emv_app.country_code;
  330. }
  331. if(emv_app.currency_code) {
  332. result->emv_data.currency_code = emv_app.currency_code;
  333. }
  334. // Notify caller and exit
  335. if(nfc_worker->callback) {
  336. nfc_worker->callback(nfc_worker->context);
  337. }
  338. break;
  339. } else {
  340. FURI_LOG_D(TAG, "Can't read card number");
  341. }
  342. furi_hal_nfc_deactivate();
  343. }
  344. } else {
  345. // Can't find EMV card
  346. FURI_LOG_W(TAG, "Card doesn't support EMV");
  347. furi_hal_nfc_deactivate();
  348. }
  349. } else {
  350. // Can't find EMV card
  351. FURI_LOG_D(TAG, "Can't find any cards");
  352. furi_hal_nfc_deactivate();
  353. }
  354. osDelay(20);
  355. }
  356. }
  357. void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
  358. ReturnCode err;
  359. uint8_t tx_buff[255] = {};
  360. uint16_t tx_len = 0;
  361. uint8_t* rx_buff;
  362. uint16_t* rx_len;
  363. NfcDeviceCommonData params = {
  364. .uid = {0xCF, 0x72, 0xd4, 0x40},
  365. .uid_len = 4,
  366. .atqa = {0x00, 0x04},
  367. .sak = 0x20,
  368. .device = NfcDeviceNfca,
  369. .protocol = NfcDeviceProtocolEMV,
  370. };
  371. // Test RX data
  372. const uint8_t debug_rx[] = {
  373. 0xba, 0x0b, 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca,
  374. 0xca, 0xfe, 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
  375. 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba,
  376. 0x0b, 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca,
  377. 0xfe, 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
  378. 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b,
  379. 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe,
  380. 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa,
  381. 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba,
  382. 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa,
  383. 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb,
  384. 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba, 0xba,
  385. 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa, 0xce,
  386. 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc,
  387. 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba, 0xba, 0x20,
  388. 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa, 0xce, 0x14,
  389. 0x88, 0x00};
  390. // Test TX data
  391. const uint8_t debug_tx[] = {
  392. 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32,
  393. 0x10, 0x14, 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad,
  394. 0xbe, 0xef, 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12,
  395. 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
  396. 0x14, 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe,
  397. 0xef, 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34,
  398. 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14,
  399. 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef,
  400. 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56,
  401. 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88,
  402. 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef, 0xce,
  403. 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56, 0x78,
  404. 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88, 0x02,
  405. 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef, 0xce, 0xee,
  406. 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56, 0x78, 0x9a,
  407. 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88, 0x02, 0x28,
  408. 0x00, 0x00};
  409. while(nfc_worker->state == NfcWorkerStateEmulateApdu) {
  410. if(furi_hal_nfc_listen(params.uid, params.uid_len, params.atqa, params.sak, false, 300)) {
  411. FURI_LOG_D(TAG, "POS terminal detected");
  412. // Read data from POS terminal
  413. err = furi_hal_nfc_data_exchange(NULL, 0, &rx_buff, &rx_len, false);
  414. if(err == ERR_NONE) {
  415. FURI_LOG_D(TAG, "Received Select PPSE");
  416. } else {
  417. FURI_LOG_D(TAG, "Error in 1st data exchange: select PPSE");
  418. furi_hal_nfc_deactivate();
  419. continue;
  420. }
  421. FURI_LOG_D(TAG, "Transive SELECT PPSE ANS");
  422. tx_len = emv_select_ppse_ans(tx_buff);
  423. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  424. if(err == ERR_NONE) {
  425. FURI_LOG_D(TAG, "Received Select APP");
  426. } else {
  427. FURI_LOG_D(TAG, "Error in 2nd data exchange: select APP");
  428. furi_hal_nfc_deactivate();
  429. continue;
  430. }
  431. FURI_LOG_D(TAG, "Transive SELECT APP ANS");
  432. tx_len = emv_select_app_ans(tx_buff);
  433. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  434. if(err == ERR_NONE) {
  435. FURI_LOG_D(TAG, "Received PDOL");
  436. } else {
  437. FURI_LOG_D(TAG, "Error in 3rd data exchange: receive PDOL");
  438. furi_hal_nfc_deactivate();
  439. continue;
  440. }
  441. FURI_LOG_D(TAG, "Transive PDOL ANS");
  442. tx_len = emv_get_proc_opt_ans(tx_buff);
  443. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  444. if(err == ERR_NONE) {
  445. FURI_LOG_D(TAG, "Transive PDOL ANS");
  446. } else {
  447. FURI_LOG_D(TAG, "Error in 4rd data exchange: Transive PDOL ANS");
  448. furi_hal_nfc_deactivate();
  449. continue;
  450. }
  451. if(*rx_len != sizeof(debug_rx) || memcmp(rx_buff, debug_rx, sizeof(debug_rx))) {
  452. FURI_LOG_D(TAG, "Failed long message test");
  453. } else {
  454. FURI_LOG_D(TAG, "Correct debug message received");
  455. tx_len = sizeof(debug_tx);
  456. err = furi_hal_nfc_data_exchange(
  457. (uint8_t*)debug_tx, tx_len, &rx_buff, &rx_len, false);
  458. if(err == ERR_NONE) {
  459. FURI_LOG_D(TAG, "Transive Debug message");
  460. }
  461. }
  462. furi_hal_nfc_deactivate();
  463. } else {
  464. FURI_LOG_D(TAG, "Can't find reader");
  465. }
  466. osDelay(20);
  467. }
  468. }
  469. void nfc_worker_read_mifare_ul(NfcWorker* nfc_worker) {
  470. ReturnCode err;
  471. rfalNfcDevice* dev_list;
  472. uint8_t dev_cnt = 0;
  473. uint8_t tx_buff[255] = {};
  474. uint16_t tx_len = 0;
  475. uint8_t* rx_buff;
  476. uint16_t* rx_len;
  477. MifareUlDevice mf_ul_read;
  478. NfcDeviceData* result = nfc_worker->dev_data;
  479. while(nfc_worker->state == NfcWorkerStateReadMifareUl) {
  480. furi_hal_nfc_deactivate();
  481. memset(&mf_ul_read, 0, sizeof(mf_ul_read));
  482. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 300, false)) {
  483. if(dev_list[0].type == RFAL_NFC_LISTEN_TYPE_NFCA &&
  484. mf_ul_check_card_type(
  485. dev_list[0].dev.nfca.sensRes.anticollisionInfo,
  486. dev_list[0].dev.nfca.sensRes.platformInfo,
  487. dev_list[0].dev.nfca.selRes.sak)) {
  488. // Get Mifare Ultralight version
  489. FURI_LOG_D(TAG, "Found Mifare Ultralight tag. Reading tag version");
  490. tx_len = mf_ul_prepare_get_version(tx_buff);
  491. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  492. if(err == ERR_NONE) {
  493. mf_ul_parse_get_version_response(rx_buff, &mf_ul_read);
  494. FURI_LOG_D(
  495. TAG,
  496. "Mifare Ultralight Type: %d, Pages: %d",
  497. mf_ul_read.data.type,
  498. mf_ul_read.pages_to_read);
  499. FURI_LOG_D(TAG, "Reading signature ...");
  500. tx_len = mf_ul_prepare_read_signature(tx_buff);
  501. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  502. FURI_LOG_D(TAG, "Failed reading signature");
  503. memset(mf_ul_read.data.signature, 0, sizeof(mf_ul_read.data.signature));
  504. } else {
  505. mf_ul_parse_read_signature_response(rx_buff, &mf_ul_read);
  506. }
  507. } else if(err == ERR_TIMEOUT) {
  508. FURI_LOG_D(
  509. TAG,
  510. "Card doesn't respond to GET VERSION command. Setting default read parameters");
  511. err = ERR_NONE;
  512. mf_ul_set_default_version(&mf_ul_read);
  513. // Reinit device
  514. furi_hal_nfc_deactivate();
  515. if(!furi_hal_nfc_detect(&dev_list, &dev_cnt, 300, false)) {
  516. FURI_LOG_D(TAG, "Lost connection. Restarting search");
  517. continue;
  518. }
  519. } else {
  520. FURI_LOG_D(
  521. TAG, "Error getting Mifare Ultralight version. Error code: %d", err);
  522. continue;
  523. }
  524. if(mf_ul_read.support_fast_read) {
  525. FURI_LOG_D(TAG, "Reading pages ...");
  526. tx_len = mf_ul_prepare_fast_read(tx_buff, 0x00, mf_ul_read.pages_to_read - 1);
  527. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  528. FURI_LOG_D(TAG, "Failed reading pages");
  529. continue;
  530. } else {
  531. mf_ul_parse_fast_read_response(
  532. rx_buff, 0x00, mf_ul_read.pages_to_read - 1, &mf_ul_read);
  533. }
  534. FURI_LOG_D(TAG, "Reading 3 counters ...");
  535. for(uint8_t i = 0; i < 3; i++) {
  536. tx_len = mf_ul_prepare_read_cnt(tx_buff, i);
  537. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  538. FURI_LOG_W(TAG, "Failed reading Counter %d", i);
  539. mf_ul_read.data.counter[i] = 0;
  540. } else {
  541. mf_ul_parse_read_cnt_response(rx_buff, i, &mf_ul_read);
  542. }
  543. }
  544. FURI_LOG_D(TAG, "Checking tearing flags ...");
  545. for(uint8_t i = 0; i < 3; i++) {
  546. tx_len = mf_ul_prepare_check_tearing(tx_buff, i);
  547. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  548. FURI_LOG_D(TAG, "Error checking tearing flag %d", i);
  549. mf_ul_read.data.tearing[i] = MF_UL_TEARING_FLAG_DEFAULT;
  550. } else {
  551. mf_ul_parse_check_tearing_response(rx_buff, i, &mf_ul_read);
  552. }
  553. }
  554. } else {
  555. // READ card with READ command (4 pages at a time)
  556. for(uint8_t page = 0; page < mf_ul_read.pages_to_read; page += 4) {
  557. FURI_LOG_D(TAG, "Reading pages %d - %d ...", page, page + 3);
  558. tx_len = mf_ul_prepare_read(tx_buff, page);
  559. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  560. FURI_LOG_D(TAG, "Read pages %d - %d failed", page, page + 3);
  561. continue;
  562. } else {
  563. mf_ul_parse_read_response(rx_buff, page, &mf_ul_read);
  564. }
  565. }
  566. }
  567. // Fill result data
  568. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  569. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  570. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  571. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  572. result->nfc_data.protocol = NfcDeviceProtocolMifareUl;
  573. memcpy(
  574. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  575. result->mf_ul_data = mf_ul_read.data;
  576. // Notify caller and exit
  577. if(nfc_worker->callback) {
  578. nfc_worker->callback(nfc_worker->context);
  579. }
  580. break;
  581. } else {
  582. FURI_LOG_W(TAG, "Tag does not support Mifare Ultralight");
  583. }
  584. } else {
  585. FURI_LOG_D(TAG, "Can't find any tags");
  586. }
  587. osDelay(100);
  588. }
  589. }
  590. void nfc_worker_emulate_mifare_ul(NfcWorker* nfc_worker) {
  591. NfcDeviceCommonData* nfc_common = &nfc_worker->dev_data->nfc_data;
  592. MifareUlDevice mf_ul_emulate;
  593. mf_ul_prepare_emulation(&mf_ul_emulate, &nfc_worker->dev_data->mf_ul_data);
  594. while(nfc_worker->state == NfcWorkerStateEmulateMifareUl) {
  595. furi_hal_nfc_emulate_nfca(
  596. nfc_common->uid,
  597. nfc_common->uid_len,
  598. nfc_common->atqa,
  599. nfc_common->sak,
  600. mf_ul_prepare_emulation_response,
  601. &mf_ul_emulate,
  602. 5000);
  603. // Check if data was modified
  604. if(mf_ul_emulate.data_changed) {
  605. nfc_worker->dev_data->mf_ul_data = mf_ul_emulate.data;
  606. if(nfc_worker->callback) {
  607. nfc_worker->callback(nfc_worker->context);
  608. }
  609. mf_ul_emulate.data_changed = false;
  610. }
  611. }
  612. }
  613. void nfc_worker_field(NfcWorker* nfc_worker) {
  614. furi_hal_nfc_field_on();
  615. while(nfc_worker->state == NfcWorkerStateField) {
  616. osDelay(50);
  617. }
  618. furi_hal_nfc_field_off();
  619. }