Eric Betts bettse

Reverse Engineered VAS Protocol Specification

Research by Grayson Martin
Last Updated 7/8/23

Introduction

Value Added Services (VAS) is the protocol used by NFC capable passes in Apple Wallet. Access to this protocol is heavily restricted on both the device end (a special certificate issued by Apple is required to create these passes) and the reader end (NDA enforced confidentiality). As such, a desire arose to better understand the protocol in order to explore additional use cases and examine its cryptographic integrity. There are gaps in understanding in certain parts of this protocol, however this document contains the minimum necessary understanding to automatically select, read data from, and decrypt a pass.

Importantly, this specification does not enable a malicious actor to read the data from a pass for which they do not have both the reader's private key, and the pass type identifier. Imp

Using pioasm in platformio projects

Here is somethig you might find useful: automatic pio assembly -> h file generation for platformio.
I have tested it on Linux only.

This is the state as of Nov 2022. The arduino core for RP2040 will most likely change in the future and make this method obsolete.

Step 1:

Contrary to the docs, stating the pioasm is installed together with the dev platform:
https://registry.platformio.org/tools/earlephilhower/tool-pioasm-rp2040-earlephilhower/installation
the json file
https://github.com/maxgerhardt/platform-raspberrypi/blob/develop/platform.json

Mifare Classic - SAK Swapping Explained

What is SAK Swapping

Behaviour has been observered where some system using Mifare Classic credentials will identify with one SAK (0x08/18) on a basic search (Wake up) but when the block 0 is dumped, the SAK appears to be different (0x88/0x98)

This is because the SAK reported on a Wake up is not coming from Block 0 but is instead burned into the card, The SAK in Block 0 is merely a Vanity SAK.

If the dump is loaded onto a Magic Mifare Classic that Mirrors the vanity SAK as the actual SAK on Wake up it will tell the system that the credential is a duplicate & to deny access.

A list of rewritable RFID blanks that are compatible with Flipper Zero.

X indicates a particular protocol is writable.

? indicates it is unknown if a particular protocol is writable.

Brand	Type	Chip	EM4100	H10301	Indala26	IoProxXSF	AWID	FDX-A	FDX-B	HIDProx	HIDExt	Pyramid	Viking	Jablotron	Paradox	PAC/Stanley	Keri	Gallagher
ETEKJOY	Fob	EM4305	X		X	X							X	X			X

How to copy, read and write Paxton fobs and cards with an RFIDler

A newer version of this info is available at https://badcfe.org/how-to-paxton-with-rfidler/

Paxton fobs and readers are popular in the UK especially the Net2 system where the fobs look like this with a blue ring:

Paxton readers often look like this:

Easy Amiibo Emulation - https://bit.ly/2z0m09k

(^ that's a short-link to this page, so you can open it in Linux)

Some users are discussing this guide in #hacking on the JoyConDroid Discord: https://discord.gg/SQNEx9v.

DO NOT ask for, or share links to, Amiibo bins in the comments! They will be removed. Thank you for understanding.

(Windows|Linux PC) + JoyControl + Bluetooth = AMIIBO EMULATION

This gist is to configure a Mosquitto MQTT Broker behind a Traefik reverse-proxy, both in a docker container. Mosquitto will be configuread as a TCP Service.

This is a simple configuration used on the same single server. Probably to be adapted for other cases. Having mosquitto behind a reverse proxy enables you to configure TLS on Traefik (likely you already do that for other applications as well) and to load balance different MQTT instances, but that goes beyond this gist.

As noted in Traefik docs, in the router you must use the rule HostSNI(`*`) when using non-TLS routers like in this example. Ref. https://docs.traefik.io/routing/routers/#rule_1

docker-compose.yml

Get a Bot Token

As your keybase user run:

$ keybase bot token create > /tmp/bot-token

You'll get back a base64 token, like: 6C37sjCBgMNf06Z6oTgixIxHJpja8G-Qp. This is your bot token that allows you to sign up bots.

	# official docs: https://graphql-ruby.org/dataloader/sources.html

	# app/graphql/sources/association.rb
	class Sources::Association < ::GraphQL::Dataloader::Source
	def initialize(association_name, scope = nil)
	@association_name = association_name
	@scope = scope
	end

	def fetch(records)

	// Usage: swift remove_alpha_channel.swift filename.png

	import Foundation
	import CoreImage

	let arguments = CommandLine.arguments
	let filename = arguments[1]

	let dataProvider = CGDataProvider(filename: filename)!
	let cgImage = CGImage(pngDataProviderSource: dataProvider, decode: nil, shouldInterpolate: true, intent: .defaultIntent)!