Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Workmem, CARD_FUNCTION, BRUTE, LOG and cleanup #171

Merged

Conversation

securechicken
Copy link
Collaborator

  • Implemented a "split memory" logic for all configurations. Each configuration can now have a "Card Memory" (the plain old memory) to store simulated cards memory, and a "Working Memory" to play with.
    • The card memory is limited to 1/8 of slot's memory (which is in turn 1/8 of all available external SPI flash memory), while working memory can take up to 7/8.
    • Implemented WORKMEM commands to read/display (WORKMEM? in hex string, WORKMEM in binary, WORKMEMDOWNLOAD for XModem download) and write (WORKMEMUPLOAD for XModem upload) the working memory.
    • This seemed necessary to stop apps messing with card memory, and mostly stuffing our code with memory overflows or hard-coded memory limits, as well as to enable application data load/store logics without compromising card simulations.
    • DETECTION and ULTRALIGHT have been ported to split memory, so they does not mess with other slot's memories or cards simulation.
  • Implemented a "CARD_FUNCTION" button function. When pushed, the button calls an application-coded function. This enables each application to embed a "button-based" logic.
  • Enabled back original RevE/RevG "ApplicationTick" logic, which allow applications to run a function every 100ms. This enables a timed processing that does not depends on codec send/receive events.
  • Implemented experimental "MF_CLASSIC_BRUTE" config, that is aimed at brute forcing 4b UIDs. It can be started/stopped with CARD_FUNCTION button, switches UID every 100ms by incrementing it, starts with set UID, and is stopped by default.
  • Implemented experimental "MF_CLASSIC_LOG" config, that is aimed at logging input/output Mifare Classic frames in Working memory. Can be started/stopped with CARD_FUNCTION button. The tick logic was absolutely necessary to keep any hope getting realistic perfs (they are still very poor, even with buffered data, as SPLI flash R/W is slow).
  • Cleaned here and there:
    • Fixed an Ultralight overflow
    • Fixed some Memory lib boundaries checks
    • Ensured that Makefile compilation flags are honoured, and factored Mifare classic related compilation flags (now that most of code is shared), so Ultralight and Classic can be compiled or not with just one flag set
    • MF_DETECTION has been renamed to MF_CLASSIC_DETECTION to get clear on what we do
    • MF_CLASSIC_BRUTE and LOG are still highly experimental and early stage, so disabled by default in Makefile
    • Cleaned AntennaLevel, as I needed it to experiment.

@iceman1001
Copy link
Owner

Very impressive!

I would prefer smaller PR's in order to test and easier to keep track of changes,
monster PR's is hard to test.

For future reference, the command names is getting longer, MIFARE_CLASSIC...
Maybe start use short like MFC_ , MFU, etc. The longer the names the less space in the GUI dropdowns.

Is this to be considered WIP or are you ready to merge?

@iceman1001 iceman1001 merged commit 40af5ba into iceman1001:master Nov 21, 2019
@securechicken
Copy link
Collaborator Author

@iceman1001 This was a lot of experimental work, and things are linked together, so having separate PRs would have been really difficult. I rebuilt the whole changes to keep the commits tidy though. On the config names, they are limited by a buffer size in FW, so we will not get any longer (and Ultralight are the longest :p). As regards readiness... I needed that for some tests on my side so... figured it could be nice to push it there as well to demonstrate some possible developments. It is ready, but do not expect much thunder from it though...

@securechicken securechicken deleted the workmem_funcbtn_brute_log_clean branch November 21, 2019 18:42
@iceman1001
Copy link
Owner

So much great effort, bro!
Who knows what happens.

@securechicken securechicken restored the workmem_funcbtn_brute_log_clean branch February 23, 2020 11:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants