Merge remote-tracking branch 'xero/dev' into mntm-dev

Next-Flip · Jan 13, 2025 · e185f32 · e185f32
2 parents dbbecd9 + 56fe7b0
commit e185f32
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -55,6 +55,7 @@
 - OFW: GPIO: Fix USB UART Bridge Crash by increasing system stack size (by @Astrrra)
 - OFW: Loader: Fix BusFault in handling of OOM (by @Willy-JL)
 - NFC:
+  - XERO: Fix issue with MFC key recovery state machine performing key reuse early (by @noproto)
   - OFW: Plantain parser Last payment amount fix (by @mxcdoam)
   - OFW: Fix skylander ID reading (by @bettse)
   - OFW: Fix MIFARE Plus detection (by @GMMan)

diff --git a/lib/nfc/protocols/mf_classic/mf_classic_poller.c b/lib/nfc/protocols/mf_classic/mf_classic_poller.c
@@ -1921,7 +1921,8 @@ NfcCommand mf_classic_poller_handler_nested_controller(MfClassicPoller* instance
                         sizeof(MfClassicKey)) :
                     NULL;
         }
-        if((is_weak || is_last_iter_for_hard_key) && dict_attack_ctx->nested_nonce.count > 0) {
+        if((is_weak && (dict_attack_ctx->nested_nonce.count == 1)) ||
+           (is_last_iter_for_hard_key && (dict_attack_ctx->nested_nonce.count == 8))) {
             // Key verify and reuse
             dict_attack_ctx->nested_phase = MfClassicNestedPhaseDictAttackVerify;
             dict_attack_ctx->auth_passed = false;