Merge remote-tracking branch 'upstream/master'
[proxmark3-svn] / armsrc / mifarecmd.c
CommitLineData
8556b852 1//-----------------------------------------------------------------------------\r
b62a5a84 2// Merlok - June 2011, 2012\r
8556b852
M
3// Gerhard de Koning Gans - May 2008\r
4// Hagen Fritsch - June 2010\r
3fe4ff4f 5// Midnitesnake - Dec 2013\r
6// Andy Davies - Apr 2014\r
7// Iceman - May 2014\r
8556b852
M
8//\r
9// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
10// at your option, any later version. See the LICENSE.txt file for the text of\r
11// the license.\r
12//-----------------------------------------------------------------------------\r
13// Routines to support ISO 14443 type A.\r
14//-----------------------------------------------------------------------------\r
15\r
16#include "mifarecmd.h"\r
17#include "apps.h"\r
787b5bd8 18#include "util.h"\r
8556b852 19\r
f168b263 20#include "des.h"\r
a631936e 21#include "crc.h"\r
22\r
f168b263 23// the block number for the ISO14443-4 PCB\r
24uint8_t pcb_blocknum = 0;\r
25// Deselect card by sending a s-block. the crc is precalced for speed\r
26static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};\r
27\r
28\r
8556b852 29//-----------------------------------------------------------------------------\r
baeaf579 30// Select, Authenticate, Read a MIFARE tag. \r
8556b852
M
31// read block\r
32//-----------------------------------------------------------------------------\r
33void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
34{\r
35 // params\r
36 uint8_t blockNo = arg0;\r
37 uint8_t keyType = arg1;\r
38 uint64_t ui64Key = 0;\r
39 ui64Key = bytes_to_num(datain, 6);\r
40 \r
41 // variables\r
42 byte_t isOK = 0;\r
43 byte_t dataoutbuf[16];\r
1c611bbd 44 uint8_t uid[10];\r
8556b852
M
45 uint32_t cuid;\r
46 struct Crypto1State mpcs = {0, 0};\r
47 struct Crypto1State *pcs;\r
48 pcs = &mpcs;\r
49\r
50 // clear trace\r
3000dc4e 51 clear_trace();\r
7bc95e2e 52 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
8556b852
M
53\r
54 LED_A_ON();\r
55 LED_B_OFF();\r
56 LED_C_OFF();\r
57\r
58 while (true) {\r
59 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
baeaf579 60 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
8556b852
M
61 break;\r
62 };\r
63\r
64 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
baeaf579 65 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
8556b852
M
66 break;\r
67 };\r
68 \r
69 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r
baeaf579 70 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r
8556b852
M
71 break;\r
72 };\r
73\r
74 if(mifare_classic_halt(pcs, cuid)) {\r
baeaf579 75 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
8556b852
M
76 break;\r
77 };\r
78 \r
79 isOK = 1;\r
80 break;\r
81 }\r
82 \r
83 // ----------------------------- crypto1 destroy\r
84 crypto1_destroy(pcs);\r
85 \r
86 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r
87\r
8556b852 88 LED_B_ON();\r
baeaf579 89 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r
8556b852
M
90 LED_B_OFF();\r
91\r
a631936e 92 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
93 LEDsoff();\r
94}\r
95\r
a631936e 96void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){\r
97\r
a631936e 98 byte_t dataoutbuf[16] = {0x00};\r
99 uint8_t uid[10] = {0x00};\r
f168b263 100 uint32_t cuid = 0x00;\r
a631936e 101\r
f168b263 102 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
a631936e 103 \r
3000dc4e 104 clear_trace();\r
a631936e 105 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
106\r
107 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
f168b263 108 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
109 OnError(0);\r
a631936e 110 return;\r
111 };\r
112 \r
f168b263 113 if(mifare_ultra_auth1(dataoutbuf)){\r
114 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r
115 OnError(1);\r
a631936e 116 return;\r
117 }\r
118\r
f168b263 119 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
a631936e 120 \r
f168b263 121 cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);\r
a631936e 122 LEDsoff();\r
123}\r
124void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){\r
125\r
a631936e 126 uint8_t key[16] = {0x00};\r
a631936e 127 byte_t dataoutbuf[16] = {0x00};\r
128 \r
129 memcpy(key, datain, 16);\r
130 \r
f168b263 131 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
a631936e 132 \r
f168b263 133 if(mifare_ultra_auth2(key, dataoutbuf)){\r
134 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");\r
135 OnError(1);\r
a631936e 136 return; \r
137 }\r
138 \r
f168b263 139 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");\r
a631936e 140 \r
f168b263 141 cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);\r
8556b852
M
142 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
143 LEDsoff();\r
7cc204bf 144}\r
145\r
f168b263 146void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r
7cc204bf 147{\r
7cc204bf 148 uint8_t blockNo = arg0;\r
787b5bd8 149 byte_t dataout[16] = {0x00};\r
150 uint8_t uid[10] = {0x00};\r
f168b263 151 uint8_t key[16] = {0x00};\r
152 bool usePwd = (arg1 == 1);\r
153\r
154 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
155\r
3000dc4e 156 clear_trace();\r
787b5bd8 157 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
f168b263 158\r
159 int len = iso14443a_select_card(uid, NULL, NULL);\r
787b5bd8 160 if(!len) {\r
f168b263 161 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r
162 OnError(1);\r
787b5bd8 163 return;\r
f168b263 164 }\r
165\r
166 // authenticate here.\r
167 if ( usePwd ) {\r
168\r
169 memcpy(key, datain, 16);\r
170\r
171 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );\r
172 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );\r
173\r
b3125340 174 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };\r
175 uint8_t random_b[8] = {0x00};\r
176 uint8_t enc_random_b[8] = {0x00};\r
177 uint8_t rnd_ab[16] = {0x00};\r
178 uint8_t IV[8] = {0x00};\r
179\r
f168b263 180 uint16_t len;\r
181 uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
182 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
183\r
184 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r
185 if (len != 11) {\r
186 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
187 OnError(1);\r
188 return;\r
189 }\r
b3125340 190 \r
f168b263 191 // tag nonce.\r
b3125340 192 memcpy(enc_random_b,receivedAnswer+1,8);\r
f168b263 193\r
194 // decrypt nonce.\r
b3125340 195 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );\r
f168b263 196\r
b3125340 197 \r
198 rol(random_b,8);\r
f168b263 199 \r
b3125340 200 memcpy(rnd_ab ,random_a,8);\r
201 memcpy(rnd_ab+8,random_b,8);\r
202\r
203 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
204 Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
205 enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],\r
206 enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);\r
207 \r
208 Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
209 random_b[0],random_b[1],random_b[2],random_b[3],\r
210 random_b[4],random_b[5],random_b[6],random_b[7]);\r
211\r
212 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
213 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],\r
214 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
215 \r
216 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
217 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],\r
218 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );\r
219 }\r
220 \r
221 // encrypt out, in, length, key, iv\r
222 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);\r
f168b263 223\r
b3125340 224 \r
225 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);\r
f168b263 226 if (len != 11) {\r
227 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
228 OnError(1);\r
229 return;\r
230 }\r
231\r
b3125340 232 uint8_t enc_resp[8] = { 0 };\r
233 uint8_t resp_random_a[8] = { 0 };\r
234 memcpy(enc_resp, receivedAnswer+1, 8);\r
235 \r
236 // decrypt out, in, length, key, iv \r
237 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);\r
238 if ( memcmp(resp_random_a, random_a, 8) != 0 )\r
f168b263 239 Dbprintf("failed authentication");\r
f168b263 240\r
b3125340 241 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
242 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", \r
243 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],\r
244 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
245\r
246 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",\r
247 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],\r
248 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);\r
249\r
250 Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",\r
251 random_a[0],random_a[1],random_a[2],random_a[3],\r
252 random_a[4],random_a[5],random_a[6],random_a[7]);\r
253 \r
254 Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",\r
255 resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],\r
256 resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);\r
257 }\r
258 }\r
259 \r
f168b263 260 if( mifare_ultra_readblock(blockNo, dataout) ) {\r
261 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r
262 OnError(2);\r
787b5bd8 263 return;\r
f168b263 264 }\r
b3125340 265 \r
f168b263 266 if( mifare_ultra_halt() ) {\r
267 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
268 OnError(3);\r
787b5bd8 269 return;\r
f168b263 270 }\r
b3125340 271 \r
272 cmd_send(CMD_ACK,1,0,0,dataout,16);\r
7cc204bf 273 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
274 LEDsoff();\r
275}\r
b3125340 276\r
7cc204bf 277//-----------------------------------------------------------------------------\r
baeaf579 278// Select, Authenticate, Read a MIFARE tag. \r
279// read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r
8556b852
M
280//-----------------------------------------------------------------------------\r
281void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
282{\r
283 // params\r
284 uint8_t sectorNo = arg0;\r
285 uint8_t keyType = arg1;\r
286 uint64_t ui64Key = 0;\r
287 ui64Key = bytes_to_num(datain, 6);\r
288 \r
289 // variables\r
3fe4ff4f 290 byte_t isOK = 0;\r
baeaf579 291 byte_t dataoutbuf[16 * 16];\r
1c611bbd 292 uint8_t uid[10];\r
8556b852
M
293 uint32_t cuid;\r
294 struct Crypto1State mpcs = {0, 0};\r
295 struct Crypto1State *pcs;\r
296 pcs = &mpcs;\r
297\r
298 // clear trace\r
3000dc4e 299 clear_trace();\r
8556b852 300\r
7bc95e2e 301 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
8556b852
M
302\r
303 LED_A_ON();\r
304 LED_B_OFF();\r
305 LED_C_OFF();\r
306\r
baeaf579 307 isOK = 1;\r
308 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
309 isOK = 0;\r
8556b852 310 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
baeaf579 311 }\r
8556b852 312\r
baeaf579 313 \r
314 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
315 isOK = 0;\r
8556b852 316 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
baeaf579 317 }\r
318 \r
319 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
320 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r
321 isOK = 0;\r
322 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r
8556b852 323 break;\r
baeaf579 324 }\r
325 }\r
8556b852 326 \r
baeaf579 327 if(mifare_classic_halt(pcs, cuid)) {\r
8556b852 328 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
8556b852 329 }\r
baeaf579 330\r
8556b852
M
331 // ----------------------------- crypto1 destroy\r
332 crypto1_destroy(pcs);\r
333 \r
334 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r
335\r
8556b852 336 LED_B_ON();\r
baeaf579 337 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r
6e82300d 338 LED_B_OFF();\r
8556b852
M
339\r
340 // Thats it...\r
341 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
342 LEDsoff();\r
7cc204bf 343}\r
344\r
787b5bd8 345void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)\r
7cc204bf 346{\r
f168b263 347 // params\r
348 uint8_t sectorNo = arg0;\r
787b5bd8 349 int Pages = arg1;\r
f168b263 350 int countpages = 0;\r
787b5bd8 351 byte_t dataout[176] = {0x00};;\r
7cc204bf 352\r
92690507 353 LEDsoff();\r
354 LED_A_ON();\r
3000dc4e 355 clear_trace();\r
787b5bd8 356 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
7cc204bf 357\r
92690507 358 int len = iso14443a_select_card(NULL, NULL, NULL);\r
787b5bd8 359 if (!len) {\r
f168b263 360 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r
361 OnError(1);\r
787b5bd8 362 return;\r
363 }\r
364 \r
365 for (int i = 0; i < Pages; i++){\r
366 \r
f168b263 367 len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);\r
787b5bd8 368 \r
369 if (len) {\r
f168b263 370 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r
371 OnError(2);\r
787b5bd8 372 return;\r
373 } else {\r
f168b263 374 countpages++;\r
787b5bd8 375 }\r
376 }\r
377 \r
f168b263 378 len = mifare_ultra_halt();\r
787b5bd8 379 if (len) {\r
f168b263 380 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
381 OnError(3);\r
787b5bd8 382 return;\r
383 }\r
384 \r
92690507 385 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Pages read %d", countpages);\r
7cc204bf 386\r
f168b263 387 len = Pages * 4;\r
7cc204bf 388\r
787b5bd8 389 cmd_send(CMD_ACK, 1, 0, 0, dataout, len); \r
31d1caa5
MHS
390 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
391 LEDsoff();\r
7cc204bf 392}\r
393\r
7cc204bf 394//-----------------------------------------------------------------------------\r
baeaf579 395// Select, Authenticate, Write a MIFARE tag. \r
7cc204bf 396// read block\r
8556b852
M
397//-----------------------------------------------------------------------------\r
398void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
399{\r
400 // params\r
401 uint8_t blockNo = arg0;\r
402 uint8_t keyType = arg1;\r
403 uint64_t ui64Key = 0;\r
404 byte_t blockdata[16];\r
405\r
406 ui64Key = bytes_to_num(datain, 6);\r
407 memcpy(blockdata, datain + 10, 16);\r
408 \r
409 // variables\r
410 byte_t isOK = 0;\r
1c611bbd 411 uint8_t uid[10];\r
8556b852
M
412 uint32_t cuid;\r
413 struct Crypto1State mpcs = {0, 0};\r
414 struct Crypto1State *pcs;\r
415 pcs = &mpcs;\r
416\r
417 // clear trace\r
3000dc4e 418 clear_trace();\r
8556b852 419\r
7bc95e2e 420 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
8556b852
M
421\r
422 LED_A_ON();\r
423 LED_B_OFF();\r
424 LED_C_OFF();\r
425\r
426 while (true) {\r
427 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
428 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
429 break;\r
430 };\r
431\r
432 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
433 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
434 break;\r
435 };\r
436 \r
437 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r
438 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
439 break;\r
440 };\r
441\r
442 if(mifare_classic_halt(pcs, cuid)) {\r
443 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
444 break;\r
445 };\r
446 \r
447 isOK = 1;\r
448 break;\r
449 }\r
450 \r
451 // ----------------------------- crypto1 destroy\r
452 crypto1_destroy(pcs);\r
453 \r
454 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
455\r
8556b852 456 LED_B_ON();\r
9492e0b0 457 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
6e82300d 458 LED_B_OFF();\r
8556b852
M
459\r
460\r
461 // Thats it...\r
462 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
463 LEDsoff();\r
7cc204bf 464}\r
465\r
466void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)\r
467{\r
f168b263 468 uint8_t blockNo = arg0;\r
787b5bd8 469 byte_t blockdata[16] = {0x00};\r
7cc204bf 470\r
f168b263 471 memcpy(blockdata, datain, 16);\r
472\r
787b5bd8 473 uint8_t uid[10] = {0x00};\r
7cc204bf 474\r
f168b263 475 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
7cc204bf 476\r
f168b263 477 clear_trace();\r
478 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
479\r
480 if(!iso14443a_select_card(uid, NULL, NULL)) {\r
481 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
482 OnError(0);\r
483 return;\r
484 };\r
485\r
486 if(mifare_ultra_writeblock(blockNo, blockdata)) {\r
487 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
488 OnError(0);\r
489 return; };\r
490\r
491 if(mifare_ultra_halt()) {\r
492 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
493 OnError(0);\r
494 return;\r
495 };\r
496\r
497 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
498\r
499 cmd_send(CMD_ACK,1,0,0,0,0);\r
500 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
501 LEDsoff();\r
7cc204bf 502}\r
503\r
504void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)\r
505{\r
baeaf579 506 uint8_t blockNo = arg0;\r
787b5bd8 507 byte_t blockdata[4] = {0x00};\r
baeaf579 508 \r
7cc204bf 509 memcpy(blockdata, datain,4);\r
510\r
787b5bd8 511 uint8_t uid[10] = {0x00};\r
f168b263 512 \r
513 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
514 clear_trace();\r
515 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
516\r
517 if(!iso14443a_select_card(uid, NULL, NULL)) {\r
518 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
519 OnError(0);\r
520 return;\r
521 };\r
7cc204bf 522\r
f168b263 523 if(mifare_ultra_special_writeblock(blockNo, blockdata)) {\r
524 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
525 OnError(0);\r
526 return;\r
527 };\r
528\r
529 if(mifare_ultra_halt()) {\r
530 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
531 OnError(0);\r
532 return;\r
533 };\r
534\r
535 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
536\r
537 cmd_send(CMD_ACK,1,0,0,0,0);\r
538 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
539 LEDsoff();\r
540}\r
541\r
542void MifareUSetPwd(uint8_t arg0, uint8_t *datain){\r
543 \r
544 uint8_t pwd[16] = {0x00};\r
545 byte_t blockdata[4] = {0x00};\r
546 \r
547 memcpy(pwd, datain, 16);\r
548 \r
549 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
3000dc4e 550 clear_trace();\r
baeaf579 551 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
7cc204bf 552\r
f168b263 553 if(!iso14443a_select_card(NULL, NULL, NULL)) {\r
554 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
555 OnError(0);\r
556 return;\r
557 };\r
7cc204bf 558\r
f168b263 559 blockdata[0] = pwd[7];\r
560 blockdata[1] = pwd[6];\r
561 blockdata[2] = pwd[5];\r
562 blockdata[3] = pwd[4];\r
563 if(mifare_ultra_special_writeblock( 44, blockdata)) {\r
564 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
565 OnError(44);\r
566 return;\r
567 };\r
7cc204bf 568\r
f168b263 569 blockdata[0] = pwd[3];\r
570 blockdata[1] = pwd[2];\r
571 blockdata[2] = pwd[1];\r
572 blockdata[3] = pwd[0];\r
573 if(mifare_ultra_special_writeblock( 45, blockdata)) {\r
574 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
575 OnError(45);\r
576 return;\r
577 };\r
7cc204bf 578\r
f168b263 579 blockdata[0] = pwd[15];\r
580 blockdata[1] = pwd[14];\r
581 blockdata[2] = pwd[13];\r
582 blockdata[3] = pwd[12];\r
583 if(mifare_ultra_special_writeblock( 46, blockdata)) {\r
584 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
585 OnError(46);\r
586 return;\r
587 };\r
7cc204bf 588\r
f168b263 589 blockdata[0] = pwd[11];\r
590 blockdata[1] = pwd[10];\r
591 blockdata[2] = pwd[9];\r
592 blockdata[3] = pwd[8];\r
593 if(mifare_ultra_special_writeblock( 47, blockdata)) {\r
594 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
595 OnError(47);\r
596 return;\r
597 }; \r
7cc204bf 598\r
f168b263 599 if(mifare_ultra_halt()) {\r
600 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
601 OnError(0);\r
602 return;\r
603 };\r
7cc204bf 604\r
f168b263 605 cmd_send(CMD_ACK,1,0,0,0,0);\r
baeaf579 606 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
607 LEDsoff();\r
7cc204bf 608}\r
609\r
610// Return 1 if the nonce is invalid else return 0\r
6a1f2d82 611int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r
7cc204bf 612 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r
8556b852
M
613 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r
614 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r
615}\r
616\r
9492e0b0 617\r
8556b852
M
618//-----------------------------------------------------------------------------\r
619// MIFARE nested authentication. \r
620// \r
621//-----------------------------------------------------------------------------\r
9492e0b0 622void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r
8556b852
M
623{\r
624 // params\r
9492e0b0 625 uint8_t blockNo = arg0 & 0xff;\r
626 uint8_t keyType = (arg0 >> 8) & 0xff;\r
627 uint8_t targetBlockNo = arg1 & 0xff;\r
628 uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
8556b852
M
629 uint64_t ui64Key = 0;\r
630\r
631 ui64Key = bytes_to_num(datain, 6);\r
632 \r
633 // variables\r
9492e0b0 634 uint16_t rtr, i, j, len;\r
635 uint16_t davg;\r
636 static uint16_t dmin, dmax;\r
1c611bbd 637 uint8_t uid[10];\r
6a1f2d82 638 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r
639 uint8_t par[1];\r
9492e0b0 640 uint32_t target_nt[2], target_ks[2];\r
641 \r
8556b852 642 uint8_t par_array[4];\r
9492e0b0 643 uint16_t ncount = 0;\r
8556b852
M
644 struct Crypto1State mpcs = {0, 0};\r
645 struct Crypto1State *pcs;\r
646 pcs = &mpcs;\r
f71f4deb 647 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
8556b852 648\r
9492e0b0 649 uint32_t auth1_time, auth2_time;\r
650 static uint16_t delta_time;\r
651\r
f71f4deb 652 // free eventually allocated BigBuf memory\r
653 BigBuf_free();\r
8556b852 654 // clear trace\r
3000dc4e
MHS
655 clear_trace();\r
656 set_tracing(false);\r
8556b852 657 \r
7bc95e2e 658 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
8556b852
M
659\r
660 LED_A_ON();\r
8556b852
M
661 LED_C_OFF();\r
662\r
8556b852 663\r
9492e0b0 664 // statistics on nonce distance\r
665 if (calibrate) { // for first call only. Otherwise reuse previous calibration\r
666 LED_B_ON();\r
3fe4ff4f 667 WDT_HIT();\r
8556b852 668\r
9492e0b0 669 davg = dmax = 0;\r
670 dmin = 2000;\r
671 delta_time = 0;\r
8556b852 672 \r
9492e0b0 673 for (rtr = 0; rtr < 17; rtr++) {\r
8556b852 674\r
9492e0b0 675 // prepare next select. No need to power down the card.\r
676 if(mifare_classic_halt(pcs, cuid)) {\r
677 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
678 rtr--;\r
679 continue;\r
680 }\r
681\r
682 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
683 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
684 rtr--;\r
685 continue;\r
686 };\r
687\r
688 auth1_time = 0;\r
689 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
690 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
691 rtr--;\r
692 continue;\r
693 };\r
694\r
695 if (delta_time) {\r
696 auth2_time = auth1_time + delta_time;\r
697 } else {\r
698 auth2_time = 0;\r
699 }\r
700 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r
701 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
702 rtr--;\r
703 continue;\r
704 };\r
705\r
b19bd5d6 706 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r
707 for (i = 101; i < 1200; i++) {\r
9492e0b0 708 nttmp = prng_successor(nttmp, 1);\r
709 if (nttmp == nt2) break;\r
710 }\r
711\r
712 if (i != 1200) {\r
713 if (rtr != 0) {\r
714 davg += i;\r
715 dmin = MIN(dmin, i);\r
716 dmax = MAX(dmax, i);\r
717 }\r
718 else {\r
719 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r
720 }\r
721 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r
722 }\r
8556b852
M
723 }\r
724 \r
9492e0b0 725 if (rtr <= 1) return;\r
8556b852 726\r
9492e0b0 727 davg = (davg + (rtr - 1)/2) / (rtr - 1);\r
728 \r
729 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);\r
8556b852 730\r
9492e0b0 731 dmin = davg - 2;\r
732 dmax = davg + 2;\r
733 \r
734 LED_B_OFF();\r
735 \r
736 }\r
8556b852
M
737// ------------------------------------------------------------------------------------------------- \r
738 \r
739 LED_C_ON();\r
740\r
741 // get crypted nonces for target sector\r
9492e0b0 742 for(i=0; i < 2; i++) { // look for exactly two different nonces\r
8556b852 743\r
9492e0b0 744 target_nt[i] = 0;\r
745 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r
8556b852 746 \r
9492e0b0 747 // prepare next select. No need to power down the card.\r
748 if(mifare_classic_halt(pcs, cuid)) {\r
749 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
750 continue;\r
751 }\r
8556b852 752\r
9492e0b0 753 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
754 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
755 continue;\r
756 };\r
8556b852 757 \r
9492e0b0 758 auth1_time = 0;\r
759 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
760 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
761 continue;\r
762 };\r
8556b852 763\r
9492e0b0 764 // nested authentication\r
765 auth2_time = auth1_time + delta_time;\r
6a1f2d82 766 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r
9492e0b0 767 if (len != 4) {\r
768 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r
769 continue;\r
770 };\r
8556b852 771 \r
9492e0b0 772 nt2 = bytes_to_num(receivedAnswer, 4); \r
6a1f2d82 773 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r
8556b852 774 \r
9492e0b0 775 // Parity validity check\r
776 for (j = 0; j < 4; j++) {\r
6a1f2d82 777 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r
9492e0b0 778 }\r
779 \r
780 ncount = 0;\r
781 nttest = prng_successor(nt1, dmin - 1);\r
782 for (j = dmin; j < dmax + 1; j++) {\r
783 nttest = prng_successor(nttest, 1);\r
784 ks1 = nt2 ^ nttest;\r
785\r
786 if (valid_nonce(nttest, nt2, ks1, par_array)){\r
787 if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r
788 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r
789 target_nt[i] = 0;\r
790 break;\r
791 }\r
792 target_nt[i] = nttest;\r
793 target_ks[i] = ks1;\r
794 ncount++;\r
795 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r
796 target_nt[i] = 0;\r
797 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r
8556b852
M
798 break;\r
799 }\r
9492e0b0 800 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r
8556b852 801 }\r
8556b852 802 }\r
9492e0b0 803 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r
8556b852
M
804 }\r
805 }\r
806\r
807 LED_C_OFF();\r
808 \r
809 // ----------------------------- crypto1 destroy\r
810 crypto1_destroy(pcs);\r
811 \r
9492e0b0 812 byte_t buf[4 + 4 * 4];\r
813 memcpy(buf, &cuid, 4);\r
814 memcpy(buf+4, &target_nt[0], 4);\r
815 memcpy(buf+8, &target_ks[0], 4);\r
816 memcpy(buf+12, &target_nt[1], 4);\r
817 memcpy(buf+16, &target_ks[1], 4);\r
8556b852
M
818 \r
819 LED_B_ON();\r
9492e0b0 820 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
6e82300d 821 LED_B_OFF();\r
8556b852 822\r
9492e0b0 823 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r
8556b852 824\r
8556b852
M
825 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
826 LEDsoff();\r
3000dc4e 827 set_tracing(TRUE);\r
8556b852
M
828}\r
829\r
830//-----------------------------------------------------------------------------\r
9492e0b0 831// MIFARE check keys. key count up to 85. \r
8556b852
M
832// \r
833//-----------------------------------------------------------------------------\r
834void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
835{\r
836 // params\r
837 uint8_t blockNo = arg0;\r
838 uint8_t keyType = arg1;\r
839 uint8_t keyCount = arg2;\r
840 uint64_t ui64Key = 0;\r
841 \r
842 // variables\r
843 int i;\r
844 byte_t isOK = 0;\r
1c611bbd 845 uint8_t uid[10];\r
8556b852
M
846 uint32_t cuid;\r
847 struct Crypto1State mpcs = {0, 0};\r
848 struct Crypto1State *pcs;\r
849 pcs = &mpcs;\r
850 \r
851 // clear debug level\r
852 int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r
853 MF_DBGLEVEL = MF_DBG_NONE;\r
854 \r
855 // clear trace\r
3000dc4e
MHS
856 clear_trace();\r
857 set_tracing(TRUE);\r
8556b852 858\r
7bc95e2e 859 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
8556b852
M
860\r
861 LED_A_ON();\r
862 LED_B_OFF();\r
863 LED_C_OFF();\r
864\r
8556b852 865 for (i = 0; i < keyCount; i++) {\r
9492e0b0 866 if(mifare_classic_halt(pcs, cuid)) {\r
867 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r
868 }\r
8556b852
M
869\r
870 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
9492e0b0 871 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r
8556b852
M
872 break;\r
873 };\r
874\r
875 ui64Key = bytes_to_num(datain + i * 6, 6);\r
876 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
877 continue;\r
878 };\r
879 \r
880 isOK = 1;\r
881 break;\r
882 }\r
883 \r
884 // ----------------------------- crypto1 destroy\r
885 crypto1_destroy(pcs);\r
886 \r
8556b852 887 LED_B_ON();\r
6e82300d 888 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r
8556b852
M
889 LED_B_OFF();\r
890\r
8556b852
M
891 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
892 LEDsoff();\r
893\r
894 // restore debug level\r
895 MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r
896}\r
897\r
898//-----------------------------------------------------------------------------\r
899// MIFARE commands set debug level\r
900// \r
901//-----------------------------------------------------------------------------\r
902void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
903 MF_DBGLEVEL = arg0;\r
904 Dbprintf("Debug level: %d", MF_DBGLEVEL);\r
905}\r
906\r
907//-----------------------------------------------------------------------------\r
908// Work with emulator memory\r
909// \r
910//-----------------------------------------------------------------------------\r
911void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
912 emlClearMem();\r
913}\r
914\r
915void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
916 emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r
917}\r
918\r
919void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
3fe4ff4f 920 byte_t buf[USB_CMD_DATA_SIZE];\r
baeaf579 921 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r
8556b852
M
922\r
923 LED_B_ON();\r
3fe4ff4f 924 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r
8556b852
M
925 LED_B_OFF();\r
926}\r
927\r
928//-----------------------------------------------------------------------------\r
929// Load a card into the emulator memory\r
930// \r
931//-----------------------------------------------------------------------------\r
932void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
baeaf579 933 uint8_t numSectors = arg0;\r
8556b852
M
934 uint8_t keyType = arg1;\r
935 uint64_t ui64Key = 0;\r
936 uint32_t cuid;\r
937 struct Crypto1State mpcs = {0, 0};\r
938 struct Crypto1State *pcs;\r
939 pcs = &mpcs;\r
940\r
941 // variables\r
942 byte_t dataoutbuf[16];\r
ab8b654e 943 byte_t dataoutbuf2[16];\r
1c611bbd 944 uint8_t uid[10];\r
8556b852
M
945\r
946 // clear trace\r
3000dc4e
MHS
947 clear_trace();\r
948 set_tracing(false);\r
8556b852 949 \r
7bc95e2e 950 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
8556b852
M
951\r
952 LED_A_ON();\r
953 LED_B_OFF();\r
954 LED_C_OFF();\r
955 \r
baeaf579 956 bool isOK = true;\r
957\r
958 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
959 isOK = false;\r
960 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
961 }\r
8556b852 962 \r
baeaf579 963 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
964 ui64Key = emlGetKey(sectorNo, keyType);\r
965 if (sectorNo == 0){\r
966 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
967 isOK = false;\r
968 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r
8556b852 969 break;\r
baeaf579 970 }\r
971 } else {\r
972 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r
973 isOK = false;\r
974 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r
8556b852 975 break;\r
baeaf579 976 }\r
977 }\r
978 \r
979 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
980 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r
981 isOK = false;\r
982 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r
ab8b654e
M
983 break;\r
984 };\r
baeaf579 985 if (isOK) {\r
986 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r
987 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
988 } else { // sector trailer, keep the keys, set only the AC\r
989 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
990 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r
991 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
992 }\r
993 }\r
8556b852
M
994 }\r
995\r
baeaf579 996 }\r
997\r
998 if(mifare_classic_halt(pcs, cuid)) {\r
999 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1000 };\r
8556b852
M
1001\r
1002 // ----------------------------- crypto1 destroy\r
1003 crypto1_destroy(pcs);\r
ab8b654e
M
1004\r
1005 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1006 LEDsoff();\r
8556b852
M
1007 \r
1008 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r
1009\r
8556b852
M
1010}\r
1011\r
0675f200
M
1012\r
1013//-----------------------------------------------------------------------------\r
1014// Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r
1015// \r
1016//-----------------------------------------------------------------------------\r
1017void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
1018 \r
1019 // params\r
1020 uint8_t needWipe = arg0;\r
208a0166
M
1021 // bit 0 - need get UID\r
1022 // bit 1 - need wupC\r
1023 // bit 2 - need HALT after sequence\r
1024 // bit 3 - need init FPGA and field before sequence\r
1025 // bit 4 - need reset FPGA and LED\r
1026 uint8_t workFlags = arg1;\r
0675f200
M
1027 uint8_t blockNo = arg2;\r
1028 \r
1029 // card commands\r
1030 uint8_t wupC1[] = { 0x40 }; \r
1031 uint8_t wupC2[] = { 0x43 }; \r
1032 uint8_t wipeC[] = { 0x41 }; \r
1033 \r
1034 // variables\r
1035 byte_t isOK = 0;\r
3fe4ff4f 1036 uint8_t uid[10] = {0x00};\r
1037 uint8_t d_block[18] = {0x00};\r
0675f200
M
1038 uint32_t cuid;\r
1039 \r
f71f4deb 1040 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
1041 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
6a1f2d82 1042\r
3fe4ff4f 1043 // reset FPGA and LED\r
208a0166 1044 if (workFlags & 0x08) {\r
208a0166
M
1045 LED_A_ON();\r
1046 LED_B_OFF();\r
1047 LED_C_OFF();\r
0675f200 1048 \r
3000dc4e
MHS
1049 clear_trace();\r
1050 set_tracing(TRUE);\r
3fe4ff4f 1051 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
208a0166 1052 }\r
0675f200
M
1053\r
1054 while (true) {\r
3fe4ff4f 1055\r
0675f200 1056 // get UID from chip\r
208a0166 1057 if (workFlags & 0x01) {\r
0675f200
M
1058 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
1059 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
1060 break;\r
1061 };\r
1062\r
1063 if(mifare_classic_halt(NULL, cuid)) {\r
1064 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1065 break;\r
1066 };\r
1067 };\r
1068 \r
1069 // reset chip\r
1070 if (needWipe){\r
6a1f2d82 1071 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1072 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
0675f200
M
1073 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
1074 break;\r
1075 };\r
1076\r
9492e0b0 1077 ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r
6a1f2d82 1078 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
0675f200
M
1079 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r
1080 break;\r
1081 };\r
1082\r
1083 if(mifare_classic_halt(NULL, cuid)) {\r
1084 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1085 break;\r
1086 };\r
1087 }; \r
1088\r
545a1f38 1089 // write block\r
208a0166 1090 if (workFlags & 0x02) {\r
6a1f2d82 1091 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1092 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
208a0166
M
1093 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
1094 break;\r
1095 };\r
0675f200 1096\r
9492e0b0 1097 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
6a1f2d82 1098 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
208a0166
M
1099 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
1100 break;\r
1101 };\r
1102 }\r
0675f200 1103\r
6a1f2d82 1104 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r
0675f200
M
1105 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r
1106 break;\r
1107 };\r
1108 \r
1109 memcpy(d_block, datain, 16);\r
1110 AppendCrc14443a(d_block, 16);\r
1111 \r
9492e0b0 1112 ReaderTransmit(d_block, sizeof(d_block), NULL);\r
6a1f2d82 1113 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r
0675f200
M
1114 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r
1115 break;\r
1116 }; \r
1117 \r
208a0166
M
1118 if (workFlags & 0x04) {\r
1119 if (mifare_classic_halt(NULL, cuid)) {\r
1120 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1121 break;\r
1122 };\r
1123 }\r
0675f200
M
1124 \r
1125 isOK = 1;\r
1126 break;\r
1127 }\r
1128 \r
0675f200 1129 LED_B_ON();\r
baeaf579 1130 cmd_send(CMD_ACK,isOK,0,0,uid,4);\r
0675f200
M
1131 LED_B_OFF();\r
1132\r
545a1f38 1133 if ((workFlags & 0x10) || (!isOK)) {\r
208a0166
M
1134 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1135 LEDsoff();\r
1136 }\r
0675f200 1137}\r
545a1f38 1138\r
baeaf579 1139\r
545a1f38
M
1140void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
1141 \r
1142 // params\r
1143 // bit 1 - need wupC\r
1144 // bit 2 - need HALT after sequence\r
1145 // bit 3 - need init FPGA and field before sequence\r
1146 // bit 4 - need reset FPGA and LED\r
1147 uint8_t workFlags = arg0;\r
1148 uint8_t blockNo = arg2;\r
1149 \r
1150 // card commands\r
1151 uint8_t wupC1[] = { 0x40 }; \r
1152 uint8_t wupC2[] = { 0x43 }; \r
1153 \r
1154 // variables\r
1155 byte_t isOK = 0;\r
3fe4ff4f 1156 uint8_t data[18] = {0x00};\r
545a1f38
M
1157 uint32_t cuid = 0;\r
1158 \r
f71f4deb 1159 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
1160 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
545a1f38
M
1161 \r
1162 if (workFlags & 0x08) {\r
545a1f38
M
1163 LED_A_ON();\r
1164 LED_B_OFF();\r
1165 LED_C_OFF();\r
1166 \r
3000dc4e
MHS
1167 clear_trace();\r
1168 set_tracing(TRUE);\r
3fe4ff4f 1169 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
545a1f38
M
1170 }\r
1171\r
1172 while (true) {\r
1173 if (workFlags & 0x02) {\r
7bc95e2e 1174 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
6a1f2d82 1175 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
545a1f38
M
1176 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
1177 break;\r
1178 };\r
1179\r
9492e0b0 1180 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
6a1f2d82 1181 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
545a1f38
M
1182 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
1183 break;\r
1184 };\r
1185 }\r
1186\r
1187 // read block\r
6a1f2d82 1188 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r
545a1f38
M
1189 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r
1190 break;\r
1191 };\r
1192 memcpy(data, receivedAnswer, 18);\r
1193 \r
1194 if (workFlags & 0x04) {\r
1195 if (mifare_classic_halt(NULL, cuid)) {\r
1196 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1197 break;\r
1198 };\r
1199 }\r
1200 \r
1201 isOK = 1;\r
1202 break;\r
1203 }\r
1204 \r
545a1f38 1205 LED_B_ON();\r
baeaf579 1206 cmd_send(CMD_ACK,isOK,0,0,data,18);\r
545a1f38
M
1207 LED_B_OFF();\r
1208\r
1209 if ((workFlags & 0x10) || (!isOK)) {\r
545a1f38
M
1210 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1211 LEDsoff();\r
1212 }\r
1213}\r
1214\r
3fe4ff4f 1215void MifareCIdent(){\r
1216 \r
1217 // card commands\r
1218 uint8_t wupC1[] = { 0x40 }; \r
1219 uint8_t wupC2[] = { 0x43 }; \r
1220 \r
1221 // variables\r
1222 byte_t isOK = 1;\r
1223 \r
f71f4deb 1224 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
1225 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
3fe4ff4f 1226\r
1227 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1228 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1229 isOK = 0;\r
1230 };\r
1231\r
1232 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
1233 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1234 isOK = 0;\r
1235 };\r
1236\r
1237 if (mifare_classic_halt(NULL, 0)) {\r
1238 isOK = 0;\r
1239 };\r
1240\r
1241 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
1242}\r
1243\r
1244 //\r
1245// DESFIRE\r
1246//\r
a631936e 1247\r
1248void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r
1249\r
1250 byte_t dataout[11] = {0x00};\r
1251 uint8_t uid[10] = {0x00};\r
1252 uint32_t cuid;\r
1253 \r
3000dc4e 1254 clear_trace();\r
a631936e 1255 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
1256\r
1257 int len = iso14443a_select_card(uid, NULL, &cuid);\r
1258 if(!len) {\r
1259 if (MF_DBGLEVEL >= MF_DBG_ERROR) \r
1260 Dbprintf("Can't select card");\r
c8b6da22 1261 //OnError(1);\r
a631936e 1262 return;\r
1263 };\r
1264\r
1265 if(mifare_desfire_des_auth1(cuid, dataout)){\r
1266 if (MF_DBGLEVEL >= MF_DBG_ERROR) \r
1267 Dbprintf("Authentication part1: Fail.");\r
c8b6da22 1268 //OnError(4);\r
a631936e 1269 return;\r
1270 }\r
1271\r
1272 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
1273 \r
1274 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r
1275}\r
1276\r
1277void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r
1278\r
1279 uint32_t cuid = arg0;\r
1280 uint8_t key[16] = {0x00};\r
1281 byte_t isOK = 0;\r
1282 byte_t dataout[12] = {0x00};\r
1283 \r
1284 memcpy(key, datain, 16);\r
1285 \r
1286 isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r
1287 \r
1288 if( isOK) {\r
1289 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r
1290 Dbprintf("Authentication part2: Failed"); \r
c8b6da22 1291 //OnError(4);\r
a631936e 1292 return;\r
1293 }\r
1294\r
1295 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r
1296 DbpString("AUTH 2 FINISHED");\r
1297\r
1298 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r
1299 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1300 LEDsoff();\r
3000dc4e 1301}\r
f168b263 1302\r
1303void OnSuccess(){\r
1304 pcb_blocknum = 0;\r
1305 ReaderTransmit(deselect_cmd, 3 , NULL);\r
1306 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1307 LEDsoff();\r
1308}\r
1309\r
1310void OnError(uint8_t reason){\r
1311 pcb_blocknum = 0;\r
1312 ReaderTransmit(deselect_cmd, 3 , NULL);\r
1313 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1314 cmd_send(CMD_ACK,0,reason,0,0,0);\r
1315 LEDsoff();\r
1316}\r
Impressum, Datenschutz