Skip to content

Conversation

@nvx
Copy link
Collaborator

@nvx nvx commented Aug 18, 2025

preivously the ATS was always filled with the ATQA which caused some oddities with DESFire EV2 and newer cards

this change populates the ATS which removes the need for the EV2 workaround

for Seos cards however the ATS does not appear to be being returned by the flipper firmware (perhaps an upstream bug?) but for Seos the ATS doesn't matter as long as "something" is present, so we retain the previous behaviour of filling in the ATQA for part4 cards

tested with defire ev3, ev1, and seos cards and all read fine now

@netlify
Copy link

netlify bot commented Aug 18, 2025

Deploy Preview for seader canceled.

Name Link
🔨 Latest commit 5e02c73
🔍 Latest deploy log https://app.netlify.com/projects/seader/deploys/68a5b9061172620008481099

preivously the ATS was always filled with the ATQA which caused
some oddities with DESFire EV2 and newer cards

this change populates the ATS which removes the need for the EV2
workaround

for Seos cards however the ATS does not appear to be being returned
by the flipper firmware (perhaps an upstream bug?) but for Seos the
ATS doesn't matter as long as "something" is present, so we retain
the previous behaviour of filling in the ATQA for part4 cards
@nvx
Copy link
Collaborator Author

nvx commented Aug 18, 2025

damn vscode not agreeing with ufbt format

Copy link
Owner

@bettse bettse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested with iclass se 🎉 , seos(aes) 🎉 , seos(des) 🎉 , cresendo(seos) 🎉 , desfire ev1 🎉 , and desfire ev2 🎉

bit_buffer_append_bytes(tx_buffer, buffer, len);
if(seader->credential->isDesfireEV2 && sizeof(select_desfire_app_no_le) == len &&
memcmp(buffer, select_desfire_app_no_le, len) == 0) {
// If a DESFire EV2 card has previously sent a dodgy reply to a SELECT SeosApp
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes you wonder how the hell the readers do it

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Newer SAM firmware seems to avoid doing the SELECT SeosApp on DESFire cards in the first place, like I can replicate that via Seader even so it's not like we're just talking to the SAM wrong. The question is how it's identifying it, it doesn't have access to the ATQA, and oddly the ATS doesn't seem to matter for the most part either which really just leaves the fact it's a 14443a-4 card, the SAK, and the UID - none of which seems like it would be a reliable indicator, but perhaps the UID is more reliable than expected if you have full NXP datasheets or something.

// a FILD_NOT_FOUND response instead of the real response
if(sizeof(select_seos_app) == len && memcmp(buffer, select_seos_app, len) == 0 &&
bit_buffer_get_size_bytes(rx_buffer) == 38) {
const uint8_t ev2_select_reply_prefix[] = {0x6F, 0x22, 0x85, 0x20};
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I try to put these at the top of the file, but it's not a blocker

@bettse bettse merged commit 98eaa52 into main Aug 20, 2025
6 checks passed
@bettse bettse deleted the fix-ats branch August 20, 2025 23:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants