nfc_worker.c 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676
  1. #include "nfc_worker_i.h"
  2. #include <furi-hal.h>
  3. #include "nfc_protocols/emv_decoder.h"
  4. #include "nfc_protocols/mifare_ultralight.h"
  5. #define NFC_WORKER_TAG "nfc worker"
  6. /***************************** NFC Worker API *******************************/
  7. NfcWorker* nfc_worker_alloc() {
  8. NfcWorker* nfc_worker = furi_alloc(sizeof(NfcWorker));
  9. // Worker thread attributes
  10. nfc_worker->thread_attr.name = "nfc_worker";
  11. nfc_worker->thread_attr.stack_size = 8192;
  12. nfc_worker->callback = NULL;
  13. nfc_worker->context = NULL;
  14. // Initialize rfal
  15. if(!furi_hal_nfc_is_busy()) {
  16. nfc_worker_change_state(nfc_worker, NfcWorkerStateReady);
  17. } else {
  18. nfc_worker_change_state(nfc_worker, NfcWorkerStateBroken);
  19. }
  20. return nfc_worker;
  21. }
  22. void nfc_worker_free(NfcWorker* nfc_worker) {
  23. furi_assert(nfc_worker);
  24. free(nfc_worker);
  25. }
  26. NfcWorkerState nfc_worker_get_state(NfcWorker* nfc_worker) {
  27. return nfc_worker->state;
  28. }
  29. void nfc_worker_start(
  30. NfcWorker* nfc_worker,
  31. NfcWorkerState state,
  32. NfcDeviceData* dev_data,
  33. NfcWorkerCallback callback,
  34. void* context) {
  35. furi_assert(nfc_worker);
  36. furi_assert(dev_data);
  37. while(nfc_worker->state != NfcWorkerStateReady) {
  38. osDelay(10);
  39. }
  40. nfc_worker->callback = callback;
  41. nfc_worker->context = context;
  42. nfc_worker->dev_data = dev_data;
  43. nfc_worker_change_state(nfc_worker, state);
  44. nfc_worker->thread = osThreadNew(nfc_worker_task, nfc_worker, &nfc_worker->thread_attr);
  45. }
  46. void nfc_worker_stop(NfcWorker* nfc_worker) {
  47. furi_assert(nfc_worker);
  48. if(nfc_worker->state == NfcWorkerStateBroken || nfc_worker->state == NfcWorkerStateReady) {
  49. return;
  50. }
  51. nfc_worker_change_state(nfc_worker, NfcWorkerStateStop);
  52. }
  53. void nfc_worker_change_state(NfcWorker* nfc_worker, NfcWorkerState state) {
  54. nfc_worker->state = state;
  55. }
  56. /***************************** NFC Worker Thread *******************************/
  57. void nfc_worker_task(void* context) {
  58. NfcWorker* nfc_worker = context;
  59. furi_hal_power_insomnia_enter();
  60. furi_hal_nfc_exit_sleep();
  61. if(nfc_worker->state == NfcWorkerStateDetect) {
  62. nfc_worker_detect(nfc_worker);
  63. } else if(nfc_worker->state == NfcWorkerStateEmulate) {
  64. nfc_worker_emulate(nfc_worker);
  65. } else if(nfc_worker->state == NfcWorkerStateReadEMVApp) {
  66. nfc_worker_read_emv_app(nfc_worker);
  67. } else if(nfc_worker->state == NfcWorkerStateReadEMV) {
  68. nfc_worker_read_emv(nfc_worker);
  69. } else if(nfc_worker->state == NfcWorkerStateEmulateApdu) {
  70. nfc_worker_emulate_apdu(nfc_worker);
  71. } else if(nfc_worker->state == NfcWorkerStateReadMifareUl) {
  72. nfc_worker_read_mifare_ul(nfc_worker);
  73. } else if(nfc_worker->state == NfcWorkerStateEmulateMifareUl) {
  74. nfc_worker_emulate_mifare_ul(nfc_worker);
  75. } else if(nfc_worker->state == NfcWorkerStateField) {
  76. nfc_worker_field(nfc_worker);
  77. }
  78. furi_hal_nfc_deactivate();
  79. nfc_worker_change_state(nfc_worker, NfcWorkerStateReady);
  80. furi_hal_power_insomnia_exit();
  81. osThreadExit();
  82. }
  83. void nfc_worker_detect(NfcWorker* nfc_worker) {
  84. rfalNfcDevice* dev_list;
  85. rfalNfcDevice* dev;
  86. uint8_t dev_cnt;
  87. NfcDeviceCommonData* result = &nfc_worker->dev_data->nfc_data;
  88. while(nfc_worker->state == NfcWorkerStateDetect) {
  89. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, true)) {
  90. // Process first found device
  91. dev = &dev_list[0];
  92. result->uid_len = dev->nfcidLen;
  93. memcpy(result->uid, dev->nfcid, dev->nfcidLen);
  94. if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCA) {
  95. result->device = NfcDeviceNfca;
  96. result->atqa[0] = dev->dev.nfca.sensRes.anticollisionInfo;
  97. result->atqa[1] = dev->dev.nfca.sensRes.platformInfo;
  98. result->sak = dev->dev.nfca.selRes.sak;
  99. if(mf_ul_check_card_type(
  100. dev->dev.nfca.sensRes.anticollisionInfo,
  101. dev->dev.nfca.sensRes.platformInfo,
  102. dev->dev.nfca.selRes.sak)) {
  103. result->protocol = NfcDeviceProtocolMifareUl;
  104. } else if(dev->rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  105. result->protocol = NfcDeviceProtocolEMV;
  106. } else {
  107. result->protocol = NfcDeviceProtocolUnknown;
  108. }
  109. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCB) {
  110. result->device = NfcDeviceNfcb;
  111. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCF) {
  112. result->device = NfcDeviceNfcf;
  113. } else if(dev->type == RFAL_NFC_LISTEN_TYPE_NFCV) {
  114. result->device = NfcDeviceNfcv;
  115. }
  116. // Notify caller and exit
  117. if(nfc_worker->callback) {
  118. nfc_worker->callback(nfc_worker->context);
  119. }
  120. break;
  121. }
  122. osDelay(100);
  123. }
  124. }
  125. void nfc_worker_emulate(NfcWorker* nfc_worker) {
  126. NfcDeviceCommonData* data = &nfc_worker->dev_data->nfc_data;
  127. while(nfc_worker->state == NfcWorkerStateEmulate) {
  128. if(furi_hal_nfc_listen(data->uid, data->uid_len, data->atqa, data->sak, false, 100)) {
  129. FURI_LOG_I(NFC_WORKER_TAG, "Reader detected");
  130. }
  131. osDelay(10);
  132. }
  133. }
  134. void nfc_worker_read_emv_app(NfcWorker* nfc_worker) {
  135. ReturnCode err;
  136. rfalNfcDevice* dev_list;
  137. EmvApplication emv_app = {};
  138. uint8_t dev_cnt = 0;
  139. uint8_t tx_buff[255] = {};
  140. uint16_t tx_len = 0;
  141. uint8_t* rx_buff;
  142. uint16_t* rx_len;
  143. NfcDeviceData* result = nfc_worker->dev_data;
  144. while(nfc_worker->state == NfcWorkerStateReadEMVApp) {
  145. memset(&emv_app, 0, sizeof(emv_app));
  146. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, false)) {
  147. // Card was found. Check that it supports EMV
  148. if(dev_list[0].rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  149. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  150. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  151. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  152. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  153. memcpy(
  154. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  155. result->nfc_data.protocol = NfcDeviceProtocolEMV;
  156. FURI_LOG_I(NFC_WORKER_TAG, "Send select PPSE command");
  157. tx_len = emv_prepare_select_ppse(tx_buff);
  158. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  159. if(err != ERR_NONE) {
  160. FURI_LOG_E(NFC_WORKER_TAG, "Error during selection PPSE request: %d", err);
  161. furi_hal_nfc_deactivate();
  162. continue;
  163. }
  164. FURI_LOG_I(
  165. NFC_WORKER_TAG, "Select PPSE response received. Start parsing response");
  166. if(emv_decode_ppse_response(rx_buff, *rx_len, &emv_app)) {
  167. FURI_LOG_I(NFC_WORKER_TAG, "Select PPSE responce parced");
  168. // Notify caller and exit
  169. result->emv_data.aid_len = emv_app.aid_len;
  170. memcpy(result->emv_data.aid, emv_app.aid, emv_app.aid_len);
  171. if(nfc_worker->callback) {
  172. nfc_worker->callback(nfc_worker->context);
  173. }
  174. break;
  175. } else {
  176. FURI_LOG_E(NFC_WORKER_TAG, "Can't find pay application");
  177. furi_hal_nfc_deactivate();
  178. continue;
  179. }
  180. } else {
  181. // Can't find EMV card
  182. FURI_LOG_W(NFC_WORKER_TAG, "Card doesn't support EMV");
  183. furi_hal_nfc_deactivate();
  184. }
  185. } else {
  186. // Can't find EMV card
  187. FURI_LOG_W(NFC_WORKER_TAG, "Can't find any cards");
  188. furi_hal_nfc_deactivate();
  189. }
  190. osDelay(20);
  191. }
  192. }
  193. void nfc_worker_read_emv(NfcWorker* nfc_worker) {
  194. ReturnCode err;
  195. rfalNfcDevice* dev_list;
  196. EmvApplication emv_app = {};
  197. uint8_t dev_cnt = 0;
  198. uint8_t tx_buff[255] = {};
  199. uint16_t tx_len = 0;
  200. uint8_t* rx_buff;
  201. uint16_t* rx_len;
  202. NfcDeviceData* result = nfc_worker->dev_data;
  203. while(nfc_worker->state == NfcWorkerStateReadEMV) {
  204. memset(&emv_app, 0, sizeof(emv_app));
  205. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 1000, false)) {
  206. // Card was found. Check that it supports EMV
  207. if(dev_list[0].rfInterface == RFAL_NFC_INTERFACE_ISODEP) {
  208. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  209. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  210. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  211. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  212. memcpy(
  213. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  214. result->nfc_data.protocol = NfcDeviceProtocolEMV;
  215. FURI_LOG_I(NFC_WORKER_TAG, "Send select PPSE command");
  216. tx_len = emv_prepare_select_ppse(tx_buff);
  217. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  218. if(err != ERR_NONE) {
  219. FURI_LOG_E(NFC_WORKER_TAG, "Error during selection PPSE request: %d", err);
  220. furi_hal_nfc_deactivate();
  221. continue;
  222. }
  223. FURI_LOG_I(
  224. NFC_WORKER_TAG, "Select PPSE response received. Start parsing response");
  225. if(emv_decode_ppse_response(rx_buff, *rx_len, &emv_app)) {
  226. FURI_LOG_I(NFC_WORKER_TAG, "Select PPSE responce parced");
  227. result->emv_data.aid_len = emv_app.aid_len;
  228. memcpy(result->emv_data.aid, emv_app.aid, emv_app.aid_len);
  229. } else {
  230. FURI_LOG_E(NFC_WORKER_TAG, "Can't find pay application");
  231. furi_hal_nfc_deactivate();
  232. continue;
  233. }
  234. FURI_LOG_I(NFC_WORKER_TAG, "Starting application ...");
  235. tx_len = emv_prepare_select_app(tx_buff, &emv_app);
  236. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  237. if(err != ERR_NONE) {
  238. FURI_LOG_E(
  239. NFC_WORKER_TAG, "Error during application selection request: %d", err);
  240. furi_hal_nfc_deactivate();
  241. continue;
  242. }
  243. FURI_LOG_I(
  244. NFC_WORKER_TAG,
  245. "Select application response received. Start parsing response");
  246. if(emv_decode_select_app_response(rx_buff, *rx_len, &emv_app)) {
  247. FURI_LOG_I(NFC_WORKER_TAG, "Card name: %s", emv_app.name);
  248. memcpy(result->emv_data.name, emv_app.name, sizeof(emv_app.name));
  249. } else if(emv_app.pdol.size > 0) {
  250. FURI_LOG_W(NFC_WORKER_TAG, "Can't find card name, but PDOL is present.");
  251. } else {
  252. FURI_LOG_E(NFC_WORKER_TAG, "Can't find card name or PDOL");
  253. furi_hal_nfc_deactivate();
  254. continue;
  255. }
  256. FURI_LOG_I(NFC_WORKER_TAG, "Starting Get Processing Options command ...");
  257. tx_len = emv_prepare_get_proc_opt(tx_buff, &emv_app);
  258. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  259. if(err != ERR_NONE) {
  260. FURI_LOG_E(
  261. NFC_WORKER_TAG, "Error during Get Processing Options command: %d", err);
  262. furi_hal_nfc_deactivate();
  263. continue;
  264. }
  265. if(emv_decode_get_proc_opt(rx_buff, *rx_len, &emv_app)) {
  266. FURI_LOG_I(NFC_WORKER_TAG, "Card number parsed");
  267. result->emv_data.number_len = emv_app.card_number_len;
  268. memcpy(result->emv_data.number, emv_app.card_number, emv_app.card_number_len);
  269. // Notify caller and exit
  270. if(nfc_worker->callback) {
  271. nfc_worker->callback(nfc_worker->context);
  272. }
  273. break;
  274. } else {
  275. // Mastercard doesn't give PAN / card number as GPO response
  276. // Iterate over all files found in application
  277. bool pan_found = false;
  278. for(uint8_t i = 0; (i < emv_app.afl.size) && !pan_found; i += 4) {
  279. uint8_t sfi = emv_app.afl.data[i] >> 3;
  280. uint8_t record_start = emv_app.afl.data[i + 1];
  281. uint8_t record_end = emv_app.afl.data[i + 2];
  282. // Iterate over all records in file
  283. for(uint8_t record = record_start; record <= record_end; ++record) {
  284. tx_len = emv_prepare_read_sfi_record(tx_buff, sfi, record);
  285. err = furi_hal_nfc_data_exchange(
  286. tx_buff, tx_len, &rx_buff, &rx_len, false);
  287. if(err != ERR_NONE) {
  288. FURI_LOG_E(
  289. NFC_WORKER_TAG,
  290. "Error reading application sfi %d, record %d",
  291. sfi,
  292. record);
  293. }
  294. if(emv_decode_read_sfi_record(rx_buff, *rx_len, &emv_app)) {
  295. pan_found = true;
  296. break;
  297. }
  298. }
  299. }
  300. if(pan_found) {
  301. FURI_LOG_I(NFC_WORKER_TAG, "Card PAN found");
  302. result->emv_data.number_len = emv_app.card_number_len;
  303. memcpy(
  304. result->emv_data.number,
  305. emv_app.card_number,
  306. result->emv_data.number_len);
  307. if(emv_app.exp_month) {
  308. result->emv_data.exp_mon = emv_app.exp_month;
  309. result->emv_data.exp_year = emv_app.exp_year;
  310. }
  311. if(emv_app.country_code) {
  312. result->emv_data.country_code = emv_app.country_code;
  313. }
  314. if(emv_app.currency_code) {
  315. result->emv_data.currency_code = emv_app.currency_code;
  316. }
  317. // Notify caller and exit
  318. if(nfc_worker->callback) {
  319. nfc_worker->callback(nfc_worker->context);
  320. }
  321. break;
  322. } else {
  323. FURI_LOG_E(NFC_WORKER_TAG, "Can't read card number");
  324. }
  325. furi_hal_nfc_deactivate();
  326. }
  327. } else {
  328. // Can't find EMV card
  329. FURI_LOG_W(NFC_WORKER_TAG, "Card doesn't support EMV");
  330. furi_hal_nfc_deactivate();
  331. }
  332. } else {
  333. // Can't find EMV card
  334. FURI_LOG_W(NFC_WORKER_TAG, "Can't find any cards");
  335. furi_hal_nfc_deactivate();
  336. }
  337. osDelay(20);
  338. }
  339. }
  340. void nfc_worker_emulate_apdu(NfcWorker* nfc_worker) {
  341. ReturnCode err;
  342. uint8_t tx_buff[255] = {};
  343. uint16_t tx_len = 0;
  344. uint8_t* rx_buff;
  345. uint16_t* rx_len;
  346. NfcDeviceCommonData params = {
  347. .uid = {0xCF, 0x72, 0xd4, 0x40},
  348. .uid_len = 4,
  349. .atqa = {0x00, 0x04},
  350. .sak = 0x20,
  351. .device = NfcDeviceNfca,
  352. .protocol = NfcDeviceProtocolEMV,
  353. };
  354. // Test RX data
  355. const uint8_t debug_rx[] = {
  356. 0xba, 0x0b, 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca,
  357. 0xca, 0xfe, 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
  358. 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba,
  359. 0x0b, 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca,
  360. 0xfe, 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
  361. 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b,
  362. 0xba, 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe,
  363. 0xfa, 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa,
  364. 0xbb, 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba,
  365. 0xba, 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa,
  366. 0xce, 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb,
  367. 0xcc, 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba, 0xba,
  368. 0x20, 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa, 0xce,
  369. 0x14, 0x88, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc,
  370. 0xdd, 0xee, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0xba, 0x0b, 0xba, 0xba, 0x20,
  371. 0x00, 0x02, 0x28, 0xde, 0xad, 0xbe, 0xef, 0x00, 0xca, 0xca, 0xca, 0xfe, 0xfa, 0xce, 0x14,
  372. 0x88, 0x00};
  373. // Test TX data
  374. const uint8_t debug_tx[] = {
  375. 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32,
  376. 0x10, 0x14, 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad,
  377. 0xbe, 0xef, 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12,
  378. 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
  379. 0x14, 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe,
  380. 0xef, 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34,
  381. 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14,
  382. 0x88, 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef,
  383. 0xce, 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56,
  384. 0x78, 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88,
  385. 0x02, 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef, 0xce,
  386. 0xee, 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56, 0x78,
  387. 0x9a, 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88, 0x02,
  388. 0x28, 0x00, 0x00, 0xca, 0xca, 0x00, 0xc0, 0xc0, 0x00, 0xde, 0xad, 0xbe, 0xef, 0xce, 0xee,
  389. 0xec, 0xca, 0xfe, 0xba, 0xba, 0xb0, 0xb0, 0xac, 0xdc, 0x11, 0x12, 0x34, 0x56, 0x78, 0x9a,
  390. 0xbc, 0xde, 0xff, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10, 0x14, 0x88, 0x02, 0x28,
  391. 0x00, 0x00};
  392. while(nfc_worker->state == NfcWorkerStateEmulateApdu) {
  393. if(furi_hal_nfc_listen(params.uid, params.uid_len, params.atqa, params.sak, false, 300)) {
  394. FURI_LOG_I(NFC_WORKER_TAG, "POS terminal detected");
  395. // Read data from POS terminal
  396. err = furi_hal_nfc_data_exchange(NULL, 0, &rx_buff, &rx_len, false);
  397. if(err == ERR_NONE) {
  398. FURI_LOG_I(NFC_WORKER_TAG, "Received Select PPSE");
  399. } else {
  400. FURI_LOG_E(NFC_WORKER_TAG, "Error in 1st data exchange: select PPSE");
  401. furi_hal_nfc_deactivate();
  402. continue;
  403. }
  404. FURI_LOG_I(NFC_WORKER_TAG, "Transive SELECT PPSE ANS");
  405. tx_len = emv_select_ppse_ans(tx_buff);
  406. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  407. if(err == ERR_NONE) {
  408. FURI_LOG_I(NFC_WORKER_TAG, "Received Select APP");
  409. } else {
  410. FURI_LOG_E(NFC_WORKER_TAG, "Error in 2nd data exchange: select APP");
  411. furi_hal_nfc_deactivate();
  412. continue;
  413. }
  414. FURI_LOG_I(NFC_WORKER_TAG, "Transive SELECT APP ANS");
  415. tx_len = emv_select_app_ans(tx_buff);
  416. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  417. if(err == ERR_NONE) {
  418. FURI_LOG_I(NFC_WORKER_TAG, "Received PDOL");
  419. } else {
  420. FURI_LOG_E(NFC_WORKER_TAG, "Error in 3rd data exchange: receive PDOL");
  421. furi_hal_nfc_deactivate();
  422. continue;
  423. }
  424. FURI_LOG_I(NFC_WORKER_TAG, "Transive PDOL ANS");
  425. tx_len = emv_get_proc_opt_ans(tx_buff);
  426. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  427. if(err == ERR_NONE) {
  428. FURI_LOG_I(NFC_WORKER_TAG, "Transive PDOL ANS");
  429. } else {
  430. FURI_LOG_E(NFC_WORKER_TAG, "Error in 4rd data exchange: Transive PDOL ANS");
  431. furi_hal_nfc_deactivate();
  432. continue;
  433. }
  434. if(*rx_len != sizeof(debug_rx) || memcmp(rx_buff, debug_rx, sizeof(debug_rx))) {
  435. FURI_LOG_E(NFC_WORKER_TAG, "Failed long message test");
  436. } else {
  437. FURI_LOG_I(NFC_WORKER_TAG, "Correct debug message received");
  438. tx_len = sizeof(debug_tx);
  439. err = furi_hal_nfc_data_exchange(
  440. (uint8_t*)debug_tx, tx_len, &rx_buff, &rx_len, false);
  441. if(err == ERR_NONE) {
  442. FURI_LOG_I(NFC_WORKER_TAG, "Transive Debug message");
  443. }
  444. }
  445. furi_hal_nfc_deactivate();
  446. } else {
  447. FURI_LOG_W(NFC_WORKER_TAG, "Can't find reader");
  448. }
  449. osDelay(20);
  450. }
  451. }
  452. void nfc_worker_read_mifare_ul(NfcWorker* nfc_worker) {
  453. ReturnCode err;
  454. rfalNfcDevice* dev_list;
  455. uint8_t dev_cnt = 0;
  456. uint8_t tx_buff[255] = {};
  457. uint16_t tx_len = 0;
  458. uint8_t* rx_buff;
  459. uint16_t* rx_len;
  460. MifareUlDevice mf_ul_read;
  461. NfcDeviceData* result = nfc_worker->dev_data;
  462. while(nfc_worker->state == NfcWorkerStateReadMifareUl) {
  463. furi_hal_nfc_deactivate();
  464. memset(&mf_ul_read, 0, sizeof(mf_ul_read));
  465. if(furi_hal_nfc_detect(&dev_list, &dev_cnt, 300, false)) {
  466. if(dev_list[0].type == RFAL_NFC_LISTEN_TYPE_NFCA &&
  467. mf_ul_check_card_type(
  468. dev_list[0].dev.nfca.sensRes.anticollisionInfo,
  469. dev_list[0].dev.nfca.sensRes.platformInfo,
  470. dev_list[0].dev.nfca.selRes.sak)) {
  471. // Get Mifare Ultralight version
  472. FURI_LOG_I(NFC_WORKER_TAG, "Found Mifare Ultralight tag. Reading tag version");
  473. tx_len = mf_ul_prepare_get_version(tx_buff);
  474. err = furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  475. if(err == ERR_NONE) {
  476. mf_ul_parse_get_version_response(rx_buff, &mf_ul_read);
  477. FURI_LOG_I(
  478. NFC_WORKER_TAG,
  479. "Mifare Ultralight Type: %d, Pages: %d",
  480. mf_ul_read.type,
  481. mf_ul_read.pages_to_read);
  482. FURI_LOG_I(NFC_WORKER_TAG, "Reading signature ...");
  483. tx_len = mf_ul_prepare_read_signature(tx_buff);
  484. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  485. FURI_LOG_W(NFC_WORKER_TAG, "Failed reading signature");
  486. memset(mf_ul_read.data.signature, 0, sizeof(mf_ul_read.data.signature));
  487. } else {
  488. mf_ul_parse_read_signature_response(rx_buff, &mf_ul_read);
  489. }
  490. } else if(err == ERR_TIMEOUT) {
  491. FURI_LOG_W(
  492. NFC_WORKER_TAG,
  493. "Card doesn't respond to GET VERSION command. Setting default read parameters");
  494. err = ERR_NONE;
  495. mf_ul_set_default_version(&mf_ul_read);
  496. // Reinit device
  497. furi_hal_nfc_deactivate();
  498. if(!furi_hal_nfc_detect(&dev_list, &dev_cnt, 300, false)) {
  499. FURI_LOG_E(NFC_WORKER_TAG, "Lost connection. Restarting search");
  500. continue;
  501. }
  502. } else {
  503. FURI_LOG_E(
  504. NFC_WORKER_TAG,
  505. "Error getting Mifare Ultralight version. Error code: %d",
  506. err);
  507. continue;
  508. }
  509. if(mf_ul_read.support_fast_read) {
  510. FURI_LOG_I(NFC_WORKER_TAG, "Reading pages ...");
  511. tx_len = mf_ul_prepare_fast_read(tx_buff, 0x00, mf_ul_read.pages_to_read - 1);
  512. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  513. FURI_LOG_E(NFC_WORKER_TAG, "Failed reading pages");
  514. continue;
  515. } else {
  516. mf_ul_parse_fast_read_response(
  517. rx_buff, 0x00, mf_ul_read.pages_to_read - 1, &mf_ul_read);
  518. }
  519. FURI_LOG_I(NFC_WORKER_TAG, "Reading 3 counters ...");
  520. for(uint8_t i = 0; i < 3; i++) {
  521. tx_len = mf_ul_prepare_read_cnt(tx_buff, i);
  522. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  523. FURI_LOG_W(NFC_WORKER_TAG, "Failed reading Counter %d", i);
  524. mf_ul_read.data.counter[i] = 0;
  525. } else {
  526. mf_ul_parse_read_cnt_response(rx_buff, i, &mf_ul_read);
  527. }
  528. }
  529. FURI_LOG_I(NFC_WORKER_TAG, "Checking tearing flags ...");
  530. for(uint8_t i = 0; i < 3; i++) {
  531. tx_len = mf_ul_prepare_check_tearing(tx_buff, i);
  532. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  533. FURI_LOG_E(NFC_WORKER_TAG, "Error checking tearing flag %d", i);
  534. mf_ul_read.data.tearing[i] = MF_UL_TEARING_FLAG_DEFAULT;
  535. } else {
  536. mf_ul_parse_check_tearing_response(rx_buff, i, &mf_ul_read);
  537. }
  538. }
  539. } else {
  540. // READ card with READ command (4 pages at a time)
  541. for(uint8_t page = 0; page < mf_ul_read.pages_to_read; page += 4) {
  542. FURI_LOG_I(NFC_WORKER_TAG, "Reading pages %d - %d ...", page, page + 3);
  543. tx_len = mf_ul_prepare_read(tx_buff, page);
  544. if(furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false)) {
  545. FURI_LOG_E(
  546. NFC_WORKER_TAG, "Read pages %d - %d failed", page, page + 3);
  547. continue;
  548. } else {
  549. mf_ul_parse_read_response(rx_buff, page, &mf_ul_read);
  550. }
  551. }
  552. }
  553. // Fill result data
  554. result->nfc_data.uid_len = dev_list[0].dev.nfca.nfcId1Len;
  555. result->nfc_data.atqa[0] = dev_list[0].dev.nfca.sensRes.anticollisionInfo;
  556. result->nfc_data.atqa[1] = dev_list[0].dev.nfca.sensRes.platformInfo;
  557. result->nfc_data.sak = dev_list[0].dev.nfca.selRes.sak;
  558. result->nfc_data.protocol = NfcDeviceProtocolMifareUl;
  559. memcpy(
  560. result->nfc_data.uid, dev_list[0].dev.nfca.nfcId1, result->nfc_data.uid_len);
  561. result->mf_ul_data = mf_ul_read.data;
  562. // Notify caller and exit
  563. if(nfc_worker->callback) {
  564. nfc_worker->callback(nfc_worker->context);
  565. }
  566. break;
  567. } else {
  568. FURI_LOG_W(NFC_WORKER_TAG, "Tag does not support Mifare Ultralight");
  569. }
  570. } else {
  571. FURI_LOG_W(NFC_WORKER_TAG, "Can't find any tags");
  572. }
  573. osDelay(100);
  574. }
  575. }
  576. void nfc_worker_emulate_mifare_ul(NfcWorker* nfc_worker) {
  577. ReturnCode err;
  578. uint8_t tx_buff[255] = {};
  579. uint16_t tx_len = 0;
  580. uint8_t* rx_buff;
  581. uint16_t* rx_len;
  582. NfcDeviceData* data = nfc_worker->dev_data;
  583. MifareUlDevice mf_ul_emulate;
  584. // Setup emulation parameters from mifare ultralight data structure
  585. mf_ul_prepare_emulation(&mf_ul_emulate, &data->mf_ul_data);
  586. while(nfc_worker->state == NfcWorkerStateEmulateMifareUl) {
  587. if(furi_hal_nfc_listen(
  588. data->nfc_data.uid,
  589. data->nfc_data.uid_len,
  590. data->nfc_data.atqa,
  591. data->nfc_data.sak,
  592. true,
  593. 200)) {
  594. FURI_LOG_D(NFC_WORKER_TAG, "Anticollision passed");
  595. if(furi_hal_nfc_get_first_frame(&rx_buff, &rx_len)) {
  596. // Data exchange loop
  597. while(nfc_worker->state == NfcWorkerStateEmulateMifareUl) {
  598. tx_len = mf_ul_prepare_emulation_response(
  599. rx_buff, *rx_len, tx_buff, &mf_ul_emulate);
  600. if(tx_len > 0) {
  601. err =
  602. furi_hal_nfc_data_exchange(tx_buff, tx_len, &rx_buff, &rx_len, false);
  603. if(err == ERR_NONE) {
  604. continue;
  605. } else {
  606. FURI_LOG_E(NFC_WORKER_TAG, "Communication error: %d", err);
  607. break;
  608. }
  609. } else {
  610. FURI_LOG_W(NFC_WORKER_TAG, "Not valid command: %02X", rx_buff[0]);
  611. furi_hal_nfc_deactivate();
  612. break;
  613. }
  614. }
  615. } else {
  616. FURI_LOG_W(NFC_WORKER_TAG, "Error in 1st data exchange");
  617. furi_hal_nfc_deactivate();
  618. }
  619. }
  620. // Check if data was modified
  621. if(mf_ul_emulate.data_changed) {
  622. nfc_worker->dev_data->mf_ul_data = mf_ul_emulate.data;
  623. if(nfc_worker->callback) {
  624. nfc_worker->callback(nfc_worker->context);
  625. }
  626. }
  627. FURI_LOG_W(NFC_WORKER_TAG, "Can't find reader");
  628. osThreadYield();
  629. }
  630. }
  631. void nfc_worker_field(NfcWorker* nfc_worker) {
  632. furi_hal_nfc_field_on();
  633. while(nfc_worker->state == NfcWorkerStateField) {
  634. osDelay(50);
  635. }
  636. furi_hal_nfc_field_off();
  637. }