]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/mifarecmd.c
projects / proxmark3-svn / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
ADD: Jonor's timeout patch for "Hf 14a raw".
[proxmark3-svn] / armsrc / mifarecmd.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------\r
2// Merlok - June 2011, 2012\r
3// Gerhard de Koning Gans - May 2008\r
4// Hagen Fritsch - June 2010\r
5// Midnitesnake - Dec 2013\r
6// Andy Davies - Apr 2014\r
7// Iceman - May 2014\r
8//\r
9// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
10// at your option, any later version. See the LICENSE.txt file for the text of\r
11// the license.\r
12//-----------------------------------------------------------------------------\r
13// Routines to support ISO 14443 type A.\r
14//-----------------------------------------------------------------------------\r
15\r
16#include "mifarecmd.h"\r
17#include "apps.h"\r
18\r
19//-----------------------------------------------------------------------------\r
20// Select, Authenticate, Read a MIFARE tag. \r
21// read block\r
22//-----------------------------------------------------------------------------\r
23void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
24{\r
25 // params\r
26 uint8_t blockNo = arg0;\r
27 uint8_t keyType = arg1;\r
28 uint64_t ui64Key = 0;\r
29 ui64Key = bytes_to_num(datain, 6);\r
30 \r
31 // variables\r
32 byte_t isOK = 0;\r
33 byte_t dataoutbuf[16];\r
34 uint8_t uid[10];\r
35 uint32_t cuid;\r
36 struct Crypto1State mpcs = {0, 0};\r
37 struct Crypto1State *pcs;\r
38 pcs = &mpcs;\r
39\r
40 // clear trace\r
41 iso14a_clear_trace();\r
42 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
43\r
44 LED_A_ON();\r
45 LED_B_OFF();\r
46 LED_C_OFF();\r
47\r
48 while (true) {\r
49 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
50 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
51 break;\r
52 };\r
53\r
54 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
55 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
56 break;\r
57 };\r
58 \r
59 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r
60 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r
61 break;\r
62 };\r
63\r
64 if(mifare_classic_halt(pcs, cuid)) {\r
65 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
66 break;\r
67 };\r
68 \r
69 isOK = 1;\r
70 break;\r
71 }\r
72 \r
73 // ----------------------------- crypto1 destroy\r
74 crypto1_destroy(pcs);\r
75 \r
76 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r
77\r
78 LED_B_ON();\r
79 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r
80 LED_B_OFF();\r
81\r
82 // Thats it...\r
83 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
84 LEDsoff();\r
85}\r
86\r
87void MifareUReadBlock(uint8_t arg0,uint8_t *datain)\r
88{\r
89 // params\r
90 uint8_t blockNo = arg0;\r
91 \r
92 // variables\r
93 byte_t isOK = 0;\r
94 byte_t dataoutbuf[16];\r
95 uint8_t uid[10];\r
96 uint32_t cuid;\r
97 \r
98 // clear trace\r
99 iso14a_clear_trace();\r
100 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
101 \r
102 LED_A_ON();\r
103 LED_B_OFF();\r
104 LED_C_OFF();\r
105 \r
106 while (true) {\r
107 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
108 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
109 break;\r
110 };\r
111 \r
112 if(mifare_ultra_readblock(cuid, blockNo, dataoutbuf)) {\r
113 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r
114 break;\r
115 };\r
116 \r
117 if(mifare_ultra_halt(cuid)) {\r
118 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
119 break;\r
120 };\r
121 \r
122 isOK = 1;\r
123 break;\r
124 }\r
125 \r
126 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r
127 \r
128 LED_B_ON();\r
129 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r
130 LED_B_OFF();\r
131 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
132 LEDsoff();\r
133}\r
134\r
135//-----------------------------------------------------------------------------\r
136// Select, Authenticate, Read a MIFARE tag. \r
137// read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r
138//-----------------------------------------------------------------------------\r
139void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
140{\r
141 // params\r
142 uint8_t sectorNo = arg0;\r
143 uint8_t keyType = arg1;\r
144 uint64_t ui64Key = 0;\r
145 ui64Key = bytes_to_num(datain, 6);\r
146 \r
147 // variables\r
148 byte_t isOK = 0;\r
149 byte_t dataoutbuf[16 * 16];\r
150 uint8_t uid[10];\r
151 uint32_t cuid;\r
152 struct Crypto1State mpcs = {0, 0};\r
153 struct Crypto1State *pcs;\r
154 pcs = &mpcs;\r
155\r
156 // clear trace\r
157 iso14a_clear_trace();\r
158\r
159 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
160\r
161 LED_A_ON();\r
162 LED_B_OFF();\r
163 LED_C_OFF();\r
164\r
165 isOK = 1;\r
166 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
167 isOK = 0;\r
168 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
169 }\r
170\r
171 \r
172 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
173 isOK = 0;\r
174 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
175 }\r
176 \r
177 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
178 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r
179 isOK = 0;\r
180 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r
181 break;\r
182 }\r
183 }\r
184 \r
185 if(mifare_classic_halt(pcs, cuid)) {\r
186 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
187 }\r
188\r
189 // ----------------------------- crypto1 destroy\r
190 crypto1_destroy(pcs);\r
191 \r
192 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r
193\r
194 LED_B_ON();\r
195 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r
196 LED_B_OFF();\r
197\r
198 // Thats it...\r
199 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
200 LEDsoff();\r
201}\r
202\r
203\r
204void MifareUReadCard(uint8_t arg0, uint8_t *datain)\r
205{\r
206 // params\r
207 uint8_t sectorNo = arg0;\r
208 \r
209 // variables\r
210 byte_t isOK = 0;\r
211 byte_t dataoutbuf[16 * 4];\r
212 uint8_t uid[10];\r
213 uint32_t cuid;\r
214\r
215 // clear trace\r
216 iso14a_clear_trace();\r
217\r
218 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
219\r
220 LED_A_ON();\r
221 LED_B_OFF();\r
222 LED_C_OFF();\r
223\r
224 while (true) {\r
225 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
226 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
227 break;\r
228 };\r
229 for(int sec=0;sec<16;sec++){\r
230 if(mifare_ultra_readblock(cuid, sectorNo * 4 + sec, dataoutbuf + 4 * sec)) {\r
231 if (MF_DBGLEVEL >= 1) Dbprintf("Read block %d error",sec);\r
232 break;\r
233 };\r
234 }\r
235 if(mifare_ultra_halt(cuid)) {\r
236 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
237 break;\r
238 };\r
239\r
240 isOK = 1;\r
241 break;\r
242 }\r
243 \r
244 if (MF_DBGLEVEL >= 2) DbpString("READ CARD FINISHED");\r
245\r
246 LED_B_ON();\r
247 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);\r
248 LED_B_OFF();\r
249\r
250 // Thats it...\r
251 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
252 LEDsoff();\r
253\r
254}\r
255\r
256\r
257//-----------------------------------------------------------------------------\r
258// Select, Authenticate, Write a MIFARE tag. \r
259// read block\r
260//-----------------------------------------------------------------------------\r
261void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
262{\r
263 // params\r
264 uint8_t blockNo = arg0;\r
265 uint8_t keyType = arg1;\r
266 uint64_t ui64Key = 0;\r
267 byte_t blockdata[16];\r
268\r
269 ui64Key = bytes_to_num(datain, 6);\r
270 memcpy(blockdata, datain + 10, 16);\r
271 \r
272 // variables\r
273 byte_t isOK = 0;\r
274 uint8_t uid[10];\r
275 uint32_t cuid;\r
276 struct Crypto1State mpcs = {0, 0};\r
277 struct Crypto1State *pcs;\r
278 pcs = &mpcs;\r
279\r
280 // clear trace\r
281 iso14a_clear_trace();\r
282\r
283 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
284\r
285 LED_A_ON();\r
286 LED_B_OFF();\r
287 LED_C_OFF();\r
288\r
289 while (true) {\r
290 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
291 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
292 break;\r
293 };\r
294\r
295 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
296 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
297 break;\r
298 };\r
299 \r
300 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r
301 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
302 break;\r
303 };\r
304\r
305 if(mifare_classic_halt(pcs, cuid)) {\r
306 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
307 break;\r
308 };\r
309 \r
310 isOK = 1;\r
311 break;\r
312 }\r
313 \r
314 // ----------------------------- crypto1 destroy\r
315 crypto1_destroy(pcs);\r
316 \r
317 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
318\r
319 LED_B_ON();\r
320 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
321 LED_B_OFF();\r
322\r
323\r
324 // Thats it...\r
325 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
326 LEDsoff();\r
327}\r
328\r
329void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)\r
330{\r
331 // params\r
332 uint8_t blockNo = arg0;\r
333 byte_t blockdata[16];\r
334\r
335 memset(blockdata,'\0',16);\r
336 memcpy(blockdata, datain,16);\r
337 \r
338 // variables\r
339 byte_t isOK = 0;\r
340 uint8_t uid[10];\r
341 uint32_t cuid;\r
342\r
343 // clear trace\r
344 iso14a_clear_trace();\r
345\r
346 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
347\r
348 LED_A_ON();\r
349 LED_B_OFF();\r
350 LED_C_OFF();\r
351\r
352 while (true) {\r
353 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
354 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
355 break;\r
356 };\r
357\r
358 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {\r
359 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
360 break;\r
361 };\r
362\r
363 if(mifare_ultra_halt(cuid)) {\r
364 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
365 break;\r
366 };\r
367 \r
368 isOK = 1;\r
369 break;\r
370 }\r
371 \r
372 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
373\r
374 LED_B_ON();\r
375 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
376 LED_B_OFF();\r
377\r
378\r
379 // Thats it...\r
380 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
381 LEDsoff();\r
382// iso14a_set_tracing(TRUE);\r
383}\r
384\r
385void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)\r
386{\r
387 // params\r
388 uint8_t blockNo = arg0;\r
389 byte_t blockdata[4];\r
390 \r
391 memcpy(blockdata, datain,4);\r
392\r
393 // variables\r
394 byte_t isOK = 0;\r
395 uint8_t uid[10];\r
396 uint32_t cuid;\r
397\r
398 // clear trace\r
399 iso14a_clear_trace();\r
400\r
401 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
402\r
403 LED_A_ON();\r
404 LED_B_OFF();\r
405 LED_C_OFF();\r
406\r
407 while (true) {\r
408 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
409 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
410 break;\r
411 };\r
412\r
413 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {\r
414 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
415 break;\r
416 };\r
417\r
418 if(mifare_ultra_halt(cuid)) {\r
419 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
420 break;\r
421 };\r
422\r
423 isOK = 1;\r
424 break;\r
425 }\r
426\r
427 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
428\r
429 LED_B_ON();\r
430 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
431 LED_B_OFF();\r
432\r
433 // Thats it...\r
434 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
435 LEDsoff();\r
436}\r
437\r
438// Return 1 if the nonce is invalid else return 0\r
439int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r
440 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r
441 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r
442 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r
443}\r
444\r
445\r
446//-----------------------------------------------------------------------------\r
447// MIFARE nested authentication. \r
448// \r
449//-----------------------------------------------------------------------------\r
450void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r
451{\r
452 // params\r
453 uint8_t blockNo = arg0 & 0xff;\r
454 uint8_t keyType = (arg0 >> 8) & 0xff;\r
455 uint8_t targetBlockNo = arg1 & 0xff;\r
456 uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
457 uint64_t ui64Key = 0;\r
458\r
459 ui64Key = bytes_to_num(datain, 6);\r
460 \r
461 // variables\r
462 uint16_t rtr, i, j, len;\r
463 uint16_t davg;\r
464 static uint16_t dmin, dmax;\r
465 uint8_t uid[10];\r
466 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r
467 uint8_t par[1];\r
468 uint32_t target_nt[2], target_ks[2];\r
469 \r
470 uint8_t par_array[4];\r
471 uint16_t ncount = 0;\r
472 struct Crypto1State mpcs = {0, 0};\r
473 struct Crypto1State *pcs;\r
474 pcs = &mpcs;\r
475 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r
476\r
477 uint32_t auth1_time, auth2_time;\r
478 static uint16_t delta_time;\r
479\r
480 // clear trace\r
481 iso14a_clear_trace();\r
482 iso14a_set_tracing(false);\r
483 \r
484 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
485\r
486 LED_A_ON();\r
487 LED_C_OFF();\r
488\r
489\r
490 // statistics on nonce distance\r
491 if (calibrate) { // for first call only. Otherwise reuse previous calibration\r
492 LED_B_ON();\r
493 WDT_HIT();\r
494\r
495 davg = dmax = 0;\r
496 dmin = 2000;\r
497 delta_time = 0;\r
498 \r
499 for (rtr = 0; rtr < 17; rtr++) {\r
500\r
501 // prepare next select. No need to power down the card.\r
502 if(mifare_classic_halt(pcs, cuid)) {\r
503 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
504 rtr--;\r
505 continue;\r
506 }\r
507\r
508 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
509 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
510 rtr--;\r
511 continue;\r
512 };\r
513\r
514 auth1_time = 0;\r
515 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
516 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
517 rtr--;\r
518 continue;\r
519 };\r
520\r
521 if (delta_time) {\r
522 auth2_time = auth1_time + delta_time;\r
523 } else {\r
524 auth2_time = 0;\r
525 }\r
526 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r
527 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
528 rtr--;\r
529 continue;\r
530 };\r
531\r
532 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r
533 for (i = 101; i < 1200; i++) {\r
534 nttmp = prng_successor(nttmp, 1);\r
535 if (nttmp == nt2) break;\r
536 }\r
537\r
538 if (i != 1200) {\r
539 if (rtr != 0) {\r
540 davg += i;\r
541 dmin = MIN(dmin, i);\r
542 dmax = MAX(dmax, i);\r
543 }\r
544 else {\r
545 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r
546 }\r
547 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r
548 }\r
549 }\r
550 \r
551 if (rtr <= 1) return;\r
552\r
553 davg = (davg + (rtr - 1)/2) / (rtr - 1);\r
554 \r
555 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);\r
556\r
557 dmin = davg - 2;\r
558 dmax = davg + 2;\r
559 \r
560 LED_B_OFF();\r
561 \r
562 }\r
563// ------------------------------------------------------------------------------------------------- \r
564 \r
565 LED_C_ON();\r
566\r
567 // get crypted nonces for target sector\r
568 for(i=0; i < 2; i++) { // look for exactly two different nonces\r
569\r
570 target_nt[i] = 0;\r
571 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r
572 \r
573 // prepare next select. No need to power down the card.\r
574 if(mifare_classic_halt(pcs, cuid)) {\r
575 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
576 continue;\r
577 }\r
578\r
579 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
580 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
581 continue;\r
582 };\r
583 \r
584 auth1_time = 0;\r
585 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
586 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
587 continue;\r
588 };\r
589\r
590 // nested authentication\r
591 auth2_time = auth1_time + delta_time;\r
592 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r
593 if (len != 4) {\r
594 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r
595 continue;\r
596 };\r
597 \r
598 nt2 = bytes_to_num(receivedAnswer, 4); \r
599 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r
600 \r
601 // Parity validity check\r
602 for (j = 0; j < 4; j++) {\r
603 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r
604 }\r
605 \r
606 ncount = 0;\r
607 nttest = prng_successor(nt1, dmin - 1);\r
608 for (j = dmin; j < dmax + 1; j++) {\r
609 nttest = prng_successor(nttest, 1);\r
610 ks1 = nt2 ^ nttest;\r
611\r
612 if (valid_nonce(nttest, nt2, ks1, par_array)){\r
613 if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r
614 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r
615 target_nt[i] = 0;\r
616 break;\r
617 }\r
618 target_nt[i] = nttest;\r
619 target_ks[i] = ks1;\r
620 ncount++;\r
621 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r
622 target_nt[i] = 0;\r
623 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r
624 break;\r
625 }\r
626 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r
627 }\r
628 }\r
629 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r
630 }\r
631 }\r
632\r
633 LED_C_OFF();\r
634 \r
635 // ----------------------------- crypto1 destroy\r
636 crypto1_destroy(pcs);\r
637 \r
638 byte_t buf[4 + 4 * 4];\r
639 memcpy(buf, &cuid, 4);\r
640 memcpy(buf+4, &target_nt[0], 4);\r
641 memcpy(buf+8, &target_ks[0], 4);\r
642 memcpy(buf+12, &target_nt[1], 4);\r
643 memcpy(buf+16, &target_ks[1], 4);\r
644 \r
645 LED_B_ON();\r
646 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
647 LED_B_OFF();\r
648\r
649 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r
650\r
651 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
652 LEDsoff();\r
653 iso14a_set_tracing(TRUE);\r
654}\r
655\r
656//-----------------------------------------------------------------------------\r
657// MIFARE check keys. key count up to 85. \r
658// \r
659//-----------------------------------------------------------------------------\r
660void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
661{\r
662 // params\r
663 uint8_t blockNo = arg0;\r
664 uint8_t keyType = arg1;\r
665 uint8_t keyCount = arg2;\r
666 uint64_t ui64Key = 0;\r
667 \r
668 // variables\r
669 int i;\r
670 byte_t isOK = 0;\r
671 uint8_t uid[10];\r
672 uint32_t cuid;\r
673 struct Crypto1State mpcs = {0, 0};\r
674 struct Crypto1State *pcs;\r
675 pcs = &mpcs;\r
676 \r
677 // clear debug level\r
678 int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r
679 MF_DBGLEVEL = MF_DBG_NONE;\r
680 \r
681 // clear trace\r
682 iso14a_clear_trace();\r
683 iso14a_set_tracing(TRUE);\r
684\r
685 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
686\r
687 LED_A_ON();\r
688 LED_B_OFF();\r
689 LED_C_OFF();\r
690\r
691 for (i = 0; i < keyCount; i++) {\r
692 if(mifare_classic_halt(pcs, cuid)) {\r
693 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r
694 }\r
695\r
696 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
697 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r
698 break;\r
699 };\r
700\r
701 ui64Key = bytes_to_num(datain + i * 6, 6);\r
702 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
703 continue;\r
704 };\r
705 \r
706 isOK = 1;\r
707 break;\r
708 }\r
709 \r
710 // ----------------------------- crypto1 destroy\r
711 crypto1_destroy(pcs);\r
712 \r
713 LED_B_ON();\r
714 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r
715 LED_B_OFF();\r
716\r
717 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
718 LEDsoff();\r
719\r
720 // restore debug level\r
721 MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r
722}\r
723\r
724//-----------------------------------------------------------------------------\r
725// MIFARE commands set debug level\r
726// \r
727//-----------------------------------------------------------------------------\r
728void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
729 MF_DBGLEVEL = arg0;\r
730 Dbprintf("Debug level: %d", MF_DBGLEVEL);\r
731}\r
732\r
733//-----------------------------------------------------------------------------\r
734// Work with emulator memory\r
735// \r
736//-----------------------------------------------------------------------------\r
737void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
738 emlClearMem();\r
739}\r
740\r
741void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
742 emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r
743}\r
744\r
745void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
746 byte_t buf[USB_CMD_DATA_SIZE];\r
747 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r
748\r
749 LED_B_ON();\r
750 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r
751 LED_B_OFF();\r
752}\r
753\r
754//-----------------------------------------------------------------------------\r
755// Load a card into the emulator memory\r
756// \r
757//-----------------------------------------------------------------------------\r
758void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
759 uint8_t numSectors = arg0;\r
760 uint8_t keyType = arg1;\r
761 uint64_t ui64Key = 0;\r
762 uint32_t cuid;\r
763 struct Crypto1State mpcs = {0, 0};\r
764 struct Crypto1State *pcs;\r
765 pcs = &mpcs;\r
766\r
767 // variables\r
768 byte_t dataoutbuf[16];\r
769 byte_t dataoutbuf2[16];\r
770 uint8_t uid[10];\r
771\r
772 // clear trace\r
773 iso14a_clear_trace();\r
774 iso14a_set_tracing(false);\r
775 \r
776 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
777\r
778 LED_A_ON();\r
779 LED_B_OFF();\r
780 LED_C_OFF();\r
781 \r
782 bool isOK = true;\r
783\r
784 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
785 isOK = false;\r
786 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
787 }\r
788 \r
789 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
790 ui64Key = emlGetKey(sectorNo, keyType);\r
791 if (sectorNo == 0){\r
792 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
793 isOK = false;\r
794 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r
795 break;\r
796 }\r
797 } else {\r
798 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r
799 isOK = false;\r
800 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r
801 break;\r
802 }\r
803 }\r
804 \r
805 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
806 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r
807 isOK = false;\r
808 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r
809 break;\r
810 };\r
811 if (isOK) {\r
812 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r
813 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
814 } else { // sector trailer, keep the keys, set only the AC\r
815 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
816 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r
817 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
818 }\r
819 }\r
820 }\r
821\r
822 }\r
823\r
824 if(mifare_classic_halt(pcs, cuid)) {\r
825 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
826 };\r
827\r
828 // ----------------------------- crypto1 destroy\r
829 crypto1_destroy(pcs);\r
830\r
831 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
832 LEDsoff();\r
833 \r
834 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r
835\r
836}\r
837\r
838\r
839//-----------------------------------------------------------------------------\r
840// Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r
841// \r
842//-----------------------------------------------------------------------------\r
843void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
844 \r
845 // params\r
846 uint8_t needWipe = arg0;\r
847 // bit 0 - need get UID\r
848 // bit 1 - need wupC\r
849 // bit 2 - need HALT after sequence\r
850 // bit 3 - need init FPGA and field before sequence\r
851 // bit 4 - need reset FPGA and LED\r
852 uint8_t workFlags = arg1;\r
853 uint8_t blockNo = arg2;\r
854 \r
855 // card commands\r
856 uint8_t wupC1[] = { 0x40 }; \r
857 uint8_t wupC2[] = { 0x43 }; \r
858 uint8_t wipeC[] = { 0x41 }; \r
859 \r
860 // variables\r
861 byte_t isOK = 0;\r
862 uint8_t uid[10] = {0x00};\r
863 uint8_t d_block[18] = {0x00};\r
864 uint32_t cuid;\r
865 \r
866 uint8_t *receivedAnswer = get_bigbufptr_recvrespbuf();\r
867 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r
868\r
869 // reset FPGA and LED\r
870 if (workFlags & 0x08) {\r
871 LED_A_ON();\r
872 LED_B_OFF();\r
873 LED_C_OFF();\r
874 \r
875 iso14a_clear_trace();\r
876 iso14a_set_tracing(TRUE);\r
877 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
878 }\r
879\r
880 while (true) {\r
881\r
882 // get UID from chip\r
883 if (workFlags & 0x01) {\r
884 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
885 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
886 break;\r
887 };\r
888\r
889 if(mifare_classic_halt(NULL, cuid)) {\r
890 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
891 break;\r
892 };\r
893 };\r
894 \r
895 // reset chip\r
896 if (needWipe){\r
897 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
898 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
899 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
900 break;\r
901 };\r
902\r
903 ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r
904 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
905 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r
906 break;\r
907 };\r
908\r
909 if(mifare_classic_halt(NULL, cuid)) {\r
910 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
911 break;\r
912 };\r
913 }; \r
914\r
915 // write block\r
916 if (workFlags & 0x02) {\r
917 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
918 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
919 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
920 break;\r
921 };\r
922\r
923 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
924 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
925 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
926 break;\r
927 };\r
928 }\r
929\r
930 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r
931 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r
932 break;\r
933 };\r
934 \r
935 memcpy(d_block, datain, 16);\r
936 AppendCrc14443a(d_block, 16);\r
937 \r
938 ReaderTransmit(d_block, sizeof(d_block), NULL);\r
939 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r
940 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r
941 break;\r
942 }; \r
943 \r
944 if (workFlags & 0x04) {\r
945 if (mifare_classic_halt(NULL, cuid)) {\r
946 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
947 break;\r
948 };\r
949 }\r
950 \r
951 isOK = 1;\r
952 break;\r
953 }\r
954 \r
955 LED_B_ON();\r
956 cmd_send(CMD_ACK,isOK,0,0,uid,4);\r
957 LED_B_OFF();\r
958\r
959 if ((workFlags & 0x10) || (!isOK)) {\r
960 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
961 LEDsoff();\r
962 }\r
963}\r
964\r
965\r
966void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
967 \r
968 // params\r
969 // bit 1 - need wupC\r
970 // bit 2 - need HALT after sequence\r
971 // bit 3 - need init FPGA and field before sequence\r
972 // bit 4 - need reset FPGA and LED\r
973 uint8_t workFlags = arg0;\r
974 uint8_t blockNo = arg2;\r
975 \r
976 // card commands\r
977 uint8_t wupC1[] = { 0x40 }; \r
978 uint8_t wupC2[] = { 0x43 }; \r
979 \r
980 // variables\r
981 byte_t isOK = 0;\r
982 uint8_t data[18] = {0x00};\r
983 uint32_t cuid = 0;\r
984 \r
985 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r
986 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r
987 \r
988 if (workFlags & 0x08) {\r
989 LED_A_ON();\r
990 LED_B_OFF();\r
991 LED_C_OFF();\r
992 \r
993 iso14a_clear_trace();\r
994 iso14a_set_tracing(TRUE);\r
995 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
996 }\r
997\r
998 while (true) {\r
999 if (workFlags & 0x02) {\r
1000 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1001 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1002 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
1003 break;\r
1004 };\r
1005\r
1006 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
1007 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1008 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
1009 break;\r
1010 };\r
1011 }\r
1012\r
1013 // read block\r
1014 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r
1015 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r
1016 break;\r
1017 };\r
1018 memcpy(data, receivedAnswer, 18);\r
1019 \r
1020 if (workFlags & 0x04) {\r
1021 if (mifare_classic_halt(NULL, cuid)) {\r
1022 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1023 break;\r
1024 };\r
1025 }\r
1026 \r
1027 isOK = 1;\r
1028 break;\r
1029 }\r
1030 \r
1031 LED_B_ON();\r
1032 cmd_send(CMD_ACK,isOK,0,0,data,18);\r
1033 LED_B_OFF();\r
1034\r
1035 if ((workFlags & 0x10) || (!isOK)) {\r
1036 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1037 LEDsoff();\r
1038 }\r
1039}\r
1040\r
1041void MifareCIdent(){\r
1042 \r
1043 // card commands\r
1044 uint8_t wupC1[] = { 0x40 }; \r
1045 uint8_t wupC2[] = { 0x43 }; \r
1046 \r
1047 // variables\r
1048 byte_t isOK = 1;\r
1049 \r
1050 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r
1051 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r
1052\r
1053 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1054 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1055 isOK = 0;\r
1056 };\r
1057\r
1058 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
1059 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1060 isOK = 0;\r
1061 };\r
1062\r
1063 if (mifare_classic_halt(NULL, 0)) {\r
1064 isOK = 0;\r
1065 };\r
1066\r
1067 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
1068}\r
1069\r
1070 //\r
1071// DESFIRE\r
1072//\r
Proxmark3 GIT tracking
Impressum, Datenschutz