#436 - Add --nopwd option for T55xx em410x write

Add a --nopwd flag to `lf em410x write` that leaves the written T55xx tag
password-free instead of applying the default password.

- Firmware: clear the T5577 PWD config bit in block 0 when the key is zero,
  so the tag is left unprotected.
- Client: add a no_pwd parameter to em410x_write_to_t55xx and a --nopwd flag.
- Include the default password in the unlock key list so a tag previously
  locked by this tool can be freed by a --nopwd write.

Author: naaraxi

firmware/application/src/rfid/reader/lf/lf_reader_main.c

@@ -131,6 +131,11 @@ static void try_reset_t55xx_passwd(uint32_t new_passwd, uint8_t *old_passwds, ui
 static uint8_t write_t55xx(uint32_t *blks, uint8_t blk_count, uint8_t *new_passwd, uint8_t *old_passwds, uint8_t old_passwd_count) {
     uint32_t passwd = bytes_to_num(new_passwd, 4);
 
+    // No password: clear the PWD bit in block 0
+    if (passwd == 0) {
+        blks[0] &= ~T5577_PWD;
+    }
+
     start_lf_125khz_radio();
     bsp_delay_ms(1);  // Delays for a while after starting the field
 

software/script/chameleon_cli_unit.py

@@ -5797,7 +5797,10 @@ class LFEM410xWriteT55xx(LFEMIdArgsUnit, ReaderRequiredUnit):
     def args_parser(self) -> ArgumentParserNoExit:
         parser = ArgumentParserNoExit()
         parser.description = "Write em410x id to t55xx"
-        return self.add_card_arg(parser, required=True)
+        parser = self.add_card_arg(parser, required=True)
+        parser.add_argument("--nopwd", action="store_true",
+                            help="Leave the T55xx password-free")
+        return parser
 
     def on_exec(self, args: argparse.Namespace):
         id_hex = args.id
@@ -5806,8 +5809,8 @@ def on_exec(self, args: argparse.Namespace):
                 "Writing to T55xx supports 5-byte EM410X (10 hex) or 13-byte Electra (26 hex) IDs."
             )
         id_bytes = bytes.fromhex(id_hex)
-        self.cmd.em410x_write_to_t55xx(id_bytes)
-        print(f" - EM410x ID write done: {id_hex}")
+        self.cmd.em410x_write_to_t55xx(id_bytes, no_pwd=args.nopwd)
+        print(f" - EM410x ID write done: {id_hex}" + (" (no password)" if args.nopwd else ""))
 
 
 @lf_hid_prox.command("read")

software/script/chameleon_cmd.py

@@ -11,7 +11,8 @@
 CURRENT_VERSION_SETTINGS = 6
 
 new_key = b'\x20\x20\x66\x66'
-old_keys = [b'\x51\x24\x36\x48', b'\x19\x92\x04\x27']
+# Passwords tried to unlock a protected T55xx (includes the default new_key)
+old_keys = [b'\x51\x24\x36\x48', b'\x19\x92\x04\x27', b'\x20\x20\x66\x66']
 
 
 class ChameleonCMD:
@@ -615,18 +616,20 @@ def em410x_scan(self):
         return resp
 
     @expect_response(Status.LF_TAG_OK)
-    def em410x_write_to_t55xx(self, id_bytes: bytes):
+    def em410x_write_to_t55xx(self, id_bytes: bytes, no_pwd: bool = False):
         """
         Write EM410X card number into T55XX.
 
         :param id_bytes: ID card number
+        :param no_pwd: if True, leave the tag password-free
         :return:
         """
+        key = b'\x00\x00\x00\x00' if no_pwd else new_key
         if len(id_bytes) == 5:
-            data = struct.pack(f'!5s4s{4*len(old_keys)}s', id_bytes, new_key, b''.join(old_keys))
+            data = struct.pack(f'!5s4s{4*len(old_keys)}s', id_bytes, key, b''.join(old_keys))
             return self.device.send_cmd_sync(Command.EM410X_WRITE_TO_T55XX, data)
         if len(id_bytes) == 13:
-            data = struct.pack(f'!13s4s{4*len(old_keys)}s', id_bytes, new_key, b''.join(old_keys))
+            data = struct.pack(f'!13s4s{4*len(old_keys)}s', id_bytes, key, b''.join(old_keys))
             return self.device.send_cmd_sync(Command.EM410X_ELECTRA_WRITE_TO_T55XX, data)
         raise ValueError("The id bytes length must equal 5 (EM410X) or 13 (Electra)")