flipperzero-firmware
flipperzero-firmware copied to clipboard
[NFC Magic] Add support for backdoor read commands for Gen 1A/1B tags
Description of the feature you're suggesting.
Overview:
Right now NFC Magic app supports next functionality for magic tags:
- Detection
- Writing
- Wiping
It would be nice to add also support of read backdoor command. For that case flow of reading could be simplified. Instead of trying to authenticate with user dictionary + standard dictionary, tag could be read fully with a backdoor command.
Usage steps:
- Check if tag is magic Gen 1A/1B (existing functionality)
- Select read (for implementation)
- If tag was read without problems (potential problems while reading should be an extra investigation points), user could have a possibility to save the dump (and next steps should be done using standard Flipper's NFC experience)
- [Optional]: As a follow up for step 3, found keys could be added into user's dictionary (automatically or with user confirmation, validation for key existence in dictionary should be done)
Tech details for read commands:
-
Gen 1A:
40(7)
,43
,30xx
+ crc -
Gen 1B:
40(7)
,30xx
+ crc (need validate should crc be present here)
Potential problems:
Now detection of Gen 1 tags is done, using 40(7)
command and concrete type (Gen1A/Gen1B) is not detected. For read it could be done via iteration through the read sequence for Gen1A, if didn't worked - for Gen1B. Which could ruin UX from the PoV of waiting time.
Implementation in existing products: It is implemented at least in next solutions:
- Proxmark3 -
cview
command - TMD-5S - it is used by default, if magic tag is detected
Anything else?
No response