]>
Commit | Line | Data |
---|---|---|
8556b852 | 1 | //-----------------------------------------------------------------------------\r |
b62a5a84 | 2 | // Merlok - June 2011, 2012\r |
8556b852 M |
3 | // Gerhard de Koning Gans - May 2008\r |
4 | // Hagen Fritsch - June 2010\r | |
3fe4ff4f | 5 | // Midnitesnake - Dec 2013\r |
6 | // Andy Davies - Apr 2014\r | |
7 | // Iceman - May 2014\r | |
8556b852 M |
8 | //\r |
9 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
10 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
11 | // the license.\r | |
12 | //-----------------------------------------------------------------------------\r | |
13 | // Routines to support ISO 14443 type A.\r | |
14 | //-----------------------------------------------------------------------------\r | |
15 | \r | |
16 | #include "mifarecmd.h"\r | |
17 | #include "apps.h"\r | |
787b5bd8 | 18 | #include "util.h"\r |
8556b852 | 19 | \r |
a631936e | 20 | #include "crc.h"\r |
21 | \r | |
f168b263 | 22 | // the block number for the ISO14443-4 PCB\r |
23 | uint8_t pcb_blocknum = 0;\r | |
24 | // Deselect card by sending a s-block. the crc is precalced for speed\r | |
25 | static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};\r | |
26 | \r | |
27 | \r | |
8556b852 | 28 | //-----------------------------------------------------------------------------\r |
baeaf579 | 29 | // Select, Authenticate, Read a MIFARE tag. \r |
8556b852 M |
30 | // read block\r |
31 | //-----------------------------------------------------------------------------\r | |
32 | void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
33 | {\r | |
34 | // params\r | |
35 | uint8_t blockNo = arg0;\r | |
36 | uint8_t keyType = arg1;\r | |
37 | uint64_t ui64Key = 0;\r | |
38 | ui64Key = bytes_to_num(datain, 6);\r | |
39 | \r | |
40 | // variables\r | |
41 | byte_t isOK = 0;\r | |
42 | byte_t dataoutbuf[16];\r | |
1c611bbd | 43 | uint8_t uid[10];\r |
8556b852 M |
44 | uint32_t cuid;\r |
45 | struct Crypto1State mpcs = {0, 0};\r | |
46 | struct Crypto1State *pcs;\r | |
47 | pcs = &mpcs;\r | |
48 | \r | |
49 | // clear trace\r | |
3000dc4e | 50 | clear_trace();\r |
7bc95e2e | 51 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
52 | \r |
53 | LED_A_ON();\r | |
54 | LED_B_OFF();\r | |
55 | LED_C_OFF();\r | |
56 | \r | |
57 | while (true) {\r | |
58 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
baeaf579 | 59 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
8556b852 M |
60 | break;\r |
61 | };\r | |
62 | \r | |
63 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
baeaf579 | 64 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
8556b852 M |
65 | break;\r |
66 | };\r | |
67 | \r | |
68 | if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r | |
baeaf579 | 69 | if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r |
8556b852 M |
70 | break;\r |
71 | };\r | |
72 | \r | |
73 | if(mifare_classic_halt(pcs, cuid)) {\r | |
baeaf579 | 74 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 M |
75 | break;\r |
76 | };\r | |
77 | \r | |
78 | isOK = 1;\r | |
79 | break;\r | |
80 | }\r | |
81 | \r | |
82 | // ----------------------------- crypto1 destroy\r | |
83 | crypto1_destroy(pcs);\r | |
84 | \r | |
85 | if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r | |
86 | \r | |
8556b852 | 87 | LED_B_ON();\r |
baeaf579 | 88 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r |
8556b852 M |
89 | LED_B_OFF();\r |
90 | \r | |
a631936e | 91 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
92 | LEDsoff();\r | |
93 | }\r | |
94 | \r | |
8258f409 | 95 | void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){\r |
a631936e | 96 | \r |
8258f409 | 97 | bool turnOffField = (arg0 == 1);\r |
a631936e | 98 | \r |
f168b263 | 99 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r |
3000dc4e | 100 | clear_trace();\r |
a631936e | 101 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
102 | \r | |
8258f409 | 103 | if(!iso14443a_select_card(NULL, NULL, NULL)) {\r |
f168b263 | 104 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r |
105 | OnError(0);\r | |
a631936e | 106 | return;\r |
107 | };\r | |
108 | \r | |
9d87eb66 | 109 | if(!mifare_ultra_auth(keybytes)){\r |
8258f409 | 110 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");\r |
f168b263 | 111 | OnError(1);\r |
a631936e | 112 | return;\r |
113 | }\r | |
114 | \r | |
8258f409 | 115 | if (turnOffField) {\r |
cceabb79 | 116 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
117 | LEDsoff();\r | |
118 | }\r | |
9d87eb66 | 119 | cmd_send(CMD_ACK,1,0,0,0,0);\r |
7cc204bf | 120 | }\r |
121 | \r | |
75377d29 | 122 | // Arg0 = BlockNo,\r |
123 | // Arg1 = UsePwd bool\r | |
124 | // datain = PWD bytes,\r | |
f168b263 | 125 | void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r |
7cc204bf | 126 | {\r |
7cc204bf | 127 | uint8_t blockNo = arg0;\r |
787b5bd8 | 128 | byte_t dataout[16] = {0x00};\r |
8258f409 | 129 | bool useKey = (arg1 == 1); //UL_C\r |
130 | bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r | |
f168b263 | 131 | \r |
75377d29 | 132 | LEDsoff();\r |
133 | LED_A_ON();\r | |
3000dc4e | 134 | clear_trace();\r |
787b5bd8 | 135 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
f168b263 | 136 | \r |
8258f409 | 137 | int len = iso14443a_select_card(NULL, NULL, NULL);\r |
787b5bd8 | 138 | if(!len) {\r |
f168b263 | 139 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r |
140 | OnError(1);\r | |
787b5bd8 | 141 | return;\r |
f168b263 | 142 | }\r |
143 | \r | |
8258f409 | 144 | // UL-C authentication\r |
145 | if ( useKey ) {\r | |
146 | uint8_t key[16] = {0x00};\r | |
147 | memcpy(key, datain, sizeof(key) );\r | |
f168b263 | 148 | \r |
9d87eb66 | 149 | if ( !mifare_ultra_auth(key) ) {\r |
f168b263 | 150 | OnError(1);\r |
151 | return;\r | |
152 | }\r | |
8258f409 | 153 | }\r |
f168b263 | 154 | \r |
8258f409 | 155 | // UL-EV1 / NTAG authentication\r |
156 | if ( usePwd ) {\r | |
157 | uint8_t pwd[4] = {0x00};\r | |
158 | memcpy(pwd, datain, 4);\r | |
159 | uint8_t pack[4] = {0,0,0,0};\r | |
9d87eb66 | 160 | if (!mifare_ul_ev1_auth(pwd, pack)) {\r |
f168b263 | 161 | OnError(1);\r |
162 | return;\r | |
163 | }\r | |
8258f409 | 164 | } \r |
f168b263 | 165 | \r |
f168b263 | 166 | if( mifare_ultra_readblock(blockNo, dataout) ) {\r |
167 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r | |
168 | OnError(2);\r | |
787b5bd8 | 169 | return;\r |
f168b263 | 170 | }\r |
8258f409 | 171 | \r |
f168b263 | 172 | if( mifare_ultra_halt() ) {\r |
173 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r | |
174 | OnError(3);\r | |
787b5bd8 | 175 | return;\r |
f168b263 | 176 | }\r |
8258f409 | 177 | \r |
178 | cmd_send(CMD_ACK,1,0,0,dataout,16);\r | |
7cc204bf | 179 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
180 | LEDsoff();\r | |
181 | }\r | |
b3125340 | 182 | \r |
7cc204bf | 183 | //-----------------------------------------------------------------------------\r |
baeaf579 | 184 | // Select, Authenticate, Read a MIFARE tag. \r |
185 | // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r | |
8556b852 M |
186 | //-----------------------------------------------------------------------------\r |
187 | void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
188 | {\r | |
189 | // params\r | |
190 | uint8_t sectorNo = arg0;\r | |
191 | uint8_t keyType = arg1;\r | |
192 | uint64_t ui64Key = 0;\r | |
193 | ui64Key = bytes_to_num(datain, 6);\r | |
194 | \r | |
195 | // variables\r | |
3fe4ff4f | 196 | byte_t isOK = 0;\r |
baeaf579 | 197 | byte_t dataoutbuf[16 * 16];\r |
1c611bbd | 198 | uint8_t uid[10];\r |
8556b852 M |
199 | uint32_t cuid;\r |
200 | struct Crypto1State mpcs = {0, 0};\r | |
201 | struct Crypto1State *pcs;\r | |
202 | pcs = &mpcs;\r | |
203 | \r | |
204 | // clear trace\r | |
3000dc4e | 205 | clear_trace();\r |
8556b852 | 206 | \r |
7bc95e2e | 207 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
208 | \r |
209 | LED_A_ON();\r | |
210 | LED_B_OFF();\r | |
211 | LED_C_OFF();\r | |
212 | \r | |
baeaf579 | 213 | isOK = 1;\r |
214 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
215 | isOK = 0;\r | |
8556b852 | 216 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
baeaf579 | 217 | }\r |
8556b852 | 218 | \r |
baeaf579 | 219 | \r |
220 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r | |
221 | isOK = 0;\r | |
8556b852 | 222 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
baeaf579 | 223 | }\r |
224 | \r | |
225 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
226 | if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r | |
227 | isOK = 0;\r | |
228 | if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r | |
8556b852 | 229 | break;\r |
baeaf579 | 230 | }\r |
231 | }\r | |
8556b852 | 232 | \r |
baeaf579 | 233 | if(mifare_classic_halt(pcs, cuid)) {\r |
8556b852 | 234 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 | 235 | }\r |
baeaf579 | 236 | \r |
8556b852 M |
237 | // ----------------------------- crypto1 destroy\r |
238 | crypto1_destroy(pcs);\r | |
239 | \r | |
240 | if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r | |
241 | \r | |
8556b852 | 242 | LED_B_ON();\r |
baeaf579 | 243 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r |
6e82300d | 244 | LED_B_OFF();\r |
8556b852 M |
245 | \r |
246 | // Thats it...\r | |
247 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
248 | LEDsoff();\r | |
7cc204bf | 249 | }\r |
250 | \r | |
75377d29 | 251 | void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r |
7cc204bf | 252 | {\r |
f168b263 | 253 | // params\r |
75377d29 | 254 | uint8_t blockNo = arg0;\r |
255 | uint16_t blocks = arg1;\r | |
cceabb79 | 256 | bool useKey = (arg2 == 1); //UL_C\r |
257 | bool usePwd = (arg2 == 2); //UL_EV1/NTAG\r | |
9d87eb66 | 258 | uint32_t countblocks = 0;\r |
259 | uint8_t *dataout = BigBuf_get_addr();\r | |
7cc204bf | 260 | \r |
92690507 | 261 | LEDsoff();\r |
262 | LED_A_ON();\r | |
3000dc4e | 263 | clear_trace();\r |
787b5bd8 | 264 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 265 | \r |
92690507 | 266 | int len = iso14443a_select_card(NULL, NULL, NULL);\r |
787b5bd8 | 267 | if (!len) {\r |
f168b263 | 268 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r |
269 | OnError(1);\r | |
787b5bd8 | 270 | return;\r |
271 | }\r | |
75377d29 | 272 | \r |
8258f409 | 273 | // UL-C authentication\r |
75377d29 | 274 | if ( useKey ) {\r |
275 | uint8_t key[16] = {0x00};\r | |
8258f409 | 276 | memcpy(key, datain, sizeof(key) );\r |
75377d29 | 277 | \r |
9d87eb66 | 278 | if ( !mifare_ultra_auth(key) ) {\r |
75377d29 | 279 | OnError(1);\r |
280 | return;\r | |
281 | }\r | |
75377d29 | 282 | }\r |
283 | \r | |
8258f409 | 284 | // UL-EV1 / NTAG authentication\r |
285 | if (usePwd) {\r | |
286 | uint8_t pwd[4] = {0x00};\r | |
287 | memcpy(pwd, datain, sizeof(pwd));\r | |
cceabb79 | 288 | uint8_t pack[4] = {0,0,0,0};\r |
289 | \r | |
9d87eb66 | 290 | if (!mifare_ul_ev1_auth(pwd, pack)){\r |
cceabb79 | 291 | OnError(1);\r |
cceabb79 | 292 | return; \r |
293 | }\r | |
294 | }\r | |
295 | \r | |
75377d29 | 296 | for (int i = 0; i < blocks; i++){\r |
9d87eb66 | 297 | if ((i*4) + 4 > BigBuf_get_traceLen()) {\r |
298 | Dbprintf("Data exceeds buffer!!");\r | |
299 | break;\r | |
300 | }\r | |
301 | \r | |
302 | len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);\r | |
75377d29 | 303 | \r |
787b5bd8 | 304 | if (len) {\r |
f168b263 | 305 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r |
9d87eb66 | 306 | // if no blocks read - error out\r |
307 | if (i==0){\r | |
308 | OnError(2);\r | |
309 | return;\r | |
310 | } else {\r | |
311 | //stop at last successful read block and return what we got\r | |
312 | break;\r | |
313 | }\r | |
787b5bd8 | 314 | } else {\r |
75377d29 | 315 | countblocks++;\r |
787b5bd8 | 316 | }\r |
317 | }\r | |
75377d29 | 318 | \r |
f168b263 | 319 | len = mifare_ultra_halt();\r |
787b5bd8 | 320 | if (len) {\r |
f168b263 | 321 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r |
322 | OnError(3);\r | |
787b5bd8 | 323 | return;\r |
324 | }\r | |
7cc204bf | 325 | \r |
75377d29 | 326 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);\r |
327 | \r | |
9d87eb66 | 328 | countblocks *= 4;\r |
329 | cmd_send(CMD_ACK, 1, countblocks, countblocks, 0, 0);\r | |
31d1caa5 MHS |
330 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
331 | LEDsoff();\r | |
7cc204bf | 332 | }\r |
333 | \r | |
7cc204bf | 334 | //-----------------------------------------------------------------------------\r |
baeaf579 | 335 | // Select, Authenticate, Write a MIFARE tag. \r |
7cc204bf | 336 | // read block\r |
8556b852 M |
337 | //-----------------------------------------------------------------------------\r |
338 | void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
339 | {\r | |
340 | // params\r | |
341 | uint8_t blockNo = arg0;\r | |
342 | uint8_t keyType = arg1;\r | |
343 | uint64_t ui64Key = 0;\r | |
344 | byte_t blockdata[16];\r | |
345 | \r | |
346 | ui64Key = bytes_to_num(datain, 6);\r | |
347 | memcpy(blockdata, datain + 10, 16);\r | |
348 | \r | |
349 | // variables\r | |
350 | byte_t isOK = 0;\r | |
1c611bbd | 351 | uint8_t uid[10];\r |
8556b852 M |
352 | uint32_t cuid;\r |
353 | struct Crypto1State mpcs = {0, 0};\r | |
354 | struct Crypto1State *pcs;\r | |
355 | pcs = &mpcs;\r | |
356 | \r | |
357 | // clear trace\r | |
3000dc4e | 358 | clear_trace();\r |
8556b852 | 359 | \r |
7bc95e2e | 360 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
361 | \r |
362 | LED_A_ON();\r | |
363 | LED_B_OFF();\r | |
364 | LED_C_OFF();\r | |
365 | \r | |
366 | while (true) {\r | |
367 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
368 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
369 | break;\r | |
370 | };\r | |
371 | \r | |
372 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
373 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r | |
374 | break;\r | |
375 | };\r | |
376 | \r | |
377 | if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r | |
378 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
379 | break;\r | |
380 | };\r | |
381 | \r | |
382 | if(mifare_classic_halt(pcs, cuid)) {\r | |
383 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
384 | break;\r | |
385 | };\r | |
386 | \r | |
387 | isOK = 1;\r | |
388 | break;\r | |
389 | }\r | |
390 | \r | |
391 | // ----------------------------- crypto1 destroy\r | |
392 | crypto1_destroy(pcs);\r | |
393 | \r | |
394 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
395 | \r | |
8556b852 | 396 | LED_B_ON();\r |
9492e0b0 | 397 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r |
6e82300d | 398 | LED_B_OFF();\r |
8556b852 M |
399 | \r |
400 | \r | |
401 | // Thats it...\r | |
402 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
403 | LEDsoff();\r | |
7cc204bf | 404 | }\r |
405 | \r | |
406 | void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)\r | |
407 | {\r | |
f168b263 | 408 | uint8_t blockNo = arg0;\r |
787b5bd8 | 409 | byte_t blockdata[16] = {0x00};\r |
7cc204bf | 410 | \r |
f168b263 | 411 | memcpy(blockdata, datain, 16);\r |
412 | \r | |
787b5bd8 | 413 | uint8_t uid[10] = {0x00};\r |
7cc204bf | 414 | \r |
f168b263 | 415 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r |
7cc204bf | 416 | \r |
f168b263 | 417 | clear_trace();\r |
418 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r | |
419 | \r | |
420 | if(!iso14443a_select_card(uid, NULL, NULL)) {\r | |
421 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
422 | OnError(0);\r | |
423 | return;\r | |
424 | };\r | |
425 | \r | |
426 | if(mifare_ultra_writeblock(blockNo, blockdata)) {\r | |
427 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
428 | OnError(0);\r | |
429 | return; };\r | |
430 | \r | |
431 | if(mifare_ultra_halt()) {\r | |
432 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
433 | OnError(0);\r | |
434 | return;\r | |
435 | };\r | |
436 | \r | |
437 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
438 | \r | |
439 | cmd_send(CMD_ACK,1,0,0,0,0);\r | |
440 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
441 | LEDsoff();\r | |
7cc204bf | 442 | }\r |
443 | \r | |
444 | void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)\r | |
445 | {\r | |
baeaf579 | 446 | uint8_t blockNo = arg0;\r |
787b5bd8 | 447 | byte_t blockdata[4] = {0x00};\r |
7cc204bf | 448 | \r |
8258f409 | 449 | memcpy(blockdata, datain,4);\r |
f168b263 | 450 | \r |
8258f409 | 451 | LEDsoff();\r |
452 | LED_A_ON();\r | |
f168b263 | 453 | clear_trace();\r |
454 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r | |
455 | \r | |
8258f409 | 456 | if(!iso14443a_select_card(NULL, NULL, NULL)) {\r |
f168b263 | 457 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
458 | OnError(0);\r | |
459 | return;\r | |
460 | };\r | |
7cc204bf | 461 | \r |
f168b263 | 462 | if(mifare_ultra_special_writeblock(blockNo, blockdata)) {\r |
463 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
464 | OnError(0);\r | |
465 | return;\r | |
466 | };\r | |
467 | \r | |
468 | if(mifare_ultra_halt()) {\r | |
469 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
470 | OnError(0);\r | |
471 | return;\r | |
472 | };\r | |
473 | \r | |
474 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
475 | \r | |
476 | cmd_send(CMD_ACK,1,0,0,0,0);\r | |
477 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
478 | LEDsoff();\r | |
479 | }\r | |
480 | \r | |
481 | void MifareUSetPwd(uint8_t arg0, uint8_t *datain){\r | |
482 | \r | |
483 | uint8_t pwd[16] = {0x00};\r | |
484 | byte_t blockdata[4] = {0x00};\r | |
485 | \r | |
486 | memcpy(pwd, datain, 16);\r | |
487 | \r | |
488 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r | |
3000dc4e | 489 | clear_trace();\r |
baeaf579 | 490 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 491 | \r |
f168b263 | 492 | if(!iso14443a_select_card(NULL, NULL, NULL)) {\r |
493 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
494 | OnError(0);\r | |
495 | return;\r | |
496 | };\r | |
7cc204bf | 497 | \r |
f168b263 | 498 | blockdata[0] = pwd[7];\r |
499 | blockdata[1] = pwd[6];\r | |
500 | blockdata[2] = pwd[5];\r | |
501 | blockdata[3] = pwd[4];\r | |
502 | if(mifare_ultra_special_writeblock( 44, blockdata)) {\r | |
503 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
504 | OnError(44);\r | |
505 | return;\r | |
506 | };\r | |
7cc204bf | 507 | \r |
f168b263 | 508 | blockdata[0] = pwd[3];\r |
509 | blockdata[1] = pwd[2];\r | |
510 | blockdata[2] = pwd[1];\r | |
511 | blockdata[3] = pwd[0];\r | |
512 | if(mifare_ultra_special_writeblock( 45, blockdata)) {\r | |
513 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
514 | OnError(45);\r | |
515 | return;\r | |
516 | };\r | |
7cc204bf | 517 | \r |
f168b263 | 518 | blockdata[0] = pwd[15];\r |
519 | blockdata[1] = pwd[14];\r | |
520 | blockdata[2] = pwd[13];\r | |
521 | blockdata[3] = pwd[12];\r | |
522 | if(mifare_ultra_special_writeblock( 46, blockdata)) {\r | |
523 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
524 | OnError(46);\r | |
525 | return;\r | |
526 | };\r | |
7cc204bf | 527 | \r |
f168b263 | 528 | blockdata[0] = pwd[11];\r |
529 | blockdata[1] = pwd[10];\r | |
530 | blockdata[2] = pwd[9];\r | |
531 | blockdata[3] = pwd[8];\r | |
532 | if(mifare_ultra_special_writeblock( 47, blockdata)) {\r | |
533 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
534 | OnError(47);\r | |
535 | return;\r | |
536 | }; \r | |
7cc204bf | 537 | \r |
f168b263 | 538 | if(mifare_ultra_halt()) {\r |
539 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
540 | OnError(0);\r | |
541 | return;\r | |
542 | };\r | |
7cc204bf | 543 | \r |
f168b263 | 544 | cmd_send(CMD_ACK,1,0,0,0,0);\r |
baeaf579 | 545 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
546 | LEDsoff();\r | |
7cc204bf | 547 | }\r |
548 | \r | |
549 | // Return 1 if the nonce is invalid else return 0\r | |
6a1f2d82 | 550 | int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r |
7cc204bf | 551 | return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r |
8556b852 M |
552 | (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r |
553 | (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r | |
554 | }\r | |
555 | \r | |
9492e0b0 | 556 | \r |
8556b852 M |
557 | //-----------------------------------------------------------------------------\r |
558 | // MIFARE nested authentication. \r | |
559 | // \r | |
560 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 561 | void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r |
8556b852 M |
562 | {\r |
563 | // params\r | |
9492e0b0 | 564 | uint8_t blockNo = arg0 & 0xff;\r |
565 | uint8_t keyType = (arg0 >> 8) & 0xff;\r | |
566 | uint8_t targetBlockNo = arg1 & 0xff;\r | |
567 | uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r | |
8556b852 M |
568 | uint64_t ui64Key = 0;\r |
569 | \r | |
570 | ui64Key = bytes_to_num(datain, 6);\r | |
571 | \r | |
572 | // variables\r | |
9492e0b0 | 573 | uint16_t rtr, i, j, len;\r |
574 | uint16_t davg;\r | |
575 | static uint16_t dmin, dmax;\r | |
1c611bbd | 576 | uint8_t uid[10];\r |
6a1f2d82 | 577 | uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r |
578 | uint8_t par[1];\r | |
9492e0b0 | 579 | uint32_t target_nt[2], target_ks[2];\r |
580 | \r | |
8556b852 | 581 | uint8_t par_array[4];\r |
9492e0b0 | 582 | uint16_t ncount = 0;\r |
8556b852 M |
583 | struct Crypto1State mpcs = {0, 0};\r |
584 | struct Crypto1State *pcs;\r | |
585 | pcs = &mpcs;\r | |
f71f4deb | 586 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
8556b852 | 587 | \r |
9492e0b0 | 588 | uint32_t auth1_time, auth2_time;\r |
589 | static uint16_t delta_time;\r | |
590 | \r | |
f71f4deb | 591 | // free eventually allocated BigBuf memory\r |
592 | BigBuf_free();\r | |
8556b852 | 593 | // clear trace\r |
3000dc4e MHS |
594 | clear_trace();\r |
595 | set_tracing(false);\r | |
8556b852 | 596 | \r |
7bc95e2e | 597 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
598 | \r |
599 | LED_A_ON();\r | |
8556b852 M |
600 | LED_C_OFF();\r |
601 | \r | |
8556b852 | 602 | \r |
9492e0b0 | 603 | // statistics on nonce distance\r |
604 | if (calibrate) { // for first call only. Otherwise reuse previous calibration\r | |
605 | LED_B_ON();\r | |
3fe4ff4f | 606 | WDT_HIT();\r |
8556b852 | 607 | \r |
9492e0b0 | 608 | davg = dmax = 0;\r |
609 | dmin = 2000;\r | |
610 | delta_time = 0;\r | |
8556b852 | 611 | \r |
9492e0b0 | 612 | for (rtr = 0; rtr < 17; rtr++) {\r |
8556b852 | 613 | \r |
9492e0b0 | 614 | // prepare next select. No need to power down the card.\r |
615 | if(mifare_classic_halt(pcs, cuid)) {\r | |
616 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
617 | rtr--;\r | |
618 | continue;\r | |
619 | }\r | |
620 | \r | |
621 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
622 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r | |
623 | rtr--;\r | |
624 | continue;\r | |
625 | };\r | |
626 | \r | |
627 | auth1_time = 0;\r | |
628 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
629 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
630 | rtr--;\r | |
631 | continue;\r | |
632 | };\r | |
633 | \r | |
634 | if (delta_time) {\r | |
635 | auth2_time = auth1_time + delta_time;\r | |
636 | } else {\r | |
637 | auth2_time = 0;\r | |
638 | }\r | |
639 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r | |
640 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r | |
641 | rtr--;\r | |
642 | continue;\r | |
643 | };\r | |
644 | \r | |
b19bd5d6 | 645 | nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r |
646 | for (i = 101; i < 1200; i++) {\r | |
9492e0b0 | 647 | nttmp = prng_successor(nttmp, 1);\r |
648 | if (nttmp == nt2) break;\r | |
649 | }\r | |
650 | \r | |
651 | if (i != 1200) {\r | |
652 | if (rtr != 0) {\r | |
653 | davg += i;\r | |
654 | dmin = MIN(dmin, i);\r | |
655 | dmax = MAX(dmax, i);\r | |
656 | }\r | |
657 | else {\r | |
658 | delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r | |
659 | }\r | |
660 | if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r | |
661 | }\r | |
8556b852 M |
662 | }\r |
663 | \r | |
9492e0b0 | 664 | if (rtr <= 1) return;\r |
8556b852 | 665 | \r |
9492e0b0 | 666 | davg = (davg + (rtr - 1)/2) / (rtr - 1);\r |
667 | \r | |
668 | if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);\r | |
8556b852 | 669 | \r |
9492e0b0 | 670 | dmin = davg - 2;\r |
671 | dmax = davg + 2;\r | |
672 | \r | |
673 | LED_B_OFF();\r | |
674 | \r | |
675 | }\r | |
8556b852 M |
676 | // ------------------------------------------------------------------------------------------------- \r |
677 | \r | |
678 | LED_C_ON();\r | |
679 | \r | |
680 | // get crypted nonces for target sector\r | |
9492e0b0 | 681 | for(i=0; i < 2; i++) { // look for exactly two different nonces\r |
8556b852 | 682 | \r |
9492e0b0 | 683 | target_nt[i] = 0;\r |
684 | while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r | |
8556b852 | 685 | \r |
9492e0b0 | 686 | // prepare next select. No need to power down the card.\r |
687 | if(mifare_classic_halt(pcs, cuid)) {\r | |
688 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
689 | continue;\r | |
690 | }\r | |
8556b852 | 691 | \r |
9492e0b0 | 692 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r |
693 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r | |
694 | continue;\r | |
695 | };\r | |
8556b852 | 696 | \r |
9492e0b0 | 697 | auth1_time = 0;\r |
698 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
699 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
700 | continue;\r | |
701 | };\r | |
8556b852 | 702 | \r |
9492e0b0 | 703 | // nested authentication\r |
704 | auth2_time = auth1_time + delta_time;\r | |
6a1f2d82 | 705 | len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r |
9492e0b0 | 706 | if (len != 4) {\r |
707 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r | |
708 | continue;\r | |
709 | };\r | |
8556b852 | 710 | \r |
9492e0b0 | 711 | nt2 = bytes_to_num(receivedAnswer, 4); \r |
6a1f2d82 | 712 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r |
8556b852 | 713 | \r |
9492e0b0 | 714 | // Parity validity check\r |
715 | for (j = 0; j < 4; j++) {\r | |
6a1f2d82 | 716 | par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r |
9492e0b0 | 717 | }\r |
718 | \r | |
719 | ncount = 0;\r | |
720 | nttest = prng_successor(nt1, dmin - 1);\r | |
721 | for (j = dmin; j < dmax + 1; j++) {\r | |
722 | nttest = prng_successor(nttest, 1);\r | |
723 | ks1 = nt2 ^ nttest;\r | |
724 | \r | |
725 | if (valid_nonce(nttest, nt2, ks1, par_array)){\r | |
726 | if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r | |
727 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r | |
728 | target_nt[i] = 0;\r | |
729 | break;\r | |
730 | }\r | |
731 | target_nt[i] = nttest;\r | |
732 | target_ks[i] = ks1;\r | |
733 | ncount++;\r | |
734 | if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r | |
735 | target_nt[i] = 0;\r | |
736 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r | |
8556b852 M |
737 | break;\r |
738 | }\r | |
9492e0b0 | 739 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r |
8556b852 | 740 | }\r |
8556b852 | 741 | }\r |
9492e0b0 | 742 | if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r |
8556b852 M |
743 | }\r |
744 | }\r | |
745 | \r | |
746 | LED_C_OFF();\r | |
747 | \r | |
748 | // ----------------------------- crypto1 destroy\r | |
749 | crypto1_destroy(pcs);\r | |
750 | \r | |
9492e0b0 | 751 | byte_t buf[4 + 4 * 4];\r |
752 | memcpy(buf, &cuid, 4);\r | |
753 | memcpy(buf+4, &target_nt[0], 4);\r | |
754 | memcpy(buf+8, &target_ks[0], 4);\r | |
755 | memcpy(buf+12, &target_nt[1], 4);\r | |
756 | memcpy(buf+16, &target_ks[1], 4);\r | |
8556b852 M |
757 | \r |
758 | LED_B_ON();\r | |
9492e0b0 | 759 | cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r |
6e82300d | 760 | LED_B_OFF();\r |
8556b852 | 761 | \r |
9492e0b0 | 762 | if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r |
8556b852 | 763 | \r |
8556b852 M |
764 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
765 | LEDsoff();\r | |
3000dc4e | 766 | set_tracing(TRUE);\r |
8556b852 M |
767 | }\r |
768 | \r | |
769 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 770 | // MIFARE check keys. key count up to 85. \r |
8556b852 M |
771 | // \r |
772 | //-----------------------------------------------------------------------------\r | |
773 | void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
774 | {\r | |
775 | // params\r | |
776 | uint8_t blockNo = arg0;\r | |
777 | uint8_t keyType = arg1;\r | |
778 | uint8_t keyCount = arg2;\r | |
779 | uint64_t ui64Key = 0;\r | |
780 | \r | |
781 | // variables\r | |
782 | int i;\r | |
783 | byte_t isOK = 0;\r | |
1c611bbd | 784 | uint8_t uid[10];\r |
8556b852 M |
785 | uint32_t cuid;\r |
786 | struct Crypto1State mpcs = {0, 0};\r | |
787 | struct Crypto1State *pcs;\r | |
788 | pcs = &mpcs;\r | |
789 | \r | |
790 | // clear debug level\r | |
791 | int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r | |
792 | MF_DBGLEVEL = MF_DBG_NONE;\r | |
793 | \r | |
794 | // clear trace\r | |
3000dc4e MHS |
795 | clear_trace();\r |
796 | set_tracing(TRUE);\r | |
8556b852 | 797 | \r |
7bc95e2e | 798 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
799 | \r |
800 | LED_A_ON();\r | |
801 | LED_B_OFF();\r | |
802 | LED_C_OFF();\r | |
803 | \r | |
8556b852 | 804 | for (i = 0; i < keyCount; i++) {\r |
9492e0b0 | 805 | if(mifare_classic_halt(pcs, cuid)) {\r |
806 | if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r | |
807 | }\r | |
8556b852 M |
808 | \r |
809 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
9492e0b0 | 810 | if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r |
8556b852 M |
811 | break;\r |
812 | };\r | |
813 | \r | |
814 | ui64Key = bytes_to_num(datain + i * 6, 6);\r | |
815 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
816 | continue;\r | |
817 | };\r | |
818 | \r | |
819 | isOK = 1;\r | |
820 | break;\r | |
821 | }\r | |
822 | \r | |
823 | // ----------------------------- crypto1 destroy\r | |
824 | crypto1_destroy(pcs);\r | |
825 | \r | |
8556b852 | 826 | LED_B_ON();\r |
6e82300d | 827 | cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r |
8556b852 M |
828 | LED_B_OFF();\r |
829 | \r | |
8556b852 M |
830 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
831 | LEDsoff();\r | |
832 | \r | |
833 | // restore debug level\r | |
834 | MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r | |
835 | }\r | |
836 | \r | |
837 | //-----------------------------------------------------------------------------\r | |
838 | // MIFARE commands set debug level\r | |
839 | // \r | |
840 | //-----------------------------------------------------------------------------\r | |
841 | void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
842 | MF_DBGLEVEL = arg0;\r | |
843 | Dbprintf("Debug level: %d", MF_DBGLEVEL);\r | |
844 | }\r | |
845 | \r | |
846 | //-----------------------------------------------------------------------------\r | |
847 | // Work with emulator memory\r | |
848 | // \r | |
849 | //-----------------------------------------------------------------------------\r | |
850 | void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
851 | emlClearMem();\r | |
852 | }\r | |
853 | \r | |
854 | void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
855 | emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r | |
856 | }\r | |
857 | \r | |
858 | void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
3fe4ff4f | 859 | byte_t buf[USB_CMD_DATA_SIZE];\r |
baeaf579 | 860 | emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r |
8556b852 M |
861 | \r |
862 | LED_B_ON();\r | |
3fe4ff4f | 863 | cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r |
8556b852 M |
864 | LED_B_OFF();\r |
865 | }\r | |
866 | \r | |
867 | //-----------------------------------------------------------------------------\r | |
868 | // Load a card into the emulator memory\r | |
869 | // \r | |
870 | //-----------------------------------------------------------------------------\r | |
871 | void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
baeaf579 | 872 | uint8_t numSectors = arg0;\r |
8556b852 M |
873 | uint8_t keyType = arg1;\r |
874 | uint64_t ui64Key = 0;\r | |
875 | uint32_t cuid;\r | |
876 | struct Crypto1State mpcs = {0, 0};\r | |
877 | struct Crypto1State *pcs;\r | |
878 | pcs = &mpcs;\r | |
879 | \r | |
880 | // variables\r | |
881 | byte_t dataoutbuf[16];\r | |
ab8b654e | 882 | byte_t dataoutbuf2[16];\r |
1c611bbd | 883 | uint8_t uid[10];\r |
8556b852 M |
884 | \r |
885 | // clear trace\r | |
3000dc4e MHS |
886 | clear_trace();\r |
887 | set_tracing(false);\r | |
8556b852 | 888 | \r |
7bc95e2e | 889 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
890 | \r |
891 | LED_A_ON();\r | |
892 | LED_B_OFF();\r | |
893 | LED_C_OFF();\r | |
894 | \r | |
baeaf579 | 895 | bool isOK = true;\r |
896 | \r | |
897 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
898 | isOK = false;\r | |
899 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
900 | }\r | |
8556b852 | 901 | \r |
baeaf579 | 902 | for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r |
903 | ui64Key = emlGetKey(sectorNo, keyType);\r | |
904 | if (sectorNo == 0){\r | |
905 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r | |
906 | isOK = false;\r | |
907 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r | |
8556b852 | 908 | break;\r |
baeaf579 | 909 | }\r |
910 | } else {\r | |
911 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r | |
912 | isOK = false;\r | |
913 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r | |
8556b852 | 914 | break;\r |
baeaf579 | 915 | }\r |
916 | }\r | |
917 | \r | |
918 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
919 | if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r | |
920 | isOK = false;\r | |
921 | if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r | |
ab8b654e M |
922 | break;\r |
923 | };\r | |
baeaf579 | 924 | if (isOK) {\r |
925 | if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r | |
926 | emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
927 | } else { // sector trailer, keep the keys, set only the AC\r | |
928 | emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
929 | memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r | |
930 | emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
931 | }\r | |
932 | }\r | |
8556b852 M |
933 | }\r |
934 | \r | |
baeaf579 | 935 | }\r |
936 | \r | |
937 | if(mifare_classic_halt(pcs, cuid)) {\r | |
938 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
939 | };\r | |
8556b852 M |
940 | \r |
941 | // ----------------------------- crypto1 destroy\r | |
942 | crypto1_destroy(pcs);\r | |
ab8b654e M |
943 | \r |
944 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
945 | LEDsoff();\r | |
8556b852 M |
946 | \r |
947 | if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r | |
948 | \r | |
8556b852 M |
949 | }\r |
950 | \r | |
0675f200 M |
951 | \r |
952 | //-----------------------------------------------------------------------------\r | |
953 | // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r | |
954 | // \r | |
955 | //-----------------------------------------------------------------------------\r | |
956 | void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
957 | \r | |
958 | // params\r | |
959 | uint8_t needWipe = arg0;\r | |
208a0166 M |
960 | // bit 0 - need get UID\r |
961 | // bit 1 - need wupC\r | |
962 | // bit 2 - need HALT after sequence\r | |
963 | // bit 3 - need init FPGA and field before sequence\r | |
964 | // bit 4 - need reset FPGA and LED\r | |
965 | uint8_t workFlags = arg1;\r | |
0675f200 M |
966 | uint8_t blockNo = arg2;\r |
967 | \r | |
968 | // card commands\r | |
969 | uint8_t wupC1[] = { 0x40 }; \r | |
970 | uint8_t wupC2[] = { 0x43 }; \r | |
971 | uint8_t wipeC[] = { 0x41 }; \r | |
972 | \r | |
973 | // variables\r | |
974 | byte_t isOK = 0;\r | |
3fe4ff4f | 975 | uint8_t uid[10] = {0x00};\r |
976 | uint8_t d_block[18] = {0x00};\r | |
0675f200 M |
977 | uint32_t cuid;\r |
978 | \r | |
f71f4deb | 979 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
980 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
6a1f2d82 | 981 | \r |
3fe4ff4f | 982 | // reset FPGA and LED\r |
208a0166 | 983 | if (workFlags & 0x08) {\r |
208a0166 M |
984 | LED_A_ON();\r |
985 | LED_B_OFF();\r | |
986 | LED_C_OFF();\r | |
0675f200 | 987 | \r |
3000dc4e MHS |
988 | clear_trace();\r |
989 | set_tracing(TRUE);\r | |
3fe4ff4f | 990 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
208a0166 | 991 | }\r |
0675f200 M |
992 | \r |
993 | while (true) {\r | |
3fe4ff4f | 994 | \r |
0675f200 | 995 | // get UID from chip\r |
208a0166 | 996 | if (workFlags & 0x01) {\r |
0675f200 M |
997 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r |
998 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
999 | break;\r | |
1000 | };\r | |
1001 | \r | |
1002 | if(mifare_classic_halt(NULL, cuid)) {\r | |
1003 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1004 | break;\r | |
1005 | };\r | |
1006 | };\r | |
1007 | \r | |
1008 | // reset chip\r | |
1009 | if (needWipe){\r | |
6a1f2d82 | 1010 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
1011 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
0675f200 M |
1012 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1013 | break;\r | |
1014 | };\r | |
1015 | \r | |
9492e0b0 | 1016 | ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r |
6a1f2d82 | 1017 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1018 | if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r |
1019 | break;\r | |
1020 | };\r | |
1021 | \r | |
1022 | if(mifare_classic_halt(NULL, cuid)) {\r | |
1023 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1024 | break;\r | |
1025 | };\r | |
1026 | }; \r | |
1027 | \r | |
545a1f38 | 1028 | // write block\r |
208a0166 | 1029 | if (workFlags & 0x02) {\r |
6a1f2d82 | 1030 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
1031 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
208a0166 M |
1032 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1033 | break;\r | |
1034 | };\r | |
0675f200 | 1035 | \r |
9492e0b0 | 1036 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r |
6a1f2d82 | 1037 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
208a0166 M |
1038 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r |
1039 | break;\r | |
1040 | };\r | |
1041 | }\r | |
0675f200 | 1042 | \r |
6a1f2d82 | 1043 | if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1044 | if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r |
1045 | break;\r | |
1046 | };\r | |
1047 | \r | |
1048 | memcpy(d_block, datain, 16);\r | |
1049 | AppendCrc14443a(d_block, 16);\r | |
1050 | \r | |
9492e0b0 | 1051 | ReaderTransmit(d_block, sizeof(d_block), NULL);\r |
6a1f2d82 | 1052 | if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1053 | if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r |
1054 | break;\r | |
1055 | }; \r | |
1056 | \r | |
208a0166 M |
1057 | if (workFlags & 0x04) {\r |
1058 | if (mifare_classic_halt(NULL, cuid)) {\r | |
1059 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1060 | break;\r | |
1061 | };\r | |
1062 | }\r | |
0675f200 M |
1063 | \r |
1064 | isOK = 1;\r | |
1065 | break;\r | |
1066 | }\r | |
1067 | \r | |
0675f200 | 1068 | LED_B_ON();\r |
baeaf579 | 1069 | cmd_send(CMD_ACK,isOK,0,0,uid,4);\r |
0675f200 M |
1070 | LED_B_OFF();\r |
1071 | \r | |
545a1f38 | 1072 | if ((workFlags & 0x10) || (!isOK)) {\r |
208a0166 M |
1073 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1074 | LEDsoff();\r | |
1075 | }\r | |
0675f200 | 1076 | }\r |
545a1f38 | 1077 | \r |
baeaf579 | 1078 | \r |
545a1f38 M |
1079 | void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r |
1080 | \r | |
1081 | // params\r | |
1082 | // bit 1 - need wupC\r | |
1083 | // bit 2 - need HALT after sequence\r | |
1084 | // bit 3 - need init FPGA and field before sequence\r | |
1085 | // bit 4 - need reset FPGA and LED\r | |
1086 | uint8_t workFlags = arg0;\r | |
1087 | uint8_t blockNo = arg2;\r | |
1088 | \r | |
1089 | // card commands\r | |
1090 | uint8_t wupC1[] = { 0x40 }; \r | |
1091 | uint8_t wupC2[] = { 0x43 }; \r | |
1092 | \r | |
1093 | // variables\r | |
1094 | byte_t isOK = 0;\r | |
3fe4ff4f | 1095 | uint8_t data[18] = {0x00};\r |
545a1f38 M |
1096 | uint32_t cuid = 0;\r |
1097 | \r | |
f71f4deb | 1098 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
1099 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
545a1f38 M |
1100 | \r |
1101 | if (workFlags & 0x08) {\r | |
545a1f38 M |
1102 | LED_A_ON();\r |
1103 | LED_B_OFF();\r | |
1104 | LED_C_OFF();\r | |
1105 | \r | |
3000dc4e MHS |
1106 | clear_trace();\r |
1107 | set_tracing(TRUE);\r | |
3fe4ff4f | 1108 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
545a1f38 M |
1109 | }\r |
1110 | \r | |
1111 | while (true) {\r | |
1112 | if (workFlags & 0x02) {\r | |
7bc95e2e | 1113 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
6a1f2d82 | 1114 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
545a1f38 M |
1115 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1116 | break;\r | |
1117 | };\r | |
1118 | \r | |
9492e0b0 | 1119 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r |
6a1f2d82 | 1120 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
545a1f38 M |
1121 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r |
1122 | break;\r | |
1123 | };\r | |
1124 | }\r | |
1125 | \r | |
1126 | // read block\r | |
6a1f2d82 | 1127 | if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r |
545a1f38 M |
1128 | if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r |
1129 | break;\r | |
1130 | };\r | |
1131 | memcpy(data, receivedAnswer, 18);\r | |
1132 | \r | |
1133 | if (workFlags & 0x04) {\r | |
1134 | if (mifare_classic_halt(NULL, cuid)) {\r | |
1135 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1136 | break;\r | |
1137 | };\r | |
1138 | }\r | |
1139 | \r | |
1140 | isOK = 1;\r | |
1141 | break;\r | |
1142 | }\r | |
1143 | \r | |
545a1f38 | 1144 | LED_B_ON();\r |
baeaf579 | 1145 | cmd_send(CMD_ACK,isOK,0,0,data,18);\r |
545a1f38 M |
1146 | LED_B_OFF();\r |
1147 | \r | |
1148 | if ((workFlags & 0x10) || (!isOK)) {\r | |
545a1f38 M |
1149 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1150 | LEDsoff();\r | |
1151 | }\r | |
1152 | }\r | |
1153 | \r | |
3fe4ff4f | 1154 | void MifareCIdent(){\r |
1155 | \r | |
1156 | // card commands\r | |
1157 | uint8_t wupC1[] = { 0x40 }; \r | |
1158 | uint8_t wupC2[] = { 0x43 }; \r | |
1159 | \r | |
1160 | // variables\r | |
1161 | byte_t isOK = 1;\r | |
1162 | \r | |
f71f4deb | 1163 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
1164 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
3fe4ff4f | 1165 | \r |
1166 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r | |
1167 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1168 | isOK = 0;\r | |
1169 | };\r | |
1170 | \r | |
1171 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r | |
1172 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1173 | isOK = 0;\r | |
1174 | };\r | |
1175 | \r | |
1176 | if (mifare_classic_halt(NULL, 0)) {\r | |
1177 | isOK = 0;\r | |
1178 | };\r | |
1179 | \r | |
1180 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r | |
1181 | }\r | |
1182 | \r | |
1183 | //\r | |
1184 | // DESFIRE\r | |
1185 | //\r | |
a631936e | 1186 | \r |
1187 | void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r | |
1188 | \r | |
1189 | byte_t dataout[11] = {0x00};\r | |
1190 | uint8_t uid[10] = {0x00};\r | |
1191 | uint32_t cuid;\r | |
1192 | \r | |
3000dc4e | 1193 | clear_trace();\r |
a631936e | 1194 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
1195 | \r | |
1196 | int len = iso14443a_select_card(uid, NULL, &cuid);\r | |
1197 | if(!len) {\r | |
8258f409 | 1198 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r |
1199 | OnError(1);\r | |
a631936e | 1200 | return;\r |
1201 | };\r | |
1202 | \r | |
1203 | if(mifare_desfire_des_auth1(cuid, dataout)){\r | |
8258f409 | 1204 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r |
1205 | OnError(4);\r | |
a631936e | 1206 | return;\r |
1207 | }\r | |
1208 | \r | |
1209 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r | |
a631936e | 1210 | cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r |
1211 | }\r | |
1212 | \r | |
1213 | void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r | |
1214 | \r | |
1215 | uint32_t cuid = arg0;\r | |
1216 | uint8_t key[16] = {0x00};\r | |
1217 | byte_t isOK = 0;\r | |
1218 | byte_t dataout[12] = {0x00};\r | |
1219 | \r | |
1220 | memcpy(key, datain, 16);\r | |
1221 | \r | |
1222 | isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r | |
1223 | \r | |
1224 | if( isOK) {\r | |
1225 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r | |
1226 | Dbprintf("Authentication part2: Failed"); \r | |
c8b6da22 | 1227 | //OnError(4);\r |
a631936e | 1228 | return;\r |
1229 | }\r | |
1230 | \r | |
1231 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r | |
1232 | DbpString("AUTH 2 FINISHED");\r | |
1233 | \r | |
1234 | cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r | |
1235 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1236 | LEDsoff();\r | |
3000dc4e | 1237 | }\r |
f168b263 | 1238 | \r |
1239 | void OnSuccess(){\r | |
1240 | pcb_blocknum = 0;\r | |
1241 | ReaderTransmit(deselect_cmd, 3 , NULL);\r | |
1242 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1243 | LEDsoff();\r | |
1244 | }\r | |
1245 | \r | |
1246 | void OnError(uint8_t reason){\r | |
1247 | pcb_blocknum = 0;\r | |
1248 | ReaderTransmit(deselect_cmd, 3 , NULL);\r | |
1249 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1250 | cmd_send(CMD_ACK,0,reason,0,0,0);\r | |
1251 | LEDsoff();\r | |
1252 | }\r |