Skip to content

Commit

Permalink
updates from unleashed
Browse files Browse the repository at this point in the history
  • Loading branch information
RogueMaster committed Sep 9, 2022
1 parent bc3919c commit bb69b56
Show file tree
Hide file tree
Showing 27 changed files with 995 additions and 242 deletions.
12 changes: 8 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,17 @@
- Added [NRFSniff : Adds unique count display #56 (By Graf3x)](https://github.com/Eng1n33r/flipperzero-firmware/pull/56/) & Thanks to [Unleashed/xMasterX](https://github.com/Eng1n33r/flipperzero-firmware)
- Assets: Includes New Dolphin Animations: [GITS (By Haseo)]
- Assets: Includes a NFC Level 50 Gan0n Amiibo (Instead of Link)
- Added [SubGhz Bruteforcer (By Ganapati)](https://github.com/Ganapati/flipperzero-firmware)
- Added [Sub-GHz Bruteforcer (By Ganapati)](https://github.com/Ganapati/flipperzero-firmware)
- Added [SubGhz: fix decoder kelooq #1719 (By Skorpionm)](https://github.com/flipperdevices/flipperzero-firmware/pull/1719)
- OFW: [Furi: wait for timer wind down in destructor #1716 (By skotopes)](https://github.com/flipperdevices/flipperzero-firmware/pull/1716)
- OFW: [SubGhz: handle missing key in cryptostore. Lib: lower default display contrast. #1717 (By skotopes)](https://github.com/flipperdevices/flipperzero-firmware/pull/1717)
- OFW: [SubGhz: fix decoder kelooq #1719 (By Skorpionm)](https://github.com/flipperdevices/flipperzero-firmware/pull/1719)
- OFW: [RFID app port to plain C #1710 (By nminaylov)](https://github.com/flipperdevices/flipperzero-firmware/pull/1710)
- GUI Changes to LFRFID Fuzzer - Thanks to [Unleashed/xMasterX](https://github.com/Eng1n33r/flipperzero-firmware)
- Updated SubGhz Bruteforce plugin (by @Ganapati & @xMasterX) (PR [#57](https://github.com/Eng1n33r/flipperzero-firmware/pull/57)) - saving functionality and many fixes by @xMasterX
- Fix GUI and add new icon in LF-RFID App(icon by @Svaarich) - Thanks to [Unleashed/xMasterX](https://github.com/Eng1n33r/flipperzero-firmware)
- Fix picopass plugin (revert OFW PR 1701) - Thanks to [Unleashed/xMasterX](https://github.com/Eng1n33r/flipperzero-firmware)
- Updated universal remote assets (by @amec0e) & Thanks to [Unleashed/xMasterX](https://github.com/Eng1n33r/flipperzero-firmware)

<table width="100%" border="0" cellspacing="0">
<tr> <td colspan=2> <h3>This software is for experimental purposes only and is not meant for any illegal activity/purposes. We do not condone illegal activity and strongly encourage keeping transmissions to legal/valid uses allowed by law.</h3> </td> </tr>
Expand Down Expand Up @@ -153,7 +158,6 @@ $ ./fbt plugin_dist FIRMWARE_APP_SET=ext_apps
- [Fix displaying LFRFID protocol names #1682 (By Astrrra)](https://github.com/flipperdevices/flipperzero-firmware/pull/1682)
- [Add new card parsers #1503 (By Astrrra)](https://github.com/flipperdevices/flipperzero-firmware/pull/1503)
- [Fix Mifare Classic 4K reading of the last 8 sectors #1712 (By Astrrra)](https://github.com/flipperdevices/flipperzero-firmware/pull/1712)
- [Picopass: detect and show SE / SIO #1701 (By pcunning)](https://github.com/flipperdevices/flipperzero-firmware/pull/1701)
- [SubGhz: fix decoder kelooq #1719 (By Skorpionm)](https://github.com/flipperdevices/flipperzero-firmware/pull/1719)

</details>
Expand Down Expand Up @@ -202,11 +206,11 @@ $ ./fbt plugin_dist FIRMWARE_APP_SET=ext_apps
- [NRF Sniff (By mothball187)](https://github.com/mothball187/flipperzero-nrf24/tree/main/nrfsniff) ([Pin Out](https://github.com/RogueMaster/flipperzero-firmware-wPlugins/tree/420/applications/nrfsniff) from nocomp/Frog/UberGuidoZ) `Req: NRF24`
- [Paint (By n-o-T-I-n-s-a-n-e)](https://github.com/n-o-T-I-n-s-a-n-e)
- [PicoPass Reader (By Bettse)](https://github.com/flipperdevices/flipperzero-firmware/pull/1366)
- [RFID Fuzzer (By Ganapati)](https://github.com/RogueMaster/flipperzero-firmware-wPlugins/pull/245)
- [RFID Fuzzer (By Ganapati)](https://github.com/RogueMaster/flipperzero-firmware-wPlugins/pull/245) [Changes by Unleashed/xMasterX](https://github.com/Eng1n33r/flipperzero-firmware)
- [RF Remix (By ESurge)](https://github.com/ESurge/flipperzero-firmware-unirfremix) [(Original By jimilinuxguy)](https://github.com/jimilinuxguy/flipperzero-universal-rf-remote/tree/028d615c83f059bb2c905530ddb3d4efbd3cbcae/applications/jukebox) [(More protocols thanks to darmiel & xMasterX)](https://github.com/darmiel/flipper-playlist/blob/feat/unirf-protocols/applications/unirfremix/unirfremix_app.c)
- [Sentry Safe (By H4ckd4ddy)](https://github.com/H4ckd4ddy/flipperzero-sentry-safe-plugin) ([Pin Out](https://github.com/RogueMaster/flipperzero-firmware-wPlugins/tree/420/applications/sentry_safe) from [UberGuidoZ](https://github.com/UberGuidoZ/))
- [Spectrum Analyzer (By jolcese)](https://github.com/jolcese/flipperzero-firmware/tree/spectrum/applications/spectrum_analyzer) [Updates (for testing) Thanks to theY4Kman](https://github.com/theY4Kman/flipperzero-firmware)
- [SubGhz Bruteforcer (By Ganapati)](https://github.com/ganapati/)
- [Sub-GHz Bruteforcer (By Ganapati & xMasterX)](https://github.com/Eng1n33r/flipperzero-firmware/pull/57)
- [WAV Player (By Zlo)](https://github.com/flipperdevices/flipperzero-firmware/tree/zlo/wav-player) Updated by Atmanos & RogueMaster To Work
- [WiFi (Deauther) (By Timmotools)](https://github.com/Timmotools/flipperzero_esp8266_deautherv2) (Inspired by WiFi (Marauder) [(By 0xchocolate)](https://github.com/0xchocolate/flipperzero-firmware-with-wifi-marauder-companion) and DSTIKE Deauther [(By SequoiaSan)](https://github.com/SequoiaSan/FlipperZero-Wifi-ESP8266-Deauther-Module/tree/FlipperZero-Module-v2/FlipperZeroModule/FlipperZero-ESP8266-Deauth-App)) `Req: ESP8266`
- [WiFi (Marauder) (By 0xchocolate)](https://github.com/0xchocolate/flipperzero-firmware-with-wifi-marauder-companion) `REQUIRES ESP32 WITH MARAUDER FLASHED`
Expand Down
12 changes: 7 additions & 5 deletions applications/flipfrid/scene/flipfrid_scene_run_attack.c
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#include "flipfrid_scene_run_attack.h"
#include <gui/elements.h>

uint8_t counter = 0;
#define TIME_BETWEEN_CARDS 5
Expand Down Expand Up @@ -182,7 +183,7 @@ void flipfrid_scene_run_attack_on_draw(Canvas* canvas, FlipFridState* context) {
canvas_set_color(canvas, ColorBlack);

// Frame
canvas_draw_frame(canvas, 0, 0, 128, 64);
//canvas_draw_frame(canvas, 0, 0, 128, 64);

// Title
canvas_set_font(canvas, FontPrimary);
Expand All @@ -202,11 +203,12 @@ void flipfrid_scene_run_attack_on_draw(Canvas* canvas, FlipFridState* context) {
canvas_draw_str_aligned(canvas, 64, 24, AlignCenter, AlignTop, uid);

canvas_set_font(canvas, FontSecondary);
char start_stop_msg[20];
//char start_stop_msg[20];
if(context->is_attacking) {
snprintf(start_stop_msg, sizeof(start_stop_msg), " Press OK to stop ");
elements_button_center(canvas, "Stop");
//snprintf(start_stop_msg, sizeof(start_stop_msg), " Press OK to stop ");
} else {
snprintf(start_stop_msg, sizeof(start_stop_msg), " Press OK to start ");
elements_button_center(canvas, "Start");
}
canvas_draw_str_aligned(canvas, 64, 44, AlignCenter, AlignTop, start_stop_msg);
//canvas_draw_str_aligned(canvas, 64, 44, AlignCenter, AlignTop, start_stop_msg);
}
2 changes: 1 addition & 1 deletion applications/flipfrid/scene/flipfrid_scene_select_field.c
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ void flipfrid_scene_select_field_on_draw(Canvas* canvas, FlipFridState* context)
canvas_set_color(canvas, ColorBlack);

// Frame
canvas_draw_frame(canvas, 0, 0, 128, 64);
//canvas_draw_frame(canvas, 0, 0, 128, 64);

// Title
canvas_set_font(canvas, FontPrimary);
Expand Down
10 changes: 6 additions & 4 deletions applications/lfrfid/scenes/lfrfid_scene_read_success.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,18 +17,18 @@ void lfrfid_scene_read_success_on_enter(void* context) {
protocol_dict_get_manufacturer(app->dict, app->protocol_id));

widget_add_string_element(
widget, 0, 2, AlignLeft, AlignTop, FontPrimary, string_get_cstr(tmp_string));
widget, 16, 3, AlignLeft, AlignTop, FontPrimary, string_get_cstr(tmp_string));

string_reset(tmp_string);
size_t size = protocol_dict_get_data_size(app->dict, app->protocol_id);
uint8_t* data = (uint8_t*)malloc(size);
protocol_dict_get_data(app->dict, app->protocol_id, data, size);
for(uint8_t i = 0; i < size; i++) {
if(i != 0) {
string_cat_printf(tmp_string, " ");
string_cat_printf(tmp_string, ":");
}

if(i >= 9) {
if(i >= 8) {
string_cat_printf(tmp_string, "...");
break;
} else {
Expand All @@ -43,9 +43,11 @@ void lfrfid_scene_read_success_on_enter(void* context) {
string_cat_printf(tmp_string, "\r\n%s", string_get_cstr(render_data));
string_clear(render_data);

widget_add_string_element(
widget_add_string_multiline_element(
widget, 0, 16, AlignLeft, AlignTop, FontSecondary, string_get_cstr(tmp_string));

widget_add_icon_element(app->widget, 0, 0, &I_RFIDSmallChip_14x14);

notification_message_block(app->notifications, &sequence_set_green_255);

view_dispatcher_switch_to_view(app->view_dispatcher, LfRfidViewWidget);
Expand Down
7 changes: 4 additions & 3 deletions applications/lfrfid/scenes/lfrfid_scene_save_type.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,10 @@ void lfrfid_scene_save_type_on_enter(void* context) {

SaveTypeCtx* state = malloc(sizeof(SaveTypeCtx));
for(uint8_t i = 0; i < LFRFIDProtocolMax; i++) {
if(strcmp(
protocol_dict_get_manufacturer(app->dict, i),
protocol_dict_get_name(app->dict, i)) != 0) {
if((strcmp(
protocol_dict_get_manufacturer(app->dict, i),
protocol_dict_get_name(app->dict, i)) != 0) &&
(strcmp(protocol_dict_get_manufacturer(app->dict, i), "N/A") != 0)) {
string_init_printf(
state->menu_item_name[i],
"%s %s",
Expand Down
2 changes: 1 addition & 1 deletion applications/lfrfid/scenes/lfrfid_scene_saved_info.c
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ void lfrfid_scene_saved_info_on_enter(void* context) {
protocol_dict_get_data(app->dict, app->protocol_id, data, size);
for(uint8_t i = 0; i < size; i++) {
if(i != 0) {
string_cat_printf(tmp_string, " ");
string_cat_printf(tmp_string, ":");
}

string_cat_printf(tmp_string, "%02X", data[i]);
Expand Down
6 changes: 4 additions & 2 deletions applications/picopass/picopass_device.c
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,10 @@ ReturnCode picopass_device_decrypt(uint8_t* enc_data, uint8_t* dec_data) {
ReturnCode picopass_device_parse_credential(PicopassBlock* AA1, PicopassPacs* pacs) {
ReturnCode err;

// Thank you proxmark!
pacs->legacy = (memcmp(AA1[5].data, "\xff\xff\xff\xff\xff\xff\xff\xff", 8) == 0);
pacs->se_enabled = (memcmp(AA1[5].data, "\xff\xff\xff\x00\x06\xff\xff\xff", 8) == 0);

pacs->biometrics = AA1[6].data[4];
pacs->pin_length = AA1[6].data[6] & 0x0F;
pacs->encryption = AA1[6].data[7];
Expand Down Expand Up @@ -344,8 +348,6 @@ ReturnCode picopass_device_parse_credential(PicopassBlock* AA1, PicopassPacs* pa
FURI_LOG_D(TAG, "Unknown encryption");
}

pacs->sio = (AA1[10].data[0] == 0x30); // rough check

return ERR_NONE;
}

Expand Down
1 change: 0 additions & 1 deletion applications/picopass/picopass_device.h
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ typedef struct {
typedef struct {
bool legacy;
bool se_enabled;
bool sio;
bool biometrics;
uint8_t pin_length;
PicopassEncryption encryption;
Expand Down
104 changes: 17 additions & 87 deletions applications/picopass/picopass_worker.c
Original file line number Diff line number Diff line change
Expand Up @@ -105,20 +105,25 @@ ReturnCode picopass_detect_card(int timeout) {

err = rfalPicoPassPollerCheckPresence();
if(err != ERR_RF_COLLISION) {
// FURI_LOG_E(TAG, "rfalPicoPassPollerCheckPresence error %d", err);
//FURI_LOG_E(TAG, "rfalPicoPassPollerCheckPresence error %d", err);
return err;
}

return ERR_NONE;
}

ReturnCode picopass_read_preauth(PicopassBlock* AA1) {
ReturnCode picopass_read_card(PicopassBlock* AA1) {
rfalPicoPassIdentifyRes idRes;
rfalPicoPassSelectRes selRes;
rfalPicoPassReadCheckRes rcRes;
rfalPicoPassCheckRes chkRes;

ReturnCode err;

uint8_t div_key[8] = {0};
uint8_t mac[4] = {0};
uint8_t ccnr[12] = {0};

err = rfalPicoPassPollerIdentify(&idRes);
if(err != ERR_NONE) {
FURI_LOG_E(TAG, "rfalPicoPassPollerIdentify error %d", err);
Expand All @@ -131,76 +136,14 @@ ReturnCode picopass_read_preauth(PicopassBlock* AA1) {
return err;
}

err = rfalPicoPassPollerReadCheck(&rcRes);
if(err != ERR_NONE) {
FURI_LOG_E(TAG, "rfalPicoPassPollerReadCheck error %d", err);
return err;
}

memcpy(AA1[PICOPASS_CSN_BLOCK_INDEX].data, selRes.CSN, sizeof(selRes.CSN));
FURI_LOG_D(
TAG,
"csn %02x%02x%02x%02x%02x%02x%02x%02x",
AA1[PICOPASS_CSN_BLOCK_INDEX].data[0],
AA1[PICOPASS_CSN_BLOCK_INDEX].data[1],
AA1[PICOPASS_CSN_BLOCK_INDEX].data[2],
AA1[PICOPASS_CSN_BLOCK_INDEX].data[3],
AA1[PICOPASS_CSN_BLOCK_INDEX].data[4],
AA1[PICOPASS_CSN_BLOCK_INDEX].data[5],
AA1[PICOPASS_CSN_BLOCK_INDEX].data[6],
AA1[PICOPASS_CSN_BLOCK_INDEX].data[7]);

rfalPicoPassReadBlockRes cfg;
err = rfalPicoPassPollerReadBlock(PICOPASS_CONFIG_BLOCK_INDEX, &cfg);
memcpy(AA1[PICOPASS_CONFIG_BLOCK_INDEX].data, cfg.data, sizeof(cfg.data));
FURI_LOG_D(
TAG,
"config %02x%02x%02x%02x%02x%02x%02x%02x",
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[0],
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[1],
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[2],
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[3],
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[4],
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[5],
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[6],
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[7]);

rfalPicoPassReadBlockRes aia;
err = rfalPicoPassPollerReadBlock(PICOPASS_AIA_BLOCK_INDEX, &aia);
memcpy(AA1[PICOPASS_AIA_BLOCK_INDEX].data, aia.data, sizeof(aia.data));
FURI_LOG_D(
TAG,
"aia %02x%02x%02x%02x%02x%02x%02x%02x",
AA1[PICOPASS_AIA_BLOCK_INDEX].data[0],
AA1[PICOPASS_AIA_BLOCK_INDEX].data[1],
AA1[PICOPASS_AIA_BLOCK_INDEX].data[2],
AA1[PICOPASS_AIA_BLOCK_INDEX].data[3],
AA1[PICOPASS_AIA_BLOCK_INDEX].data[4],
AA1[PICOPASS_AIA_BLOCK_INDEX].data[5],
AA1[PICOPASS_AIA_BLOCK_INDEX].data[6],
AA1[PICOPASS_AIA_BLOCK_INDEX].data[7]);

return ERR_NONE;
}

ReturnCode picopass_read_card(PicopassBlock* AA1) {
rfalPicoPassReadCheckRes rcRes;
rfalPicoPassCheckRes chkRes;

ReturnCode err;

uint8_t div_key[8] = {0};
uint8_t mac[4] = {0};
uint8_t ccnr[12] = {0};

err = rfalPicoPassPollerReadCheck(&rcRes);
if(err != ERR_NONE) {
FURI_LOG_E(TAG, "rfalPicoPassPollerReadCheck error %d", err);
return err;
}
memcpy(ccnr, rcRes.CCNR, sizeof(rcRes.CCNR)); // last 4 bytes left 0

loclass_diversifyKey(AA1[PICOPASS_CSN_BLOCK_INDEX].data, picopass_iclass_key, div_key);
loclass_diversifyKey(selRes.CSN, picopass_iclass_key, div_key);
loclass_opt_doReaderMAC(ccnr, div_key, mac);

err = rfalPicoPassPollerCheck(mac, &chkRes);
Expand All @@ -209,9 +152,15 @@ ReturnCode picopass_read_card(PicopassBlock* AA1) {
return err;
}

size_t app_limit = AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[0] < PICOPASS_MAX_APP_LIMIT ?
AA1[PICOPASS_CONFIG_BLOCK_INDEX].data[0] :
PICOPASS_MAX_APP_LIMIT;
rfalPicoPassReadBlockRes csn;
err = rfalPicoPassPollerReadBlock(PICOPASS_CSN_BLOCK_INDEX, &csn);
memcpy(AA1[PICOPASS_CSN_BLOCK_INDEX].data, csn.data, sizeof(csn.data));

rfalPicoPassReadBlockRes cfg;
err = rfalPicoPassPollerReadBlock(PICOPASS_CONFIG_BLOCK_INDEX, &cfg);
memcpy(AA1[PICOPASS_CONFIG_BLOCK_INDEX].data, cfg.data, sizeof(cfg.data));

size_t app_limit = cfg.data[0] < PICOPASS_MAX_APP_LIMIT ? cfg.data[0] : PICOPASS_MAX_APP_LIMIT;

for(size_t i = 2; i < app_limit; i++) {
FURI_LOG_D(TAG, "rfalPicoPassPollerReadBlock block %d", i);
Expand Down Expand Up @@ -338,30 +287,11 @@ void picopass_worker_detect(PicopassWorker* picopass_worker) {
PicopassPacs* pacs = &dev_data->pacs;
ReturnCode err;

// reset device data
for(size_t i = 0; i < PICOPASS_MAX_APP_LIMIT; i++) {
memset(AA1[i].data, 0, sizeof(AA1[i].data));
}
memset(pacs, 0, sizeof(PicopassPacs));

PicopassWorkerEvent nextState = PicopassWorkerEventSuccess;

while(picopass_worker->state == PicopassWorkerStateDetect) {
if(picopass_detect_card(1000) == ERR_NONE) {
// Process first found device
err = picopass_read_preauth(AA1);
if(err != ERR_NONE) {
FURI_LOG_E(TAG, "picopass_read_preauth error %d", err);
nextState = PicopassWorkerEventFail;
}

// Thank you proxmark!
pacs->legacy = (memcmp(AA1[5].data, "\xff\xff\xff\xff\xff\xff\xff\xff", 8) == 0);
pacs->se_enabled = (memcmp(AA1[5].data, "\xff\xff\xff\x00\x06\xff\xff\xff", 8) == 0);
if(pacs->se_enabled) {
FURI_LOG_D(TAG, "SE enabled");
}

err = picopass_read_card(AA1);
if(err != ERR_NONE) {
FURI_LOG_E(TAG, "picopass_read_card error %d", err);
Expand Down
1 change: 0 additions & 1 deletion applications/picopass/picopass_worker.h
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@ typedef enum {
PicopassWorkerEventSuccess,
PicopassWorkerEventFail,
PicopassWorkerEventNoCardDetected,
PicopassWorkerEventSeEnabled,

PicopassWorkerEventStartReading,
} PicopassWorkerEvent;
Expand Down
Loading

0 comments on commit bb69b56

Please sign in to comment.