]>
Commit | Line | Data |
---|---|---|
20f9a2a1 | 1 | //-----------------------------------------------------------------------------\r |
b62a5a84 | 2 | // Merlok, May 2011, 2012\r |
8f51ddb0 | 3 | // Many authors, whom made it possible\r |
20f9a2a1 M |
4 | //\r |
5 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
6 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
7 | // the license.\r | |
8 | //-----------------------------------------------------------------------------\r | |
8f51ddb0 | 9 | // Work with mifare cards.\r |
20f9a2a1 M |
10 | //-----------------------------------------------------------------------------\r |
11 | \r | |
12 | #include "proxmark3.h"\r | |
13 | #include "apps.h"\r | |
14 | #include "util.h"\r | |
15 | #include "string.h"\r | |
16 | \r | |
17 | #include "iso14443crc.h"\r | |
18 | #include "iso14443a.h"\r | |
19 | #include "crapto1.h"\r | |
20 | #include "mifareutil.h"\r | |
21 | \r | |
f397b5cc M |
22 | int MF_DBGLEVEL = MF_DBG_ALL;\r |
23 | \r | |
8f51ddb0 | 24 | // memory management\r |
20f9a2a1 | 25 | uint8_t* mifare_get_bigbufptr(void) {\r |
8f51ddb0 M |
26 | return (((uint8_t *)BigBuf) + MIFARE_BUFF_OFFSET); // was 3560 - tied to other size changes\r |
27 | }\r | |
28 | uint8_t* eml_get_bigbufptr_sendbuf(void) {\r | |
29 | return (((uint8_t *)BigBuf) + RECV_CMD_OFFSET); \r | |
30 | }\r | |
31 | uint8_t* eml_get_bigbufptr_recbuf(void) {\r | |
32 | return (((uint8_t *)BigBuf) + MIFARE_BUFF_OFFSET);\r | |
33 | }\r | |
34 | uint8_t* eml_get_bigbufptr_cardmem(void) {\r | |
35 | return (((uint8_t *)BigBuf) + CARD_MEMORY);\r | |
36 | }\r | |
37 | \r | |
38 | // crypto1 helpers\r | |
39 | void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len){\r | |
40 | uint8_t bt = 0;\r | |
41 | int i;\r | |
42 | \r | |
43 | if (len != 1) {\r | |
44 | for (i = 0; i < len; i++)\r | |
45 | data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];\r | |
46 | } else {\r | |
47 | bt = 0;\r | |
48 | for (i = 0; i < 4; i++)\r | |
49 | bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data[0], i)) << i;\r | |
50 | \r | |
51 | data[0] = bt;\r | |
52 | }\r | |
53 | return;\r | |
54 | }\r | |
55 | \r | |
56 | void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, int len, uint32_t *par) {\r | |
57 | uint8_t bt = 0;\r | |
58 | int i;\r | |
59 | uint32_t mltpl = 1 << (len - 1); // for len=18 it=0x20000\r | |
60 | *par = 0;\r | |
61 | for (i = 0; i < len; i++) {\r | |
62 | bt = data[i];\r | |
63 | data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];\r | |
64 | *par = (*par >> 1) | ( ((filter(pcs->odd) ^ oddparity(bt)) & 0x01) * mltpl );\r | |
65 | } \r | |
66 | return;\r | |
67 | }\r | |
68 | \r | |
69 | uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data) {\r | |
70 | uint8_t bt = 0;\r | |
71 | int i;\r | |
72 | \r | |
73 | for (i = 0; i < 4; i++)\r | |
74 | bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data, i)) << i;\r | |
75 | \r | |
76 | return bt;\r | |
20f9a2a1 M |
77 | }\r |
78 | \r | |
8f51ddb0 | 79 | // send commands\r |
9492e0b0 | 80 | int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint32_t *timing)\r |
f89c7050 | 81 | {\r |
981bd429 | 82 | return mifare_sendcmd_shortex(pcs, crypted, cmd, data, answer, NULL, timing); |
83 | } | |
84 | ||
85 | int mifare_sendcmd_short_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t* data, uint8_t* answer, uint8_t *timing) | |
86 | { | |
87 | uint8_t dcmd[8];//, ecmd[4]; | |
88 | //uint32_t par=0; | |
89 | ||
90 | dcmd[0] = cmd; | |
91 | dcmd[1] = data[0]; | |
92 | dcmd[2] = data[1]; | |
93 | dcmd[3] = data[2]; | |
94 | dcmd[4] = data[3]; | |
95 | dcmd[5] = data[4]; | |
96 | AppendCrc14443a(dcmd, 6); | |
97 | //Dbprintf("Data command: %02x", dcmd[0]); | |
98 | //Dbprintf("Data R: %02x %02x %02x %02x %02x %02x %02x", dcmd[1],dcmd[2],dcmd[3],dcmd[4],dcmd[5],dcmd[6],dcmd[7]); | |
99 | ||
100 | //memcpy(ecmd, dcmd, sizeof(dcmd)); | |
101 | ReaderTransmit(dcmd, sizeof(dcmd), NULL); | |
102 | int len = ReaderReceive(answer); | |
103 | if(!len) | |
104 | { | |
105 | if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout."); | |
106 | return 2; | |
107 | } | |
108 | return len; | |
109 | } | |
110 | ||
111 | int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint32_t * parptr, uint32_t *timing) | |
112 | { | |
113 | uint8_t dcmd[4], ecmd[4]; | |
20f9a2a1 M |
114 | uint32_t pos, par, res;\r |
115 | \r | |
116 | dcmd[0] = cmd;\r | |
117 | dcmd[1] = data;\r | |
118 | AppendCrc14443a(dcmd, 2);\r | |
119 | \r | |
120 | memcpy(ecmd, dcmd, sizeof(dcmd));\r | |
121 | \r | |
122 | if (crypted) {\r | |
123 | par = 0;\r | |
124 | for (pos = 0; pos < 4; pos++)\r | |
125 | {\r | |
126 | ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];\r | |
127 | par = (par >> 1) | ( ((filter(pcs->odd) ^ oddparity(dcmd[pos])) & 0x01) * 0x08 );\r | |
128 | } \r | |
129 | \r | |
9492e0b0 | 130 | ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);\r |
20f9a2a1 M |
131 | \r |
132 | } else {\r | |
9492e0b0 | 133 | ReaderTransmit(dcmd, sizeof(dcmd), timing);\r |
20f9a2a1 M |
134 | }\r |
135 | \r | |
f89c7050 M |
136 | int len = ReaderReceivePar(answer, &par);\r |
137 | \r | |
138 | if (parptr) *parptr = par;\r | |
20f9a2a1 | 139 | \r |
4abe4f58 | 140 | if (crypted == CRYPT_ALL) {\r |
20f9a2a1 M |
141 | if (len == 1) {\r |
142 | res = 0;\r | |
143 | for (pos = 0; pos < 4; pos++)\r | |
144 | res |= (crypto1_bit(pcs, 0, 0) ^ BIT(answer[0], pos)) << pos;\r | |
145 | \r | |
146 | answer[0] = res;\r | |
147 | \r | |
148 | } else {\r | |
149 | for (pos = 0; pos < len; pos++)\r | |
150 | {\r | |
151 | answer[pos] = crypto1_byte(pcs, 0x00, 0) ^ answer[pos];\r | |
152 | }\r | |
153 | }\r | |
154 | }\r | |
155 | \r | |
156 | return len;\r | |
157 | }\r | |
158 | \r | |
8f51ddb0 | 159 | // mifare commands\r |
20f9a2a1 | 160 | int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint64_t isNested) \r |
f89c7050 | 161 | {\r |
9492e0b0 | 162 | return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL);\r |
f89c7050 M |
163 | }\r |
164 | \r | |
9492e0b0 | 165 | int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint64_t isNested, uint32_t * ntptr, uint32_t *timing) \r |
20f9a2a1 M |
166 | {\r |
167 | // variables\r | |
4abe4f58 | 168 | int len; \r |
20f9a2a1 M |
169 | uint32_t pos;\r |
170 | uint8_t tmp4[4];\r | |
4abe4f58 M |
171 | byte_t par = 0;\r |
172 | byte_t ar[4];\r | |
20f9a2a1 M |
173 | uint32_t nt, ntpp; // Supplied tag nonce\r |
174 | \r | |
175 | uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r | |
4abe4f58 | 176 | uint8_t* receivedAnswer = mifare_get_bigbufptr();\r |
20f9a2a1 | 177 | \r |
4abe4f58 | 178 | // Transmit MIFARE_CLASSIC_AUTH\r |
9492e0b0 | 179 | len = mifare_sendcmd_short(pcs, isNested, 0x60 + (keyType & 0x01), blockNo, receivedAnswer, timing);\r |
180 | if (MF_DBGLEVEL >= 4) Dbprintf("rand nonce len: %x", len); \r | |
4abe4f58 | 181 | if (len != 4) return 1;\r |
20f9a2a1 M |
182 | \r |
183 | ar[0] = 0x55;\r | |
184 | ar[1] = 0x41;\r | |
185 | ar[2] = 0x49;\r | |
186 | ar[3] = 0x92; \r | |
187 | \r | |
188 | // Save the tag nonce (nt)\r | |
189 | nt = bytes_to_num(receivedAnswer, 4);\r | |
20f9a2a1 M |
190 | \r |
191 | // ----------------------------- crypto1 create\r | |
4abe4f58 M |
192 | if (isNested)\r |
193 | crypto1_destroy(pcs);\r | |
194 | \r | |
195 | // Init cipher with key\r | |
20f9a2a1 M |
196 | crypto1_create(pcs, ui64Key);\r |
197 | \r | |
4abe4f58 M |
198 | if (isNested == AUTH_NESTED) {\r |
199 | // decrypt nt with help of new key \r | |
200 | nt = crypto1_word(pcs, nt ^ uid, 1) ^ nt;\r | |
201 | } else {\r | |
202 | // Load (plain) uid^nt into the cipher\r | |
203 | crypto1_word(pcs, nt ^ uid, 0);\r | |
204 | }\r | |
205 | \r | |
206 | // some statistic\r | |
f397b5cc | 207 | if (!ntptr && (MF_DBGLEVEL >= 3))\r |
f89c7050 M |
208 | Dbprintf("auth uid: %08x nt: %08x", uid, nt); \r |
209 | \r | |
210 | // save Nt\r | |
211 | if (ntptr)\r | |
212 | *ntptr = nt;\r | |
20f9a2a1 M |
213 | \r |
214 | par = 0;\r | |
4abe4f58 M |
215 | // Generate (encrypted) nr+parity by loading it into the cipher (Nr)\r |
216 | for (pos = 0; pos < 4; pos++)\r | |
217 | {\r | |
218 | mf_nr_ar[pos] = crypto1_byte(pcs, ar[pos], 0) ^ ar[pos];\r | |
20f9a2a1 | 219 | par = (par >> 1) | ( ((filter(pcs->odd) ^ oddparity(ar[pos])) & 0x01) * 0x80 );\r |
4abe4f58 | 220 | } \r |
20f9a2a1 | 221 | \r |
4abe4f58 M |
222 | // Skip 32 bits in pseudo random generator\r |
223 | nt = prng_successor(nt,32);\r | |
20f9a2a1 M |
224 | \r |
225 | // ar+parity\r | |
4abe4f58 M |
226 | for (pos = 4; pos < 8; pos++)\r |
227 | {\r | |
20f9a2a1 | 228 | nt = prng_successor(nt,8);\r |
4abe4f58 | 229 | mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);\r |
20f9a2a1 | 230 | par = (par >> 1)| ( ((filter(pcs->odd) ^ oddparity(nt & 0xff)) & 0x01) * 0x80 );\r |
4abe4f58 | 231 | } \r |
20f9a2a1 | 232 | \r |
4abe4f58 | 233 | // Transmit reader nonce and reader answer\r |
9492e0b0 | 234 | ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);\r |
20f9a2a1 | 235 | \r |
4abe4f58 | 236 | // Receive 4 bit answer\r |
20f9a2a1 | 237 | len = ReaderReceive(receivedAnswer);\r |
4abe4f58 M |
238 | if (!len)\r |
239 | {\r | |
f397b5cc | 240 | if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");\r |
20f9a2a1 | 241 | return 2;\r |
4abe4f58 | 242 | }\r |
20f9a2a1 | 243 | \r |
4abe4f58 | 244 | memcpy(tmp4, receivedAnswer, 4);\r |
20f9a2a1 M |
245 | ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);\r |
246 | \r | |
247 | if (ntpp != bytes_to_num(tmp4, 4)) {\r | |
f397b5cc | 248 | if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response.");\r |
20f9a2a1 M |
249 | return 3;\r |
250 | }\r | |
251 | \r | |
252 | return 0;\r | |
253 | }\r | |
254 | \r | |
255 | int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) \r | |
256 | {\r | |
257 | // variables\r | |
4abe4f58 | 258 | int len; \r |
20f9a2a1 M |
259 | uint8_t bt[2];\r |
260 | \r | |
4abe4f58 | 261 | uint8_t* receivedAnswer = mifare_get_bigbufptr();\r |
20f9a2a1 | 262 | \r |
4abe4f58 | 263 | // command MIFARE_CLASSIC_READBLOCK\r |
9492e0b0 | 264 | len = mifare_sendcmd_short(pcs, 1, 0x30, blockNo, receivedAnswer, NULL);\r |
20f9a2a1 | 265 | if (len == 1) {\r |
f397b5cc | 266 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]); \r |
20f9a2a1 M |
267 | return 1;\r |
268 | }\r | |
269 | if (len != 18) {\r | |
f397b5cc | 270 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: card timeout. len: %x", len); \r |
20f9a2a1 M |
271 | return 2;\r |
272 | }\r | |
273 | \r | |
274 | memcpy(bt, receivedAnswer + 16, 2);\r | |
4abe4f58 | 275 | AppendCrc14443a(receivedAnswer, 16);\r |
20f9a2a1 | 276 | if (bt[0] != receivedAnswer[16] || bt[1] != receivedAnswer[17]) {\r |
f397b5cc | 277 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd CRC response error."); \r |
20f9a2a1 M |
278 | return 3;\r |
279 | }\r | |
280 | \r | |
281 | memcpy(blockData, receivedAnswer, 16);\r | |
981bd429 | 282 | return 0; |
283 | } | |
284 | ||
285 | int mifare_ultra_readblock(uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
286 | { | |
287 | // variables | |
288 | int len; | |
289 | uint8_t bt[2]; | |
290 | ||
291 | uint8_t* receivedAnswer = mifare_get_bigbufptr(); | |
292 | ||
293 | // command MIFARE_CLASSIC_READBLOCK | |
294 | len = mifare_sendcmd_short(NULL, 1, 0x30, blockNo, receivedAnswer,NULL); | |
295 | if (len == 1) { | |
296 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]); | |
297 | return 1; | |
298 | } | |
299 | if (len != 18) { | |
300 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: card timeout. len: %x", len); | |
301 | return 2; | |
302 | } | |
303 | ||
304 | memcpy(bt, receivedAnswer + 16, 2); | |
305 | AppendCrc14443a(receivedAnswer, 16); | |
306 | if (bt[0] != receivedAnswer[16] || bt[1] != receivedAnswer[17]) { | |
307 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd CRC response error."); | |
308 | return 3; | |
309 | } | |
310 | ||
311 | memcpy(blockData, receivedAnswer, 14); | |
312 | return 0; | |
313 | } | |
314 | ||
315 | ||
316 | int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
317 | { | |
318 | // variables | |
4abe4f58 | 319 | int len, i; \r |
20f9a2a1 | 320 | uint32_t pos;\r |
4abe4f58 M |
321 | uint32_t par = 0;\r |
322 | byte_t res;\r | |
20f9a2a1 M |
323 | \r |
324 | uint8_t d_block[18], d_block_enc[18];\r | |
4abe4f58 | 325 | uint8_t* receivedAnswer = mifare_get_bigbufptr();\r |
20f9a2a1 | 326 | \r |
4abe4f58 | 327 | // command MIFARE_CLASSIC_WRITEBLOCK\r |
9492e0b0 | 328 | len = mifare_sendcmd_short(pcs, 1, 0xA0, blockNo, receivedAnswer, NULL);\r |
20f9a2a1 M |
329 | \r |
330 | if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK\r | |
f397b5cc | 331 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]); \r |
20f9a2a1 M |
332 | return 1;\r |
333 | }\r | |
334 | \r | |
335 | memcpy(d_block, blockData, 16);\r | |
336 | AppendCrc14443a(d_block, 16);\r | |
337 | \r | |
338 | // crypto\r | |
339 | par = 0;\r | |
4abe4f58 M |
340 | for (pos = 0; pos < 18; pos++)\r |
341 | {\r | |
342 | d_block_enc[pos] = crypto1_byte(pcs, 0x00, 0) ^ d_block[pos];\r | |
20f9a2a1 | 343 | par = (par >> 1) | ( ((filter(pcs->odd) ^ oddparity(d_block[pos])) & 0x01) * 0x20000 );\r |
4abe4f58 | 344 | } \r |
20f9a2a1 | 345 | \r |
9492e0b0 | 346 | ReaderTransmitPar(d_block_enc, sizeof(d_block_enc), par, NULL);\r |
20f9a2a1 | 347 | \r |
4abe4f58 | 348 | // Receive the response\r |
20f9a2a1 M |
349 | len = ReaderReceive(receivedAnswer); \r |
350 | \r | |
351 | res = 0;\r | |
352 | for (i = 0; i < 4; i++)\r | |
353 | res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], i)) << i;\r | |
354 | \r | |
355 | if ((len != 1) || (res != 0x0A)) {\r | |
f397b5cc | 356 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd send data2 Error: %02x", res); \r |
20f9a2a1 M |
357 | return 2;\r |
358 | }\r | |
359 | \r | |
981bd429 | 360 | return 0; |
361 | } | |
362 | ||
363 | int mifare_ultra_writeblock(uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
364 | { | |
365 | // variables | |
366 | int len; | |
367 | uint32_t par = 0; | |
368 | ||
369 | uint8_t d_block[18]; | |
370 | uint8_t* receivedAnswer = mifare_get_bigbufptr(); | |
371 | ||
372 | // command MIFARE_CLASSIC_WRITEBLOCK | |
373 | len = mifare_sendcmd_short(NULL, 1, 0xA0, blockNo, receivedAnswer,NULL); | |
374 | ||
375 | if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK | |
376 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Addr Error: %02x", receivedAnswer[0]); | |
377 | return 1; | |
378 | } | |
379 | ||
380 | memset(d_block,'\0',18); | |
381 | memcpy(d_block, blockData, 16); | |
382 | AppendCrc14443a(d_block, 16); | |
383 | ||
384 | ReaderTransmitPar(d_block, sizeof(d_block), par, NULL); | |
385 | ||
386 | // Receive the response | |
387 | len = ReaderReceive(receivedAnswer); | |
388 | ||
389 | if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK | |
390 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Data Error: %02x %d", receivedAnswer[0],len); | |
391 | return 2; | |
392 | } | |
393 | ||
394 | return 0; | |
395 | } | |
396 | ||
397 | int mifare_ultra_special_writeblock(uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
398 | { | |
399 | // variables | |
400 | int len; | |
401 | //uint32_t par = 0; | |
402 | ||
403 | uint8_t d_block[8]; | |
404 | uint8_t* receivedAnswer = mifare_get_bigbufptr(); | |
405 | ||
406 | // command MIFARE_CLASSIC_WRITEBLOCK | |
407 | memset(d_block,'\0',8); | |
408 | d_block[0]= blockNo; | |
409 | memcpy(d_block+1,blockData,4); | |
410 | AppendCrc14443a(d_block, 6); | |
411 | ||
412 | //i know the data send here is correct | |
413 | len = mifare_sendcmd_short_special(NULL, 1, 0xA2, d_block, receivedAnswer,NULL); | |
414 | ||
415 | if (receivedAnswer[0] != 0x0A) { // 0x0a - ACK | |
416 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Send Error: %02x %d", receivedAnswer[0],len); | |
417 | return 1; | |
418 | } | |
419 | return 0; | |
420 | } | |
421 | ||
422 | int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid) | |
423 | { | |
424 | // variables | |
4abe4f58 | 425 | int len; \r |
20f9a2a1 M |
426 | \r |
427 | // Mifare HALT\r | |
4abe4f58 | 428 | uint8_t* receivedAnswer = mifare_get_bigbufptr();\r |
20f9a2a1 | 429 | \r |
9492e0b0 | 430 | len = mifare_sendcmd_short(pcs, pcs == NULL ? 0:1, 0x50, 0x00, receivedAnswer, NULL);\r |
4abe4f58 | 431 | if (len != 0) {\r |
f397b5cc | 432 | if (MF_DBGLEVEL >= 1) Dbprintf("halt error. response len: %x", len); \r |
20f9a2a1 M |
433 | return 1;\r |
434 | }\r | |
435 | \r | |
981bd429 | 436 | return 0; |
437 | } | |
438 | ||
439 | int mifare_ultra_halt(uint32_t uid) | |
440 | { | |
441 | // variables | |
442 | int len; | |
443 | ||
444 | // Mifare HALT | |
445 | uint8_t* receivedAnswer = mifare_get_bigbufptr(); | |
446 | ||
447 | len = mifare_sendcmd_short(NULL, 1, 0x50, 0x00, receivedAnswer, NULL); | |
448 | if (len != 0) { | |
449 | if (MF_DBGLEVEL >= 1) Dbprintf("halt error. response len: %x", len); | |
450 | return 1; | |
451 | } | |
452 | ||
453 | return 0; | |
454 | } | |
455 | ||
baeaf579 | 456 | \r |
457 | // Mifare Memory Structure: up to 32 Sectors with 4 blocks each (1k and 2k cards),\r | |
458 | // plus evtl. 8 sectors with 16 blocks each (4k cards)\r | |
459 | uint8_t NumBlocksPerSector(uint8_t sectorNo) \r | |
460 | {\r | |
461 | if (sectorNo < 32) \r | |
462 | return 4;\r | |
463 | else\r | |
464 | return 16;\r | |
465 | }\r | |
466 | \r | |
467 | uint8_t FirstBlockOfSector(uint8_t sectorNo) \r | |
468 | {\r | |
469 | if (sectorNo < 32)\r | |
470 | return sectorNo * 4;\r | |
471 | else\r | |
472 | return 32*4 + (sectorNo - 32) * 16;\r | |
473 | \r | |
474 | }\r | |
475 | \r | |
476 | \r | |
981bd429 | 477 | // work with emulator memory |
478 | void emlSetMem(uint8_t *data, int blockNum, int blocksCount) { | |
479 | uint8_t* emCARD = eml_get_bigbufptr_cardmem(); | |
8f51ddb0 M |
480 | \r |
481 | memcpy(emCARD + blockNum * 16, data, blocksCount * 16);\r | |
482 | }\r | |
483 | \r | |
484 | void emlGetMem(uint8_t *data, int blockNum, int blocksCount) {\r | |
485 | uint8_t* emCARD = eml_get_bigbufptr_cardmem();\r | |
486 | \r | |
487 | memcpy(data, emCARD + blockNum * 16, blocksCount * 16);\r | |
488 | }\r | |
489 | \r | |
490 | void emlGetMemBt(uint8_t *data, int bytePtr, int byteCount) {\r | |
491 | uint8_t* emCARD = eml_get_bigbufptr_cardmem();\r | |
492 | \r | |
493 | memcpy(data, emCARD + bytePtr, byteCount);\r | |
494 | }\r | |
495 | \r | |
0014cb46 M |
496 | int emlCheckValBl(int blockNum) {\r |
497 | uint8_t* emCARD = eml_get_bigbufptr_cardmem();\r | |
498 | uint8_t* data = emCARD + blockNum * 16;\r | |
499 | \r | |
500 | if ((data[0] != (data[4] ^ 0xff)) || (data[0] != data[8]) ||\r | |
501 | (data[1] != (data[5] ^ 0xff)) || (data[1] != data[9]) ||\r | |
502 | (data[2] != (data[6] ^ 0xff)) || (data[2] != data[10]) ||\r | |
503 | (data[3] != (data[7] ^ 0xff)) || (data[3] != data[11]) ||\r | |
504 | (data[12] != (data[13] ^ 0xff)) || (data[12] != data[14]) ||\r | |
505 | (data[12] != (data[15] ^ 0xff))\r | |
506 | ) \r | |
507 | return 1;\r | |
508 | return 0;\r | |
509 | }\r | |
510 | \r | |
511 | int emlGetValBl(uint32_t *blReg, uint8_t *blBlock, int blockNum) {\r | |
512 | uint8_t* emCARD = eml_get_bigbufptr_cardmem();\r | |
513 | uint8_t* data = emCARD + blockNum * 16;\r | |
514 | \r | |
515 | if (emlCheckValBl(blockNum)) {\r | |
516 | return 1;\r | |
517 | }\r | |
518 | \r | |
519 | memcpy(blReg, data, 4);\r | |
520 | *blBlock = data[12];\r | |
521 | \r | |
522 | return 0;\r | |
523 | }\r | |
524 | \r | |
525 | int emlSetValBl(uint32_t blReg, uint8_t blBlock, int blockNum) {\r | |
526 | uint8_t* emCARD = eml_get_bigbufptr_cardmem();\r | |
527 | uint8_t* data = emCARD + blockNum * 16;\r | |
528 | \r | |
529 | memcpy(data + 0, &blReg, 4);\r | |
530 | memcpy(data + 8, &blReg, 4);\r | |
531 | blReg = blReg ^ 0xffffffff;\r | |
532 | memcpy(data + 4, &blReg, 4);\r | |
533 | \r | |
534 | data[12] = blBlock;\r | |
535 | data[13] = blBlock ^ 0xff;\r | |
536 | data[14] = blBlock;\r | |
537 | data[15] = blBlock ^ 0xff;\r | |
538 | \r | |
539 | return 0;\r | |
540 | }\r | |
541 | \r | |
8556b852 M |
542 | uint64_t emlGetKey(int sectorNum, int keyType) {\r |
543 | uint8_t key[6];\r | |
544 | uint8_t* emCARD = eml_get_bigbufptr_cardmem();\r | |
545 | \r | |
baeaf579 | 546 | memcpy(key, emCARD + 16 * (FirstBlockOfSector(sectorNum) + NumBlocksPerSector(sectorNum) - 1) + keyType * 10, 6);\r |
8556b852 M |
547 | return bytes_to_num(key, 6);\r |
548 | }\r | |
549 | \r | |
8f51ddb0 | 550 | void emlClearMem(void) {\r |
aea4d766 | 551 | int b;\r |
8f51ddb0 M |
552 | \r |
553 | const uint8_t trailer[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07, 0x80, 0x69, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};\r | |
8f51ddb0 | 554 | const uint8_t uid[] = {0xe6, 0x84, 0x87, 0xf3, 0x16, 0x88, 0x04, 0x00, 0x46, 0x8e, 0x45, 0x55, 0x4d, 0x70, 0x41, 0x04};\r |
aea4d766 | 555 | uint8_t* emCARD = eml_get_bigbufptr_cardmem();\r |
556 | \r | |
557 | memset(emCARD, 0, CARD_MEMORY_LEN);\r | |
558 | \r | |
559 | // fill sectors trailer data\r | |
560 | for(b = 3; b < 256; b<127?(b+=4):(b+=16)) {\r | |
561 | emlSetMem((uint8_t *)trailer, b , 1);\r | |
562 | } \r | |
8f51ddb0 M |
563 | \r |
564 | // uid\r | |
565 | emlSetMem((uint8_t *)uid, 0, 1);\r | |
566 | return;\r | |
567 | }\r |