Add support for Ultralight emulation.

CHANGELOG.md

@@ -30,6 +30,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Added support for timestamped comments in CLI via `rem`, `;`, `%` or `#` (@doegox)
  - Fixed watchdog trigger during `hw factory_reset` (@doegox)
  - Added PyInstaller support for CLI client (@augustozanellato)
+ - Added proper Mifare Ultralight (original, C, EV1) / NTAG (213, 215, 216) emulation (@turbocooler).
 
 ## [v2.0.0][2023-09-26]
  - Added `hw slot nick delete` and DELETE_SLOT_TAG_NICK (@doegox)

docs/protocol.md

@@ -388,6 +388,38 @@ Notes:
 * Command: no data
 * Response: no data or N bytes: `uidlen|uid[uidlen]|atqa[2]|sak|atslen|ats[atslen]`. UID, ATQA, SAK and ATS as bytes.
 * CLI: cf `hw slot list`/`hf mf econfig`/`hf mfu econfig`
+### 4019: MF0_NTAG_GET_UID_MAGIC_MODE
+* Command: no data
+* Response: 1 byte where a non-zero value indicates that UID magic mode is enabled for the current slot.
+* CLI: cf `hf mfu econfig`
+### 4020: MF0_NTAG_SET_UID_MAGIC_MODE
+* Command: 1 byte where a non-zero value indicates that UID magic mode should be enabled for the current slot, otherwise disabled.
+* Response: no data
+* CLI: cf `hf mfu econfig --enable-uid-magic`/`hf mfu econfig --disable-uid-magic`
+### 4021: MF0_NTAG_READ_EMU_PAGE_DATA
+* Command: 2 bytes: one for first page index, one for count of pages to be read.
+* Response: `4 * n` bytes where `n` is the number if pages to be read
+* CLI: cf `hf mfu eview`
+### 4022: MF0_NTAG_WRITE_EMU_PAGE_DATA
+* Command: 2 + `n * 4` bytes: one for first page index, one for count of pages to be read, `n * 4` for `n` pages data.
+* Response: no data
+* CLI: unused
+### 4023: MF0_NTAG_GET_VERSION_DATA
+* Command: no data
+* Response: 8 version data bytes.
+* CLI: cf `hf mfu econfig`
+### 4024: MF0_NTAG_SET_VERSION_DATA
+* Command: 8 version data bytes.
+* Response: no data
+* CLI: cf `hf mfu econfig --set-version <hex>`
+### 4025: MF0_NTAG_GET_SIGNATURE_DATA
+* Command: no data
+* Response: 32 signature data bytes.
+* CLI: cf `hf mfu econfig`
+### 4026: MF0_NTAG_SET_SIGNATURE_DATA
+* Command: 32 signature data bytes.
+* Response: no data
+* CLI: cf `hf mfu econfig --set-signature <hex>`
 ### 5000: EM410X_SET_EMU_ID
 * Command: 5 bytes. `id[5]`. ID as 5 bytes.
 * Response: no data

firmware/application/Makefile

@@ -28,7 +28,7 @@ SRC_FILES += \
   $(PROJ_DIR)/rfid/nfctag/hf/crypto1_helper.c \
   $(PROJ_DIR)/rfid/nfctag/hf/nfc_14a.c \
   $(PROJ_DIR)/rfid/nfctag/hf/nfc_mf1.c \
-  $(PROJ_DIR)/rfid/nfctag/hf/nfc_ntag.c \
+  $(PROJ_DIR)/rfid/nfctag/hf/nfc_mf0_ntag.c \
   $(PROJ_DIR)/rfid/nfctag/lf/lf_tag_em.c \
   $(PROJ_DIR)/utils/dataframe.c \
   $(PROJ_DIR)/utils/delayed_reset.c \

firmware/application/src/app_cmd.c

@@ -790,6 +790,99 @@ static data_frame_tx_t *cmd_processor_mf1_read_emu_block_data(uint16_t cmd, uint
     return data_frame_make(cmd, STATUS_SUCCESS, result_length, result_buffer);
 }
 
+static data_frame_tx_t *cmd_processor_mf0_ntag_write_emu_page_data(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    uint8_t active_slot = tag_emulation_get_slot();
+
+    tag_slot_specific_type_t active_slot_tag_types;
+    tag_emulation_get_specific_types_by_slot(active_slot, &active_slot_tag_types);
+
+    int nr_pages = nfc_tag_mf0_ntag_get_nr_pages_by_tag_type(active_slot_tag_types.tag_hf);
+    // This means wrong slot type.
+    if (nr_pages <= 0) return data_frame_make(cmd, STATUS_INVALID_SLOT_TYPE, 0, data);
+
+    if (length < 2) return data_frame_make(cmd, STATUS_INVALID_PARAMS, 1, &nr_pages);
+
+    int page_index = data[0];
+    int pages_count = data[1];
+    int byte_length = (int)nr_pages * NFC_TAG_MF0_NTAG_DATA_SIZE;
+
+    if (pages_count == 0) return data_frame_make(cmd, STATUS_SUCCESS, 0, NULL);
+    else if (
+        (page_index >= ((int)nr_pages)) 
+        || (pages_count > (((int)nr_pages) - page_index)) 
+        || (((int)length - 2) < byte_length)
+    ) {
+        return data_frame_make(cmd, STATUS_INVALID_PARAMS, 1, &nr_pages);
+    }
+
+    tag_data_buffer_t *buffer = get_buffer_by_tag_type(active_slot_tag_types.tag_hf);
+    nfc_tag_mf0_ntag_information_t *info = (nfc_tag_mf0_ntag_information_t *)buffer->buffer;
+
+    memcpy(&info->memory[page_index][0], &data[2], byte_length);
+
+    return data_frame_make(cmd, STATUS_SUCCESS, 0, NULL);
+}
+
+static data_frame_tx_t *cmd_processor_mf0_ntag_read_emu_page_data(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    uint8_t active_slot = tag_emulation_get_slot();
+
+    tag_slot_specific_type_t active_slot_tag_types;
+    tag_emulation_get_specific_types_by_slot(active_slot, &active_slot_tag_types);
+
+    int nr_pages = nfc_tag_mf0_ntag_get_nr_pages_by_tag_type(active_slot_tag_types.tag_hf);
+    // This means wrong slot type.
+    if (nr_pages <= 0) return data_frame_make(cmd, STATUS_INVALID_SLOT_TYPE, 0, data);
+
+    if (length < 2) return data_frame_make(cmd, STATUS_INVALID_PARAMS, 1, &nr_pages);
+
+    int page_index = data[0];
+    int pages_count = data[1];
+
+    if (pages_count == 0) return data_frame_make(cmd, STATUS_SUCCESS, 0, NULL);
+    else if ((page_index >= ((int)nr_pages)) || (pages_count > (((int)nr_pages) - page_index))) {
+        return data_frame_make(cmd, STATUS_INVALID_PARAMS, 1, &nr_pages);
+    }
+
+    tag_data_buffer_t *buffer = get_buffer_by_tag_type(active_slot_tag_types.tag_hf);
+    nfc_tag_mf0_ntag_information_t *info = (nfc_tag_mf0_ntag_information_t *)buffer->buffer;
+
+    return data_frame_make(cmd, STATUS_SUCCESS, pages_count * NFC_TAG_MF0_NTAG_DATA_SIZE, &info->memory[page_index][0]);
+}
+
+static data_frame_tx_t *cmd_processor_mf0_ntag_get_version_data(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    uint8_t *version_data = nfc_tag_mf0_ntag_get_version_data();
+    if (version_data == NULL) return data_frame_make(cmd, STATUS_INVALID_SLOT_TYPE, 0, NULL);
+
+    return data_frame_make(cmd, STATUS_SUCCESS, NFC_TAG_MF0_NTAG_VER_SIZE, version_data);
+}
+
+static data_frame_tx_t *cmd_processor_mf0_ntag_set_version_data(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    if (length != 8) return data_frame_make(cmd, STATUS_INVALID_PARAMS, 0, NULL);
+
+    uint8_t *version_data = nfc_tag_mf0_ntag_get_version_data();
+    if (version_data == NULL) return data_frame_make(cmd, STATUS_INVALID_SLOT_TYPE, 0, NULL);
+    memcpy(version_data, data, NFC_TAG_MF0_NTAG_VER_SIZE);
+
+    return data_frame_make(cmd, STATUS_SUCCESS, 0, NULL);
+}
+
+static data_frame_tx_t *cmd_processor_mf0_ntag_get_signature_data(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    uint8_t *signature_data = nfc_tag_mf0_ntag_get_signature_data();
+    if (signature_data == NULL) return data_frame_make(cmd, STATUS_INVALID_SLOT_TYPE, 0, NULL);
+
+    return data_frame_make(cmd, STATUS_SUCCESS, NFC_TAG_MF0_NTAG_SIG_SIZE, signature_data);
+}
+
+static data_frame_tx_t *cmd_processor_mf0_ntag_set_signature_data(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    if (length != NFC_TAG_MF0_NTAG_SIG_SIZE) return data_frame_make(cmd, STATUS_INVALID_PARAMS, 0, NULL);
+
+    uint8_t *signature_data = nfc_tag_mf0_ntag_get_signature_data();
+    if (signature_data == NULL) return data_frame_make(cmd, STATUS_INVALID_SLOT_TYPE, 0, NULL);
+    memcpy(signature_data, data, NFC_TAG_MF0_NTAG_SIG_SIZE);
+
+    return data_frame_make(cmd, STATUS_SUCCESS, 0, NULL);
+}
+
 static data_frame_tx_t *cmd_processor_hf14a_set_anti_coll_data(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
     // uidlen[1]|uid[uidlen]|atqa[2]|sak[1]|atslen[1]|ats[atslen]
     // dynamic length, so no struct
@@ -1026,6 +1119,24 @@ static data_frame_tx_t *after_hf_reader_run(uint16_t cmd, uint16_t status, uint1
 // fct will be defined after m_data_cmd_map because we need to know its size
 data_frame_tx_t *cmd_processor_get_device_capabilities(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data);
 
+static data_frame_tx_t *cmd_processor_mf0_ntag_get_uid_mode(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    int rc = nfc_tag_mf0_ntag_get_uid_mode();
+
+    if (rc < 0) return data_frame_make(cmd, STATUS_PAR_ERR, 0, NULL);
+    else {
+        uint8_t res = rc;
+        return data_frame_make(cmd, STATUS_SUCCESS, 1, &res);
+    }
+}
+
+static data_frame_tx_t *cmd_processor_mf0_ntag_set_uid_mode(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    if (length != 1 || !nfc_tag_mf0_ntag_set_uid_mode(data[0] != 0)) {
+        return data_frame_make(cmd, STATUS_PAR_ERR, 0, NULL);
+    }
+
+    return data_frame_make(cmd, STATUS_SUCCESS, 0, NULL);
+}
+
 /**
  * (cmd -> processor) function map, the map struct is:
  *       cmd code                               before process               cmd processor                                after process
@@ -1109,6 +1220,14 @@ static cmd_data_map_t m_data_cmd_map[] = {
     {    DATA_CMD_MF1_GET_WRITE_MODE,           NULL,                        cmd_processor_mf1_get_write_mode,            NULL                   },
     {    DATA_CMD_MF1_SET_WRITE_MODE,           NULL,                        cmd_processor_mf1_set_write_mode,            NULL                   },
     {    DATA_CMD_HF14A_GET_ANTI_COLL_DATA,     NULL,                        cmd_processor_hf14a_get_anti_coll_data,      NULL                   },
+    {    DATA_CMD_MF0_NTAG_GET_UID_MAGIC_MODE,  NULL,                        cmd_processor_mf0_ntag_get_uid_mode,         NULL                   },
+    {    DATA_CMD_MF0_NTAG_SET_UID_MAGIC_MODE,  NULL,                        cmd_processor_mf0_ntag_set_uid_mode,         NULL                   },
+    {    DATA_CMD_MF0_NTAG_READ_EMU_PAGE_DATA,  NULL,                        cmd_processor_mf0_ntag_read_emu_page_data,   NULL                   },
+    {    DATA_CMD_MF0_NTAG_WRITE_EMU_PAGE_DATA, NULL,                        cmd_processor_mf0_ntag_write_emu_page_data,  NULL                   },
+    {    DATA_CMD_MF0_NTAG_GET_VERSION_DATA,    NULL,                        cmd_processor_mf0_ntag_get_version_data,     NULL                   },
+    {    DATA_CMD_MF0_NTAG_SET_VERSION_DATA,    NULL,                        cmd_processor_mf0_ntag_set_version_data,     NULL                   },
+    {    DATA_CMD_MF0_NTAG_GET_SIGNATURE_DATA,  NULL,                        cmd_processor_mf0_ntag_get_signature_data,   NULL                   },
+    {    DATA_CMD_MF0_NTAG_SET_SIGNATURE_DATA,  NULL,                        cmd_processor_mf0_ntag_set_signature_data,   NULL                   },
 
     {    DATA_CMD_EM410X_SET_EMU_ID,            NULL,                        cmd_processor_em410x_set_emu_id,             NULL                   },
     {    DATA_CMD_EM410X_GET_EMU_ID,            NULL,                        cmd_processor_em410x_get_emu_id,             NULL                   },

firmware/application/src/app_main.c

@@ -653,8 +653,12 @@ static void btn_fn_copy_ic_uid(void) {
 
         case TAG_TYPE_NTAG_213:
         case TAG_TYPE_NTAG_215:
-        case TAG_TYPE_NTAG_216: {
-            nfc_tag_ntag_information_t *p_info = (nfc_tag_ntag_information_t *)buffer->buffer;
+        case TAG_TYPE_NTAG_216:
+        case TAG_TYPE_MF0ICU1:
+        case TAG_TYPE_MF0ICU2:
+        case TAG_TYPE_MF0UL11:
+        case TAG_TYPE_MF0UL21: {
+            nfc_tag_mf0_ntag_information_t *p_info = (nfc_tag_mf0_ntag_information_t *)buffer->buffer;
             antres = &(p_info->res_coll);
             break;
         }

firmware/application/src/app_status.h

@@ -32,4 +32,6 @@
 #define     STATUS_NOT_IMPLEMENTED                  (0x69)  // Calling some unrealized operations, which belongs to the missed error of the developer
 #define     STATUS_FLASH_WRITE_FAIL                 (0x70)  // Flash writing failed
 #define     STATUS_FLASH_READ_FAIL                  (0x71)  // Flash read failed
+#define     STATUS_INVALID_SLOT_TYPE                (0x72)  // Invalid slot type
+#define     STATUS_INVALID_PARAMS                   (0x73)  // Invalid command parameters
 #endif

firmware/application/src/data_cmd.h

@@ -106,6 +106,14 @@
 #define DATA_CMD_MF1_GET_WRITE_MODE             (4016)
 #define DATA_CMD_MF1_SET_WRITE_MODE             (4017)
 #define DATA_CMD_HF14A_GET_ANTI_COLL_DATA       (4018)
+#define DATA_CMD_MF0_NTAG_GET_UID_MAGIC_MODE    (4019)
+#define DATA_CMD_MF0_NTAG_SET_UID_MAGIC_MODE    (4020)
+#define DATA_CMD_MF0_NTAG_READ_EMU_PAGE_DATA    (4021)
+#define DATA_CMD_MF0_NTAG_WRITE_EMU_PAGE_DATA   (4022)
+#define DATA_CMD_MF0_NTAG_GET_VERSION_DATA      (4023)
+#define DATA_CMD_MF0_NTAG_SET_VERSION_DATA      (4024)
+#define DATA_CMD_MF0_NTAG_GET_SIGNATURE_DATA    (4025)
+#define DATA_CMD_MF0_NTAG_SET_SIGNATURE_DATA    (4026)
 //
 // ******************************************************************
 

firmware/application/src/rfid/nfctag/hf/nfc_14a.c

@@ -295,6 +295,7 @@ uint8_t nfc_tag_14a_unwrap_frame(const uint8_t *pbtFrame, const size_t szFrameBi
  * @param[in]   appendCrc  Whether to send the byte flow, automatically send the CRC16 verification automatically
  */
 void nfc_tag_14a_tx_bytes(uint8_t *data, uint32_t bytes, bool appendCrc) {
+    ASSERT(bytes <= MAX_NFC_TX_BUFFER_SIZE);
     NFC_14A_TX_BYTE_CORE(data, bytes, appendCrc, NRF_NFCT_FRAME_DELAY_MODE_WINDOWGRID);
 }
 

firmware/application/src/rfid/nfctag/hf/nfc_14a.h

@@ -3,7 +3,7 @@
 
 #include "tag_emulation.h"
 
-#define MAX_NFC_RX_BUFFER_SIZE  64
+#define MAX_NFC_RX_BUFFER_SIZE  257
 #define MAX_NFC_TX_BUFFER_SIZE  64
 
 #define NFC_TAG_14A_CRC_LENGTH  2