NFC Emulation Mifare Worked but now Doesnt

littleBird · January 25, 2023, 4:54pm

Hi!

I have received my FZ a couple of days ago, everything appeared to be working properly and today I did my first physical assessment with it.

I used the flipper to save two Mifare DESFire UIDs, I have actually used them to open up a few doors but the problem was during emulating that the FZ froze and had to be hard resetted (back and left). After 4-5 uses the NFC emulation stopped working, the reader does not see my FZ emulation anymore. The reader was not broken, an actual card kept working on the receiver at the door but it just stopped recognizing the signal coming from my FZ. Edit: i tried other receivers on other doors, did not receive any signal either.

I have read there is no support (for Mifare DESfire), but it seems that the hardware suddenly broke down, which to my opinion should be shameful if that’s the case. is there any way to verify this?

And even though not in support… the fact of the matter is that it worked and now it doesn’t absolutely fks with me mentally.

The FZ can still read the card without problem, it’s just the emulation doesn’t work and I actually wanted to use the FZ for demo and awareness training purposes so I’m kinda sad. I tried a factory reset. Any other idea’s?

maqumih · January 25, 2023, 6:48pm

It appears to be well-known problem. Try:

Extra actions → Read NFC-A data, then emulate
Downgrading the firmware, details are in adjacent topic.
Waiting for someone to fix it.

littleBird · January 25, 2023, 7:38pm

Thanks for that Maqumih. I actually tried doing the extra actions: reading the card and directly emulating without saving, did not work. I did not yet try to downgrade, i will try that tonight.

I actually tried to use my iPhones NFC functionality to test the receiving and sending of NFC signals coming from the FZ. With a Mifare Classic 1K emulation i can get my iPhone to respond, not with a Mifare DESfire.

I actually tried to use the ‘Detect Reader’ functionality on the reader as well, same issue: first it worked and now it doesn’t. Its driving me crazy.

littleBird · January 25, 2023, 11:27pm

For more reference: i continued doing more testing. Flashed back to older version, tried recovery via DFU. Even tried flashing other forked firmware… this specific NFC card is still not working. I’m totally frustrated, i just don’t get it why it worked this morning and now it doesn’t anymore, even when i fully resetted the device.

I manually tried to add all various types: ultralight, ntags, mifare classic (both 4 and 7 bytes), mifare mini, all worked without problems. I’ve pinpointed the problem and it focuses in on NFC-A ATQA 4403 SAK 20 which is Desfire. I tried various adjustments SAK 08, 10, 13, 15, 19… all worked with same UID (12 6x00)… interestingly enough: SAK 08 worked, but freezes (like the SAK 20 did this morning…). I also tried SAK 20 with a different ATQA but that did not work.

At least this confirms that the NFC hardware should not be broken, tags can be read and emulated just fine- but for NFC-A not in this specific case. Considering this very specific element of NFC and transmission of SAK 20 is broken specifically seems sooooo far fetched. But if it’s a software issue, why isn’t it fixed when fully resetting the FZ?

Do you have any ideas, thoughtpoints or tips, please share them with me so i can troubleshoot further, i’d really want to make this card usuable again.

littleBird · January 26, 2023, 2:54pm

Sorry to spam, i have created an issue now on the Github.

github.com/flipperdevices/flipperzero-firmware

DESfire ID emulation no signal

opened 02:49PM - 26 Jan 23 UTC

GitGitBunny

bug

### Describe the bug. Ready for a headache? This is not for the faint of hear…t, an absolute challenge. Yesterday morning i used my Flipper to read DESfire cards and emulate them to open a few locks during an approved penetration assessment. During the simulation, the Flipper froze during the emulation of the ID so after every emulation i had to hard reset the Flipper (left+back). In the afternoon emulation of Desfire cards stopped entirely. I have a working NFC card (employee badge) that i tried to emulate and that has been working but now doesn't anymore. The reader does not recognize any signal coming from my Flipper anymore! Neither does my iPhone, when simulating the UID of Desfire (ATQA 4403 or 0403 (last of which is random UID)). Any other NFC card works, it is only when simulating ATQA4403 or 0403 with SAK20. Trying to simulate NFC-A 7 byte with ATQA0400 SAK88 works fine. I tried manually editing in all different variants that can be manually added, emulation of all work, all except for Desfire. Reading of the Desfire card does work without a problem. It registers properly and identifies it as a DESfire card, but when emulating, it seems no signal is received. When emulating, the UID shows, the led is blinking purple, but the NFC reader does not receive any signal. One more weird thing: when i just open my iPhone's NFC menu and scan my tag, the Flipper shows a 'log' button and when i click it i get the same message over and over again 'R: 00' whenever i hold the Flipper close to the reader. The weird thing: no debug logs register. Edit: one more addition: i tried factory resetting, erasing via qflipper, recovery mode repair via DFU and bought a different SD card. All did not fix the problem. ### Reproduction 1. Go To NFC 2. Read Card 3. Emulate ID 4. No response by reader. ### Target iPhone NFC reader ### Logs ```Text # Reading DESfire (twice) and emulating the second time. 291156 [D][DolphinState] icounter 20, butthurt 0 294433 [D][ViewDispatcher] View changed while key press 2000E8E8 -> 2000E130. Sending key: Back, type: Release, sequence: 00000032 to previous view port 295807 [D][ViewDispatcher] View changed while key press 2000E130 -> 2000E8E8. Sending key: Back, type: Release, sequence: 00000033 to previous view port 297271 [D][ViewDispatcher] View changed while key press 2000E8E8 -> 2000E208. Sending key: Back, type: Release, sequence: 00000034 to previous view port 303573 [D][DolphinState] icounter 20, butthurt 0 304151 [I][NfcWorker] Mifare DESFire detected 304374 [W][MifareDESFire] Bad DESFire GET_KEY_SETTINGS response 304605 [D][DolphinState] icounter 20, butthurt 0 325534 [I][NfcWorker] Mifare DESFire detected 325755 [W][MifareDESFire] Bad DESFire GET_KEY_SETTINGS response 325982 [D][DolphinState] icounter 20, butthurt 0 330933 [D][DolphinState] icounter 20, butthurt 0 336857 [D][ViewDispatcher] View changed while key press 2000E8E8 -> 2000E130. Sending key: Back, type: Release, sequence: 0000003D to previous view port #Scan, save and emulate 391617 [D][DolphinState] icounter 20, butthurt 0 392606 [I][NfcWorker] Mifare DESFire detected 392825 [W][MifareDESFire] Bad DESFire GET_KEY_SETTINGS response 393057 [D][DolphinState] icounter 20, butthurt 0 401131 [I][Nfc] Saving to folder /any/nfc 402759 [D][BrowserWorker] Start 402777 [D][BrowserWorker] Enter folder: /any/nfc items: 7 idx: 6 402780 [D][BrowserWorker] Load offset: 0 cnt: 50 406241 [D][BrowserWorker] End 406343 [W][NfcDevice] Non-parsed apps found! 409420 [D][DolphinState] icounter 20, butthurt 0 #Emulating Mifare classic on my iPhone when not waiting for NFC input: 1508177 [D][BrowserWorker] Start 1508189 [D][BrowserWorker] Enter folder: /any/nfc items: 7 idx: -1 1508193 [D][BrowserWorker] Load offset: 0 cnt: 50 1514436 [D][BrowserWorker] End 1515376 [D][DolphinState] icounter 20, butthurt 0 1517712 [D][MfClassic] 0e56deb5 keyA block 3 nt/nr/ar: 3277a1a5 d805f324 fca4b1cb 1517771 [W][MfClassic] Incorrect nr + ar 1517822 [D][MfClassic] 0e56deb5 keyA block 3 nt/nr/ar: 12817c7f 3423dd49 75390f7c 1517877 [D][MfClassic] 0e56deb5 keyA block 3 nt/nr/ar: c4fafb0e 4f298bef a1c91059 1517931 [D][MfClassic] 0e56deb5 keyA block 3 nt/nr/ar: 50f3745c 26901b9f 29824fbf 1517985 [D][MfClassic] 0e56deb5 keyA block 3 nt/nr/ar: 1bcf4639 fbd7f740 5ebc98f0 1518040 [D][MfClassic] 0e56deb5 keyA block 3 nt/nr/ar: 17acf0bd f84e0a3f 9970f17a 1524399 [D][ViewDispatcher] View changed while key press 2000EB60 -> 2000E980. Sending key: Back, type: Release, sequence: 0000005C to previous view port #Emulating DESfire on my Iphone while it is not waiting for NFC input (see photo for the R: 00 message) 1528508 [D][BrowserWorker] Start 1528528 [D][BrowserWorker] Enter folder: /any/nfc items: 7 idx: 3 1528530 [D][BrowserWorker] Load offset: 0 cnt: 50 1533252 [D][BrowserWorker] End 1533348 [W][NfcDevice] Non-parsed apps found! 1534297 [D][DolphinState] icounter 20, butthurt 0 1564304 [I][Dolphin] Flush stats 1564306 [I][SavedStruct] Saving "/int/.dolphin.state" 1564317 [D][StorageInt] Device erase: page 3, translated page: c0 1564324 [D][StorageInt] Device sync: skipping 1564327 [I][DolphinState] State saved 1569827 [D][ViewDispatcher] View changed while key press 2000F0D0 -> 2000F1E8. Sending key: Back, type: Release, sequence: 00000066 to previous view port 1571100 [D][ViewDispatcher] View changed while key press 2000F1E8 -> 2000E980. Sending key: Back, type: Release, sequence: 00000067 to previous view port ``` ### Anything else? To be clear: this has worked. It was perfectly fine and working yesterday morning and now it does not anymore. Below is the R:00 message on the flipper. Do you need more info? please request i'd be happy to share and participate in debugging this issue together. ![IMG_8847](https://user-images.githubusercontent.com/27221660/214866672-e949679f-3e07-43bc-a16c-d25af6499fe6.jpg)

maqumih · February 1, 2023, 6:54pm

Weird. Emulating a Classic for DESFire reader shouldn’t work.
What do you mean by working there? Did it collect any nonces?

Let me confirm: you did it in NFC-A mode, not in DESFire or any other?

littleBird · February 15, 2023, 8:50am

@maqumih sorry, been up and about. The situation was as follows:

I scanned a DESFire card; saved it, emulated it and used it on a card reader and this worked.
The FZ got ‘stuck’ so i forced reboot, and every time i emulated the NFC card at the door it froze up.
I manually tried to set-up some UIDs and tested those on the door, now when emulating NFC type-A manually no signals are received. Reading and emulating my DESFire card does not work anymore.

Ftr: I can emulate the DESfire card but it is never read, even though i know that only the UID is emulated, also that is not received anymore by ANY reader.

After further testing i noticed NTAG, Classic 4K and 1K and Ultralight (from the NFC menu) to be working, but setting up a SAK20 ATQA 0344 NFC-A 7-bytes UID manually creates no signal when emulating.

I have read online that there is a way to ‘brick’ magic cards with a bad BCC checksum. Could that be the issue? And if so, is there a way to fix that on a FZ? It could be a possible solution.

Regards,
LB

littleBird · February 15, 2023, 12:12pm

And in response to the first question: it did not acquire any nonces - but the reader did respond to the signals (flashing lights and beeping as if it read a card). A colleague pointed out that the readers that this company was using maybe used a some sort of dual band mode and therefore the simulated ID was still able to be read. It could be a great coincidence that exactly on that day the system was upgraded to disable this dual band mode, i know for a fact that this company was phasing out their old card system.

If this is the ‘what are the odds’ case, shouldn’t my FZ still would be able to emulate the ID of the Desfire card to the extent that a NFC reader could pick up the signal?

Best Regards,

maqumih · February 19, 2023, 5:11pm

It doesn’t even need to be dual band. Classic and DESFire share underlying technology. Your description means that Flipper and reader sensed each other, Flipper sent identification info, reader decided it is not a valid card and gave up. Zero nonces mean no attempts no read as Classic.

How did you test? Original reader or mobile phone?

I can’t find anything related to magic cards out there. We have original card - not writable, FZ - too smart, reader - hopefully immune to external bad behaviour blackbox.

Maaaybeee…
Set SAQ and ATQA to all-zeros and leave the UID untouched. Record the results. Repeat with ones from Classic (0004, 08).