Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mifare DESFire tag emulation support #287

Merged
merged 10 commits into from
Oct 19, 2020
Prev Previous commit
Next Next commit
Including a sample DESFire tag dump and the command outputs that were…
… used to create the tag data
  • Loading branch information
maxieds committed Oct 17, 2020
commit d1b850869d8cdb171518ea37eb45200569ee7249
28 changes: 26 additions & 2 deletions Doc/DESFireSupportReadme.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,34 @@ Support for DESFire tag emulation on the Chameleon Mini is complicated for at le
The firmware has been tested and known to work with the KAOS manufactured RevG Chameleon devices.
Unfortunately, formative RevE device support is not available due to the memory requirements to
run this firmware emulation. The device responds well using the ``libnfc``-based utility
``nfc-anticol``. More testing needs to be done to fine tune support for interfacing the Chameleon
``nfc-anticol``:
```bash
NFC reader: SCM Micro / SCL3711-NFC&RW opened

Sent bits: 26 (7 bits)
Received bits: 03 44
Sent bits: 93 20
Received bits: 88 23 77 00 dc
Sent bits: 93 70 88 23 77 00 dc 4b b3
Received bits: 04
Sent bits: 95 20
Received bits: 0b 99 bf 98 b5
Sent bits: 95 70 0b 99 bf 98 b5 2f 24
Received bits: 20
Sent bits: e0 50 bc a5
Received bits: 75 77 81 02 80
Sent bits: 50 00 57 cd

Found tag with
UID: 2377000b99bf98
ATQA: 4403
SAK: 20
ATS: 75 77 81 02 80
```
More testing needs to be done to fine tune support for interfacing the Chameleon
with live, in-the-wild DESFire tag readers in practice. It has been verified to work with the
Proxmark3 NFC devices:
```
```bash
[usb] pm3 --> hf 14a read
[+] UID: 4A D9 BA 11 B9 97 57
[+] ATQA: 44 03
Expand Down
72 changes: 72 additions & 0 deletions Dumps/DESFire_example.contents
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
>>> Select Application By AID:
-> 90 5a 00 00 03 00 00 00 | 00
<- 91 00

>>> Start AES Authenticate:
-> 90 aa 00 00 01 00 00
<- 35 a1 bf c7 9b e3 3b 29 | 35 9b 37 57 ed 35 88 b9 | 91 af
-- RNDA = f4 2d 68 bf bb 3e 87 12
-- RNDB = 0d 3e 90 75 5c 6d d5 22
-- CHAL = f4 2d 68 bf bb 3e 87 12 | 22 0d 3e 90 75 5c 6d d5
-> 90 af 00 00 10 72 15 a8 | 83 46 4c 69 f9 50 c4 7b | a8 e7 30 a7 68 00
<- 0d b4 4f 21 52 89 bc 84 | 25 3b ef bc 54 15 90 11 | 91 00
... AUTH OK! :)

>>> CreateApplication command:
-> 90 ca 00 00 05 01 00 34 | 0f 03 00
<- 91 00
>>> Select Application By AID:
-> 90 5a 00 00 03 01 00 34 | 00
<- 91 00

>>> Start AES Authenticate:
-> 90 aa 00 00 01 00 00
<- b0 82 2a 30 c2 b6 1f d0 | f9 68 33 c9 4b 26 24 20 | 91 af
-- RNDA = c3 70 32 58 4c 06 ef f2
-- RNDB = 2e 7d 6c 67 ae 32 cc f7
-- CHAL = c3 70 32 58 4c 06 ef f2 | f7 2e 7d 6c 67 ae 32 cc
-> 90 af 00 00 10 68 49 4a | c5 1d 75 02 f2 79 23 18 | b8 15 18 21 32 00
<- 6a 61 d5 7e 97 09 35 89 | 7d 10 87 d3 04 8e 20 47 | 91 00
... AUTH OK! :)

>>> CreateStdDataFile command:
-> 90 cd 00 00 07 00 00 0f | 00 04 00 00 00
<- 91 00

>>> CreateBackupDataFile command:
-> 90 cb 00 00 07 01 00 0f | 00 08 00 00 00
<- 91 00

>>> CreateValueFile command:
-> 90 cc 00 00 11 02 00 0f | 00 00 00 00 00 00 01 00 | 00 80 00 00 00 01 00
<- 91 00

>>> CreateLinearRecordFile command:
-> 90 c1 00 00 0a 03 00 0f | 00 04 00 00 0c 00 00 00
<- 91 00

>>> CreateCyclicRecordFile command:
-> 90 c0 00 00 0a 04 00 0f | 00 01 00 00 05 00 00 00
<- 91 00

>>> GetFileIds command:
-> 90 6f 00 00 00 00
<- 00 01 02 03 04 91 00
>>> DeleteFile command:
-> 90 df 00 00 01 01 00
<- 91 00
>>> GetFileIds command:
-> 90 6f 00 00 00 00
<- 00 02 03 04 91 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 00 00
<- 00 00 0f 00 04 00 00 91 | 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 02 00
<- 02 00 0f 00 00 00 00 00 | 00 01 00 00 80 00 00 00 | 01 91 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 03 00
<- 03 00 0f 00 04 00 00 0c | 00 00 00 00 00 91 00
>>> GetFileSettings command:
-> 90 f5 00 00 01 04 00
<- 04 00 0f 00 01 00 00 05 | 00 00 00 00 00 91 00
Binary file added Dumps/DESFire_example.dmp
Binary file not shown.