From 12ea3f087ce16c8e56f7ca928eb4974f3576bbd4 Mon Sep 17 00:00:00 2001 From: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com> Date: Sun, 19 Apr 2026 22:34:45 +0300 Subject: [PATCH 1/2] Bodge: fix mfpreadsector Looks like either I, or someone else, has never thought about encrypted mode enforcement in mfpreadsector. Now during readouts data is decrypted on the fly. Checked on real tag. Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com> --- client/src/mifare/mifare4.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/client/src/mifare/mifare4.c b/client/src/mifare/mifare4.c index ea7986441..1faa3a82a 100644 --- a/client/src/mifare/mifare4.c +++ b/client/src/mifare/mifare4.c @@ -21,6 +21,7 @@ #include "commonutil.h" // ARRAYLEN #include "comms.h" // DropField #include "cmdhf14a.h" +#include "cmdhfmfp.h" // mfp_data_crypt #include "ui.h" #include "crypto/libpcrypto.h" @@ -532,6 +533,9 @@ int mfpReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data DropField(); return 6; } + + // Encrypted mode is always used. Doing an if to check will waste instructions + mfp_data_crypt(&_session, &data[1], &data[1], true); memcpy(&dataout[(n - firstBlockNo) * 16], &data[1], 16); From 99a6e4f39ec7ac1282b807e6584855b08492e759 Mon Sep 17 00:00:00 2001 From: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com> Date: Sun, 19 Apr 2026 22:35:58 +0300 Subject: [PATCH 2/2] Update CHANGELOG.md Signed-off-by: team-orangeBlue <63470411+team-orangeBlue@users.noreply.github.com> --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3244d9e07..aa05d6fd0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] +- Fixed `mfpReadSector` function to decrypt received data, fixing commands like `hf mfp dump` (@team-orangeBlue) - Added `hf mfdes intauth` command (@kormax) - Improved `hf iclass legbrute` throughput: added a 64-wide bitsliced MAC1 sweep that tests 64 key candidates in parallel per cipher tick. Thanks @chick3nman (@antiklesys) - Improved `hf iclass legbrute` throughput further: added wider SIMD backends (128-lane NEON, 256-lane AVX2, 512-lane AVX-512F) with a runtime dispatcher that picks the widest one the CPU supports. Thanks @chick3nman (@antiklesys)