Skip to content

[Fix/Feature] Implement ISO-DEP Chaining & Integrated EMV Scanning Suite#400

Open
nieldk wants to merge 8 commits intoRfidResearchGroup:mainfrom
nieldk:main
Open

[Fix/Feature] Implement ISO-DEP Chaining & Integrated EMV Scanning Suite#400
nieldk wants to merge 8 commits intoRfidResearchGroup:mainfrom
nieldk:main

Conversation

@nieldk
Copy link
Copy Markdown
Contributor

@nieldk nieldk commented Apr 4, 2026

This PR addresses a critical limitation in the Chameleon Ultra’s NFC-A Level 4 (ISO-DEP) implementation and introduces a complete suite for EMV application scanning and emulation.
Previously, the firmware was unable to reassemble card responses exceeding the 64-byte hardware FIFO, causing truncation during PPSE and Record retrieval. This PR implements R(ACK) chaining and upgrades internal data handling to support large APDUs.
Key Technical Changes
Firmware (C)
• 16-bit Length Support: Upgraded internal response trackers (ppse_rlen, sel_rlen, gpo_rlen, rr_rlen) from uint8_t to uint16_t, removing the 255-byte logical ceiling.
• ISO-DEP Chaining: Added a robust R(ACK) loop to DATA_CMD_HF14A_4_READER_APDU. The firmware now correctly detects the "More Data" bit and requests subsequent blocks until reassembly is complete.
• Buffer Management: Introduced a resp_chain[512] reassembly buffer while maintaining the rbuf[64] window for RC522 hardware FIFO compatibility.
CLI (Python)
• emv scan: Automates the discovery of AIDs and the exhaustive retrieval of public card records.
• emv load: Enables loading captured EMV profiles directly into tag slots for emulation.
• Synchronized Parsing: Updated packet unpacking logic to match the 16-bit little-endian headers provided by the new firmware.
Hardware Performance & Compatibility
• Validated on DevKit: Successfully tested with Visa and Mastercard cards, retrieving full multi-block records that were previously unreachable.
• Standard CU Note: While the software logic is now correct for all models, the standard "small" CU remains physically sensitive to antenna noise during long chains. This PR ensures the software is no longer the bottleneck.
• Compatibility: Adheres strictly to ISO 14443-4. Note: This may impact legacy/non-compliant stacks (e.g., Windows Phone) that do not support extended frame sizes, a necessary trade-off for modern EMV research.

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 4, 2026

You are welcome to add an entry to the CHANGELOG.md as well

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 4, 2026

Built artifacts for commit 94c1203

Firmware

Client

@nieldk
Copy link
Copy Markdown
Contributor Author

nieldk commented Apr 4, 2026

To test:

  1. on PM3 first read and save the card
    emv scan -at ~/test.json /your EMV card should now be hold at the PM3
  2. on Chameleon (ULTRA)
    emv load -f ~/test.json -s 3 //slot 3 in the example
    hw slot change -s 3 //change to slot 3
    hw mode -e // Emulator mode
  3. Now you can do - on PM3, while presenting the CU (ULTRA) to PM3
    emv scan -at ~/test.json //this will show the CU (ULTRA) responding to the PM3

If you just want, short info, just use 'emv scan'

@GameTec-live GameTec-live added the testme! This PR is ready but just missing tests. Join in and help testing! label Apr 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

testme! This PR is ready but just missing tests. Join in and help testing!

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants