Key recovery via backdoor for static encrypted nonce cards (#263)

* Implement MF1_ENC_NESTED_ACQUIRE in firmware

* Implement MF1_ENC_NESTED_ACQUIRE in software + fix code formatter

* Remove xz and pthreads from sources, use CMake FetchContent

* Update changelog

* lzma.h

* Update CMakeLists.txt

* Update CMakeLists.txt

* Probably fix workflow taking wrong commit for building

* Fix CMake building tools into bin/Debug on Windows

* Added cmd for fetching all slots nicks (without 16 commands)

* Fix type and use temp directory instead cwd (https://github.com/RfidResearchGroup/ChameleonUltra/pull/261)

* Fix endian for mfu_read_emu_counter_data and mfu_write_emu_counter_data

* Fix  --key interpreted as list

software/script/tests/output_grabber.py

@@ -4,6 +4,8 @@ import threading
 import time
 
 # From https://stackoverflow.com/a/29834357
+
+
 class OutputGrabber(object):
     """
     Class used to grab standard output or another stream.
@@ -72,7 +74,7 @@ class OutputGrabber(object):
         and save the text in `captured_text`.
         """
         while True:
-            char = os.read(self.pipe_out,1).decode(self.origstream.encoding)
+            char = os.read(self.pipe_out, 1).decode(self.origstream.encoding)
             if not char or self.escape_char in char:
                 break
             self.captured_text += char

software/script/tests/test_hard_acquire.py

@@ -1,24 +1,22 @@
 #!/usr/bin/env python3
+import hardnested_utils
+from chameleon_cmd import ChameleonCMD
+from chameleon_com import ChameleonCom, OpenFailException
 import sys
 sys.path.append('..')
 
-from chameleon_com import ChameleonCom, OpenFailException
-from chameleon_cmd import ChameleonCMD
-import hardnested_utils
-
 
 def test_hardnested_acquire():
     nonces_buffer = bytearray()
     acquire_count = 0
 
     # known key and target block
-    key = bytes.fromhex("FFFFFFFFFFFF") # <-- Your known key
+    key = bytes.fromhex("FFFFFFFFFFFF")  # <-- Your known key
     block_known = 0x00
     type_known = 0x60
     block_target = 0x00
     type_target = 0x60
 
-
     # Before acquire start, we need to reset history
     hardnested_utils.reset()
 
@@ -32,7 +30,7 @@ def test_hardnested_acquire():
         cml = ChameleonCom().open('/dev/ttyACM0')
     cml_cmd = ChameleonCMD(cml)
 
-        # ------------------------ SET DEVICE MODE ------------------------
+    # ------------------------ SET DEVICE MODE ------------------------
     print("Setting device mode to HF Reader...")
     status = cml_cmd.set_device_reader_mode()
 
@@ -59,7 +57,8 @@ def test_hardnested_acquire():
 
     while True:
         # 1, acquire from device
-        acquire_datas = cml_cmd.mf1_hard_nested_acquire(0, block_known, type_known, key, block_target, type_target) # slow = 0 to fast acquire...
+        # slow = 0 to fast acquire...
+        acquire_datas = cml_cmd.mf1_hard_nested_acquire(0, block_known, type_known, key, block_target, type_target)
         if acquire_datas is not None:
             acquire_count += 1
             print(f"Acquire success, count: {acquire_count}")
@@ -102,6 +101,7 @@ def test_hardnested_acquire():
     # You can decrypt nonce bin by pm3 client, or any app if support pm3 nonce bin format.
     # TODO If CU bin can decrypt, run cmd on here...
 
+
 if __name__ == "__main__":
     try:
         test_hardnested_acquire()