]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/mifarecmd.c
projects / proxmark3-svn / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Merge remote-tracking branch 'upstream/master'
[proxmark3-svn] / armsrc / mifarecmd.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------\r
2// Merlok - June 2011, 2012\r
3// Gerhard de Koning Gans - May 2008\r
4// Hagen Fritsch - June 2010\r
5// Midnitesnake - Dec 2013\r
6// Andy Davies - Apr 2014\r
7// Iceman - May 2014\r
8//\r
9// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
10// at your option, any later version. See the LICENSE.txt file for the text of\r
11// the license.\r
12//-----------------------------------------------------------------------------\r
13// Routines to support ISO 14443 type A.\r
14//-----------------------------------------------------------------------------\r
15\r
16#include "mifarecmd.h"\r
17#include "apps.h"\r
18#include "util.h"\r
19\r
20#include "des.h"\r
21#include "crc.h"\r
22\r
23// the block number for the ISO14443-4 PCB\r
24uint8_t pcb_blocknum = 0;\r
25// Deselect card by sending a s-block. the crc is precalced for speed\r
26static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};\r
27\r
28\r
29//-----------------------------------------------------------------------------\r
30// Select, Authenticate, Read a MIFARE tag. \r
31// read block\r
32//-----------------------------------------------------------------------------\r
33void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
34{\r
35 // params\r
36 uint8_t blockNo = arg0;\r
37 uint8_t keyType = arg1;\r
38 uint64_t ui64Key = 0;\r
39 ui64Key = bytes_to_num(datain, 6);\r
40 \r
41 // variables\r
42 byte_t isOK = 0;\r
43 byte_t dataoutbuf[16];\r
44 uint8_t uid[10];\r
45 uint32_t cuid;\r
46 struct Crypto1State mpcs = {0, 0};\r
47 struct Crypto1State *pcs;\r
48 pcs = &mpcs;\r
49\r
50 // clear trace\r
51 clear_trace();\r
52 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
53\r
54 LED_A_ON();\r
55 LED_B_OFF();\r
56 LED_C_OFF();\r
57\r
58 while (true) {\r
59 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
60 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
61 break;\r
62 };\r
63\r
64 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
65 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
66 break;\r
67 };\r
68 \r
69 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r
70 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r
71 break;\r
72 };\r
73\r
74 if(mifare_classic_halt(pcs, cuid)) {\r
75 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
76 break;\r
77 };\r
78 \r
79 isOK = 1;\r
80 break;\r
81 }\r
82 \r
83 // ----------------------------- crypto1 destroy\r
84 crypto1_destroy(pcs);\r
85 \r
86 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r
87\r
88 LED_B_ON();\r
89 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r
90 LED_B_OFF();\r
91\r
92 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
93 LEDsoff();\r
94}\r
95\r
96void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){\r
97\r
98 byte_t dataoutbuf[16] = {0x00};\r
99 uint8_t uid[10] = {0x00};\r
100 uint32_t cuid = 0x00;\r
101\r
102 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
103 \r
104 clear_trace();\r
105 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
106\r
107 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
108 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
109 OnError(0);\r
110 return;\r
111 };\r
112 \r
113 if(mifare_ultra_auth1(dataoutbuf)){\r
114 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r
115 OnError(1);\r
116 return;\r
117 }\r
118\r
119 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
120 \r
121 cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);\r
122 LEDsoff();\r
123}\r
124void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){\r
125\r
126 uint8_t key[16] = {0x00};\r
127 byte_t dataoutbuf[16] = {0x00};\r
128 \r
129 memcpy(key, datain, 16);\r
130 \r
131 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
132 \r
133 if(mifare_ultra_auth2(key, dataoutbuf)){\r
134 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");\r
135 OnError(1);\r
136 return; \r
137 }\r
138 \r
139 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");\r
140 \r
141 cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);\r
142 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
143 LEDsoff();\r
144}\r
145\r
146void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r
147{\r
148 uint8_t blockNo = arg0;\r
149 byte_t dataout[16] = {0x00};\r
150 uint8_t uid[10] = {0x00};\r
151 uint8_t key[16] = {0x00};\r
152 bool usePwd = (arg1 == 1);\r
153\r
154 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
155\r
156 clear_trace();\r
157 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
158\r
159 int len = iso14443a_select_card(uid, NULL, NULL);\r
160 if(!len) {\r
161 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r
162 OnError(1);\r
163 return;\r
164 }\r
165\r
166 // authenticate here.\r
167 if ( usePwd ) {\r
168\r
169 memcpy(key, datain, 16);\r
170\r
171 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );\r
172 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );\r
173\r
174 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };\r
175 uint8_t random_b[8] = {0x00};\r
176 uint8_t enc_random_b[8] = {0x00};\r
177 uint8_t rnd_ab[16] = {0x00};\r
178 uint8_t IV[8] = {0x00};\r
179\r
180 uint16_t len;\r
181 uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
182 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
183\r
184 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r
185 if (len != 11) {\r
186 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
187 OnError(1);\r
188 return;\r
189 }\r
190 \r
191 // tag nonce.\r
192 memcpy(enc_random_b,receivedAnswer+1,8);\r
193\r
194 // decrypt nonce.\r
195 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );\r
196\r
197 \r
198 rol(random_b,8);\r
199 \r
200 memcpy(rnd_ab ,random_a,8);\r
201 memcpy(rnd_ab+8,random_b,8);\r
202\r
203 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
204 Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
205 enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],\r
206 enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);\r
207 \r
208 Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
209 random_b[0],random_b[1],random_b[2],random_b[3],\r
210 random_b[4],random_b[5],random_b[6],random_b[7]);\r
211\r
212 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
213 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],\r
214 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
215 \r
216 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
217 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],\r
218 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );\r
219 }\r
220 \r
221 // encrypt out, in, length, key, iv\r
222 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);\r
223\r
224 \r
225 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);\r
226 if (len != 11) {\r
227 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
228 OnError(1);\r
229 return;\r
230 }\r
231\r
232 uint8_t enc_resp[8] = { 0 };\r
233 uint8_t resp_random_a[8] = { 0 };\r
234 memcpy(enc_resp, receivedAnswer+1, 8);\r
235 \r
236 // decrypt out, in, length, key, iv \r
237 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);\r
238 if ( memcmp(resp_random_a, random_a, 8) != 0 )\r
239 Dbprintf("failed authentication");\r
240\r
241 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
242 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", \r
243 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],\r
244 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
245\r
246 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",\r
247 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],\r
248 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);\r
249\r
250 Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",\r
251 random_a[0],random_a[1],random_a[2],random_a[3],\r
252 random_a[4],random_a[5],random_a[6],random_a[7]);\r
253 \r
254 Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",\r
255 resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],\r
256 resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);\r
257 }\r
258 }\r
259 \r
260 if( mifare_ultra_readblock(blockNo, dataout) ) {\r
261 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r
262 OnError(2);\r
263 return;\r
264 }\r
265 \r
266 if( mifare_ultra_halt() ) {\r
267 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
268 OnError(3);\r
269 return;\r
270 }\r
271 \r
272 cmd_send(CMD_ACK,1,0,0,dataout,16);\r
273 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
274 LEDsoff();\r
275}\r
276\r
277//-----------------------------------------------------------------------------\r
278// Select, Authenticate, Read a MIFARE tag. \r
279// read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r
280//-----------------------------------------------------------------------------\r
281void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
282{\r
283 // params\r
284 uint8_t sectorNo = arg0;\r
285 uint8_t keyType = arg1;\r
286 uint64_t ui64Key = 0;\r
287 ui64Key = bytes_to_num(datain, 6);\r
288 \r
289 // variables\r
290 byte_t isOK = 0;\r
291 byte_t dataoutbuf[16 * 16];\r
292 uint8_t uid[10];\r
293 uint32_t cuid;\r
294 struct Crypto1State mpcs = {0, 0};\r
295 struct Crypto1State *pcs;\r
296 pcs = &mpcs;\r
297\r
298 // clear trace\r
299 clear_trace();\r
300\r
301 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
302\r
303 LED_A_ON();\r
304 LED_B_OFF();\r
305 LED_C_OFF();\r
306\r
307 isOK = 1;\r
308 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
309 isOK = 0;\r
310 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
311 }\r
312\r
313 \r
314 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
315 isOK = 0;\r
316 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
317 }\r
318 \r
319 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
320 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r
321 isOK = 0;\r
322 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r
323 break;\r
324 }\r
325 }\r
326 \r
327 if(mifare_classic_halt(pcs, cuid)) {\r
328 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
329 }\r
330\r
331 // ----------------------------- crypto1 destroy\r
332 crypto1_destroy(pcs);\r
333 \r
334 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r
335\r
336 LED_B_ON();\r
337 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r
338 LED_B_OFF();\r
339\r
340 // Thats it...\r
341 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
342 LEDsoff();\r
343}\r
344\r
345void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)\r
346{\r
347 // params\r
348 uint8_t sectorNo = arg0;\r
349 int Pages = arg1;\r
350 int countpages = 0;\r
351 byte_t dataout[176] = {0x00};;\r
352\r
353 LEDsoff();\r
354 LED_A_ON();\r
355 clear_trace();\r
356 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
357\r
358 int len = iso14443a_select_card(NULL, NULL, NULL);\r
359 if (!len) {\r
360 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r
361 OnError(1);\r
362 return;\r
363 }\r
364 \r
365 for (int i = 0; i < Pages; i++){\r
366 \r
367 len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);\r
368 \r
369 if (len) {\r
370 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r
371 OnError(2);\r
372 return;\r
373 } else {\r
374 countpages++;\r
375 }\r
376 }\r
377 \r
378 len = mifare_ultra_halt();\r
379 if (len) {\r
380 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
381 OnError(3);\r
382 return;\r
383 }\r
384 \r
385 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Pages read %d", countpages);\r
386\r
387 len = Pages * 4;\r
388\r
389 cmd_send(CMD_ACK, 1, 0, 0, dataout, len); \r
390 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
391 LEDsoff();\r
392}\r
393\r
394//-----------------------------------------------------------------------------\r
395// Select, Authenticate, Write a MIFARE tag. \r
396// read block\r
397//-----------------------------------------------------------------------------\r
398void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
399{\r
400 // params\r
401 uint8_t blockNo = arg0;\r
402 uint8_t keyType = arg1;\r
403 uint64_t ui64Key = 0;\r
404 byte_t blockdata[16];\r
405\r
406 ui64Key = bytes_to_num(datain, 6);\r
407 memcpy(blockdata, datain + 10, 16);\r
408 \r
409 // variables\r
410 byte_t isOK = 0;\r
411 uint8_t uid[10];\r
412 uint32_t cuid;\r
413 struct Crypto1State mpcs = {0, 0};\r
414 struct Crypto1State *pcs;\r
415 pcs = &mpcs;\r
416\r
417 // clear trace\r
418 clear_trace();\r
419\r
420 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
421\r
422 LED_A_ON();\r
423 LED_B_OFF();\r
424 LED_C_OFF();\r
425\r
426 while (true) {\r
427 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
428 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
429 break;\r
430 };\r
431\r
432 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
433 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
434 break;\r
435 };\r
436 \r
437 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r
438 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
439 break;\r
440 };\r
441\r
442 if(mifare_classic_halt(pcs, cuid)) {\r
443 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
444 break;\r
445 };\r
446 \r
447 isOK = 1;\r
448 break;\r
449 }\r
450 \r
451 // ----------------------------- crypto1 destroy\r
452 crypto1_destroy(pcs);\r
453 \r
454 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
455\r
456 LED_B_ON();\r
457 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
458 LED_B_OFF();\r
459\r
460\r
461 // Thats it...\r
462 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
463 LEDsoff();\r
464}\r
465\r
466void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)\r
467{\r
468 uint8_t blockNo = arg0;\r
469 byte_t blockdata[16] = {0x00};\r
470\r
471 memcpy(blockdata, datain, 16);\r
472\r
473 uint8_t uid[10] = {0x00};\r
474\r
475 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
476\r
477 clear_trace();\r
478 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
479\r
480 if(!iso14443a_select_card(uid, NULL, NULL)) {\r
481 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
482 OnError(0);\r
483 return;\r
484 };\r
485\r
486 if(mifare_ultra_writeblock(blockNo, blockdata)) {\r
487 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
488 OnError(0);\r
489 return; };\r
490\r
491 if(mifare_ultra_halt()) {\r
492 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
493 OnError(0);\r
494 return;\r
495 };\r
496\r
497 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
498\r
499 cmd_send(CMD_ACK,1,0,0,0,0);\r
500 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
501 LEDsoff();\r
502}\r
503\r
504void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)\r
505{\r
506 uint8_t blockNo = arg0;\r
507 byte_t blockdata[4] = {0x00};\r
508 \r
509 memcpy(blockdata, datain,4);\r
510\r
511 uint8_t uid[10] = {0x00};\r
512 \r
513 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
514 clear_trace();\r
515 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
516\r
517 if(!iso14443a_select_card(uid, NULL, NULL)) {\r
518 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
519 OnError(0);\r
520 return;\r
521 };\r
522\r
523 if(mifare_ultra_special_writeblock(blockNo, blockdata)) {\r
524 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
525 OnError(0);\r
526 return;\r
527 };\r
528\r
529 if(mifare_ultra_halt()) {\r
530 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
531 OnError(0);\r
532 return;\r
533 };\r
534\r
535 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
536\r
537 cmd_send(CMD_ACK,1,0,0,0,0);\r
538 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
539 LEDsoff();\r
540}\r
541\r
542void MifareUSetPwd(uint8_t arg0, uint8_t *datain){\r
543 \r
544 uint8_t pwd[16] = {0x00};\r
545 byte_t blockdata[4] = {0x00};\r
546 \r
547 memcpy(pwd, datain, 16);\r
548 \r
549 LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
550 clear_trace();\r
551 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
552\r
553 if(!iso14443a_select_card(NULL, NULL, NULL)) {\r
554 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
555 OnError(0);\r
556 return;\r
557 };\r
558\r
559 blockdata[0] = pwd[7];\r
560 blockdata[1] = pwd[6];\r
561 blockdata[2] = pwd[5];\r
562 blockdata[3] = pwd[4];\r
563 if(mifare_ultra_special_writeblock( 44, blockdata)) {\r
564 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
565 OnError(44);\r
566 return;\r
567 };\r
568\r
569 blockdata[0] = pwd[3];\r
570 blockdata[1] = pwd[2];\r
571 blockdata[2] = pwd[1];\r
572 blockdata[3] = pwd[0];\r
573 if(mifare_ultra_special_writeblock( 45, blockdata)) {\r
574 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
575 OnError(45);\r
576 return;\r
577 };\r
578\r
579 blockdata[0] = pwd[15];\r
580 blockdata[1] = pwd[14];\r
581 blockdata[2] = pwd[13];\r
582 blockdata[3] = pwd[12];\r
583 if(mifare_ultra_special_writeblock( 46, blockdata)) {\r
584 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
585 OnError(46);\r
586 return;\r
587 };\r
588\r
589 blockdata[0] = pwd[11];\r
590 blockdata[1] = pwd[10];\r
591 blockdata[2] = pwd[9];\r
592 blockdata[3] = pwd[8];\r
593 if(mifare_ultra_special_writeblock( 47, blockdata)) {\r
594 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
595 OnError(47);\r
596 return;\r
597 }; \r
598\r
599 if(mifare_ultra_halt()) {\r
600 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
601 OnError(0);\r
602 return;\r
603 };\r
604\r
605 cmd_send(CMD_ACK,1,0,0,0,0);\r
606 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
607 LEDsoff();\r
608}\r
609\r
610// Return 1 if the nonce is invalid else return 0\r
611int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r
612 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r
613 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r
614 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r
615}\r
616\r
617\r
618//-----------------------------------------------------------------------------\r
619// MIFARE nested authentication. \r
620// \r
621//-----------------------------------------------------------------------------\r
622void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r
623{\r
624 // params\r
625 uint8_t blockNo = arg0 & 0xff;\r
626 uint8_t keyType = (arg0 >> 8) & 0xff;\r
627 uint8_t targetBlockNo = arg1 & 0xff;\r
628 uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
629 uint64_t ui64Key = 0;\r
630\r
631 ui64Key = bytes_to_num(datain, 6);\r
632 \r
633 // variables\r
634 uint16_t rtr, i, j, len;\r
635 uint16_t davg;\r
636 static uint16_t dmin, dmax;\r
637 uint8_t uid[10];\r
638 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r
639 uint8_t par[1];\r
640 uint32_t target_nt[2], target_ks[2];\r
641 \r
642 uint8_t par_array[4];\r
643 uint16_t ncount = 0;\r
644 struct Crypto1State mpcs = {0, 0};\r
645 struct Crypto1State *pcs;\r
646 pcs = &mpcs;\r
647 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
648\r
649 uint32_t auth1_time, auth2_time;\r
650 static uint16_t delta_time;\r
651\r
652 // free eventually allocated BigBuf memory\r
653 BigBuf_free();\r
654 // clear trace\r
655 clear_trace();\r
656 set_tracing(false);\r
657 \r
658 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
659\r
660 LED_A_ON();\r
661 LED_C_OFF();\r
662\r
663\r
664 // statistics on nonce distance\r
665 if (calibrate) { // for first call only. Otherwise reuse previous calibration\r
666 LED_B_ON();\r
667 WDT_HIT();\r
668\r
669 davg = dmax = 0;\r
670 dmin = 2000;\r
671 delta_time = 0;\r
672 \r
673 for (rtr = 0; rtr < 17; rtr++) {\r
674\r
675 // prepare next select. No need to power down the card.\r
676 if(mifare_classic_halt(pcs, cuid)) {\r
677 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
678 rtr--;\r
679 continue;\r
680 }\r
681\r
682 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
683 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
684 rtr--;\r
685 continue;\r
686 };\r
687\r
688 auth1_time = 0;\r
689 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
690 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
691 rtr--;\r
692 continue;\r
693 };\r
694\r
695 if (delta_time) {\r
696 auth2_time = auth1_time + delta_time;\r
697 } else {\r
698 auth2_time = 0;\r
699 }\r
700 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r
701 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
702 rtr--;\r
703 continue;\r
704 };\r
705\r
706 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r
707 for (i = 101; i < 1200; i++) {\r
708 nttmp = prng_successor(nttmp, 1);\r
709 if (nttmp == nt2) break;\r
710 }\r
711\r
712 if (i != 1200) {\r
713 if (rtr != 0) {\r
714 davg += i;\r
715 dmin = MIN(dmin, i);\r
716 dmax = MAX(dmax, i);\r
717 }\r
718 else {\r
719 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r
720 }\r
721 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r
722 }\r
723 }\r
724 \r
725 if (rtr <= 1) return;\r
726\r
727 davg = (davg + (rtr - 1)/2) / (rtr - 1);\r
728 \r
729 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);\r
730\r
731 dmin = davg - 2;\r
732 dmax = davg + 2;\r
733 \r
734 LED_B_OFF();\r
735 \r
736 }\r
737// ------------------------------------------------------------------------------------------------- \r
738 \r
739 LED_C_ON();\r
740\r
741 // get crypted nonces for target sector\r
742 for(i=0; i < 2; i++) { // look for exactly two different nonces\r
743\r
744 target_nt[i] = 0;\r
745 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r
746 \r
747 // prepare next select. No need to power down the card.\r
748 if(mifare_classic_halt(pcs, cuid)) {\r
749 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
750 continue;\r
751 }\r
752\r
753 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
754 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
755 continue;\r
756 };\r
757 \r
758 auth1_time = 0;\r
759 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
760 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
761 continue;\r
762 };\r
763\r
764 // nested authentication\r
765 auth2_time = auth1_time + delta_time;\r
766 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r
767 if (len != 4) {\r
768 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r
769 continue;\r
770 };\r
771 \r
772 nt2 = bytes_to_num(receivedAnswer, 4); \r
773 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r
774 \r
775 // Parity validity check\r
776 for (j = 0; j < 4; j++) {\r
777 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r
778 }\r
779 \r
780 ncount = 0;\r
781 nttest = prng_successor(nt1, dmin - 1);\r
782 for (j = dmin; j < dmax + 1; j++) {\r
783 nttest = prng_successor(nttest, 1);\r
784 ks1 = nt2 ^ nttest;\r
785\r
786 if (valid_nonce(nttest, nt2, ks1, par_array)){\r
787 if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r
788 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r
789 target_nt[i] = 0;\r
790 break;\r
791 }\r
792 target_nt[i] = nttest;\r
793 target_ks[i] = ks1;\r
794 ncount++;\r
795 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r
796 target_nt[i] = 0;\r
797 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r
798 break;\r
799 }\r
800 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r
801 }\r
802 }\r
803 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r
804 }\r
805 }\r
806\r
807 LED_C_OFF();\r
808 \r
809 // ----------------------------- crypto1 destroy\r
810 crypto1_destroy(pcs);\r
811 \r
812 byte_t buf[4 + 4 * 4];\r
813 memcpy(buf, &cuid, 4);\r
814 memcpy(buf+4, &target_nt[0], 4);\r
815 memcpy(buf+8, &target_ks[0], 4);\r
816 memcpy(buf+12, &target_nt[1], 4);\r
817 memcpy(buf+16, &target_ks[1], 4);\r
818 \r
819 LED_B_ON();\r
820 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
821 LED_B_OFF();\r
822\r
823 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r
824\r
825 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
826 LEDsoff();\r
827 set_tracing(TRUE);\r
828}\r
829\r
830//-----------------------------------------------------------------------------\r
831// MIFARE check keys. key count up to 85. \r
832// \r
833//-----------------------------------------------------------------------------\r
834void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
835{\r
836 // params\r
837 uint8_t blockNo = arg0;\r
838 uint8_t keyType = arg1;\r
839 uint8_t keyCount = arg2;\r
840 uint64_t ui64Key = 0;\r
841 \r
842 // variables\r
843 int i;\r
844 byte_t isOK = 0;\r
845 uint8_t uid[10];\r
846 uint32_t cuid;\r
847 struct Crypto1State mpcs = {0, 0};\r
848 struct Crypto1State *pcs;\r
849 pcs = &mpcs;\r
850 \r
851 // clear debug level\r
852 int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r
853 MF_DBGLEVEL = MF_DBG_NONE;\r
854 \r
855 // clear trace\r
856 clear_trace();\r
857 set_tracing(TRUE);\r
858\r
859 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
860\r
861 LED_A_ON();\r
862 LED_B_OFF();\r
863 LED_C_OFF();\r
864\r
865 for (i = 0; i < keyCount; i++) {\r
866 if(mifare_classic_halt(pcs, cuid)) {\r
867 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r
868 }\r
869\r
870 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
871 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r
872 break;\r
873 };\r
874\r
875 ui64Key = bytes_to_num(datain + i * 6, 6);\r
876 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
877 continue;\r
878 };\r
879 \r
880 isOK = 1;\r
881 break;\r
882 }\r
883 \r
884 // ----------------------------- crypto1 destroy\r
885 crypto1_destroy(pcs);\r
886 \r
887 LED_B_ON();\r
888 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r
889 LED_B_OFF();\r
890\r
891 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
892 LEDsoff();\r
893\r
894 // restore debug level\r
895 MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r
896}\r
897\r
898//-----------------------------------------------------------------------------\r
899// MIFARE commands set debug level\r
900// \r
901//-----------------------------------------------------------------------------\r
902void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
903 MF_DBGLEVEL = arg0;\r
904 Dbprintf("Debug level: %d", MF_DBGLEVEL);\r
905}\r
906\r
907//-----------------------------------------------------------------------------\r
908// Work with emulator memory\r
909// \r
910//-----------------------------------------------------------------------------\r
911void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
912 emlClearMem();\r
913}\r
914\r
915void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
916 emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r
917}\r
918\r
919void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
920 byte_t buf[USB_CMD_DATA_SIZE];\r
921 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r
922\r
923 LED_B_ON();\r
924 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r
925 LED_B_OFF();\r
926}\r
927\r
928//-----------------------------------------------------------------------------\r
929// Load a card into the emulator memory\r
930// \r
931//-----------------------------------------------------------------------------\r
932void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
933 uint8_t numSectors = arg0;\r
934 uint8_t keyType = arg1;\r
935 uint64_t ui64Key = 0;\r
936 uint32_t cuid;\r
937 struct Crypto1State mpcs = {0, 0};\r
938 struct Crypto1State *pcs;\r
939 pcs = &mpcs;\r
940\r
941 // variables\r
942 byte_t dataoutbuf[16];\r
943 byte_t dataoutbuf2[16];\r
944 uint8_t uid[10];\r
945\r
946 // clear trace\r
947 clear_trace();\r
948 set_tracing(false);\r
949 \r
950 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
951\r
952 LED_A_ON();\r
953 LED_B_OFF();\r
954 LED_C_OFF();\r
955 \r
956 bool isOK = true;\r
957\r
958 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
959 isOK = false;\r
960 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
961 }\r
962 \r
963 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
964 ui64Key = emlGetKey(sectorNo, keyType);\r
965 if (sectorNo == 0){\r
966 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
967 isOK = false;\r
968 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r
969 break;\r
970 }\r
971 } else {\r
972 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r
973 isOK = false;\r
974 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r
975 break;\r
976 }\r
977 }\r
978 \r
979 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
980 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r
981 isOK = false;\r
982 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r
983 break;\r
984 };\r
985 if (isOK) {\r
986 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r
987 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
988 } else { // sector trailer, keep the keys, set only the AC\r
989 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
990 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r
991 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
992 }\r
993 }\r
994 }\r
995\r
996 }\r
997\r
998 if(mifare_classic_halt(pcs, cuid)) {\r
999 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1000 };\r
1001\r
1002 // ----------------------------- crypto1 destroy\r
1003 crypto1_destroy(pcs);\r
1004\r
1005 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1006 LEDsoff();\r
1007 \r
1008 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r
1009\r
1010}\r
1011\r
1012\r
1013//-----------------------------------------------------------------------------\r
1014// Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r
1015// \r
1016//-----------------------------------------------------------------------------\r
1017void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
1018 \r
1019 // params\r
1020 uint8_t needWipe = arg0;\r
1021 // bit 0 - need get UID\r
1022 // bit 1 - need wupC\r
1023 // bit 2 - need HALT after sequence\r
1024 // bit 3 - need init FPGA and field before sequence\r
1025 // bit 4 - need reset FPGA and LED\r
1026 uint8_t workFlags = arg1;\r
1027 uint8_t blockNo = arg2;\r
1028 \r
1029 // card commands\r
1030 uint8_t wupC1[] = { 0x40 }; \r
1031 uint8_t wupC2[] = { 0x43 }; \r
1032 uint8_t wipeC[] = { 0x41 }; \r
1033 \r
1034 // variables\r
1035 byte_t isOK = 0;\r
1036 uint8_t uid[10] = {0x00};\r
1037 uint8_t d_block[18] = {0x00};\r
1038 uint32_t cuid;\r
1039 \r
1040 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
1041 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
1042\r
1043 // reset FPGA and LED\r
1044 if (workFlags & 0x08) {\r
1045 LED_A_ON();\r
1046 LED_B_OFF();\r
1047 LED_C_OFF();\r
1048 \r
1049 clear_trace();\r
1050 set_tracing(TRUE);\r
1051 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
1052 }\r
1053\r
1054 while (true) {\r
1055\r
1056 // get UID from chip\r
1057 if (workFlags & 0x01) {\r
1058 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
1059 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
1060 break;\r
1061 };\r
1062\r
1063 if(mifare_classic_halt(NULL, cuid)) {\r
1064 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1065 break;\r
1066 };\r
1067 };\r
1068 \r
1069 // reset chip\r
1070 if (needWipe){\r
1071 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1072 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1073 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
1074 break;\r
1075 };\r
1076\r
1077 ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r
1078 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1079 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r
1080 break;\r
1081 };\r
1082\r
1083 if(mifare_classic_halt(NULL, cuid)) {\r
1084 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1085 break;\r
1086 };\r
1087 }; \r
1088\r
1089 // write block\r
1090 if (workFlags & 0x02) {\r
1091 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1092 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1093 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
1094 break;\r
1095 };\r
1096\r
1097 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
1098 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1099 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
1100 break;\r
1101 };\r
1102 }\r
1103\r
1104 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r
1105 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r
1106 break;\r
1107 };\r
1108 \r
1109 memcpy(d_block, datain, 16);\r
1110 AppendCrc14443a(d_block, 16);\r
1111 \r
1112 ReaderTransmit(d_block, sizeof(d_block), NULL);\r
1113 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r
1114 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r
1115 break;\r
1116 }; \r
1117 \r
1118 if (workFlags & 0x04) {\r
1119 if (mifare_classic_halt(NULL, cuid)) {\r
1120 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1121 break;\r
1122 };\r
1123 }\r
1124 \r
1125 isOK = 1;\r
1126 break;\r
1127 }\r
1128 \r
1129 LED_B_ON();\r
1130 cmd_send(CMD_ACK,isOK,0,0,uid,4);\r
1131 LED_B_OFF();\r
1132\r
1133 if ((workFlags & 0x10) || (!isOK)) {\r
1134 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1135 LEDsoff();\r
1136 }\r
1137}\r
1138\r
1139\r
1140void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
1141 \r
1142 // params\r
1143 // bit 1 - need wupC\r
1144 // bit 2 - need HALT after sequence\r
1145 // bit 3 - need init FPGA and field before sequence\r
1146 // bit 4 - need reset FPGA and LED\r
1147 uint8_t workFlags = arg0;\r
1148 uint8_t blockNo = arg2;\r
1149 \r
1150 // card commands\r
1151 uint8_t wupC1[] = { 0x40 }; \r
1152 uint8_t wupC2[] = { 0x43 }; \r
1153 \r
1154 // variables\r
1155 byte_t isOK = 0;\r
1156 uint8_t data[18] = {0x00};\r
1157 uint32_t cuid = 0;\r
1158 \r
1159 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
1160 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
1161 \r
1162 if (workFlags & 0x08) {\r
1163 LED_A_ON();\r
1164 LED_B_OFF();\r
1165 LED_C_OFF();\r
1166 \r
1167 clear_trace();\r
1168 set_tracing(TRUE);\r
1169 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
1170 }\r
1171\r
1172 while (true) {\r
1173 if (workFlags & 0x02) {\r
1174 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1175 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1176 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
1177 break;\r
1178 };\r
1179\r
1180 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
1181 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1182 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
1183 break;\r
1184 };\r
1185 }\r
1186\r
1187 // read block\r
1188 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r
1189 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r
1190 break;\r
1191 };\r
1192 memcpy(data, receivedAnswer, 18);\r
1193 \r
1194 if (workFlags & 0x04) {\r
1195 if (mifare_classic_halt(NULL, cuid)) {\r
1196 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1197 break;\r
1198 };\r
1199 }\r
1200 \r
1201 isOK = 1;\r
1202 break;\r
1203 }\r
1204 \r
1205 LED_B_ON();\r
1206 cmd_send(CMD_ACK,isOK,0,0,data,18);\r
1207 LED_B_OFF();\r
1208\r
1209 if ((workFlags & 0x10) || (!isOK)) {\r
1210 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1211 LEDsoff();\r
1212 }\r
1213}\r
1214\r
1215void MifareCIdent(){\r
1216 \r
1217 // card commands\r
1218 uint8_t wupC1[] = { 0x40 }; \r
1219 uint8_t wupC2[] = { 0x43 }; \r
1220 \r
1221 // variables\r
1222 byte_t isOK = 1;\r
1223 \r
1224 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
1225 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
1226\r
1227 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1228 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1229 isOK = 0;\r
1230 };\r
1231\r
1232 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
1233 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1234 isOK = 0;\r
1235 };\r
1236\r
1237 if (mifare_classic_halt(NULL, 0)) {\r
1238 isOK = 0;\r
1239 };\r
1240\r
1241 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
1242}\r
1243\r
1244 //\r
1245// DESFIRE\r
1246//\r
1247\r
1248void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r
1249\r
1250 byte_t dataout[11] = {0x00};\r
1251 uint8_t uid[10] = {0x00};\r
1252 uint32_t cuid;\r
1253 \r
1254 clear_trace();\r
1255 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
1256\r
1257 int len = iso14443a_select_card(uid, NULL, &cuid);\r
1258 if(!len) {\r
1259 if (MF_DBGLEVEL >= MF_DBG_ERROR) \r
1260 Dbprintf("Can't select card");\r
1261 //OnError(1);\r
1262 return;\r
1263 };\r
1264\r
1265 if(mifare_desfire_des_auth1(cuid, dataout)){\r
1266 if (MF_DBGLEVEL >= MF_DBG_ERROR) \r
1267 Dbprintf("Authentication part1: Fail.");\r
1268 //OnError(4);\r
1269 return;\r
1270 }\r
1271\r
1272 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
1273 \r
1274 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r
1275}\r
1276\r
1277void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r
1278\r
1279 uint32_t cuid = arg0;\r
1280 uint8_t key[16] = {0x00};\r
1281 byte_t isOK = 0;\r
1282 byte_t dataout[12] = {0x00};\r
1283 \r
1284 memcpy(key, datain, 16);\r
1285 \r
1286 isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r
1287 \r
1288 if( isOK) {\r
1289 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r
1290 Dbprintf("Authentication part2: Failed"); \r
1291 //OnError(4);\r
1292 return;\r
1293 }\r
1294\r
1295 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r
1296 DbpString("AUTH 2 FINISHED");\r
1297\r
1298 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r
1299 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1300 LEDsoff();\r
1301}\r
1302\r
1303void OnSuccess(){\r
1304 pcb_blocknum = 0;\r
1305 ReaderTransmit(deselect_cmd, 3 , NULL);\r
1306 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1307 LEDsoff();\r
1308}\r
1309\r
1310void OnError(uint8_t reason){\r
1311 pcb_blocknum = 0;\r
1312 ReaderTransmit(deselect_cmd, 3 , NULL);\r
1313 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1314 cmd_send(CMD_ACK,0,reason,0,0,0);\r
1315 LEDsoff();\r
1316}\r
Proxmark3 GIT tracking
Impressum, Datenschutz