rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

check crypto0,1 bits if its in NON_SECURE_MODE, instead of a too strict good value of 0x2C

Browse Source
This commit is contained in:
iceman1001
2026-03-20 14:30:08 +07:00
parent 570fb542a0
commit ba5812a775
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/cmdhficlass.c
+9 -8
View File
@@ -3911,12 +3911,13 @@ static int CmdHFiClass_BlackTears(const char *Cmd) {
goto out;
}
#define TEAR_WRITE_BYTE 0x2C
#define TEAR_INITAL 0x3C
#define TEAR_UNLOCKED 0xAC
#define TEAR_NON_SECURE_MODE 0x2C
#define TEAR_INITAL 0x3C
#define TEAR_PERSO 0xAC
#define TEAR_IS_PERSO_SET(x) (((x) & 0x80) == 0x80)
#define TEAR_BAD(x) (((x) & 0x01) == 0)
#define TEAR_IS_PERSO_SET(x) (((x) & 0x80) == 0x80)
#define TEAR_IS_NONSECURE_SET(x) (((x) % 0x18) == 0x18)
#define TEAR_BAD(x) (((x) & 0x01) == 0)
// perform initial read here, repeat if failed or 00s
@@ -3948,7 +3949,7 @@ static int CmdHFiClass_BlackTears(const char *Cmd) {
uint8_t data[8] = { 0 }; // tearoff payload
memcpy(data, data_read_orig, sizeof(data));
data[7] = TEAR_WRITE_BYTE;
data[7] = TEAR_NON_SECURE_MODE;
// add the modified OTP if needed
if (otp_len) {
@@ -4221,7 +4222,7 @@ out:
if ( b7 == TEAR_INITAL) {
PrintAndLogEx(INFO, _YELLOW_("Fuses unchanged. Try again if the OTP is unchanged"));
// check for OTP change?
} else if ( b7 == TEAR_UNLOCKED) {
} else if (TEAR_IS_NONSECURE_SET(b7)) {
// don't do anything as this is ok
PrintAndLogEx(SUCCESS, "Detected fuse: " _GREEN_("0x%02X")" _non secure memory_ ( %s )", data_read[7], _GREEN_("ok"));
@@ -4231,7 +4232,7 @@ out:
PrintAndLogEx(SUCCESS, "Detected fuse: " _GREEN_("0x%02X") " set non-secure memory: " _YELLOW_("0xAC"), data_read[7]);
memcpy(data, data_read, PICOPASS_BLOCK_SIZE);
data[7] = TEAR_UNLOCKED;
data[7] = TEAR_NON_SECURE_MODE;
// set non-secure memory with 0xAC, in this state it will always succeed
iclass_write_block(blockno, data, mac, key, use_credit_key, elite, rawkey, use_replay, false, auth, shallow_mod);