]>
Commit | Line | Data |
---|---|---|
8556b852 | 1 | //-----------------------------------------------------------------------------\r |
b62a5a84 | 2 | // Merlok - June 2011, 2012\r |
8556b852 M |
3 | // Gerhard de Koning Gans - May 2008\r |
4 | // Hagen Fritsch - June 2010\r | |
3fe4ff4f | 5 | // Midnitesnake - Dec 2013\r |
6 | // Andy Davies - Apr 2014\r | |
7 | // Iceman - May 2014\r | |
8556b852 M |
8 | //\r |
9 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
10 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
11 | // the license.\r | |
12 | //-----------------------------------------------------------------------------\r | |
13 | // Routines to support ISO 14443 type A.\r | |
14 | //-----------------------------------------------------------------------------\r | |
15 | \r | |
16 | #include "mifarecmd.h"\r | |
17 | #include "apps.h"\r | |
787b5bd8 | 18 | #include "util.h"\r |
a631936e | 19 | #include "crc.h"\r |
20 | \r | |
f168b263 | 21 | // the block number for the ISO14443-4 PCB\r |
22 | uint8_t pcb_blocknum = 0;\r | |
23 | // Deselect card by sending a s-block. the crc is precalced for speed\r | |
24 | static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};\r | |
25 | \r | |
8556b852 | 26 | //-----------------------------------------------------------------------------\r |
baeaf579 | 27 | // Select, Authenticate, Read a MIFARE tag. \r |
8556b852 M |
28 | // read block\r |
29 | //-----------------------------------------------------------------------------\r | |
30 | void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
31 | {\r | |
32 | // params\r | |
33 | uint8_t blockNo = arg0;\r | |
34 | uint8_t keyType = arg1;\r | |
35 | uint64_t ui64Key = 0;\r | |
36 | ui64Key = bytes_to_num(datain, 6);\r | |
37 | \r | |
38 | // variables\r | |
39 | byte_t isOK = 0;\r | |
40 | byte_t dataoutbuf[16];\r | |
1c611bbd | 41 | uint8_t uid[10];\r |
8556b852 M |
42 | uint32_t cuid;\r |
43 | struct Crypto1State mpcs = {0, 0};\r | |
44 | struct Crypto1State *pcs;\r | |
45 | pcs = &mpcs;\r | |
46 | \r | |
47 | // clear trace\r | |
3000dc4e | 48 | clear_trace();\r |
7bc95e2e | 49 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
50 | \r |
51 | LED_A_ON();\r | |
52 | LED_B_OFF();\r | |
53 | LED_C_OFF();\r | |
54 | \r | |
55 | while (true) {\r | |
56 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
baeaf579 | 57 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
8556b852 M |
58 | break;\r |
59 | };\r | |
60 | \r | |
61 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
baeaf579 | 62 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
8556b852 M |
63 | break;\r |
64 | };\r | |
65 | \r | |
66 | if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r | |
baeaf579 | 67 | if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r |
8556b852 M |
68 | break;\r |
69 | };\r | |
70 | \r | |
71 | if(mifare_classic_halt(pcs, cuid)) {\r | |
baeaf579 | 72 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 M |
73 | break;\r |
74 | };\r | |
75 | \r | |
76 | isOK = 1;\r | |
77 | break;\r | |
78 | }\r | |
79 | \r | |
80 | // ----------------------------- crypto1 destroy\r | |
81 | crypto1_destroy(pcs);\r | |
82 | \r | |
83 | if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r | |
84 | \r | |
8556b852 | 85 | LED_B_ON();\r |
baeaf579 | 86 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r |
8556b852 M |
87 | LED_B_OFF();\r |
88 | \r | |
a631936e | 89 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
90 | LEDsoff();\r | |
91 | }\r | |
92 | \r | |
8258f409 | 93 | void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){\r |
a631936e | 94 | \r |
8258f409 | 95 | bool turnOffField = (arg0 == 1);\r |
a631936e | 96 | \r |
f168b263 | 97 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r |
3000dc4e | 98 | clear_trace();\r |
a631936e | 99 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
100 | \r | |
8258f409 | 101 | if(!iso14443a_select_card(NULL, NULL, NULL)) {\r |
f168b263 | 102 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r |
103 | OnError(0);\r | |
a631936e | 104 | return;\r |
105 | };\r | |
106 | \r | |
9d87eb66 | 107 | if(!mifare_ultra_auth(keybytes)){\r |
8258f409 | 108 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");\r |
f168b263 | 109 | OnError(1);\r |
a631936e | 110 | return;\r |
111 | }\r | |
112 | \r | |
8258f409 | 113 | if (turnOffField) {\r |
cceabb79 | 114 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
115 | LEDsoff();\r | |
116 | }\r | |
9d87eb66 | 117 | cmd_send(CMD_ACK,1,0,0,0,0);\r |
7cc204bf | 118 | }\r |
119 | \r | |
75377d29 | 120 | // Arg0 = BlockNo,\r |
121 | // Arg1 = UsePwd bool\r | |
122 | // datain = PWD bytes,\r | |
f168b263 | 123 | void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r |
7cc204bf | 124 | {\r |
7cc204bf | 125 | uint8_t blockNo = arg0;\r |
787b5bd8 | 126 | byte_t dataout[16] = {0x00};\r |
8258f409 | 127 | bool useKey = (arg1 == 1); //UL_C\r |
128 | bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r | |
f168b263 | 129 | \r |
75377d29 | 130 | LEDsoff();\r |
131 | LED_A_ON();\r | |
3000dc4e | 132 | clear_trace();\r |
787b5bd8 | 133 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
f168b263 | 134 | \r |
8258f409 | 135 | int len = iso14443a_select_card(NULL, NULL, NULL);\r |
787b5bd8 | 136 | if(!len) {\r |
f168b263 | 137 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r |
138 | OnError(1);\r | |
787b5bd8 | 139 | return;\r |
f168b263 | 140 | }\r |
141 | \r | |
8258f409 | 142 | // UL-C authentication\r |
143 | if ( useKey ) {\r | |
144 | uint8_t key[16] = {0x00};\r | |
145 | memcpy(key, datain, sizeof(key) );\r | |
f168b263 | 146 | \r |
9d87eb66 | 147 | if ( !mifare_ultra_auth(key) ) {\r |
f168b263 | 148 | OnError(1);\r |
149 | return;\r | |
150 | }\r | |
8258f409 | 151 | }\r |
f168b263 | 152 | \r |
8258f409 | 153 | // UL-EV1 / NTAG authentication\r |
154 | if ( usePwd ) {\r | |
155 | uint8_t pwd[4] = {0x00};\r | |
156 | memcpy(pwd, datain, 4);\r | |
157 | uint8_t pack[4] = {0,0,0,0};\r | |
9d87eb66 | 158 | if (!mifare_ul_ev1_auth(pwd, pack)) {\r |
f168b263 | 159 | OnError(1);\r |
160 | return;\r | |
161 | }\r | |
8258f409 | 162 | } \r |
f168b263 | 163 | \r |
f168b263 | 164 | if( mifare_ultra_readblock(blockNo, dataout) ) {\r |
165 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r | |
166 | OnError(2);\r | |
787b5bd8 | 167 | return;\r |
f168b263 | 168 | }\r |
8258f409 | 169 | \r |
f168b263 | 170 | if( mifare_ultra_halt() ) {\r |
171 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r | |
172 | OnError(3);\r | |
787b5bd8 | 173 | return;\r |
f168b263 | 174 | }\r |
8258f409 | 175 | \r |
176 | cmd_send(CMD_ACK,1,0,0,dataout,16);\r | |
7cc204bf | 177 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
178 | LEDsoff();\r | |
179 | }\r | |
b3125340 | 180 | \r |
7cc204bf | 181 | //-----------------------------------------------------------------------------\r |
baeaf579 | 182 | // Select, Authenticate, Read a MIFARE tag. \r |
183 | // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r | |
8556b852 M |
184 | //-----------------------------------------------------------------------------\r |
185 | void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
186 | {\r | |
187 | // params\r | |
188 | uint8_t sectorNo = arg0;\r | |
189 | uint8_t keyType = arg1;\r | |
190 | uint64_t ui64Key = 0;\r | |
191 | ui64Key = bytes_to_num(datain, 6);\r | |
192 | \r | |
193 | // variables\r | |
3fe4ff4f | 194 | byte_t isOK = 0;\r |
baeaf579 | 195 | byte_t dataoutbuf[16 * 16];\r |
1c611bbd | 196 | uint8_t uid[10];\r |
8556b852 M |
197 | uint32_t cuid;\r |
198 | struct Crypto1State mpcs = {0, 0};\r | |
199 | struct Crypto1State *pcs;\r | |
200 | pcs = &mpcs;\r | |
201 | \r | |
202 | // clear trace\r | |
3000dc4e | 203 | clear_trace();\r |
8556b852 | 204 | \r |
7bc95e2e | 205 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
206 | \r |
207 | LED_A_ON();\r | |
208 | LED_B_OFF();\r | |
209 | LED_C_OFF();\r | |
210 | \r | |
baeaf579 | 211 | isOK = 1;\r |
212 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
213 | isOK = 0;\r | |
8556b852 | 214 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
baeaf579 | 215 | }\r |
8556b852 | 216 | \r |
baeaf579 | 217 | \r |
218 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r | |
219 | isOK = 0;\r | |
8556b852 | 220 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
baeaf579 | 221 | }\r |
222 | \r | |
223 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
224 | if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r | |
225 | isOK = 0;\r | |
226 | if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r | |
8556b852 | 227 | break;\r |
baeaf579 | 228 | }\r |
229 | }\r | |
8556b852 | 230 | \r |
baeaf579 | 231 | if(mifare_classic_halt(pcs, cuid)) {\r |
8556b852 | 232 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 | 233 | }\r |
baeaf579 | 234 | \r |
8556b852 M |
235 | // ----------------------------- crypto1 destroy\r |
236 | crypto1_destroy(pcs);\r | |
237 | \r | |
238 | if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r | |
239 | \r | |
8556b852 | 240 | LED_B_ON();\r |
baeaf579 | 241 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r |
6e82300d | 242 | LED_B_OFF();\r |
8556b852 M |
243 | \r |
244 | // Thats it...\r | |
245 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
246 | LEDsoff();\r | |
7cc204bf | 247 | }\r |
248 | \r | |
79d7bcbb | 249 | // arg0 = blockNo (start)\r |
250 | // arg1 = Pages (number of blocks)\r | |
251 | // arg2 = useKey\r | |
252 | // datain = KEY bytes\r | |
75377d29 | 253 | void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r |
7cc204bf | 254 | {\r |
d7acc640 | 255 | // free eventually allocated BigBuf memory\r |
256 | BigBuf_free();\r | |
d7acc640 | 257 | clear_trace();\r |
258 | \r | |
f168b263 | 259 | // params\r |
75377d29 | 260 | uint8_t blockNo = arg0;\r |
261 | uint16_t blocks = arg1;\r | |
cceabb79 | 262 | bool useKey = (arg2 == 1); //UL_C\r |
263 | bool usePwd = (arg2 == 2); //UL_EV1/NTAG\r | |
9d87eb66 | 264 | uint32_t countblocks = 0;\r |
d7acc640 | 265 | uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);\r |
266 | if (dataout == NULL){\r | |
267 | Dbprintf("out of memory");\r | |
268 | OnError(1);\r | |
269 | return;\r | |
270 | }\r | |
7cc204bf | 271 | \r |
92690507 | 272 | LEDsoff();\r |
273 | LED_A_ON();\r | |
787b5bd8 | 274 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 275 | \r |
92690507 | 276 | int len = iso14443a_select_card(NULL, NULL, NULL);\r |
787b5bd8 | 277 | if (!len) {\r |
f168b263 | 278 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r |
279 | OnError(1);\r | |
787b5bd8 | 280 | return;\r |
281 | }\r | |
75377d29 | 282 | \r |
8258f409 | 283 | // UL-C authentication\r |
75377d29 | 284 | if ( useKey ) {\r |
285 | uint8_t key[16] = {0x00};\r | |
8258f409 | 286 | memcpy(key, datain, sizeof(key) );\r |
75377d29 | 287 | \r |
9d87eb66 | 288 | if ( !mifare_ultra_auth(key) ) {\r |
75377d29 | 289 | OnError(1);\r |
290 | return;\r | |
291 | }\r | |
75377d29 | 292 | }\r |
293 | \r | |
8258f409 | 294 | // UL-EV1 / NTAG authentication\r |
295 | if (usePwd) {\r | |
296 | uint8_t pwd[4] = {0x00};\r | |
297 | memcpy(pwd, datain, sizeof(pwd));\r | |
cceabb79 | 298 | uint8_t pack[4] = {0,0,0,0};\r |
299 | \r | |
9d87eb66 | 300 | if (!mifare_ul_ev1_auth(pwd, pack)){\r |
cceabb79 | 301 | OnError(1);\r |
cceabb79 | 302 | return; \r |
303 | }\r | |
304 | }\r | |
305 | \r | |
75377d29 | 306 | for (int i = 0; i < blocks; i++){\r |
22342f6d | 307 | if ((i*4) + 4 >= CARD_MEMORY_SIZE) {\r |
9d87eb66 | 308 | Dbprintf("Data exceeds buffer!!");\r |
309 | break;\r | |
310 | }\r | |
311 | \r | |
312 | len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);\r | |
75377d29 | 313 | \r |
787b5bd8 | 314 | if (len) {\r |
f168b263 | 315 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r |
9d87eb66 | 316 | // if no blocks read - error out\r |
317 | if (i==0){\r | |
318 | OnError(2);\r | |
319 | return;\r | |
320 | } else {\r | |
321 | //stop at last successful read block and return what we got\r | |
322 | break;\r | |
323 | }\r | |
787b5bd8 | 324 | } else {\r |
75377d29 | 325 | countblocks++;\r |
787b5bd8 | 326 | }\r |
327 | }\r | |
75377d29 | 328 | \r |
f168b263 | 329 | len = mifare_ultra_halt();\r |
787b5bd8 | 330 | if (len) {\r |
f168b263 | 331 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r |
332 | OnError(3);\r | |
787b5bd8 | 333 | return;\r |
334 | }\r | |
7cc204bf | 335 | \r |
75377d29 | 336 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);\r |
337 | \r | |
9d87eb66 | 338 | countblocks *= 4;\r |
22342f6d | 339 | \r |
0ce03d9a | 340 | cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);\r |
31d1caa5 MHS |
341 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
342 | LEDsoff();\r | |
22342f6d | 343 | BigBuf_free();\r |
7cc204bf | 344 | }\r |
345 | \r | |
7cc204bf | 346 | //-----------------------------------------------------------------------------\r |
baeaf579 | 347 | // Select, Authenticate, Write a MIFARE tag. \r |
7cc204bf | 348 | // read block\r |
8556b852 M |
349 | //-----------------------------------------------------------------------------\r |
350 | void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
351 | {\r | |
352 | // params\r | |
353 | uint8_t blockNo = arg0;\r | |
354 | uint8_t keyType = arg1;\r | |
355 | uint64_t ui64Key = 0;\r | |
356 | byte_t blockdata[16];\r | |
357 | \r | |
358 | ui64Key = bytes_to_num(datain, 6);\r | |
359 | memcpy(blockdata, datain + 10, 16);\r | |
360 | \r | |
361 | // variables\r | |
362 | byte_t isOK = 0;\r | |
1c611bbd | 363 | uint8_t uid[10];\r |
8556b852 M |
364 | uint32_t cuid;\r |
365 | struct Crypto1State mpcs = {0, 0};\r | |
366 | struct Crypto1State *pcs;\r | |
367 | pcs = &mpcs;\r | |
368 | \r | |
369 | // clear trace\r | |
3000dc4e | 370 | clear_trace();\r |
8556b852 | 371 | \r |
7bc95e2e | 372 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
373 | \r |
374 | LED_A_ON();\r | |
375 | LED_B_OFF();\r | |
376 | LED_C_OFF();\r | |
377 | \r | |
378 | while (true) {\r | |
379 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
380 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
381 | break;\r | |
382 | };\r | |
383 | \r | |
384 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
385 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r | |
386 | break;\r | |
387 | };\r | |
388 | \r | |
389 | if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r | |
390 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
391 | break;\r | |
392 | };\r | |
393 | \r | |
394 | if(mifare_classic_halt(pcs, cuid)) {\r | |
395 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
396 | break;\r | |
397 | };\r | |
398 | \r | |
399 | isOK = 1;\r | |
400 | break;\r | |
401 | }\r | |
402 | \r | |
403 | // ----------------------------- crypto1 destroy\r | |
404 | crypto1_destroy(pcs);\r | |
405 | \r | |
406 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
407 | \r | |
8556b852 | 408 | LED_B_ON();\r |
9492e0b0 | 409 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r |
6e82300d | 410 | LED_B_OFF();\r |
8556b852 M |
411 | \r |
412 | \r | |
413 | // Thats it...\r | |
414 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
415 | LEDsoff();\r | |
7cc204bf | 416 | }\r |
417 | \r | |
4973f23d | 418 | /* // Command not needed but left for future testing \r |
419 | void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)\r | |
7cc204bf | 420 | {\r |
f168b263 | 421 | uint8_t blockNo = arg0;\r |
787b5bd8 | 422 | byte_t blockdata[16] = {0x00};\r |
7cc204bf | 423 | \r |
f168b263 | 424 | memcpy(blockdata, datain, 16);\r |
425 | \r | |
787b5bd8 | 426 | uint8_t uid[10] = {0x00};\r |
7cc204bf | 427 | \r |
f168b263 | 428 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r |
7cc204bf | 429 | \r |
f168b263 | 430 | clear_trace();\r |
431 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r | |
432 | \r | |
433 | if(!iso14443a_select_card(uid, NULL, NULL)) {\r | |
434 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
435 | OnError(0);\r | |
436 | return;\r | |
437 | };\r | |
438 | \r | |
4973f23d | 439 | if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {\r |
f168b263 | 440 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
441 | OnError(0);\r | |
442 | return; };\r | |
443 | \r | |
444 | if(mifare_ultra_halt()) {\r | |
445 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
446 | OnError(0);\r | |
447 | return;\r | |
448 | };\r | |
449 | \r | |
450 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
451 | \r | |
452 | cmd_send(CMD_ACK,1,0,0,0,0);\r | |
453 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
454 | LEDsoff();\r | |
7cc204bf | 455 | }\r |
4973f23d | 456 | */\r |
7cc204bf | 457 | \r |
79d7bcbb | 458 | // Arg0 : Block to write to.\r |
459 | // Arg1 : 0 = use no authentication.\r | |
460 | // 1 = use 0x1A authentication.\r | |
461 | // 2 = use 0x1B authentication.\r | |
462 | // datain : 4 first bytes is data to be written.\r | |
463 | // : 4/16 next bytes is authentication key.\r | |
4973f23d | 464 | void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r |
7cc204bf | 465 | {\r |
baeaf579 | 466 | uint8_t blockNo = arg0;\r |
79d7bcbb | 467 | bool useKey = (arg1 == 1); //UL_C\r |
468 | bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r | |
787b5bd8 | 469 | byte_t blockdata[4] = {0x00};\r |
7cc204bf | 470 | \r |
8258f409 | 471 | memcpy(blockdata, datain,4);\r |
f168b263 | 472 | \r |
8258f409 | 473 | LEDsoff();\r |
474 | LED_A_ON();\r | |
f168b263 | 475 | clear_trace();\r |
476 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r | |
477 | \r | |
8258f409 | 478 | if(!iso14443a_select_card(NULL, NULL, NULL)) {\r |
f168b263 | 479 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
480 | OnError(0);\r | |
481 | return;\r | |
482 | };\r | |
7cc204bf | 483 | \r |
79d7bcbb | 484 | // UL-C authentication\r |
485 | if ( useKey ) {\r | |
486 | uint8_t key[16] = {0x00};\r | |
487 | memcpy(key, datain+4, sizeof(key) );\r | |
488 | \r | |
489 | if ( !mifare_ultra_auth(key) ) {\r | |
490 | OnError(1);\r | |
491 | return;\r | |
492 | }\r | |
493 | }\r | |
494 | \r | |
495 | // UL-EV1 / NTAG authentication\r | |
496 | if (usePwd) {\r | |
497 | uint8_t pwd[4] = {0x00};\r | |
498 | memcpy(pwd, datain+4, 4);\r | |
499 | uint8_t pack[4] = {0,0,0,0};\r | |
500 | if (!mifare_ul_ev1_auth(pwd, pack)) {\r | |
501 | OnError(1);\r | |
502 | return;\r | |
503 | }\r | |
504 | }\r | |
505 | \r | |
4973f23d | 506 | if(mifare_ultra_writeblock(blockNo, blockdata)) {\r |
f168b263 | 507 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
508 | OnError(0);\r | |
509 | return;\r | |
510 | };\r | |
511 | \r | |
512 | if(mifare_ultra_halt()) {\r | |
513 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
514 | OnError(0);\r | |
515 | return;\r | |
516 | };\r | |
517 | \r | |
518 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
519 | \r | |
520 | cmd_send(CMD_ACK,1,0,0,0,0);\r | |
521 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
522 | LEDsoff();\r | |
523 | }\r | |
524 | \r | |
525 | void MifareUSetPwd(uint8_t arg0, uint8_t *datain){\r | |
526 | \r | |
527 | uint8_t pwd[16] = {0x00};\r | |
528 | byte_t blockdata[4] = {0x00};\r | |
529 | \r | |
530 | memcpy(pwd, datain, 16);\r | |
531 | \r | |
532 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r | |
3000dc4e | 533 | clear_trace();\r |
baeaf579 | 534 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 535 | \r |
f168b263 | 536 | if(!iso14443a_select_card(NULL, NULL, NULL)) {\r |
537 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
538 | OnError(0);\r | |
539 | return;\r | |
540 | };\r | |
7cc204bf | 541 | \r |
f168b263 | 542 | blockdata[0] = pwd[7];\r |
543 | blockdata[1] = pwd[6];\r | |
544 | blockdata[2] = pwd[5];\r | |
545 | blockdata[3] = pwd[4];\r | |
4973f23d | 546 | if(mifare_ultra_writeblock( 44, blockdata)) {\r |
f168b263 | 547 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
548 | OnError(44);\r | |
549 | return;\r | |
550 | };\r | |
7cc204bf | 551 | \r |
f168b263 | 552 | blockdata[0] = pwd[3];\r |
553 | blockdata[1] = pwd[2];\r | |
554 | blockdata[2] = pwd[1];\r | |
555 | blockdata[3] = pwd[0];\r | |
4973f23d | 556 | if(mifare_ultra_writeblock( 45, blockdata)) {\r |
f168b263 | 557 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
558 | OnError(45);\r | |
559 | return;\r | |
560 | };\r | |
7cc204bf | 561 | \r |
f168b263 | 562 | blockdata[0] = pwd[15];\r |
563 | blockdata[1] = pwd[14];\r | |
564 | blockdata[2] = pwd[13];\r | |
565 | blockdata[3] = pwd[12];\r | |
4973f23d | 566 | if(mifare_ultra_writeblock( 46, blockdata)) {\r |
f168b263 | 567 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
568 | OnError(46);\r | |
569 | return;\r | |
570 | };\r | |
7cc204bf | 571 | \r |
f168b263 | 572 | blockdata[0] = pwd[11];\r |
573 | blockdata[1] = pwd[10];\r | |
574 | blockdata[2] = pwd[9];\r | |
575 | blockdata[3] = pwd[8];\r | |
4973f23d | 576 | if(mifare_ultra_writeblock( 47, blockdata)) {\r |
f168b263 | 577 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
578 | OnError(47);\r | |
579 | return;\r | |
580 | }; \r | |
7cc204bf | 581 | \r |
f168b263 | 582 | if(mifare_ultra_halt()) {\r |
583 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
584 | OnError(0);\r | |
585 | return;\r | |
586 | };\r | |
7cc204bf | 587 | \r |
f168b263 | 588 | cmd_send(CMD_ACK,1,0,0,0,0);\r |
baeaf579 | 589 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
590 | LEDsoff();\r | |
7cc204bf | 591 | }\r |
592 | \r | |
593 | // Return 1 if the nonce is invalid else return 0\r | |
6a1f2d82 | 594 | int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r |
7cc204bf | 595 | return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r |
8556b852 M |
596 | (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r |
597 | (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r | |
598 | }\r | |
599 | \r | |
9492e0b0 | 600 | \r |
8556b852 M |
601 | //-----------------------------------------------------------------------------\r |
602 | // MIFARE nested authentication. \r | |
603 | // \r | |
604 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 605 | void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r |
8556b852 M |
606 | {\r |
607 | // params\r | |
9492e0b0 | 608 | uint8_t blockNo = arg0 & 0xff;\r |
609 | uint8_t keyType = (arg0 >> 8) & 0xff;\r | |
610 | uint8_t targetBlockNo = arg1 & 0xff;\r | |
611 | uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r | |
8556b852 M |
612 | uint64_t ui64Key = 0;\r |
613 | \r | |
614 | ui64Key = bytes_to_num(datain, 6);\r | |
615 | \r | |
616 | // variables\r | |
9492e0b0 | 617 | uint16_t rtr, i, j, len;\r |
618 | uint16_t davg;\r | |
619 | static uint16_t dmin, dmax;\r | |
1c611bbd | 620 | uint8_t uid[10];\r |
6a1f2d82 | 621 | uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r |
622 | uint8_t par[1];\r | |
9492e0b0 | 623 | uint32_t target_nt[2], target_ks[2];\r |
624 | \r | |
8556b852 | 625 | uint8_t par_array[4];\r |
9492e0b0 | 626 | uint16_t ncount = 0;\r |
8556b852 M |
627 | struct Crypto1State mpcs = {0, 0};\r |
628 | struct Crypto1State *pcs;\r | |
629 | pcs = &mpcs;\r | |
f71f4deb | 630 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
8556b852 | 631 | \r |
9492e0b0 | 632 | uint32_t auth1_time, auth2_time;\r |
633 | static uint16_t delta_time;\r | |
634 | \r | |
f71f4deb | 635 | // free eventually allocated BigBuf memory\r |
636 | BigBuf_free();\r | |
8556b852 | 637 | // clear trace\r |
3000dc4e MHS |
638 | clear_trace();\r |
639 | set_tracing(false);\r | |
8556b852 | 640 | \r |
7bc95e2e | 641 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
642 | \r |
643 | LED_A_ON();\r | |
8556b852 M |
644 | LED_C_OFF();\r |
645 | \r | |
8556b852 | 646 | \r |
9492e0b0 | 647 | // statistics on nonce distance\r |
dc8ba239 | 648 | int16_t isOK = 0;\r |
649 | #define NESTED_MAX_TRIES 12\r | |
650 | uint16_t unsuccessfull_tries = 0;\r | |
9492e0b0 | 651 | if (calibrate) { // for first call only. Otherwise reuse previous calibration\r |
652 | LED_B_ON();\r | |
3fe4ff4f | 653 | WDT_HIT();\r |
8556b852 | 654 | \r |
9492e0b0 | 655 | davg = dmax = 0;\r |
656 | dmin = 2000;\r | |
657 | delta_time = 0;\r | |
8556b852 | 658 | \r |
9492e0b0 | 659 | for (rtr = 0; rtr < 17; rtr++) {\r |
8556b852 | 660 | \r |
dc8ba239 | 661 | // Test if the action was cancelled\r |
662 | if(BUTTON_PRESS()) {\r | |
663 | isOK = -2;\r | |
664 | break;\r | |
665 | }\r | |
666 | \r | |
9492e0b0 | 667 | // prepare next select. No need to power down the card.\r |
668 | if(mifare_classic_halt(pcs, cuid)) {\r | |
669 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
670 | rtr--;\r | |
671 | continue;\r | |
672 | }\r | |
673 | \r | |
674 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
675 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r | |
676 | rtr--;\r | |
677 | continue;\r | |
678 | };\r | |
679 | \r | |
680 | auth1_time = 0;\r | |
681 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
682 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
683 | rtr--;\r | |
684 | continue;\r | |
685 | };\r | |
686 | \r | |
687 | if (delta_time) {\r | |
688 | auth2_time = auth1_time + delta_time;\r | |
689 | } else {\r | |
690 | auth2_time = 0;\r | |
691 | }\r | |
692 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r | |
693 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r | |
694 | rtr--;\r | |
695 | continue;\r | |
696 | };\r | |
697 | \r | |
b19bd5d6 | 698 | nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r |
699 | for (i = 101; i < 1200; i++) {\r | |
9492e0b0 | 700 | nttmp = prng_successor(nttmp, 1);\r |
701 | if (nttmp == nt2) break;\r | |
702 | }\r | |
703 | \r | |
704 | if (i != 1200) {\r | |
705 | if (rtr != 0) {\r | |
706 | davg += i;\r | |
707 | dmin = MIN(dmin, i);\r | |
708 | dmax = MAX(dmax, i);\r | |
709 | }\r | |
710 | else {\r | |
711 | delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r | |
712 | }\r | |
713 | if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r | |
dc8ba239 | 714 | } else {\r |
715 | unsuccessfull_tries++;\r | |
716 | if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)\r | |
717 | isOK = -3;\r | |
718 | }\r | |
9492e0b0 | 719 | }\r |
8556b852 | 720 | }\r |
8556b852 | 721 | \r |
9492e0b0 | 722 | davg = (davg + (rtr - 1)/2) / (rtr - 1);\r |
723 | \r | |
dc8ba239 | 724 | if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);\r |
8556b852 | 725 | \r |
9492e0b0 | 726 | dmin = davg - 2;\r |
727 | dmax = davg + 2;\r | |
728 | \r | |
729 | LED_B_OFF();\r | |
730 | \r | |
731 | }\r | |
e35031d2 | 732 | // ------------------------------------------------------------------------------------------------- \r |
8556b852 M |
733 | \r |
734 | LED_C_ON();\r | |
735 | \r | |
736 | // get crypted nonces for target sector\r | |
dc8ba239 | 737 | for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r |
8556b852 | 738 | \r |
9492e0b0 | 739 | target_nt[i] = 0;\r |
740 | while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r | |
8556b852 | 741 | \r |
9492e0b0 | 742 | // prepare next select. No need to power down the card.\r |
743 | if(mifare_classic_halt(pcs, cuid)) {\r | |
744 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
745 | continue;\r | |
746 | }\r | |
8556b852 | 747 | \r |
9492e0b0 | 748 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r |
749 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r | |
750 | continue;\r | |
751 | };\r | |
8556b852 | 752 | \r |
9492e0b0 | 753 | auth1_time = 0;\r |
754 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
755 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
756 | continue;\r | |
757 | };\r | |
8556b852 | 758 | \r |
9492e0b0 | 759 | // nested authentication\r |
760 | auth2_time = auth1_time + delta_time;\r | |
e35031d2 | 761 | len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r |
9492e0b0 | 762 | if (len != 4) {\r |
763 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r | |
764 | continue;\r | |
765 | };\r | |
8556b852 | 766 | \r |
9492e0b0 | 767 | nt2 = bytes_to_num(receivedAnswer, 4); \r |
6a1f2d82 | 768 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r |
8556b852 | 769 | \r |
9492e0b0 | 770 | // Parity validity check\r |
771 | for (j = 0; j < 4; j++) {\r | |
6a1f2d82 | 772 | par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r |
9492e0b0 | 773 | }\r |
774 | \r | |
775 | ncount = 0;\r | |
776 | nttest = prng_successor(nt1, dmin - 1);\r | |
777 | for (j = dmin; j < dmax + 1; j++) {\r | |
778 | nttest = prng_successor(nttest, 1);\r | |
779 | ks1 = nt2 ^ nttest;\r | |
780 | \r | |
781 | if (valid_nonce(nttest, nt2, ks1, par_array)){\r | |
782 | if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r | |
783 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r | |
784 | target_nt[i] = 0;\r | |
785 | break;\r | |
786 | }\r | |
787 | target_nt[i] = nttest;\r | |
788 | target_ks[i] = ks1;\r | |
789 | ncount++;\r | |
790 | if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r | |
791 | target_nt[i] = 0;\r | |
792 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r | |
8556b852 M |
793 | break;\r |
794 | }\r | |
9492e0b0 | 795 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r |
8556b852 | 796 | }\r |
8556b852 | 797 | }\r |
9492e0b0 | 798 | if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r |
8556b852 M |
799 | }\r |
800 | }\r | |
801 | \r | |
802 | LED_C_OFF();\r | |
803 | \r | |
804 | // ----------------------------- crypto1 destroy\r | |
805 | crypto1_destroy(pcs);\r | |
806 | \r | |
9492e0b0 | 807 | byte_t buf[4 + 4 * 4];\r |
808 | memcpy(buf, &cuid, 4);\r | |
809 | memcpy(buf+4, &target_nt[0], 4);\r | |
810 | memcpy(buf+8, &target_ks[0], 4);\r | |
811 | memcpy(buf+12, &target_nt[1], 4);\r | |
812 | memcpy(buf+16, &target_ks[1], 4);\r | |
8556b852 M |
813 | \r |
814 | LED_B_ON();\r | |
dc8ba239 | 815 | cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r |
6e82300d | 816 | LED_B_OFF();\r |
8556b852 | 817 | \r |
9492e0b0 | 818 | if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r |
8556b852 | 819 | \r |
8556b852 M |
820 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
821 | LEDsoff();\r | |
3000dc4e | 822 | set_tracing(TRUE);\r |
8556b852 M |
823 | }\r |
824 | \r | |
825 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 826 | // MIFARE check keys. key count up to 85. \r |
8556b852 M |
827 | // \r |
828 | //-----------------------------------------------------------------------------\r | |
829 | void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
830 | {\r | |
831 | // params\r | |
832 | uint8_t blockNo = arg0;\r | |
833 | uint8_t keyType = arg1;\r | |
834 | uint8_t keyCount = arg2;\r | |
835 | uint64_t ui64Key = 0;\r | |
836 | \r | |
837 | // variables\r | |
838 | int i;\r | |
839 | byte_t isOK = 0;\r | |
1c611bbd | 840 | uint8_t uid[10];\r |
8556b852 M |
841 | uint32_t cuid;\r |
842 | struct Crypto1State mpcs = {0, 0};\r | |
843 | struct Crypto1State *pcs;\r | |
844 | pcs = &mpcs;\r | |
845 | \r | |
846 | // clear debug level\r | |
847 | int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r | |
848 | MF_DBGLEVEL = MF_DBG_NONE;\r | |
849 | \r | |
850 | // clear trace\r | |
3000dc4e MHS |
851 | clear_trace();\r |
852 | set_tracing(TRUE);\r | |
8556b852 | 853 | \r |
7bc95e2e | 854 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
855 | \r |
856 | LED_A_ON();\r | |
857 | LED_B_OFF();\r | |
858 | LED_C_OFF();\r | |
859 | \r | |
8556b852 | 860 | for (i = 0; i < keyCount; i++) {\r |
9492e0b0 | 861 | if(mifare_classic_halt(pcs, cuid)) {\r |
862 | if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r | |
863 | }\r | |
8556b852 M |
864 | \r |
865 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
9492e0b0 | 866 | if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r |
8556b852 M |
867 | break;\r |
868 | };\r | |
869 | \r | |
870 | ui64Key = bytes_to_num(datain + i * 6, 6);\r | |
871 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
872 | continue;\r | |
873 | };\r | |
874 | \r | |
875 | isOK = 1;\r | |
876 | break;\r | |
877 | }\r | |
878 | \r | |
879 | // ----------------------------- crypto1 destroy\r | |
880 | crypto1_destroy(pcs);\r | |
881 | \r | |
8556b852 | 882 | LED_B_ON();\r |
6e82300d | 883 | cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r |
8556b852 M |
884 | LED_B_OFF();\r |
885 | \r | |
8556b852 M |
886 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
887 | LEDsoff();\r | |
888 | \r | |
889 | // restore debug level\r | |
890 | MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r | |
891 | }\r | |
892 | \r | |
893 | //-----------------------------------------------------------------------------\r | |
894 | // MIFARE commands set debug level\r | |
895 | // \r | |
896 | //-----------------------------------------------------------------------------\r | |
897 | void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
898 | MF_DBGLEVEL = arg0;\r | |
899 | Dbprintf("Debug level: %d", MF_DBGLEVEL);\r | |
900 | }\r | |
901 | \r | |
902 | //-----------------------------------------------------------------------------\r | |
903 | // Work with emulator memory\r | |
904 | // \r | |
905 | //-----------------------------------------------------------------------------\r | |
906 | void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
907 | emlClearMem();\r | |
908 | }\r | |
909 | \r | |
910 | void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
911 | emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r | |
912 | }\r | |
913 | \r | |
914 | void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
3fe4ff4f | 915 | byte_t buf[USB_CMD_DATA_SIZE];\r |
baeaf579 | 916 | emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r |
8556b852 M |
917 | \r |
918 | LED_B_ON();\r | |
3fe4ff4f | 919 | cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r |
8556b852 M |
920 | LED_B_OFF();\r |
921 | }\r | |
922 | \r | |
923 | //-----------------------------------------------------------------------------\r | |
924 | // Load a card into the emulator memory\r | |
925 | // \r | |
926 | //-----------------------------------------------------------------------------\r | |
927 | void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
baeaf579 | 928 | uint8_t numSectors = arg0;\r |
8556b852 M |
929 | uint8_t keyType = arg1;\r |
930 | uint64_t ui64Key = 0;\r | |
931 | uint32_t cuid;\r | |
932 | struct Crypto1State mpcs = {0, 0};\r | |
933 | struct Crypto1State *pcs;\r | |
934 | pcs = &mpcs;\r | |
935 | \r | |
936 | // variables\r | |
937 | byte_t dataoutbuf[16];\r | |
ab8b654e | 938 | byte_t dataoutbuf2[16];\r |
1c611bbd | 939 | uint8_t uid[10];\r |
8556b852 M |
940 | \r |
941 | // clear trace\r | |
3000dc4e MHS |
942 | clear_trace();\r |
943 | set_tracing(false);\r | |
8556b852 | 944 | \r |
7bc95e2e | 945 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
946 | \r |
947 | LED_A_ON();\r | |
948 | LED_B_OFF();\r | |
949 | LED_C_OFF();\r | |
950 | \r | |
baeaf579 | 951 | bool isOK = true;\r |
952 | \r | |
953 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
954 | isOK = false;\r | |
955 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
956 | }\r | |
8556b852 | 957 | \r |
baeaf579 | 958 | for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r |
959 | ui64Key = emlGetKey(sectorNo, keyType);\r | |
960 | if (sectorNo == 0){\r | |
961 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r | |
962 | isOK = false;\r | |
963 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r | |
8556b852 | 964 | break;\r |
baeaf579 | 965 | }\r |
966 | } else {\r | |
967 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r | |
968 | isOK = false;\r | |
969 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r | |
8556b852 | 970 | break;\r |
baeaf579 | 971 | }\r |
972 | }\r | |
973 | \r | |
974 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
975 | if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r | |
976 | isOK = false;\r | |
977 | if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r | |
ab8b654e M |
978 | break;\r |
979 | };\r | |
baeaf579 | 980 | if (isOK) {\r |
981 | if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r | |
982 | emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
983 | } else { // sector trailer, keep the keys, set only the AC\r | |
984 | emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
985 | memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r | |
986 | emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
987 | }\r | |
988 | }\r | |
8556b852 M |
989 | }\r |
990 | \r | |
baeaf579 | 991 | }\r |
992 | \r | |
993 | if(mifare_classic_halt(pcs, cuid)) {\r | |
994 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
995 | };\r | |
8556b852 M |
996 | \r |
997 | // ----------------------------- crypto1 destroy\r | |
998 | crypto1_destroy(pcs);\r | |
ab8b654e M |
999 | \r |
1000 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1001 | LEDsoff();\r | |
8556b852 M |
1002 | \r |
1003 | if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r | |
1004 | \r | |
8556b852 M |
1005 | }\r |
1006 | \r | |
0675f200 M |
1007 | \r |
1008 | //-----------------------------------------------------------------------------\r | |
1009 | // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r | |
1010 | // \r | |
1011 | //-----------------------------------------------------------------------------\r | |
1012 | void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
1013 | \r | |
1014 | // params\r | |
1015 | uint8_t needWipe = arg0;\r | |
208a0166 M |
1016 | // bit 0 - need get UID\r |
1017 | // bit 1 - need wupC\r | |
1018 | // bit 2 - need HALT after sequence\r | |
1019 | // bit 3 - need init FPGA and field before sequence\r | |
1020 | // bit 4 - need reset FPGA and LED\r | |
1021 | uint8_t workFlags = arg1;\r | |
0675f200 M |
1022 | uint8_t blockNo = arg2;\r |
1023 | \r | |
1024 | // card commands\r | |
1025 | uint8_t wupC1[] = { 0x40 }; \r | |
1026 | uint8_t wupC2[] = { 0x43 }; \r | |
1027 | uint8_t wipeC[] = { 0x41 }; \r | |
1028 | \r | |
1029 | // variables\r | |
1030 | byte_t isOK = 0;\r | |
3fe4ff4f | 1031 | uint8_t uid[10] = {0x00};\r |
1032 | uint8_t d_block[18] = {0x00};\r | |
0675f200 M |
1033 | uint32_t cuid;\r |
1034 | \r | |
f71f4deb | 1035 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
1036 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
6a1f2d82 | 1037 | \r |
3fe4ff4f | 1038 | // reset FPGA and LED\r |
208a0166 | 1039 | if (workFlags & 0x08) {\r |
208a0166 M |
1040 | LED_A_ON();\r |
1041 | LED_B_OFF();\r | |
1042 | LED_C_OFF();\r | |
0675f200 | 1043 | \r |
3000dc4e MHS |
1044 | clear_trace();\r |
1045 | set_tracing(TRUE);\r | |
3fe4ff4f | 1046 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
208a0166 | 1047 | }\r |
0675f200 M |
1048 | \r |
1049 | while (true) {\r | |
3fe4ff4f | 1050 | \r |
0675f200 | 1051 | // get UID from chip\r |
208a0166 | 1052 | if (workFlags & 0x01) {\r |
0675f200 M |
1053 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r |
1054 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
1055 | break;\r | |
1056 | };\r | |
1057 | \r | |
1058 | if(mifare_classic_halt(NULL, cuid)) {\r | |
1059 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1060 | break;\r | |
1061 | };\r | |
1062 | };\r | |
1063 | \r | |
1064 | // reset chip\r | |
1065 | if (needWipe){\r | |
6a1f2d82 | 1066 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
1067 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
0675f200 M |
1068 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1069 | break;\r | |
1070 | };\r | |
1071 | \r | |
9492e0b0 | 1072 | ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r |
6a1f2d82 | 1073 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1074 | if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r |
1075 | break;\r | |
1076 | };\r | |
1077 | \r | |
1078 | if(mifare_classic_halt(NULL, cuid)) {\r | |
1079 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1080 | break;\r | |
1081 | };\r | |
1082 | }; \r | |
1083 | \r | |
545a1f38 | 1084 | // write block\r |
208a0166 | 1085 | if (workFlags & 0x02) {\r |
6a1f2d82 | 1086 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
1087 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
208a0166 M |
1088 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1089 | break;\r | |
1090 | };\r | |
0675f200 | 1091 | \r |
9492e0b0 | 1092 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r |
6a1f2d82 | 1093 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
208a0166 M |
1094 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r |
1095 | break;\r | |
1096 | };\r | |
1097 | }\r | |
0675f200 | 1098 | \r |
6a1f2d82 | 1099 | if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1100 | if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r |
1101 | break;\r | |
1102 | };\r | |
1103 | \r | |
1104 | memcpy(d_block, datain, 16);\r | |
1105 | AppendCrc14443a(d_block, 16);\r | |
1106 | \r | |
9492e0b0 | 1107 | ReaderTransmit(d_block, sizeof(d_block), NULL);\r |
6a1f2d82 | 1108 | if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1109 | if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r |
1110 | break;\r | |
1111 | }; \r | |
1112 | \r | |
208a0166 M |
1113 | if (workFlags & 0x04) {\r |
1114 | if (mifare_classic_halt(NULL, cuid)) {\r | |
1115 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1116 | break;\r | |
1117 | };\r | |
1118 | }\r | |
0675f200 M |
1119 | \r |
1120 | isOK = 1;\r | |
1121 | break;\r | |
1122 | }\r | |
1123 | \r | |
0675f200 | 1124 | LED_B_ON();\r |
baeaf579 | 1125 | cmd_send(CMD_ACK,isOK,0,0,uid,4);\r |
0675f200 M |
1126 | LED_B_OFF();\r |
1127 | \r | |
545a1f38 | 1128 | if ((workFlags & 0x10) || (!isOK)) {\r |
208a0166 M |
1129 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1130 | LEDsoff();\r | |
1131 | }\r | |
0675f200 | 1132 | }\r |
545a1f38 | 1133 | \r |
baeaf579 | 1134 | \r |
545a1f38 M |
1135 | void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r |
1136 | \r | |
1137 | // params\r | |
1138 | // bit 1 - need wupC\r | |
1139 | // bit 2 - need HALT after sequence\r | |
1140 | // bit 3 - need init FPGA and field before sequence\r | |
1141 | // bit 4 - need reset FPGA and LED\r | |
1142 | uint8_t workFlags = arg0;\r | |
1143 | uint8_t blockNo = arg2;\r | |
1144 | \r | |
1145 | // card commands\r | |
1146 | uint8_t wupC1[] = { 0x40 }; \r | |
1147 | uint8_t wupC2[] = { 0x43 }; \r | |
1148 | \r | |
1149 | // variables\r | |
1150 | byte_t isOK = 0;\r | |
3fe4ff4f | 1151 | uint8_t data[18] = {0x00};\r |
545a1f38 M |
1152 | uint32_t cuid = 0;\r |
1153 | \r | |
f71f4deb | 1154 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
1155 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
545a1f38 M |
1156 | \r |
1157 | if (workFlags & 0x08) {\r | |
545a1f38 M |
1158 | LED_A_ON();\r |
1159 | LED_B_OFF();\r | |
1160 | LED_C_OFF();\r | |
1161 | \r | |
3000dc4e MHS |
1162 | clear_trace();\r |
1163 | set_tracing(TRUE);\r | |
3fe4ff4f | 1164 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
545a1f38 M |
1165 | }\r |
1166 | \r | |
1167 | while (true) {\r | |
1168 | if (workFlags & 0x02) {\r | |
7bc95e2e | 1169 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
6a1f2d82 | 1170 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
545a1f38 M |
1171 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1172 | break;\r | |
1173 | };\r | |
1174 | \r | |
9492e0b0 | 1175 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r |
6a1f2d82 | 1176 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
545a1f38 M |
1177 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r |
1178 | break;\r | |
1179 | };\r | |
1180 | }\r | |
1181 | \r | |
1182 | // read block\r | |
6a1f2d82 | 1183 | if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r |
545a1f38 M |
1184 | if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r |
1185 | break;\r | |
1186 | };\r | |
1187 | memcpy(data, receivedAnswer, 18);\r | |
1188 | \r | |
1189 | if (workFlags & 0x04) {\r | |
1190 | if (mifare_classic_halt(NULL, cuid)) {\r | |
1191 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1192 | break;\r | |
1193 | };\r | |
1194 | }\r | |
1195 | \r | |
1196 | isOK = 1;\r | |
1197 | break;\r | |
1198 | }\r | |
1199 | \r | |
545a1f38 | 1200 | LED_B_ON();\r |
baeaf579 | 1201 | cmd_send(CMD_ACK,isOK,0,0,data,18);\r |
545a1f38 M |
1202 | LED_B_OFF();\r |
1203 | \r | |
1204 | if ((workFlags & 0x10) || (!isOK)) {\r | |
545a1f38 M |
1205 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1206 | LEDsoff();\r | |
1207 | }\r | |
1208 | }\r | |
1209 | \r | |
3fe4ff4f | 1210 | void MifareCIdent(){\r |
1211 | \r | |
1212 | // card commands\r | |
1213 | uint8_t wupC1[] = { 0x40 }; \r | |
1214 | uint8_t wupC2[] = { 0x43 }; \r | |
1215 | \r | |
1216 | // variables\r | |
1217 | byte_t isOK = 1;\r | |
1218 | \r | |
f71f4deb | 1219 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
1220 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
3fe4ff4f | 1221 | \r |
1222 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r | |
1223 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1224 | isOK = 0;\r | |
1225 | };\r | |
1226 | \r | |
1227 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r | |
1228 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1229 | isOK = 0;\r | |
1230 | };\r | |
1231 | \r | |
1232 | if (mifare_classic_halt(NULL, 0)) {\r | |
1233 | isOK = 0;\r | |
1234 | };\r | |
1235 | \r | |
1236 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r | |
1237 | }\r | |
1238 | \r | |
1239 | //\r | |
1240 | // DESFIRE\r | |
1241 | //\r | |
a631936e | 1242 | \r |
1243 | void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r | |
1244 | \r | |
1245 | byte_t dataout[11] = {0x00};\r | |
1246 | uint8_t uid[10] = {0x00};\r | |
1247 | uint32_t cuid;\r | |
1248 | \r | |
3000dc4e | 1249 | clear_trace();\r |
a631936e | 1250 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
1251 | \r | |
1252 | int len = iso14443a_select_card(uid, NULL, &cuid);\r | |
1253 | if(!len) {\r | |
8258f409 | 1254 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r |
1255 | OnError(1);\r | |
a631936e | 1256 | return;\r |
1257 | };\r | |
1258 | \r | |
1259 | if(mifare_desfire_des_auth1(cuid, dataout)){\r | |
8258f409 | 1260 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r |
1261 | OnError(4);\r | |
a631936e | 1262 | return;\r |
1263 | }\r | |
1264 | \r | |
1265 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r | |
a631936e | 1266 | cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r |
1267 | }\r | |
1268 | \r | |
1269 | void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r | |
1270 | \r | |
1271 | uint32_t cuid = arg0;\r | |
1272 | uint8_t key[16] = {0x00};\r | |
1273 | byte_t isOK = 0;\r | |
1274 | byte_t dataout[12] = {0x00};\r | |
1275 | \r | |
1276 | memcpy(key, datain, 16);\r | |
1277 | \r | |
1278 | isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r | |
1279 | \r | |
1280 | if( isOK) {\r | |
4973f23d | 1281 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed"); \r |
1282 | OnError(4);\r | |
a631936e | 1283 | return;\r |
1284 | }\r | |
1285 | \r | |
4973f23d | 1286 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");\r |
a631936e | 1287 | \r |
1288 | cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r | |
1289 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1290 | LEDsoff();\r | |
3000dc4e | 1291 | }\r |
f168b263 | 1292 | \r |
1293 | void OnSuccess(){\r | |
1294 | pcb_blocknum = 0;\r | |
1295 | ReaderTransmit(deselect_cmd, 3 , NULL);\r | |
1296 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1297 | LEDsoff();\r | |
1298 | }\r | |
1299 | \r | |
1300 | void OnError(uint8_t reason){\r | |
1301 | pcb_blocknum = 0;\r | |
1302 | ReaderTransmit(deselect_cmd, 3 , NULL);\r | |
1303 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1304 | cmd_send(CMD_ACK,0,reason,0,0,0);\r | |
1305 | LEDsoff();\r | |
1306 | }\r |