Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backdoor Commands for Chinese Mifare tags #94

Open
wants to merge 8 commits into
base: master
Choose a base branch
from

Conversation

SigmaDolphin
Copy link

-This change would add support to the library to unlock the backdoor of special
Mifare tags that allow for reading and writing any block without authenticating

-It shouldn't affect any already existing platforms, just adding more functionality
to them

-I already tested the code and it works correctly, it detects when the tag responds
to the special commands or not

Thank you for considering my pull request, i hope the functionality of these tags is added even if
my pull request is rejected!

Some chinese Mifare Classic 1k tags have a special backdoor that allows for read and write to all blocks ignoring access bits and keys
Some Chinese Mifare Classic tags contain a backdoor that can only be triggered with a certain command sequence
I did some proper investigation and added the commands in a more proper manner this time, it can correctly detect if the backdoor commands are being successful or not
Added more proper UnlockBackdoor command
Sorry, i am a bit new to this github pull requests thing and didn't see that extra brace
@ladyada
Copy link
Member

ladyada commented Jun 28, 2021

neat (or not-so-neat i guess it depends on what security you expected :)

@SigmaDolphin
Copy link
Author

SigmaDolphin commented Jun 28, 2021

I mean, they are unsecure by design, haha
These kind of tags are meant to be used for cloning tags since you can also write to block 0

also, sorry about missing the Doxygen thing, I don't really know how it works

@ladyada
Copy link
Member

ladyada commented Jun 28, 2021

heres a guide on doxygen, it is very easy! https://learn.adafruit.com/the-well-automated-arduino-library/doxygen

@SigmaDolphin
Copy link
Author

I still don't quite understand
In the log here, I see a ton of "Warning"s saying that a lot of the .h file isn't documented, but that's just how the files were in the first place, the only instance I can find in the Doxygen log of my additions is one of the declaration in the .h file, like all of the declarations in the .h file
I did took my time to document the functions I added in the .cpp file and they indeed don't appear in the log

@ladyada
Copy link
Member

ladyada commented Jun 28, 2021

all good!

@SigmaDolphin
Copy link
Author

oh, ok, thank you for letting me know its all good then!

I noticed that if the command failed during the unlock process, the chip may stay in a "non-working" state until a successful unlock
also cleaned up some of the documentation comments and changed an unnecessary condition in the InCommunicateThru command
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants