Add hf mfu ercnt/ewcnt commands for reading and writing emulator's counters.

software/script/chameleon_cli_unit.py

@@ -1670,6 +1670,43 @@ class HFMFEConfig(SlotIndexArgsAndGoUnit, HF14AAntiCollArgsUnit, DeviceRequiredU
                 f'- {"Log (mfkey32) mode:":40}{f"{CG}enabled{C0}" if detection else f"{CR}disabled{C0}"}')
 
 
+@hf_mfu.command('ercnt')
+class HFMFUVERSION(ReaderRequiredUnit):
+    def args_parser(self) -> ArgumentParserNoExit:
+        parser = ArgumentParserNoExit()
+        parser.description = 'Read MIFARE Ultralight / NTAG counter value.'
+        parser.add_argument('-c', '--counter', type=int, required=True, help="Counter index.")
+        return parser
+
+    def on_exec(self, args: argparse.Namespace):
+        value, no_tearing = self.cmd.mfu_read_emu_counter_data(args.counter)
+        print(f" - Value: {value:06x}")
+        if no_tearing:
+            print(f" - Tearing: {CG}not set{C0}")
+        else:
+            print(f" - Tearing: {CR}set{C0}")
+
+
+@hf_mfu.command('ewcnt')
+class HFMFUVERSION(ReaderRequiredUnit):
+    def args_parser(self) -> ArgumentParserNoExit:
+        parser = ArgumentParserNoExit()
+        parser.description = 'Read MIFARE Ultralight / NTAG counter value.'
+        parser.add_argument('-c', '--counter', type=int, required=True, help="Counter index.")
+        parser.add_argument('-v', '--value', type=int, required=True, help="Counter value (24-bit).")
+        parser.add_argument('-t', '--reset-tearing', action='store_true', help="Reset tearing event flag.")
+        return parser
+
+    def on_exec(self, args: argparse.Namespace):
+        if args.value > 0xFFFFFF:
+            print(f"{CR}Counter value {args.value:#x} is too large.{C0}")
+            return
+
+        self.cmd.mfu_write_emu_counter_data(args.counter, args.value, args.reset_tearing)
+
+        print('- Ok')
+
+
 @hf_mfu.command('rdpg')
 class HFMFURDPG(MFUAuthArgsUnit):
     def args_parser(self) -> ArgumentParserNoExit:

software/script/chameleon_cmd.py

@@ -608,6 +608,26 @@ class ChameleonCMD:
         resp = self.device.send_cmd_sync(Command.MF0_NTAG_WRITE_EMU_PAGE_DATA, data)
         return resp
 
+    @expect_response(Status.SUCCESS)
+    def mfu_read_emu_counter_data(self, index: int) -> (int, bool):
+        """
+            Gets data for selected counter
+        """
+        data = struct.pack('!B', index)
+        resp = self.device.send_cmd_sync(Command.MF0_NTAG_GET_COUNTER_DATA, data)
+        if resp.status == Status.SUCCESS:
+            resp.parsed = (((resp.data[0] << 16) | (resp.data[1] << 8) | resp.data[2]), resp.data[3] == 0xBD)
+        return resp
+
+    @expect_response(Status.SUCCESS)
+    def mfu_write_emu_counter_data(self, index: int, value: int, reset_tearing: bool):
+        """
+            Sets data for selected counter
+        """
+        data = struct.pack('!BBBB', index | (int(reset_tearing) << 7), (value >> 16) & 0xFF, (value >> 8) & 0xFF, value & 0xFF)
+        resp = self.device.send_cmd_sync(Command.MF0_NTAG_SET_COUNTER_DATA, data)
+        return resp
+
     @expect_response(Status.SUCCESS)
     def hf14a_set_anti_coll_data(self, uid: bytes, atqa: bytes, sak: bytes, ats: bytes = b''):
         """

software/script/chameleon_enum.py

@@ -103,6 +103,8 @@ class Command(enum.IntEnum):
     MF0_NTAG_SET_VERSION_DATA = 4024
     MF0_NTAG_GET_SIGNATURE_DATA = 4025
     MF0_NTAG_SET_SIGNATURE_DATA = 4026
+    MF0_NTAG_GET_COUNTER_DATA = 4027
+    MF0_NTAG_SET_COUNTER_DATA = 4028
 
     EM410X_SET_EMU_ID = 5000
     EM410X_GET_EMU_ID = 5001