nfc: Fix sector overrun in MFC nested dictionary attack #4048
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GMMan
requested review from
skotopes,
DrZlo13,
hedger,
gsurkov,
gornekich and
Astrrra
as code owners
GMMan
force-pushed
the
nfc-fix-mfc-mfplus-crash
branch
from
892a19b to
bb27473
Compare
|
Possible regression with this PR or 3822 for Hardnested. Waiting on a card I ordered 2 weeks ago to isolate a crash. edit: 2K cards aren't recognized, which seems like the root cause for any sector overrun? |
Potentially addressed in #4053 |
|
This should be the correct fix for this issue (rather than fixing a byproduct of the crash): noproto/xero-firmware@56fe7b0 Tested and would welcome feedback. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What's new
X2k variants in SL1.Verification
X2k variants in SL1Checklist (For Reviewer)
I'm not sure what the actual intended flow is supposed to be when the dictionary attack runs off the end of the card. I assume it would loop back and continue to check the first part of the dictionary, but it could also just move on to nonce collection, although that would involve some refactoring to free up the loaded dictionaries. Probably something for @noproto to clarify.
Edit: I've discovered that the test card in question is actually a MIFARE Plus EV1. Flipper's detection of this is not quite working, and because the card gave the same historical bytes as MIFARE Plus X, it was incorrectly assumed to be that chip.