PM5: larger NG frames (4064)

[nieldk]

This raises PM3_CMD_DATA_SIZE to 4064 for PM5 only (guarded ON_DEVICE && !PM5).

The client sizes to the larger value and already clamps sends per-device via pm3_max_cmd_data_size(). 4064 is the ceiling that fits the ESP's 4096-byte app_com payload once NG framing (+12) is accounted for.

Also in this change:

PM5 stack raised to 64 KB in ldscript.defs.at32. The 4064-byte command buffers overflow the old stack and hardfault the device; this is where the RAM on a 512 KB part goes.
Clamp KEYS_IN_BLOCK and MFC_CHKKEYS_FAST_MAX_KEYS to 255. Their frame-derived counts now exceed 255 but land in uint8_t fields (keycnt / wire key_count), which would overflow/truncate.

[github-actions]

You are welcome to add an entry to the CHANGELOG.md as well

[doegox]

Hmm that breaks many commands that compute how much data they can send based on the PM3_CMD_DATA_SIZE

[nieldk]

hmm, it may not be a big task, let me look thru the source

[nieldk]

Hmm that breaks many commands that compute how much data they can send based on the PM3_CMD_DATA_SIZE

This is what i could find.

client/src/cmdhflegic.c
client/src/cmdfpga.c
client/src/cmdlf.c
client/src/cmdhficlass.c
client/src/cmdhfmf.c
client/src/cmdhfjooki.c
client/src/cmdhffelica.c
client/src/cmdhfmfu.c
client/src/cmdhf15.c
client/src/cmdhf14a.c
client/src/cmdhf14b.c
client/src/cmdlfem4x50.c
client/src/cmdhw.c
client/src/mifare/mifarehost.c

Can create a patch and apply

[doegox]

There are more places to check, everywhere PM3_CMD_DATA_SIZE is used in the client to prepare a buffer to be sent.

[nieldk]

There are more places to check, everywhere PM3_CMD_DATA_SIZE is used in the client to prepare a buffer to be sent.

Good, will check.
We will get this done, important work!

[nieldk]

@doegox pretty sure it’s complete now

[doegox]

I think cmdsmartcard.c line 1338 should be fixed too, even if not directly triggable

[doegox]

also cmdhfvas.c line 705

[doegox]

also cmdhfepa.c line 159

[doegox]

also cmdtrace.c download_trace()

[doegox]

cmdlf.c 363 the error message max length is wrong, should use m3_max_cmd_data_size() instead of sizeof(cmd)

[doegox]

[usb] pm3 --> lf sim
[=] converted Graphbuffer to bitstream values (0|1)
[=] .[!] ⚠️ Sending 4064 bytes of payload is too much for this device (max 624), abort

[doegox]

usart txhex -d 504d33620a80000000010100f09f988ef09fa5b3623300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
[!] ⚠️ Sending 635 bytes of payload is too much for this device (max 624), abort

usart tx -d
same thing

[doegox]

hf 14a apdu -sm 00A40400 -d 325041592E5359532E444446303100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 -el 65536

[!!] 🚨 UART:: write time-out
[!] ⚠️ command execution time out

[doegox]

mifarehost.c
uint8_t keyBlock[PM3_CMD_DATA_SIZE];
uint32_t max_keys = KEYS_IN_BLOCK;
uint8_t size = keycount - i > max_keys ? max_keys : keycount - i;

client/src/mifare/mifarehost.h
69:#define KEYS_IN_BLOCK MIN((PM3_CMD_DATA_SIZE - 5) / MIFARE_KEY_SIZE, 255)
=> max_keys not capped.

Beware a second client/src/mifarehost.c got introduced in the PR...

[doegox]

oops I almost pushed your branch to master when testing locally because your PR is on your master branch. Next time better to always create a new branch when you foresee a PR. It will also make your life easier to sync with the repo master as well after merge.

[nieldk]

[usb] pm3 --> lf sim [=] converted Graphbuffer to bitstream values (0|1) [=] .[!] ⚠️ Sending 4064 bytes of payload is too much for this device (max 624), abort

usart txhex -d 504d33620a80000000010100f09f988ef09fa5b3623300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
[!] ⚠️ Sending 635 bytes of payload is too much for this device (max 624), abort

usart tx -d
same thing

pm3 ?

[doegox]

[usb] pm3 --> lf sim [=] converted Graphbuffer to bitstream values (0|1) [=] .[!] ⚠️ Sending 4064 bytes of payload is too much for this device (max 624), abort

usart txhex -d
usart tx -d
same thing

pm3 ?

yes with Blueshark

[nieldk]

[usb] pm3 --> lf sim [=] converted Graphbuffer to bitstream values (0|1) [=] .[!] ⚠️ Sending 4064 bytes of payload is too much for this device (max 624), abort

usart txhex -d
usart tx -d
same thing

pm3 ?

yes with Blueshark

OK, been trhrough it all. I dont have my RDV4 (and Blueshark) with me.
It should be handled now