Skip to content

Commit

Permalink
Add NFC Emulate UID(works only for FeliCa)
Browse files Browse the repository at this point in the history
  • Loading branch information
andreock committed Jan 25, 2025
1 parent d84b67d commit e1f65e5
Show file tree
Hide file tree
Showing 16 changed files with 295 additions and 17 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ Working Features:

- Wi-Fi support
- BLE support
- BadUSB support(Limited to 4-5 files in file browser)
- BadUSB support
- NFC support
- Some network attacks
- SubGHZ(Beta support, need more testing)
Expand Down
45 changes: 42 additions & 3 deletions lib/UI/navigation/NFC/NFCNavigation.cpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -30,6 +30,7 @@
#include "pages/NFC/NFCPollingResultPage.hpp"
#include "pages/NFC/NFCPollingWaitingPage.hpp"
#include "pages/NFC/NFCWriteResultPage.hpp"
#include "pages/NFC/NFCEmulateTagPage.hpp"
#include "posixsd.hpp"
#include "sdcard_helper.hpp"

Expand All @@ -44,6 +45,7 @@ static NFCBruteforceTagPage *nfc_bruteforce_tag_page = nullptr;
static NFCFelicaPollingResultPage *nfc_felica_polling_result_page = nullptr;
static FileBrowserPage *nfc_dump_file_browser_page = nullptr;
static NFCWriteResultPage *nfc_write_result_page = nullptr;
static NFCEmulateTagPage *nfc_emulate_tag_page = nullptr;

std::list<std::string> nfc_dumps_files; // NFC Dumps files

Expand Down Expand Up @@ -76,7 +78,7 @@ void goto_nfc_polling_result_gui(uint8_t *uid, uint8_t len,
const char *tag_name) {
gui->reset();
nfc_polling_result_page =
new NFCPollingResultPage(5, 2, 1, gui->get_screen());
new NFCPollingResultPage(6, 2, 1, gui->get_screen());
gui->set_current_page(nfc_polling_result_page, false);
nfc_polling_result_page->display(uid, len, tag_name);
}
Expand All @@ -94,13 +96,25 @@ void nfc_cleanup() {
}
}

bool emulating = false;

void goto_home() {
if(emulating) {
stop_emulate();
emulating = false;
}
reset_uid();
reset_felica();
nfc_cleanup();
init_main_gui();
}

void nfc_return_back() {
stop_emulate();
gui->reset();
gui->set_current_page(nfc_polling_result_page);
}

void save_dump_to_sd() {
Serial.println("save_dump_to_sd");
save_file(DUMP_SAVE_PATH, nfc_attacks->get_scanned_tag()->get_data(), 224);
Expand Down Expand Up @@ -189,7 +203,7 @@ void write_felica_tag() {
void init_nfc_felica_polling_result_gui(uint8_t *idm, uint8_t *pmm,
uint16_t sys_code) {
nfc_felica_polling_result_page =
new NFCFelicaPollingResultPage(5, 4, 1, gui->get_screen());
new NFCFelicaPollingResultPage(6, 4, 1, gui->get_screen());
nfc_felica_polling_result_page->display(idm, pmm, sys_code);
gui->set_current_page(nfc_felica_polling_result_page, false);
nfc_polling_waiting_page = nullptr;
Expand All @@ -200,6 +214,31 @@ void felica_dump() {
dump_felica(gui, nfc_attacks);
}

extern uint8_t uid[8];

void emulate_iso14443a() {
gui->reset();
nfc_emulate_tag_page = new NFCEmulateTagPage(1, 1, 1, gui->get_screen());
gui->set_current_page(nfc_emulate_tag_page, true, false);
emulate_iso14443a_tag(uid, nfc_attacks);
emulating = true;
}

extern uint8_t idm[8];
extern uint8_t pmm[8];
extern uint16_t sys_code;

void emulate_iso18092() {
gui->reset();
nfc_emulate_tag_page = new NFCEmulateTagPage(2, 1, 1, gui->get_screen());
gui->set_current_page(nfc_emulate_tag_page, true, false);
uint8_t _sys_code[2];
_sys_code[0] = sys_code >> 8;
_sys_code[1] = sys_code & 0xff;
emulate_iso18092_tag(idm, pmm, _sys_code, nfc_attacks);
emulating = true;
}

void set_dumped_sectors(int sectors) {
nfc_dump_result_page->set_dumped(sectors);
};
Expand Down
5 changes: 4 additions & 1 deletion lib/UI/navigation/NFC/NFCNavigation.hpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -28,10 +28,13 @@ void nfc_mifare_polling();
void nfc_felica_polling();
void format_nfc_tag();
void goto_home();
void nfc_return_back();
void open_nfc_dump_browser();
void bruteforce_a_tag();
void init_nfc_felica_polling_result_gui(uint8_t *idm, uint8_t *pmm,
uint16_t sys_code);
void emulate_iso14443a();
void emulate_iso18092();
void set_dumped_sectors(int sectors);
void set_unreadable_sectors(int sectors);
void set_unauthenticated_sectors(int sectors);
Expand Down
4 changes: 3 additions & 1 deletion lib/UI/pages/NFC/FeliCaPages/NFCFelicaPollingResultPage.cpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -39,6 +39,7 @@ void NFCFelicaPollingResultPage::display(uint8_t *idm, uint8_t *pmm,
english_words->at(NFC_FELICA_SYSTEM_CODE_KEY) + String(sys_code, HEX));
dump_to_sd = new List(screen, english_words->at(NFC_DUMP_TAG_TO_SD), 2,
ST77XX_WHITE, 20, ST77XX_BLACK, felica_dump);
emulate_tag = new List(screen, "Emulate UID", 2, ST77XX_WHITE, 20, ST77XX_BLACK, emulate_iso18092);
// write_tag = new List(screen, "Write tag", 2, ST77XX_WHITE, 20,
// ST77XX_BLACK); format_tag = new List(screen,
// english_words->at(NFC_FORMAT_TAG_TO_SD), 2,
Expand All @@ -55,6 +56,7 @@ void NFCFelicaPollingResultPage::display(uint8_t *idm, uint8_t *pmm,
// grid->add(write_tag);
// grid->add(format_tag);
// grid->add(bruteforce_tag);
grid->add(emulate_tag);
grid->add(exit_page);
grid->set_selected(4, true);
grid->set_y_spacing(20);
Expand Down
3 changes: 2 additions & 1 deletion lib/UI/pages/NFC/FeliCaPages/NFCFelicaPollingResultPage.hpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -34,6 +34,7 @@ class NFCFelicaPollingResultPage : public Page {
List *write_tag;
List *format_tag;
List *bruteforce_tag;
List *emulate_tag;
List *exit_page;

public:
Expand Down
38 changes: 38 additions & 0 deletions lib/UI/pages/NFC/NFCEmulateTagPage.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, version 3.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

#include "NFCEmulateTagPage.hpp"
#include "../../navigation/NFC/NFCNavigation.hpp"

#include "gui.hpp"

NFCEmulateTagPage::~NFCEmulateTagPage() {
delete emulate_text;
delete exit_page;
}

void NFCEmulateTagPage::display() {
grid = new Grid(screen, 2, 1);
emulate_text =
new Text(screen, ST77XX_WHITE, "Emulating tag...");
exit_page = new List(screen, "Exit", 2, ST77XX_WHITE, 20, ST77XX_BLACK, goto_home);
grid->add(emulate_text);
grid->add(exit_page);
grid->set_y_spacing(20);
grid->set_selected(1, true);
grid->display();
}
45 changes: 45 additions & 0 deletions lib/UI/pages/NFC/NFCEmulateTagPage.hpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, version 3.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/

#include "../../i18n.hpp"
#include "../../i18n/NFC/nfc_format_page_keys.h"
#include "../Page.hpp"
#include "Grid.hpp"
#include "List.hpp"
#include "Text.hpp"

#ifndef NFC_EMULATE_PAGE_H
#define NFC_EMULATE_PAGE_H

class NFCEmulateTagPage : public Page {
private:
Text *emulate_text;
List *exit_page;

public:
NFCEmulateTagPage(uint8_t _position_limit, uint8_t _lower_limit,
uint8_t _position_increment, GFXForms *screen)
: Page(_position_limit, _lower_limit, _position_increment, screen) {
};
~NFCEmulateTagPage();
void display();

void click(int pos, void callback()) { grid->click(pos, callback); };
void set_selected(int pos, bool status) { grid->set_selected(pos, status); };
};

#endif
4 changes: 3 additions & 1 deletion lib/UI/pages/NFC/NFCPollingResultPage.cpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -43,13 +43,15 @@ void NFCPollingResultPage::display(uint8_t *uid, uint8_t length,
bruteforce_tag =
new List(screen, english_words->at(NFC_BRUTEFORCE_TAG_KEY), 2,
ST77XX_WHITE, 20, ST77XX_BLACK, bruteforce_a_tag);
emulate_tag = new List(screen, "Emulate UID", 2, ST77XX_WHITE, 20, ST77XX_BLACK, emulate_iso14443a);
exit_page = new List(screen, english_words->at(NFC_GO_BACK_KEY), 2,
ST77XX_WHITE, 20, ST77XX_BLACK, goto_home);
grid->add(tag_info);
grid->add(uid_text);
grid->add(write_tag);
grid->add(format_tag);
grid->add(bruteforce_tag);
grid->add(emulate_tag);
grid->add(exit_page);
grid->set_selected(2, true);
grid->set_y_spacing(20);
Expand Down
3 changes: 2 additions & 1 deletion lib/UI/pages/NFC/NFCPollingResultPage.hpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -32,6 +32,7 @@ class NFCPollingResultPage : public Page {
List *write_tag;
List *format_tag;
List *bruteforce_tag;
List *emulate_tag;
List *exit_page;

public:
Expand Down
12 changes: 10 additions & 2 deletions lib/nfc_attacks/nfc_attacks.cpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -562,4 +562,12 @@ NFCTag NFCAttacks::get_felica_towrite() {
memcpy(&data[i][0], &buffer[i * 16], 16);
}
return NFCTag(idm, pmm, sys_code, data);
}
}

bool NFCAttacks::emulate_tag(uint8_t *uid) {
return nfc_framework.emulate_tag(uid);
}

bool NFCAttacks::emulate_tag(uint8_t *idm, uint8_t *pmm, uint8_t *sys_code) {
return nfc_framework.emulate_tag(idm, pmm, sys_code);
};
5 changes: 4 additions & 1 deletion lib/nfc_attacks/nfc_attacks.hpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/*
* This file is part of the Capibara zero (https://github.com/CapibaraZero/fw or
* https://capibarazero.github.io/). Copyright (c) 2024 Andrea Canale.
* https://capibarazero.github.io/). Copyright (c) 2025 Andrea Canale.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -97,6 +97,9 @@ class NFCAttacks {
bool get_bruteforce_status() { return bruteforce_status; };
uint8_t get_formatted_sectors() { return formatted_sectors; };
uint8_t get_tag_blocks() { return current_tag_blocks; };

bool emulate_tag(uint8_t *uid);
bool emulate_tag(uint8_t *idm, uint8_t *pmm, uint8_t *sys_code);
};

#endif
Loading

0 comments on commit e1f65e5

Please sign in to comment.