1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
16 #include "mifarecmd.h"
22 //-----------------------------------------------------------------------------
23 // Select, Authenticate, Read a MIFARE tag.
25 //-----------------------------------------------------------------------------
26 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
29 uint8_t blockNo
= arg0
;
30 uint8_t keyType
= arg1
;
32 ui64Key
= bytes_to_num(datain
, 6);
36 byte_t dataoutbuf
[16];
39 struct Crypto1State mpcs
= {0, 0};
40 struct Crypto1State
*pcs
;
45 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
52 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
53 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
57 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
58 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
62 if(mifare_classic_readblock(pcs
, cuid
, blockNo
, dataoutbuf
)) {
63 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block error");
67 if(mifare_classic_halt(pcs
, cuid
)) {
68 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
76 // ----------------------------- crypto1 destroy
79 if (MF_DBGLEVEL
>= 2) DbpString("READ BLOCK FINISHED");
82 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16);
85 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
90 void MifareUC_Auth(uint8_t arg0
, uint8_t *keybytes
){
92 bool turnOffField
= (arg0
== 1);
94 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
96 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
98 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
99 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card");
104 if(mifare_ultra_auth(keybytes
) == 1){
105 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Authentication failed");
110 cmd_send(CMD_ACK
,1,0,0,0,0);
113 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
119 // Arg1 = UsePwd bool
120 // datain = PWD bytes,
121 void MifareUReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
)
123 uint8_t blockNo
= arg0
;
124 byte_t dataout
[16] = {0x00};
125 bool useKey
= (arg1
== 1); //UL_C
126 bool usePwd
= (arg1
== 2); //UL_EV1/NTAG
131 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
133 int len
= iso14443a_select_card(NULL
, NULL
, NULL
);
135 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card (RC:%02X)",len
);
140 // UL-C authentication
142 uint8_t key
[16] = {0x00};
143 memcpy(key
, datain
, sizeof(key
) );
145 if ( mifare_ultra_auth(key
) == 1 ) {
151 // UL-EV1 / NTAG authentication
153 uint8_t pwd
[4] = {0x00};
154 memcpy(pwd
, datain
, 4);
155 uint8_t pack
[4] = {0,0,0,0};
157 if (mifare_ul_ev1_auth(pwd
, pack
) == 1){
163 if( mifare_ultra_readblock(blockNo
, dataout
) ) {
164 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Read block error");
169 if( mifare_ultra_halt() ) {
170 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Halt error");
175 cmd_send(CMD_ACK
,1,0,0,dataout
,16);
176 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
179 //-----------------------------------------------------------------------------
180 // Select, Authenticate, Read a MIFARE tag.
181 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
182 //-----------------------------------------------------------------------------
183 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
186 uint8_t sectorNo
= arg0
;
187 uint8_t keyType
= arg1
;
188 uint64_t ui64Key
= 0;
189 ui64Key
= bytes_to_num(datain
, 6);
193 byte_t dataoutbuf
[16 * 16];
196 struct Crypto1State mpcs
= {0, 0};
197 struct Crypto1State
*pcs
;
203 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
210 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
212 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
215 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
217 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
220 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
221 if(mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
+ 16 * blockNo
)) {
223 if (MF_DBGLEVEL
>= 1) Dbprintf("Read sector %2d block %2d error", sectorNo
, blockNo
);
228 if(mifare_classic_halt(pcs
, cuid
)) {
229 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
232 // ----------------------------- crypto1 destroy
233 crypto1_destroy(pcs
);
235 if (MF_DBGLEVEL
>= 2) DbpString("READ SECTOR FINISHED");
238 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16*NumBlocksPerSector(sectorNo
));
242 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
246 // arg0 = blockNo (start)
247 // arg1 = Pages (number of blocks)
249 // datain = KEY bytes
250 void MifareUReadCard(uint8_t arg0
, uint16_t arg1
, uint8_t arg2
, uint8_t *datain
)
253 uint8_t blockNo
= arg0
;
254 uint16_t blocks
= arg1
;
255 bool useKey
= (arg2
== 1); //UL_C
256 bool usePwd
= (arg2
== 2); //UL_EV1/NTAG
258 uint8_t dataout
[176] = {0x00};
263 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
265 int len
= iso14443a_select_card(NULL
, NULL
, NULL
);
267 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card (RC:%d)",len
);
272 // UL-C authentication
274 uint8_t key
[16] = {0x00};
275 memcpy(key
, datain
, sizeof(key
) );
277 if ( mifare_ultra_auth(key
) == 1 ) {
283 // UL-EV1 / NTAG authentication
285 uint8_t pwd
[4] = {0x00};
286 memcpy(pwd
, datain
, sizeof(pwd
));
287 uint8_t pack
[4] = {0,0,0,0};
289 if (mifare_ul_ev1_auth(pwd
, pack
) == 1){
295 for (int i
= 0; i
< blocks
; i
++){
296 len
= mifare_ultra_readblock(blockNo
* 4 + i
, dataout
+ 4 * i
);
299 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Read block %d error",i
);
307 len
= mifare_ultra_halt();
309 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Halt error");
314 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) Dbprintf("Blocks read %d", countblocks
);
318 cmd_send(CMD_ACK
, 1, len
, 0, dataout
, len
);
319 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
323 //-----------------------------------------------------------------------------
324 // Select, Authenticate, Write a MIFARE tag.
326 //-----------------------------------------------------------------------------
327 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
330 uint8_t blockNo
= arg0
;
331 uint8_t keyType
= arg1
;
332 uint64_t ui64Key
= 0;
333 byte_t blockdata
[16];
335 ui64Key
= bytes_to_num(datain
, 6);
336 memcpy(blockdata
, datain
+ 10, 16);
342 struct Crypto1State mpcs
= {0, 0};
343 struct Crypto1State
*pcs
;
349 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
356 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
357 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
361 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
362 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
366 if(mifare_classic_writeblock(pcs
, cuid
, blockNo
, blockdata
)) {
367 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
371 if(mifare_classic_halt(pcs
, cuid
)) {
372 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
380 // ----------------------------- crypto1 destroy
381 crypto1_destroy(pcs
);
383 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
386 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
391 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
396 void MifareUWriteBlock(uint8_t arg0
, uint8_t *datain
)
398 uint8_t blockNo
= arg0
;
399 byte_t blockdata
[16] = {0x00};
401 memcpy(blockdata
, datain
, 16);
403 uint8_t uid
[10] = {0x00};
405 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
408 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
410 if(!iso14443a_select_card(uid
, NULL
, NULL
)) {
411 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
416 if(mifare_ultra_writeblock(blockNo
, blockdata
)) {
417 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
421 if(mifare_ultra_halt()) {
422 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
427 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
429 cmd_send(CMD_ACK
,1,0,0,0,0);
430 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
434 void MifareUWriteBlock_Special(uint8_t arg0
, uint8_t *datain
)
436 uint8_t blockNo
= arg0
;
437 byte_t blockdata
[4] = {0x00};
438 uint8_t uid
[10] = {0x00};
440 memcpy(blockdata
, datain
,4);
445 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
447 if(!iso14443a_select_card(uid
, NULL
, NULL
)) {
448 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
453 if(mifare_ultra_special_writeblock(blockNo
, blockdata
)) {
454 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
459 if(mifare_ultra_halt()) {
460 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
465 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
467 cmd_send(CMD_ACK
,1,0,0,0,0);
468 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
472 void MifareUSetPwd(uint8_t arg0
, uint8_t *datain
){
474 uint8_t pwd
[16] = {0x00};
475 byte_t blockdata
[4] = {0x00};
477 memcpy(pwd
, datain
, 16);
479 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
481 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
483 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
484 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
489 blockdata
[0] = pwd
[7];
490 blockdata
[1] = pwd
[6];
491 blockdata
[2] = pwd
[5];
492 blockdata
[3] = pwd
[4];
493 if(mifare_ultra_special_writeblock( 44, blockdata
)) {
494 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
499 blockdata
[0] = pwd
[3];
500 blockdata
[1] = pwd
[2];
501 blockdata
[2] = pwd
[1];
502 blockdata
[3] = pwd
[0];
503 if(mifare_ultra_special_writeblock( 45, blockdata
)) {
504 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
509 blockdata
[0] = pwd
[15];
510 blockdata
[1] = pwd
[14];
511 blockdata
[2] = pwd
[13];
512 blockdata
[3] = pwd
[12];
513 if(mifare_ultra_special_writeblock( 46, blockdata
)) {
514 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
519 blockdata
[0] = pwd
[11];
520 blockdata
[1] = pwd
[10];
521 blockdata
[2] = pwd
[9];
522 blockdata
[3] = pwd
[8];
523 if(mifare_ultra_special_writeblock( 47, blockdata
)) {
524 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
529 if(mifare_ultra_halt()) {
530 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
535 cmd_send(CMD_ACK
,1,0,0,0,0);
536 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
540 // Return 1 if the nonce is invalid else return 0
541 int valid_nonce(uint32_t Nt
, uint32_t NtEnc
, uint32_t Ks1
, uint8_t *parity
) {
542 return ((oddparity((Nt
>> 24) & 0xFF) == ((parity
[0]) ^ oddparity((NtEnc
>> 24) & 0xFF) ^ BIT(Ks1
,16))) & \
543 (oddparity((Nt
>> 16) & 0xFF) == ((parity
[1]) ^ oddparity((NtEnc
>> 16) & 0xFF) ^ BIT(Ks1
,8))) & \
544 (oddparity((Nt
>> 8) & 0xFF) == ((parity
[2]) ^ oddparity((NtEnc
>> 8) & 0xFF) ^ BIT(Ks1
,0)))) ? 1 : 0;
548 //-----------------------------------------------------------------------------
549 // MIFARE nested authentication.
551 //-----------------------------------------------------------------------------
552 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t calibrate
, uint8_t *datain
)
555 uint8_t blockNo
= arg0
& 0xff;
556 uint8_t keyType
= (arg0
>> 8) & 0xff;
557 uint8_t targetBlockNo
= arg1
& 0xff;
558 uint8_t targetKeyType
= (arg1
>> 8) & 0xff;
559 uint64_t ui64Key
= 0;
561 ui64Key
= bytes_to_num(datain
, 6);
564 uint16_t rtr
, i
, j
, len
;
566 static uint16_t dmin
, dmax
;
568 uint32_t cuid
, nt1
, nt2
, nttmp
, nttest
, ks1
;
570 uint32_t target_nt
[2], target_ks
[2];
572 uint8_t par_array
[4];
574 struct Crypto1State mpcs
= {0, 0};
575 struct Crypto1State
*pcs
;
577 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
579 uint32_t auth1_time
, auth2_time
;
580 static uint16_t delta_time
;
582 // free eventually allocated BigBuf memory
588 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
594 // statistics on nonce distance
595 if (calibrate
) { // for first call only. Otherwise reuse previous calibration
603 for (rtr
= 0; rtr
< 17; rtr
++) {
605 // prepare next select. No need to power down the card.
606 if(mifare_classic_halt(pcs
, cuid
)) {
607 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
612 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
613 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
619 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
620 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
626 auth2_time
= auth1_time
+ delta_time
;
630 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_NESTED
, &nt2
, &auth2_time
)) {
631 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error");
636 nttmp
= prng_successor(nt1
, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
637 for (i
= 101; i
< 1200; i
++) {
638 nttmp
= prng_successor(nttmp
, 1);
639 if (nttmp
== nt2
) break;
649 delta_time
= auth2_time
- auth1_time
+ 32; // allow some slack for proper timing
651 if (MF_DBGLEVEL
>= 3) Dbprintf("Nested: calibrating... ntdist=%d", i
);
655 if (rtr
<= 1) return;
657 davg
= (davg
+ (rtr
- 1)/2) / (rtr
- 1);
659 if (MF_DBGLEVEL
>= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin
, dmax
, davg
, delta_time
);
667 // -------------------------------------------------------------------------------------------------
671 // get crypted nonces for target sector
672 for(i
=0; i
< 2; i
++) { // look for exactly two different nonces
675 while(target_nt
[i
] == 0) { // continue until we have an unambiguous nonce
677 // prepare next select. No need to power down the card.
678 if(mifare_classic_halt(pcs
, cuid
)) {
679 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
683 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
684 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
689 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
690 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
694 // nested authentication
695 auth2_time
= auth1_time
+ delta_time
;
696 len
= mifare_sendcmd_shortex(pcs
, AUTH_NESTED
, 0x60 + (targetKeyType
& 0x01), targetBlockNo
, receivedAnswer
, par
, &auth2_time
);
698 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error len=%d", len
);
702 nt2
= bytes_to_num(receivedAnswer
, 4);
703 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i
+1, nt1
, nt2
, par
[0]);
705 // Parity validity check
706 for (j
= 0; j
< 4; j
++) {
707 par_array
[j
] = (oddparity(receivedAnswer
[j
]) != ((par
[0] >> (7-j
)) & 0x01));
711 nttest
= prng_successor(nt1
, dmin
- 1);
712 for (j
= dmin
; j
< dmax
+ 1; j
++) {
713 nttest
= prng_successor(nttest
, 1);
716 if (valid_nonce(nttest
, nt2
, ks1
, par_array
)){
717 if (ncount
> 0) { // we are only interested in disambiguous nonces, try again
718 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i
+1, j
);
722 target_nt
[i
] = nttest
;
725 if (i
== 1 && target_nt
[1] == target_nt
[0]) { // we need two different nonces
727 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j
);
730 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i
+1, j
);
733 if (target_nt
[i
] == 0 && j
== dmax
+1 && MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i
+1);
739 // ----------------------------- crypto1 destroy
740 crypto1_destroy(pcs
);
742 byte_t buf
[4 + 4 * 4];
743 memcpy(buf
, &cuid
, 4);
744 memcpy(buf
+4, &target_nt
[0], 4);
745 memcpy(buf
+8, &target_ks
[0], 4);
746 memcpy(buf
+12, &target_nt
[1], 4);
747 memcpy(buf
+16, &target_ks
[1], 4);
750 cmd_send(CMD_ACK
, 0, 2, targetBlockNo
+ (targetKeyType
* 0x100), buf
, sizeof(buf
));
753 if (MF_DBGLEVEL
>= 3) DbpString("NESTED FINISHED");
755 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
760 //-----------------------------------------------------------------------------
761 // MIFARE check keys. key count up to 85.
763 //-----------------------------------------------------------------------------
764 void MifareChkKeys(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
767 uint8_t blockNo
= arg0
;
768 uint8_t keyType
= arg1
;
769 uint8_t keyCount
= arg2
;
770 uint64_t ui64Key
= 0;
777 struct Crypto1State mpcs
= {0, 0};
778 struct Crypto1State
*pcs
;
782 int OLD_MF_DBGLEVEL
= MF_DBGLEVEL
;
783 MF_DBGLEVEL
= MF_DBG_NONE
;
789 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
795 for (i
= 0; i
< keyCount
; i
++) {
796 if(mifare_classic_halt(pcs
, cuid
)) {
797 if (MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Halt error");
800 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
801 if (OLD_MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Can't select card");
805 ui64Key
= bytes_to_num(datain
+ i
* 6, 6);
806 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
814 // ----------------------------- crypto1 destroy
815 crypto1_destroy(pcs
);
818 cmd_send(CMD_ACK
,isOK
,0,0,datain
+ i
* 6,6);
821 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
824 // restore debug level
825 MF_DBGLEVEL
= OLD_MF_DBGLEVEL
;
828 //-----------------------------------------------------------------------------
829 // MIFARE commands set debug level
831 //-----------------------------------------------------------------------------
832 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
834 Dbprintf("Debug level: %d", MF_DBGLEVEL
);
837 //-----------------------------------------------------------------------------
838 // Work with emulator memory
840 //-----------------------------------------------------------------------------
841 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
845 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
846 emlSetMem(datain
, arg0
, arg1
); // data, block num, blocks count
849 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
850 byte_t buf
[USB_CMD_DATA_SIZE
];
851 emlGetMem(buf
, arg0
, arg1
); // data, block num, blocks count (max 4)
854 cmd_send(CMD_ACK
,arg0
,arg1
,0,buf
,USB_CMD_DATA_SIZE
);
858 //-----------------------------------------------------------------------------
859 // Load a card into the emulator memory
861 //-----------------------------------------------------------------------------
862 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
863 uint8_t numSectors
= arg0
;
864 uint8_t keyType
= arg1
;
865 uint64_t ui64Key
= 0;
867 struct Crypto1State mpcs
= {0, 0};
868 struct Crypto1State
*pcs
;
872 byte_t dataoutbuf
[16];
873 byte_t dataoutbuf2
[16];
880 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
888 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
890 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
893 for (uint8_t sectorNo
= 0; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
894 ui64Key
= emlGetKey(sectorNo
, keyType
);
896 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
898 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo
);
902 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_NESTED
)) {
904 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo
);
909 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
910 if(isOK
&& mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
)) {
912 if (MF_DBGLEVEL
>= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo
, blockNo
);
916 if (blockNo
< NumBlocksPerSector(sectorNo
) - 1) {
917 emlSetMem(dataoutbuf
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
918 } else { // sector trailer, keep the keys, set only the AC
919 emlGetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
920 memcpy(&dataoutbuf2
[6], &dataoutbuf
[6], 4);
921 emlSetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
928 if(mifare_classic_halt(pcs
, cuid
)) {
929 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
932 // ----------------------------- crypto1 destroy
933 crypto1_destroy(pcs
);
935 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
938 if (MF_DBGLEVEL
>= 2) DbpString("EMUL FILL SECTORS FINISHED");
943 //-----------------------------------------------------------------------------
944 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
946 //-----------------------------------------------------------------------------
947 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
950 uint8_t needWipe
= arg0
;
951 // bit 0 - need get UID
953 // bit 2 - need HALT after sequence
954 // bit 3 - need init FPGA and field before sequence
955 // bit 4 - need reset FPGA and LED
956 uint8_t workFlags
= arg1
;
957 uint8_t blockNo
= arg2
;
960 uint8_t wupC1
[] = { 0x40 };
961 uint8_t wupC2
[] = { 0x43 };
962 uint8_t wipeC
[] = { 0x41 };
966 uint8_t uid
[10] = {0x00};
967 uint8_t d_block
[18] = {0x00};
970 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
971 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
973 // reset FPGA and LED
974 if (workFlags
& 0x08) {
981 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
987 if (workFlags
& 0x01) {
988 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
989 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
993 if(mifare_classic_halt(NULL
, cuid
)) {
994 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1001 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1002 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1003 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1007 ReaderTransmit(wipeC
, sizeof(wipeC
), NULL
);
1008 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1009 if (MF_DBGLEVEL
>= 1) Dbprintf("wipeC error");
1013 if(mifare_classic_halt(NULL
, cuid
)) {
1014 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1020 if (workFlags
& 0x02) {
1021 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1022 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1023 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1027 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1028 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1029 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1034 if ((mifare_sendcmd_short(NULL
, 0, 0xA0, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1035 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send command error");
1039 memcpy(d_block
, datain
, 16);
1040 AppendCrc14443a(d_block
, 16);
1042 ReaderTransmit(d_block
, sizeof(d_block
), NULL
);
1043 if ((ReaderReceive(receivedAnswer
, receivedAnswerPar
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1044 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send data error");
1048 if (workFlags
& 0x04) {
1049 if (mifare_classic_halt(NULL
, cuid
)) {
1050 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1060 cmd_send(CMD_ACK
,isOK
,0,0,uid
,4);
1063 if ((workFlags
& 0x10) || (!isOK
)) {
1064 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1070 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
1073 // bit 1 - need wupC
1074 // bit 2 - need HALT after sequence
1075 // bit 3 - need init FPGA and field before sequence
1076 // bit 4 - need reset FPGA and LED
1077 uint8_t workFlags
= arg0
;
1078 uint8_t blockNo
= arg2
;
1081 uint8_t wupC1
[] = { 0x40 };
1082 uint8_t wupC2
[] = { 0x43 };
1086 uint8_t data
[18] = {0x00};
1089 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1090 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1092 if (workFlags
& 0x08) {
1099 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1103 if (workFlags
& 0x02) {
1104 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1105 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1106 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1110 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1111 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1112 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1118 if ((mifare_sendcmd_short(NULL
, 0, 0x30, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 18)) {
1119 if (MF_DBGLEVEL
>= 1) Dbprintf("read block send command error");
1122 memcpy(data
, receivedAnswer
, 18);
1124 if (workFlags
& 0x04) {
1125 if (mifare_classic_halt(NULL
, cuid
)) {
1126 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1136 cmd_send(CMD_ACK
,isOK
,0,0,data
,18);
1139 if ((workFlags
& 0x10) || (!isOK
)) {
1140 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1145 void MifareCIdent(){
1148 uint8_t wupC1
[] = { 0x40 };
1149 uint8_t wupC2
[] = { 0x43 };
1154 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1155 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1157 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1158 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1162 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1163 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1167 if (mifare_classic_halt(NULL
, 0)) {
1171 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
1174 void MifareCollectNonces(uint32_t arg0
, uint32_t arg1
){
1178 uint32_t iterations
= arg0
;
1179 uint8_t uid
[10] = {0x00};
1181 uint8_t *response
= BigBuf_malloc(MAX_MIFARE_FRAME_SIZE
);
1182 uint8_t *responsePar
= BigBuf_malloc(MAX_MIFARE_PARITY_SIZE
);
1184 uint8_t mf_auth
[] = { 0x60,0x00,0xf5,0x7b };
1186 // get memory from BigBuf.
1187 uint8_t *nonces
= BigBuf_malloc(iterations
* 4);
1195 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1197 for (int i
= 0; i
< iterations
; i
++) {
1201 // Test if the action was cancelled
1202 if(BUTTON_PRESS()) break;
1204 // if(mifare_classic_halt(pcs, cuid)) {
1205 // if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1208 if(!iso14443a_select_card(uid
, NULL
, NULL
)) {
1209 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
1213 // Transmit MIFARE_CLASSIC_AUTH.
1214 ReaderTransmit(mf_auth
, sizeof(mf_auth
), NULL
);
1216 // Receive the (4 Byte) "random" nonce
1217 if (!ReaderReceive(response
, responsePar
)) {
1218 if (MF_DBGLEVEL
>= 1) Dbprintf("Couldn't receive tag nonce");
1222 nonces
[i
*4] = bytes_to_num(response
, 4);
1225 int packLen
= iterations
* 4;
1228 while (packLen
> 0) {
1229 packSize
= MIN(USB_CMD_DATA_SIZE
, packLen
);
1231 cmd_send(CMD_ACK
, 77, 0, packSize
, nonces
- packLen
, packSize
);
1234 packLen
-= packSize
;
1237 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1245 void Mifare_DES_Auth1(uint8_t arg0
, uint8_t *datain
){
1247 byte_t dataout
[11] = {0x00};
1248 uint8_t uid
[10] = {0x00};
1249 uint32_t cuid
= 0x00;
1252 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1254 int len
= iso14443a_select_card(uid
, NULL
, &cuid
);
1256 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card");
1261 if(mifare_desfire_des_auth1(cuid
, dataout
)){
1262 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Authentication part1: Fail.");
1267 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) DbpString("AUTH 1 FINISHED");
1268 cmd_send(CMD_ACK
,1,cuid
,0,dataout
, sizeof(dataout
));
1271 void Mifare_DES_Auth2(uint32_t arg0
, uint8_t *datain
){
1273 uint32_t cuid
= arg0
;
1274 uint8_t key
[16] = {0x00};
1275 byte_t dataout
[12] = {0x00};
1278 memcpy(key
, datain
, 16);
1280 isOK
= mifare_desfire_des_auth2(cuid
, key
, dataout
);
1283 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) Dbprintf("Authentication part2: Failed");
1288 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) DbpString("AUTH 2 FINISHED");
1290 cmd_send(CMD_ACK
, isOK
, 0, 0, dataout
, sizeof(dataout
));
1291 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);