Merge branch 'main' into main

.github/workflows/build_client.yml

@@ -38,10 +38,15 @@ jobs:
         uses: actions/checkout@v3
         with:
           ref: ${{ inputs.checkout-sha == null && github.sha || inputs.checkout-sha }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
       - name: Install PyInstaller and client dependencies
         run: |
-          pip3 install pyinstaller
-          pip3 install -r software/script/requirements.txt
+          python -m pip install --upgrade pip
+          pip install pyinstaller
+          pip install -r software/script/requirements.txt
       - name: Run OS specific setup
         run: ${{ matrix.pre_command }}
       - name: Compile native code

CHANGELOG.md

@@ -30,8 +30,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Added support for timestamped comments in CLI via `rem`, `;`, `%` or `#` (@doegox)
  - Fixed watchdog trigger during `hw factory_reset` (@doegox)
  - Added PyInstaller support for CLI client (@augustozanellato)
- - Added TechSecurityTools to Autorized Distributors (@yanis333)
-
+ - Added proper Mifare Ultralight (original, C, EV1) / NTAG (213, 215, 216) emulation (@turbocooler).
 
 ## [v2.0.0][2023-09-26]
  - Added `hw slot nick delete` and DELETE_SLOT_TAG_NICK (@doegox)

README.md

@@ -8,6 +8,8 @@ Europe: [Lab401](https://lab401.com/)
 
 United States: [Hackerwarehouse](https://hackerwarehouse.com/)
 
+MTools Tec: [MTools Tec](https://shop.mtoolstec.com/)
+
 Anywhere else: [Sneaktechnology](https://sneaktechnology.com) / [Aliexpress by RRG](https://proxgrind.aliexpress.com/store/1101312023) / [TechSecurityTools](https://techsecuritytools.com/product/chameleon-ultra/)
 
 # What is it and how to use ?
@@ -39,6 +41,7 @@ Table for future functionality progress
 # Compatible applications
 
 * [ChameleonUltraGUI](https://github.com/GameTec-live/ChameleonUltraGUI)
+* [MTools BLE](docs/mtoolsble.md)
 
 # Videos
 
@@ -47,6 +50,7 @@ Table for future functionality progress
 * [Downloading and compiling the official CLI](https://www.youtube.com/watch?v=VGpAeitNXH0)
 * [Downloading ChameleonUltraGUI](https://www.youtube.com/watch?v=rHH7iqbX3nY)
 * [ChameleonGUI features overview](https://www.youtube.com/watch?v=YqE8wyVSse4)
+* [MTools BLE - How to clone a card with ChameleonUltra](https://youtu.be/IvH-xtdW1Wk?si=4exqgAAeJ-kxU3aN)
 
 # Official channels
 

docs/development.md

@@ -334,6 +334,31 @@ in a second terminal:
 JLinkRTTClient
 ```
 
+For Windows add these lines to the `tasks.json`:
+```json
+        {
+            "label": "logs",
+            "type": "shell",
+            "command": "C:\\WINDOWS\\System32\\cmd.exe",
+            "args": ["/K", "C:\\Program Files\\SEGGER\\JLink\\JLinkRTTClient.exe"],
+            "options": {
+                "cwd": "C:\\Program Files\\SEGGER\\JLink"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "logger server",
+            "type": "shell",
+            "command": "C:\\WINDOWS\\System32\\cmd.exe",
+            "args": ["/K", "C:\\Program Files\\SEGGER\\JLink\\JLink.Exe", "-if",  "SWD",  "-device",  "nrf52",  "-speed",  "4000", "-autoconnect", "1"],
+            "options": {
+                "cwd": "C:\\Program Files\\SEGGER\\JLink"
+            },
+            "problemMatcher": []
+        },
+```
+
+
 ## Using SWO pin as UART to monitor NRF_LOG
 
 One can set `NRF_LOG_UART_ON_SWO_ENABLED := 1` in `Makefile.defs` to activate this functionality.

docs/firmware.md

@@ -71,7 +71,7 @@ On a new Chameleon (or after a factory reset), 3 slots are defined, slot 1 holdi
 
 - slot 1 LF: a EM4100 with UID `DEADBEEF88`
 - slot 1 HF: a MIFARE Classic 1k with UID `DEADBEEF`
-- slot 2 HF: a MIFARE Classic 1k with UID `DEADBEEF`
+- slot 2 HF: a MIFARE Classic Ultralight  with UID `04689571FA5C64`
 - slot 3 LF: a EM4100 with UID `DEADBEEF88`
 
 When a slot is selected, the LED shows what type of card is loaded with the following color code:

docs/mtoolsble.md

@@ -0,0 +1,50 @@
+# MTools BLE Introduction  
+MTools BLE supports managing the ChamleonUltra, ChameleonLite and DevKits via BLE connections. 
+## Downlaod Link 
+- [MTools BLE on iOS](https://apps.apple.com/app/mtools-ble-rfid-reader/id1531345398) 
+- [MTools BLE on Google Play](https://play.google.com/store/apps/details?id=com.mtoolstec.mtoolsLite) 
+
+## How to connect with Bluetooth in MTools BLE
+1. Click **A** or **B** button to power on.
+2. Click **Bluetooth List** icon in App to search devices.
+3. Click **Connect** button on the right to connect.
+
+#### Notice for Bluetooth Connection
+1. Grant the Bluetooth permission of App on iOS.
+2. Allow Location permission to scan Bluetooth devices on Android.
+
+## Features for ChameleonUltra 
+### Slot Manager  
+1. Fetch all slot status.
+2. Enable or disable Slots. 
+3. Change LF and HF Slot name. 
+4. Set LF and HF Tag Type.
+5. Delete and reset all slots. 
+
+### Reader  
+1. Fast read LF and HF Tag. 
+2. Simulate Mifare Classic Tag with UID, SAK, ATQA and empty dump. 
+3. Simulate Mifare Ultralight Tag with UID, SAK, ATQA and empty dump.
+4. Simulate EM410X LF tag or manually set the ID then simulate. 
+
+### Mifare Classic Dump 
+1. eRead full dump from current active slot to App. 
+2. Upload full dump to current active slot and simulate.
+3. Read Mifare Mini, 1K, 2K, 4K dump from tag with known keys.
+4. Write Gen1A, Gen2, Gen3, Gen4 dump to tag with known keys.
+5. Format common and magic Mifare Classic tags.
+6. Modify block data and save to new dump file. 
+
+### Mifare Ultralight Dump 
+1. eRead full dump from current active slot to App.
+2. Upload full dump to current active slot and simulate.
+3. Read Mifare Ultralight dump from tag.
+4. Write Mifare Ultralight dump to tag.
+
+### Settings
+1. Set the Animation of LEDs. 
+2. Set press and long press button of A and B. 
+3. Set the **Mifare Classic Emulation** of current slot. 
+4. Set the **Mifare Ultralight Emulation** of current slot.
+5. DFU Tool for updating firmware.
+6. Reset Chameleon Device.

docs/protocol.md

@@ -388,6 +388,54 @@ Notes:
 * Command: no data
 * Response: no data or N bytes: `uidlen|uid[uidlen]|atqa[2]|sak|atslen|ats[atslen]`. UID, ATQA, SAK and ATS as bytes.
 * CLI: cf `hw slot list`/`hf mf econfig`/`hf mfu econfig`
+### 4019: MF0_NTAG_GET_UID_MAGIC_MODE
+* Command: no data
+* Response: 1 byte where a non-zero value indicates that UID magic mode is enabled for the current slot.
+* CLI: cf `hf mfu econfig`
+### 4020: MF0_NTAG_SET_UID_MAGIC_MODE
+* Command: 1 byte where a non-zero value indicates that UID magic mode should be enabled for the current slot, otherwise disabled.
+* Response: no data
+* CLI: cf `hf mfu econfig --enable-uid-magic`/`hf mfu econfig --disable-uid-magic`
+### 4021: MF0_NTAG_READ_EMU_PAGE_DATA
+* Command: 2 bytes: one for first page index, one for count of pages to be read.
+* Response: `4 * n` bytes where `n` is the number if pages to be read
+* CLI: cf `hf mfu eview`
+### 4022: MF0_NTAG_WRITE_EMU_PAGE_DATA
+* Command: 2 + `n * 4` bytes: one for first page index, one for count of pages to be read, `n * 4` for `n` pages data.
+* Response: no data
+* CLI: unused
+### 4023: MF0_NTAG_GET_VERSION_DATA
+* Command: no data
+* Response: 8 version data bytes.
+* CLI: cf `hf mfu econfig`
+### 4024: MF0_NTAG_SET_VERSION_DATA
+* Command: 8 version data bytes.
+* Response: no data
+* CLI: cf `hf mfu econfig --set-version <hex>`
+### 4025: MF0_NTAG_GET_SIGNATURE_DATA
+* Command: no data
+* Response: 32 signature data bytes.
+* CLI: cf `hf mfu econfig`
+### 4026: MF0_NTAG_SET_SIGNATURE_DATA
+* Command: 32 signature data bytes.
+* Response: no data
+* CLI: cf `hf mfu econfig --set-signature <hex>`
+### 4027: MF0_NTAG_GET_COUNTER_DATA
+* Command: 1 byte for the counter index
+* Response: 3 bytes for the counter value (big-endian) + 1 byte for tearing where `0xBD` means tearing flag is not set.
+* CLI: cf `hf mfu ercnt`
+### 4028: MF0_NTAG_SET_COUNTER_DATA
+* Command: 1 byte where the lower 7 bits are the counter index and the top bit indicates whether tearing event flag should be reset + 3 bytes of the counter value (big-endian).
+* Response: no data
+* CLI: cf `hf mfu ewcnt`
+### 4029: MF0_NTAG_RESET_AUTH_CNT
+* Command: no data
+* Response: 1 byte for the old value of the unsuccessful auth counter.
+* CLI: cf `hf mfu econfig --reset-auth-cnt`
+### 4030: MF0_NTAG_GET_PAGE_COUNT
+* Command: no data
+* Response: 1 byte is the number of pages available in the current card slot
+* CLI: unused
 ### 5000: EM410X_SET_EMU_ID
 * Command: 5 bytes. `id[5]`. ID as 5 bytes.
 * Response: no data

docs/quickstart.md

@@ -9,8 +9,8 @@ Quickly get up and running with your Chameleon and no technical skill
    - [ChameleonUltraGUI on Windows](https://nightly.link/GameTec-live/ChameleonUltraGUI/workflows/build-app/main/windows-installer.zip) ([or without installer](https://nightly.link/GameTec-live/ChameleonUltraGUI/workflows/build-app/main/windows.zip))
    - [ChameleonUltraGUI on Linux](https://nightly.link/GameTec-live/ChameleonUltraGUI/workflows/build-app/main/linux.zip)
    - [ChameleonUltraGUI on macOS](https://apps.apple.com/app/chameleon-ultra-gui/id6462919364)
-   - [MTools Lite on iOS](https://apps.apple.com/app/mtools-ble-rfid-reader/id1531345398)
-   - [MTools Lite on Google Play](https://play.google.com/store/apps/details?id=com.mtoolstec.mtoolsLite) 
+   - [MTools BLE on App Store](https://apps.apple.com/app/mtools-ble-rfid-reader/id1531345398)
+   - [MTools BLE on Google Play](https://play.google.com/store/apps/details?id=com.mtoolstec.mtoolsLite) 
 
 2. Connect your Chameleon via USB or BLE
 

firmware/application/Makefile

@@ -28,7 +28,7 @@ SRC_FILES += \
   $(PROJ_DIR)/rfid/nfctag/hf/crypto1_helper.c \
   $(PROJ_DIR)/rfid/nfctag/hf/nfc_14a.c \
   $(PROJ_DIR)/rfid/nfctag/hf/nfc_mf1.c \
-  $(PROJ_DIR)/rfid/nfctag/hf/nfc_ntag.c \
+  $(PROJ_DIR)/rfid/nfctag/hf/nfc_mf0_ntag.c \
   $(PROJ_DIR)/rfid/nfctag/lf/lf_tag_em.c \
   $(PROJ_DIR)/utils/dataframe.c \
   $(PROJ_DIR)/utils/delayed_reset.c \