Fix NTAG INCR_CNT command byte order.

RfidResearchGroup · Jul 2, 2024 · a283795 · a283795
1 parent 1c14fc0
commit a283795
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/firmware/application/src/rfid/nfctag/hf/nfc_mf0_ntag.c b/firmware/application/src/rfid/nfctag/hf/nfc_mf0_ntag.c
@@ -733,15 +733,15 @@ static void handle_incr_cnt_command(uint8_t block_num, uint8_t *p_data) {
     }
 
     uint8_t *cnt_data = m_tag_information->memory[ctr_page_off + block_num];
-    uint32_t incr_value = ((uint32_t)p_data[0]) | ((uint32_t)p_data[1] << 8) | ((uint32_t)p_data[2] << 16);
-    uint32_t cnt = ((uint32_t)cnt_data[0]) | ((uint32_t)cnt_data[1] << 8) | ((uint32_t)cnt_data[2] << 16);
+    uint32_t incr_value = ((uint32_t)p_data[0] << 16) | ((uint32_t)p_data[1] << 8) | ((uint32_t)p_data[2]);
+    uint32_t cnt = ((uint32_t)cnt_data[0] << 16) | ((uint32_t)cnt_data[1] << 8) | ((uint32_t)cnt_data[2]);
 
     if ((0xFFFFFF - cnt) < incr_value) cnt = 0xFFFFFF;
     else cnt += incr_value;
 
-    cnt_data[0] = (uint8_t)(cnt & 0xff);
+    cnt_data[0] = (uint8_t)(cnt >> 16);
     cnt_data[1] = (uint8_t)(cnt >> 8);
-    cnt_data[2] = (uint8_t)(cnt >> 16);
+    cnt_data[2] = (uint8_t)(cnt & 0xff);
 
     nfc_tag_14a_tx_nbit(ACK_VALUE, 4);
 }