Skip to content

feat: context-aware HF sniff frames annotation(#884) #885

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NaiveTomcat wants to merge 18 commits into
base: main
Choose a base branch
from
Open

feat: context-aware HF sniff frames annotation(#884) #885

Show file tree
Hide file tree
Changes from 14 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
80d7ae4
feat: context-aware HF sniff frames annotation(#884)
NaiveTomcat May 19, 2026
2374456
Potential fix for pull request finding
NaiveTomcat May 19, 2026
05e04d5
Resolving Copilot PR review messages
NaiveTomcat May 19, 2026
d3d5ddf
Resolving Copilot PR review message
NaiveTomcat May 19, 2026
09c1839
Apply suggestions from code review
NaiveTomcat May 19, 2026
91aad00
Resolving Copilot PR review messages
NaiveTomcat May 19, 2026
8385d24
Potential fix for pull request finding
NaiveTomcat May 19, 2026
376be74
Resolving Copilot PR review msgs
NaiveTomcat May 19, 2026
ce3a011
format
NaiveTomcat May 19, 2026
facbc2c
fix GET_VERSION matching to include length
NaiveTomcat May 19, 2026
cbca6ce
Resoiving Copilot review msgs
NaiveTomcat May 20, 2026
b310d19
Apply suggestions from code review
NaiveTomcat May 20, 2026
4874871
Resolving reveiw msgs
NaiveTomcat May 20, 2026
cec537b
Merge branch 'main' of https://github.com/NaiveTomcat/ChameleonUltraGUI
NaiveTomcat May 20, 2026
5065ca2
Apply suggestions from code review
NaiveTomcat May 20, 2026
63dbdd0
resolve review msgs
NaiveTomcat May 20, 2026
892e12d
format
NaiveTomcat May 20, 2026
ef3148a
fix: added length guard
NaiveTomcat May 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
248 changes: 8 additions & 240 deletions chameleonultragui/lib/helpers/hf_sniff.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,8 @@
import 'dart:typed_data';

enum HfSniffDirection { readerToCard, cardToReader }

class HfSniffFrame {
final int rawBitLength;
final int bitLength;
final Uint8List data;
final HfSniffDirection direction;

const HfSniffFrame({
required this.rawBitLength,
required this.bitLength,
required this.data,
required this.direction,
});

bool get isReaderToCard => direction == HfSniffDirection.readerToCard;

bool get isCardToReader => direction == HfSniffDirection.cardToReader;

String get hexString => _hex(data);
}
import 'package:chameleonultragui/helpers/hf_sniff_models.dart';
Comment thread
NaiveTomcat marked this conversation as resolved.
export 'package:chameleonultragui/helpers/hf_sniff_models.dart';
import 'package:chameleonultragui/helpers/hf_sniff_stateful_parser.dart';

class HfSniffAnnotatedFrame {
final HfSniffFrame frame;
Expand Down Expand Up @@ -183,45 +165,13 @@ List<HfSniffFrame> parseHf14aSniffFrames(Uint8List buffer) {
List<HfSniffAnnotatedFrame> annotateHf14aSniffFrames(
List<HfSniffFrame> frames) {
final annotated = <HfSniffAnnotatedFrame>[];
bool expectNt = false;
bool expectNrAr = false;
String? lastAuthKeyType;
int? lastAuthBlock;
final parser = StatefulHfParser();

for (final frame in frames) {
final data = frame.data;
String label;

if (frame.isReaderToCard &&
frame.bitLength == 32 &&
data.length == 4 &&
data.isNotEmpty &&
(data[0] == 0x60 || data[0] == 0x61)) {
lastAuthKeyType = data[0] == 0x60 ? 'A' : 'B';
lastAuthBlock = data[1];
expectNt = true;
expectNrAr = false;
label =
'MIFARE Classic AUTH Key$lastAuthKeyType block=0x${lastAuthBlock.toRadixString(16).padLeft(2, '0').toUpperCase()} ($lastAuthBlock)';
} else if (frame.isCardToReader &&
expectNt &&
frame.bitLength == 32 &&
data.length == 4) {
label = 'AUTH: NT (card nonce) = ${_hex(data, spaced: false)}';
expectNt = false;
expectNrAr = true;
} else if (frame.isReaderToCard &&
expectNrAr &&
frame.bitLength == 64 &&
data.length == 8) {
label =
'AUTH continuation: NR||AR (enc) NR=${_hex(Uint8List.fromList(data.sublist(0, 4)), spaced: false)} AR=${_hex(Uint8List.fromList(data.sublist(4, 8)), spaced: false)}';
expectNrAr = false;
} else {
expectNt = false;
expectNrAr = false;
label = _decodeHf14aFrame(frame);
}
// feed parser first to update context
parser.feedFrame(frame);
// ask parser to produce a context-aware label
final label = parser.annotateFrame(frame);
Comment thread
NaiveTomcat marked this conversation as resolved.

annotated.add(HfSniffAnnotatedFrame(frame: frame, label: label));
}
Comment thread
NaiveTomcat marked this conversation as resolved.
Expand Down Expand Up @@ -483,188 +433,6 @@ String buildHfSniffRawHexPreview(Uint8List data, {int maxBytes = 1024}) {
return (byteCount * 8, Uint8List.fromList(stripped));
}

String _decodeHf14aFrame(HfSniffFrame frame) {
final data = frame.data;
if (data.isEmpty) {
return '';
}

final b0 = data[0];
final bitLength = frame.bitLength;

if (bitLength == 16 && data.length == 2) {
const blocked = <int>{
0x93,
0x95,
0x97,
0x50,
0x60,
0x61,
0x30,
0xA0,
0xA2,
0xE0
};
if (!blocked.contains(data[0])) {
final atqa = data[0] | (data[1] << 8);
return 'ATQA (Answer To Request, Type A) = 0x${atqa.toRadixString(16).padLeft(4, '0').toUpperCase()}';
}
}

if (bitLength == 8 && data.length == 1) {
final sakType = _sakType(data[0]);
if (sakType != null) {
return 'SAK (Select Acknowledge) = 0x${data[0].toRadixString(16).padLeft(2, '0').toUpperCase()} [$sakType]';
}
return 'SAK (Select Acknowledge) = 0x${data[0].toRadixString(16).padLeft(2, '0').toUpperCase()}';
}

if (bitLength == 40 && data.length == 5) {
final calc = data[0] ^ data[1] ^ data[2] ^ data[3];
final uid = _hex(Uint8List.fromList(data.sublist(0, 4)), spaced: false);
if (calc == data[4]) {
return 'ANTICOLL CL1 response: UID=$uid BCC=0x${data[4].toRadixString(16).padLeft(2, '0').toUpperCase()} (OK)';
}
return 'ANTICOLL-like: UID=$uid BCC=0x${data[4].toRadixString(16).padLeft(2, '0').toUpperCase()}';
}

if (frame.rawBitLength == 7) {
if (b0 == 0x26) {
return 'REQA';
}
if (b0 == 0x52) {
return 'WUPA';
}
return 'short(0x${b0.toRadixString(16).padLeft(2, '0')})';
}

if (b0 == 0x93 || b0 == 0x95 || b0 == 0x97) {
final level = b0 == 0x93 ? 'CL1' : (b0 == 0x95 ? 'CL2' : 'CL3');
if (data.length > 1 && data[1] == 0x70) {
final uid =
data.length >= 6 ? _hex(Uint8List.fromList(data.sublist(2, 6))) : '';
return 'SELECT $level UID=$uid';
}
final nvb =
data.length > 1 ? data[1].toRadixString(16).padLeft(2, '0') : '';
return 'ANTICOLL $level NVB=$nvb';
}

if (b0 == 0x50) {
return 'HALT';
}
if (b0 == 0xC2) {
return 'S-DESELECT';
}
if (b0 == 0xD0) {
return data.length > 1
? 'PPS PPS1=${data[1].toRadixString(16).padLeft(2, '0')}'
: 'PPS';
}
if (b0 == 0xE0) {
final fsdi = data.length > 1 ? (data[1] >> 4) : 0;
final cid = data.length > 1 ? (data[1] & 0x0F) : 0;
return 'RATS FSDI=$fsdi CID=$cid';
}

if (b0 == 0x60) {
return data.length > 1 ? 'AUTH KeyA block=${data[1]}' : 'AUTH KeyA';
}
if (b0 == 0x61) {
return data.length > 1 ? 'AUTH KeyB block=${data[1]}' : 'AUTH KeyB';
}
if (bitLength == 72) {
return '(encrypted nonce - auth challenge/response)';
}
if (b0 == 0x30) {
return data.length > 1 ? 'READ block=${data[1]}' : 'READ';
}
if (b0 == 0xA0) {
return data.length > 1 ? 'WRITE block=${data[1]}' : 'WRITE';
}
if (b0 == 0x40) {
return 'MAGIC WUPC1';
}
if (b0 == 0x43) {
return 'MAGIC WUPC2';
}
if (b0 == 0x41) {
return 'MAGIC WIPE';
}

if (data.length >= 2 &&
(b0 == 0x00 || b0 == 0x80 || b0 == 0x90 || b0 == 0xA0)) {
final cla = data[0];
final ins = data[1];
final p1 = data.length > 2 ? data[2] : 0;
final p2 = data.length > 3 ? data[3] : 0;

if (cla == 0x00 && ins == 0xA4) {
if (data.length > 5 && data.length >= 5 + data[4]) {
final aid = Uint8List.fromList(data.sublist(5, 5 + data[4]));
final knownName = _knownAidName(aid);
final rawAid = _hex(aid).toUpperCase();
return knownName.isEmpty
? 'SELECT AID $rawAid'
: 'SELECT AID $rawAid ($knownName)';
}
return 'SELECT';
}
if (cla == 0x00 && ins == 0xB0) {
final offset = (p1 << 8) | p2;
final length = data.length > 4 ? data[4] : 0;
return 'READ BINARY off=$offset len=$length';
}
if (cla == 0x00 && ins == 0xB2) {
return 'READ RECORD SFI=${p2 >> 3} rec=$p1';
}
if (cla == 0x80 && ins == 0xCA) {
final tag = (p1 << 8) | p2;
final name = _knownBerTag(tag);
return name == null
? 'GET DATA ${p1.toRadixString(16).padLeft(2, '0')}${p2.toRadixString(16).padLeft(2, '0')}'
: 'GET DATA ${p1.toRadixString(16).padLeft(2, '0')}${p2.toRadixString(16).padLeft(2, '0')} ($name)';
}
if (cla == 0x80 && ins == 0xA8) {
return 'GPO (Get Processing Options)';
}
if (cla == 0x80 && ins == 0xAE) {
final request = switch (p1 & 0xC0) {
0x00 => 'AAC',
0x40 => 'TC',
0x80 => 'ARQC',
_ => 'AC/${p1.toRadixString(16).padLeft(2, '0')}',
};
return 'GENERATE AC requesting $request';
}
if (cla == 0x00 && ins == 0x20) {
return 'VERIFY PIN';
}
if (cla == 0x00 && ins == 0x88) {
return 'INTERNAL AUTH';
}
if (cla == 0x00 && ins == 0x82) {
return 'EXTERNAL AUTH';
}
if (cla == 0x00 && ins == 0x70) {
return 'MANAGE CHANNEL';
}
return 'APDU CLA=${cla.toRadixString(16).padLeft(2, '0')} INS=${ins.toRadixString(16).padLeft(2, '0')} P1=${p1.toRadixString(16).padLeft(2, '0')} P2=${p2.toRadixString(16).padLeft(2, '0')}';
}

for (final swOffset in const <int>[-2, -4]) {
if (data.length >= swOffset.abs()) {
final label = _decodeSw(
data[data.length + swOffset], data[data.length + swOffset + 1]);
if (label != null) {
return 'SW ${data[data.length + swOffset].toRadixString(16).padLeft(2, '0').toUpperCase()} ${data[data.length + swOffset + 1].toRadixString(16).padLeft(2, '0').toUpperCase()} $label';
}
}
}

return 'unknown (0x${b0.toRadixString(16).padLeft(2, '0')})';
}

String _hex(Uint8List data, {bool spaced = true}) {
final separator = spaced ? ' ' : '';
return data
Expand Down
24 changes: 24 additions & 0 deletions chameleonultragui/lib/helpers/hf_sniff_models.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
import 'dart:typed_data';

enum HfSniffDirection { readerToCard, cardToReader }

class HfSniffFrame {
final int rawBitLength;
final int bitLength;
final Uint8List data;
final HfSniffDirection direction;

const HfSniffFrame({
required this.rawBitLength,
required this.bitLength,
required this.data,
required this.direction,
});

bool get isReaderToCard => direction == HfSniffDirection.readerToCard;

bool get isCardToReader => direction == HfSniffDirection.cardToReader;

String get hexString =>
data.map((b) => b.toRadixString(16).padLeft(2, '0')).join(' ');
Comment thread
NaiveTomcat marked this conversation as resolved.
Outdated
}
Loading
Loading