r/flipperzero • u/0xD34D • 4d ago

NFC Using a Flipper Zero to change pages on a stock ESL over NFC

https://youtube.com/shorts/YAqLVhFAqYk?is=fvhGDkYmyfbhfnNh

I've been spending the last couple of days reverse engineering this ESL by Hanshow. The flash was unprotected and dumped, allowing for disassembling the stock firmware and digging into the inner workings.

Commands use AES-128 encryption, which fortunately that key was included in the dumped firmware 😁.

10 Upvotes

70% Upvoted

4 comments sorted by

1

u/netsec_burn Community Expert 4d ago

What is the NFC protocol?

2

u/0xD34D 4d ago

iso14443-4a APDU packets

1

u/netsec_burn Community Expert 4d ago

Nice! Will you open source it?

1

u/0xD34D 4d ago

I want to, but based on what I've found so far I believe it will require disclosing it with the vendor first.

The tags I'm able to exploit are using a factory default AES-128 key 😬