git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17
  18 #include "apps.h"
  19 #include "util.h"
  20 #include "parity.h"
  21 #include "crc.h"
  22
  23 #define AUTHENTICATION_TIMEOUT 848                      // card times out 1ms after wrong authentication (according to NXP documentation)
  24 #define PRE_AUTHENTICATION_LEADTIME 400         // some (non standard) cards need a pause after select before they are ready for first authentication
  25
  26
  27 // the block number for the ISO14443-4 PCB
  28 static uint8_t pcb_blocknum = 0;
  29 // Deselect card by sending a s-block. the crc is precalced for speed
  30 static  uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
  31
  32 //-----------------------------------------------------------------------------
  33 // Select, Authenticate, Read a MIFARE tag.
  34 // read block
  35 //-----------------------------------------------------------------------------
  36 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  37 {
  38   // params
  39         uint8_t blockNo = arg0;
  40         uint8_t keyType = arg1;
  41         uint64_t ui64Key = 0;
  42         ui64Key = bytes_to_num(datain, 6);
  43
  44         // variables
  45         byte_t isOK = 0;
  46         byte_t dataoutbuf[16];
  47         uint8_t uid[10];
  48         uint32_t cuid;
  49         struct Crypto1State mpcs = {0, 0};
  50         struct Crypto1State *pcs;
  51         pcs = &mpcs;
  52
  53         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  54
  55         clear_trace();
  56
  57         LED_A_ON();
  58         LED_B_OFF();
  59         LED_C_OFF();
  60
  61         while (true) {
  62                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
  63                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  64                         break;
  65                 };
  66
  67                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  68                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  69                         break;
  70                 };
  71
  72                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  73                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  74                         break;
  75                 };
  76
  77                 if(mifare_classic_halt(pcs, cuid)) {
  78                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  79                         break;
  80                 };
  81
  82                 isOK = 1;
  83                 break;
  84         }
  85
  86         //  ----------------------------- crypto1 destroy
  87         crypto1_destroy(pcs);
  88
  89         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  90
  91         LED_B_ON();
  92         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  93         LED_B_OFF();
  94
  95         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  96         LEDsoff();
  97 }
  98
  99 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
 100
 101         bool turnOffField = (arg0 == 1);
 102
 103         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 104
 105         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 106
 107         clear_trace();
 108
 109         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
 110                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 111                 OnError(0);
 112                 return;
 113         };
 114
 115         if(!mifare_ultra_auth(keybytes)){
 116                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
 117                 OnError(1);
 118                 return;
 119         }
 120
 121         if (turnOffField) {
 122                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 123                 LEDsoff();
 124         }
 125         cmd_send(CMD_ACK,1,0,0,0,0);
 126 }
 127
 128 // Arg0 = BlockNo,
 129 // Arg1 = UsePwd bool
 130 // datain = PWD bytes,
 131 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 132 {
 133         uint8_t blockNo = arg0;
 134         byte_t dataout[16] = {0x00};
 135         bool useKey = (arg1 == 1); //UL_C
 136         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 137
 138         LEDsoff();
 139         LED_A_ON();
 140         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 141
 142         clear_trace();
 143
 144         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
 145         if(!len) {
 146                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 147                 OnError(1);
 148                 return;
 149         }
 150
 151         // UL-C authentication
 152         if ( useKey ) {
 153                 uint8_t key[16] = {0x00};
 154                 memcpy(key, datain, sizeof(key) );
 155
 156                 if ( !mifare_ultra_auth(key) ) {
 157                         OnError(1);
 158                         return;
 159                 }
 160         }
 161
 162         // UL-EV1 / NTAG authentication
 163         if ( usePwd ) {
 164                 uint8_t pwd[4] = {0x00};
 165                 memcpy(pwd, datain, 4);
 166                 uint8_t pack[4] = {0,0,0,0};
 167                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 168                         OnError(1);
 169                         return;
 170                 }
 171         }
 172
 173         if( mifare_ultra_readblock(blockNo, dataout) ) {
 174                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 175                 OnError(2);
 176                 return;
 177         }
 178
 179         if( mifare_ultra_halt() ) {
 180                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 181                 OnError(3);
 182                 return;
 183         }
 184
 185         cmd_send(CMD_ACK,1,0,0,dataout,16);
 186         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 187         LEDsoff();
 188 }
 189
 190 //-----------------------------------------------------------------------------
 191 // Select, Authenticate, Read a MIFARE tag.
 192 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 193 //-----------------------------------------------------------------------------
 194 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 195 {
 196   // params
 197         uint8_t sectorNo = arg0;
 198         uint8_t keyType = arg1;
 199         uint64_t ui64Key = 0;
 200         ui64Key = bytes_to_num(datain, 6);
 201
 202         // variables
 203         byte_t isOK = 0;
 204         byte_t dataoutbuf[16 * 16];
 205         uint8_t uid[10];
 206         uint32_t cuid;
 207         struct Crypto1State mpcs = {0, 0};
 208         struct Crypto1State *pcs;
 209         pcs = &mpcs;
 210
 211         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 212
 213         clear_trace();
 214
 215         LED_A_ON();
 216         LED_B_OFF();
 217         LED_C_OFF();
 218
 219         isOK = 1;
 220         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
 221                 isOK = 0;
 222                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 223         }
 224
 225
 226         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 227                 isOK = 0;
 228                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 229         }
 230
 231         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 232                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 233                         isOK = 0;
 234                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 235                         break;
 236                 }
 237         }
 238
 239         if(mifare_classic_halt(pcs, cuid)) {
 240                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 241         }
 242
 243         //  ----------------------------- crypto1 destroy
 244         crypto1_destroy(pcs);
 245
 246         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 247
 248         LED_B_ON();
 249         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 250         LED_B_OFF();
 251
 252         // Thats it...
 253         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 254         LEDsoff();
 255 }
 256
 257 // arg0 = blockNo (start)
 258 // arg1 = Pages (number of blocks)
 259 // arg2 = useKey
 260 // datain = KEY bytes
 261 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 262 {
 263         LEDsoff();
 264         LED_A_ON();
 265         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 266
 267         // free eventually allocated BigBuf memory
 268         BigBuf_free();
 269         clear_trace();
 270
 271         // params
 272         uint8_t blockNo = arg0;
 273         uint16_t blocks = arg1;
 274         bool useKey = (arg2 == 1); //UL_C
 275         bool usePwd = (arg2 == 2); //UL_EV1/NTAG
 276         uint32_t countblocks = 0;
 277         uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
 278         if (dataout == NULL){
 279                 Dbprintf("out of memory");
 280                 OnError(1);
 281                 return;
 282         }
 283
 284         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
 285         if (!len) {
 286                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 287                 OnError(1);
 288                 return;
 289         }
 290
 291         // UL-C authentication
 292         if ( useKey ) {
 293                 uint8_t key[16] = {0x00};
 294                 memcpy(key, datain, sizeof(key) );
 295
 296                 if ( !mifare_ultra_auth(key) ) {
 297                         OnError(1);
 298                         return;
 299                 }
 300         }
 301
 302         // UL-EV1 / NTAG authentication
 303         if (usePwd) {
 304                 uint8_t pwd[4] = {0x00};
 305                 memcpy(pwd, datain, sizeof(pwd));
 306                 uint8_t pack[4] = {0,0,0,0};
 307
 308                 if (!mifare_ul_ev1_auth(pwd, pack)){
 309                         OnError(1);
 310                         return;
 311                 }
 312         }
 313
 314         for (int i = 0; i < blocks; i++){
 315                 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
 316                         Dbprintf("Data exceeds buffer!!");
 317                         break;
 318                 }
 319
 320                 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
 321
 322                 if (len) {
 323                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 324                         // if no blocks read - error out
 325                         if (i==0){
 326                                 OnError(2);
 327                                 return;
 328                         } else {
 329                                 //stop at last successful read block and return what we got
 330                                 break;
 331                         }
 332                 } else {
 333                         countblocks++;
 334                 }
 335         }
 336
 337         len = mifare_ultra_halt();
 338         if (len) {
 339                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 340                 OnError(3);
 341                 return;
 342         }
 343
 344         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 345
 346         countblocks *= 4;
 347
 348         cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
 349         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 350         LEDsoff();
 351         BigBuf_free();
 352 }
 353
 354 //-----------------------------------------------------------------------------
 355 // Select, Authenticate, Write a MIFARE tag.
 356 // read block
 357 //-----------------------------------------------------------------------------
 358 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 359 {
 360         // params
 361         uint8_t blockNo = arg0;
 362         uint8_t keyType = arg1;
 363         uint64_t ui64Key = 0;
 364         byte_t blockdata[16];
 365
 366         ui64Key = bytes_to_num(datain, 6);
 367         memcpy(blockdata, datain + 10, 16);
 368
 369         // variables
 370         byte_t isOK = 0;
 371         uint8_t uid[10];
 372         uint32_t cuid;
 373         struct Crypto1State mpcs = {0, 0};
 374         struct Crypto1State *pcs;
 375         pcs = &mpcs;
 376
 377         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 378
 379         clear_trace();
 380
 381         LED_A_ON();
 382         LED_B_OFF();
 383         LED_C_OFF();
 384
 385         while (true) {
 386                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
 387                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 388                         break;
 389                 };
 390
 391                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 392                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 393                         break;
 394                 };
 395
 396                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 397                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 398                         break;
 399                 };
 400
 401                 if(mifare_classic_halt(pcs, cuid)) {
 402                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 403                         break;
 404                 };
 405
 406                 isOK = 1;
 407                 break;
 408         }
 409
 410         //  ----------------------------- crypto1 destroy
 411         crypto1_destroy(pcs);
 412
 413         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 414
 415         LED_B_ON();
 416         cmd_send(CMD_ACK,isOK,0,0,0,0);
 417         LED_B_OFF();
 418
 419
 420         // Thats it...
 421         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 422         LEDsoff();
 423 }
 424
 425 /* // Command not needed but left for future testing
 426 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
 427 {
 428         uint8_t blockNo = arg0;
 429         byte_t blockdata[16] = {0x00};
 430
 431         memcpy(blockdata, datain, 16);
 432
 433         uint8_t uid[10] = {0x00};
 434
 435         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 436
 437         clear_trace();
 438         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 439
 440         if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
 441                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 442                 OnError(0);
 443                 return;
 444         };
 445
 446         if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
 447                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 448                 OnError(0);
 449                 return; };
 450
 451         if(mifare_ultra_halt()) {
 452                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 453                 OnError(0);
 454                 return;
 455         };
 456
 457         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 458
 459         cmd_send(CMD_ACK,1,0,0,0,0);
 460         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 461         LEDsoff();
 462 }
 463 */
 464
 465 // Arg0   : Block to write to.
 466 // Arg1   : 0 = use no authentication.
 467 //          1 = use 0x1A authentication.
 468 //          2 = use 0x1B authentication.
 469 // datain : 4 first bytes is data to be written.
 470 //        : 4/16 next bytes is authentication key.
 471 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 472 {
 473         uint8_t blockNo = arg0;
 474         bool useKey = (arg1 == 1); //UL_C
 475         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 476         byte_t blockdata[4] = {0x00};
 477
 478         memcpy(blockdata, datain,4);
 479
 480         LEDsoff();
 481         LED_A_ON();
 482         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 483
 484         clear_trace();
 485
 486         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
 487                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 488                 OnError(0);
 489                 return;
 490         };
 491
 492         // UL-C authentication
 493         if ( useKey ) {
 494                 uint8_t key[16] = {0x00};
 495                 memcpy(key, datain+4, sizeof(key) );
 496
 497                 if ( !mifare_ultra_auth(key) ) {
 498                         OnError(1);
 499                         return;
 500                 }
 501         }
 502
 503         // UL-EV1 / NTAG authentication
 504         if (usePwd) {
 505                 uint8_t pwd[4] = {0x00};
 506                 memcpy(pwd, datain+4, 4);
 507                 uint8_t pack[4] = {0,0,0,0};
 508                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 509                         OnError(1);
 510                         return;
 511                 }
 512         }
 513
 514         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 515                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 516                 OnError(0);
 517                 return;
 518         };
 519
 520         if(mifare_ultra_halt()) {
 521                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 522                 OnError(0);
 523                 return;
 524         };
 525
 526         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 527
 528         cmd_send(CMD_ACK,1,0,0,0,0);
 529         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 530         LEDsoff();
 531 }
 532
 533 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 534
 535         uint8_t pwd[16] = {0x00};
 536         byte_t blockdata[4] = {0x00};
 537
 538         memcpy(pwd, datain, 16);
 539
 540         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 541         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 542
 543         clear_trace();
 544
 545         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
 546                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 547                 OnError(0);
 548                 return;
 549         };
 550
 551         blockdata[0] = pwd[7];
 552         blockdata[1] = pwd[6];
 553         blockdata[2] = pwd[5];
 554         blockdata[3] = pwd[4];
 555         if(mifare_ultra_writeblock( 44, blockdata)) {
 556                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 557                 OnError(44);
 558                 return;
 559         };
 560
 561         blockdata[0] = pwd[3];
 562         blockdata[1] = pwd[2];
 563         blockdata[2] = pwd[1];
 564         blockdata[3] = pwd[0];
 565         if(mifare_ultra_writeblock( 45, blockdata)) {
 566                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 567                 OnError(45);
 568                 return;
 569         };
 570
 571         blockdata[0] = pwd[15];
 572         blockdata[1] = pwd[14];
 573         blockdata[2] = pwd[13];
 574         blockdata[3] = pwd[12];
 575         if(mifare_ultra_writeblock( 46, blockdata)) {
 576                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 577                 OnError(46);
 578                 return;
 579         };
 580
 581         blockdata[0] = pwd[11];
 582         blockdata[1] = pwd[10];
 583         blockdata[2] = pwd[9];
 584         blockdata[3] = pwd[8];
 585         if(mifare_ultra_writeblock( 47, blockdata)) {
 586                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 587                 OnError(47);
 588                 return;
 589         };
 590
 591         if(mifare_ultra_halt()) {
 592                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 593                 OnError(0);
 594                 return;
 595         };
 596
 597         cmd_send(CMD_ACK,1,0,0,0,0);
 598         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 599         LEDsoff();
 600 }
 601
 602 // Return 1 if the nonce is invalid else return 0
 603 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 604         return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 605         (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 606         (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 607 }
 608
 609
 610 //-----------------------------------------------------------------------------
 611 // acquire encrypted nonces in order to perform the attack described in
 612 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
 613 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
 614 // Computer and Communications Security, 2015
 615 //-----------------------------------------------------------------------------
 616 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
 617 {
 618         uint64_t ui64Key = 0;
 619         uint8_t uid[10];
 620         uint32_t cuid;
 621         uint8_t cascade_levels = 0;
 622         struct Crypto1State mpcs = {0, 0};
 623         struct Crypto1State *pcs;
 624         pcs = &mpcs;
 625         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 626         int16_t isOK = 0;
 627         uint8_t par_enc[1];
 628         uint8_t nt_par_enc = 0;
 629         uint8_t buf[USB_CMD_DATA_SIZE];
 630         uint32_t timeout;
 631
 632         uint8_t blockNo = arg0 & 0xff;
 633         uint8_t keyType = (arg0 >> 8) & 0xff;
 634         uint8_t targetBlockNo = arg1 & 0xff;
 635         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 636         ui64Key = bytes_to_num(datain, 6);
 637         bool initialize = flags & 0x0001;
 638         bool slow = flags & 0x0002;
 639         bool field_off = flags & 0x0004;
 640
 641         LED_A_ON();
 642         LED_C_OFF();
 643
 644         if (initialize) {
 645                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 646                 clear_trace();
 647                 set_tracing(true);
 648         }
 649
 650         LED_C_ON();
 651
 652         uint16_t num_nonces = 0;
 653         bool have_uid = false;
 654         for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
 655
 656                 // Test if the action was cancelled
 657                 if(BUTTON_PRESS()) {
 658                         isOK = 2;
 659                         field_off = true;
 660                         break;
 661                 }
 662
 663                 if (!have_uid) { // need a full select cycle to get the uid first
 664                         iso14a_card_select_t card_info;
 665                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
 666                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (ALL)");
 667                                 continue;
 668                         }
 669                         switch (card_info.uidlen) {
 670                                 case 4 : cascade_levels = 1; break;
 671                                 case 7 : cascade_levels = 2; break;
 672                                 case 10: cascade_levels = 3; break;
 673                                 default: break;
 674                         }
 675                         have_uid = true;
 676                 } else { // no need for anticollision. We can directly select the card
 677                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
 678                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (UID)");
 679                                 continue;
 680                         }
 681                 }
 682
 683                 if (slow) {
 684                         timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
 685                         while(GetCountSspClk() < timeout);
 686                 }
 687
 688                 uint32_t nt1;
 689                 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
 690                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth1 error");
 691                         continue;
 692                 }
 693
 694                 // nested authentication
 695                 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
 696                 if (len != 4) {
 697                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth2 error len=%d", len);
 698                         continue;
 699                 }
 700
 701                 // send a dummy byte as reader response in order to trigger the cards authentication timeout
 702                 uint8_t dummy_answer = 0;
 703                 ReaderTransmit(&dummy_answer, 1, NULL);
 704                 timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
 705
 706                 num_nonces++;
 707                 if (num_nonces % 2) {
 708                         memcpy(buf+i, receivedAnswer, 4);
 709                         nt_par_enc = par_enc[0] & 0xf0;
 710                 } else {
 711                         nt_par_enc |= par_enc[0] >> 4;
 712                         memcpy(buf+i+4, receivedAnswer, 4);
 713                         memcpy(buf+i+8, &nt_par_enc, 1);
 714                         i += 9;
 715                 }
 716
 717                 // wait for the card to become ready again
 718                 while(GetCountSspClk() < timeout);
 719
 720         }
 721
 722         LED_C_OFF();
 723
 724         crypto1_destroy(pcs);
 725
 726         LED_B_ON();
 727         cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
 728         LED_B_OFF();
 729
 730         if (MF_DBGLEVEL >= 3)   DbpString("AcquireEncryptedNonces finished");
 731
 732         if (field_off) {
 733                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 734                 LEDsoff();
 735         }
 736 }
 737
 738
 739 //-----------------------------------------------------------------------------
 740 // MIFARE nested authentication.
 741 //
 742 //-----------------------------------------------------------------------------
 743 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 744 {
 745         // params
 746         uint8_t blockNo = arg0 & 0xff;
 747         uint8_t keyType = (arg0 >> 8) & 0xff;
 748         uint8_t targetBlockNo = arg1 & 0xff;
 749         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 750         uint64_t ui64Key = 0;
 751
 752         ui64Key = bytes_to_num(datain, 6);
 753
 754         // variables
 755         uint16_t rtr, i, j, len;
 756         uint16_t davg;
 757         static uint16_t dmin, dmax;
 758         uint8_t uid[10];
 759         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 760         uint8_t par[1];
 761         uint32_t target_nt[2], target_ks[2];
 762
 763         uint8_t par_array[4];
 764         uint16_t ncount = 0;
 765         struct Crypto1State mpcs = {0, 0};
 766         struct Crypto1State *pcs;
 767         pcs = &mpcs;
 768         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 769
 770         uint32_t auth1_time, auth2_time;
 771         static uint16_t delta_time;
 772
 773         LED_A_ON();
 774         LED_C_OFF();
 775         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 776
 777         // free eventually allocated BigBuf memory
 778         BigBuf_free();
 779
 780         if (calibrate) clear_trace();
 781         set_tracing(true);
 782
 783         // statistics on nonce distance
 784         int16_t isOK = 0;
 785         #define NESTED_MAX_TRIES 12
 786         uint16_t unsuccessfull_tries = 0;
 787         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 788                 LED_B_ON();
 789                 WDT_HIT();
 790
 791                 davg = dmax = 0;
 792                 dmin = 2000;
 793                 delta_time = 0;
 794
 795                 for (rtr = 0; rtr < 17; rtr++) {
 796
 797                         // Test if the action was cancelled
 798                         if(BUTTON_PRESS()) {
 799                                 isOK = -2;
 800                                 break;
 801                         }
 802
 803                         // prepare next select. No need to power down the card.
 804                         if(mifare_classic_halt(pcs, cuid)) {
 805                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 806                                 rtr--;
 807                                 continue;
 808                         }
 809
 810                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
 811                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 812                                 rtr--;
 813                                 continue;
 814                         };
 815
 816                         auth1_time = 0;
 817                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 818                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 819                                 rtr--;
 820                                 continue;
 821                         };
 822
 823                         if (delta_time) {
 824                                 auth2_time = auth1_time + delta_time;
 825                         } else {
 826                                 auth2_time = 0;
 827                         }
 828                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 829                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 830                                 rtr--;
 831                                 continue;
 832                         };
 833
 834                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 835                         for (i = 101; i < 1200; i++) {
 836                                 nttmp = prng_successor(nttmp, 1);
 837                                 if (nttmp == nt2) break;
 838                         }
 839
 840                         if (i != 1200) {
 841                                 if (rtr != 0) {
 842                                         davg += i;
 843                                         dmin = MIN(dmin, i);
 844                                         dmax = MAX(dmax, i);
 845                                 }
 846                                 else {
 847                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 848                                 }
 849                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 850                         } else {
 851                                 unsuccessfull_tries++;
 852                                 if (unsuccessfull_tries > NESTED_MAX_TRIES) {   // card isn't vulnerable to nested attack (random numbers are not predictable)
 853                                         isOK = -3;
 854                                 }
 855                         }
 856                 }
 857
 858                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 859
 860                 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
 861
 862                 dmin = davg - 2;
 863                 dmax = davg + 2;
 864
 865                 LED_B_OFF();
 866
 867         }
 868         //  -------------------------------------------------------------------------------------------------
 869
 870         LED_C_ON();
 871
 872         //  get crypted nonces for target sector
 873         for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
 874
 875                 target_nt[i] = 0;
 876                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 877
 878                         // prepare next select. No need to power down the card.
 879                         if(mifare_classic_halt(pcs, cuid)) {
 880                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 881                                 continue;
 882                         }
 883
 884                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
 885                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 886                                 continue;
 887                         };
 888
 889                         auth1_time = 0;
 890                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 891                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 892                                 continue;
 893                         };
 894
 895                         // nested authentication
 896                         auth2_time = auth1_time + delta_time;
 897                         len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 898                         if (len != 4) {
 899                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 900                                 continue;
 901                         };
 902
 903                         nt2 = bytes_to_num(receivedAnswer, 4);
 904                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 905
 906                         // Parity validity check
 907                         for (j = 0; j < 4; j++) {
 908                                 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 909                         }
 910
 911                         ncount = 0;
 912                         nttest = prng_successor(nt1, dmin - 1);
 913                         for (j = dmin; j < dmax + 1; j++) {
 914                                 nttest = prng_successor(nttest, 1);
 915                                 ks1 = nt2 ^ nttest;
 916
 917                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 918                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 919                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 920                                                 target_nt[i] = 0;
 921                                                 break;
 922                                         }
 923                                         target_nt[i] = nttest;
 924                                         target_ks[i] = ks1;
 925                                         ncount++;
 926                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 927                                                 target_nt[i] = 0;
 928                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 929                                                 break;
 930                                         }
 931                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 932                                 }
 933                         }
 934                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 935                 }
 936         }
 937
 938         LED_C_OFF();
 939
 940         //  ----------------------------- crypto1 destroy
 941         crypto1_destroy(pcs);
 942
 943         byte_t buf[4 + 4 * 4];
 944         memcpy(buf, &cuid, 4);
 945         memcpy(buf+4, &target_nt[0], 4);
 946         memcpy(buf+8, &target_ks[0], 4);
 947         memcpy(buf+12, &target_nt[1], 4);
 948         memcpy(buf+16, &target_ks[1], 4);
 949
 950         LED_B_ON();
 951         cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 952         LED_B_OFF();
 953
 954         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 955
 956         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 957         LEDsoff();
 958 }
 959
 960 //-----------------------------------------------------------------------------
 961 // MIFARE check keys. key count up to 85.
 962 //
 963 //-----------------------------------------------------------------------------
 964 void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 965 {
 966         uint8_t blockNo = arg0 & 0xff;
 967         uint8_t keyType = (arg0 >> 8) & 0xff;
 968         bool clearTrace = arg1;
 969         uint8_t keyCount = arg2;
 970         uint64_t ui64Key = 0;
 971
 972         bool have_uid = false;
 973         uint8_t cascade_levels = 0;
 974         uint32_t timeout = 0;
 975         int i;
 976         byte_t isOK = 0;
 977         uint8_t uid[10];
 978         uint32_t cuid;
 979         struct Crypto1State mpcs = {0, 0};
 980         struct Crypto1State *pcs;
 981         pcs = &mpcs;
 982
 983         // clear debug level
 984         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 985         MF_DBGLEVEL = MF_DBG_NONE;
 986
 987         LED_A_ON();
 988         LED_B_OFF();
 989         LED_C_OFF();
 990         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 991
 992         if (clearTrace) clear_trace();
 993         set_tracing(true);
 994
 995         for (i = 0; i < keyCount; i++) {
 996 //              if(mifare_classic_halt(pcs, cuid)) {
 997 //                      if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 998 //              }
 999
1000                 // Iceman: use piwi's faster nonce collecting part in hardnested.
1001                 if (!have_uid) { // need a full select cycle to get the uid first
1002                         iso14a_card_select_t card_info;
1003                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
1004                                 if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
1005                                 --i; // try same key once again
1006                                 continue;
1007                         }
1008                         switch (card_info.uidlen) {
1009                                 case 4 : cascade_levels = 1; break;
1010                                 case 7 : cascade_levels = 2; break;
1011                                 case 10: cascade_levels = 3; break;
1012                                 default: break;
1013                         }
1014                         have_uid = true;
1015                 } else { // no need for anticollision. We can directly select the card
1016                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
1017                                 if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card (UID)");
1018                                 --i; // try same key once again
1019                                 continue;
1020                         }
1021                 }
1022
1023                 ui64Key = bytes_to_num(datain + i * 6, 6);
1024                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
1025                         uint8_t dummy_answer = 0;
1026                         ReaderTransmit(&dummy_answer, 1, NULL);
1027                         timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
1028
1029                         // wait for the card to become ready again
1030                         while(GetCountSspClk() < timeout);
1031                         continue;
1032                 }
1033
1034                 isOK = 1;
1035                 break;
1036         }
1037
1038         LED_B_ON();
1039     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
1040         LED_B_OFF();
1041
1042         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1043         LEDsoff();
1044
1045         // restore debug level
1046         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1047 }
1048
1049 //-----------------------------------------------------------------------------
1050 // MIFARE commands set debug level
1051 //
1052 //-----------------------------------------------------------------------------
1053 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1054         MF_DBGLEVEL = arg0;
1055         Dbprintf("Debug level: %d", MF_DBGLEVEL);
1056 }
1057
1058 //-----------------------------------------------------------------------------
1059 // Work with emulator memory
1060 //
1061 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1062 // involved in dealing with emulator memory. But if it is called later, it might
1063 // destroy the Emulator Memory.
1064 //-----------------------------------------------------------------------------
1065
1066 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1067         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1068         emlClearMem();
1069 }
1070
1071 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1072         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1073         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
1074 }
1075
1076 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1077         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1078         byte_t buf[USB_CMD_DATA_SIZE];
1079         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1080
1081         LED_B_ON();
1082         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1083         LED_B_OFF();
1084 }
1085
1086 //-----------------------------------------------------------------------------
1087 // Load a card into the emulator memory
1088 //
1089 //-----------------------------------------------------------------------------
1090 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1091         uint8_t numSectors = arg0;
1092         uint8_t keyType = arg1;
1093         uint64_t ui64Key = 0;
1094         uint32_t cuid;
1095         struct Crypto1State mpcs = {0, 0};
1096         struct Crypto1State *pcs;
1097         pcs = &mpcs;
1098
1099         // variables
1100         byte_t dataoutbuf[16];
1101         byte_t dataoutbuf2[16];
1102         uint8_t uid[10];
1103
1104         LED_A_ON();
1105         LED_B_OFF();
1106         LED_C_OFF();
1107         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1108
1109         clear_trace();
1110         set_tracing(false);
1111
1112         bool isOK = true;
1113
1114         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1115                 isOK = false;
1116                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1117         }
1118
1119         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1120                 ui64Key = emlGetKey(sectorNo, keyType);
1121                 if (sectorNo == 0){
1122                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1123                                 isOK = false;
1124                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
1125                                 break;
1126                         }
1127                 } else {
1128                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1129                                 isOK = false;
1130                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1131                                 break;
1132                         }
1133                 }
1134
1135                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1136                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1137                                 isOK = false;
1138                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1139                                 break;
1140                         };
1141                         if (isOK) {
1142                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1143                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1144                                 } else {        // sector trailer, keep the keys, set only the AC
1145                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1146                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1147                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
1148                                 }
1149                         }
1150                 }
1151
1152         }
1153
1154         if(mifare_classic_halt(pcs, cuid)) {
1155                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1156         };
1157
1158         //  ----------------------------- crypto1 destroy
1159         crypto1_destroy(pcs);
1160
1161         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1162         LEDsoff();
1163
1164         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1165
1166 }
1167
1168
1169 //-----------------------------------------------------------------------------
1170 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1171 //
1172 //-----------------------------------------------------------------------------
1173
1174 static bool isBlockTrailer(int blockN) {
1175         if (blockN >= 0 && blockN < 128) {
1176                 return ((blockN & 0x03) == 0x03);
1177         }
1178         if (blockN >= 128 && blockN <= 256) {
1179                 return ((blockN & 0x0F) == 0x0F);
1180         }
1181         return FALSE;
1182 }
1183
1184 void MifareCWipe(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1185         // var
1186         byte_t isOK = 0;
1187         uint32_t numBlocks = arg0;
1188         // cmdParams:
1189         // bit 0 - wipe gen1a
1190         // bit 1 - fill card with default data
1191         // bit 2 - gen1a = 0, gen1b = 1
1192         uint8_t cmdParams = arg1;
1193         bool needWipe = cmdParams & 0x01;
1194         bool needFill = cmdParams & 0x02;
1195         bool gen1b = cmdParams & 0x04;
1196
1197         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1198         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1199
1200         uint8_t block0[16] = {0x01, 0x02, 0x03, 0x04, 0x04, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0xAF};
1201         uint8_t block1[16] = {0x00};
1202         uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
1203         uint8_t d_block[18] = {0x00};
1204
1205         // card commands
1206         uint8_t wupC1[]       = { 0x40 };
1207         uint8_t wupC2[]       = { 0x43 };
1208         uint8_t wipeC[]       = { 0x41 };
1209
1210         // iso14443 setup
1211         LED_A_ON();
1212         LED_B_OFF();
1213         LED_C_OFF();
1214         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1215
1216         // tracing
1217         clear_trace();
1218         set_tracing(true);
1219
1220         while (true){
1221                 // wipe
1222                 if (needWipe){
1223                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1224                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1225                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1226                                 break;
1227                         };
1228
1229                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1230                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1231                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
1232                                 break;
1233                         };
1234
1235                         if(mifare_classic_halt(NULL, 0)) {
1236                                 if (MF_DBGLEVEL > 2)    Dbprintf("Halt error");
1237                         };
1238                 };
1239
1240                 // put default data
1241                 if (needFill){
1242                         // select commands
1243                         ReaderTransmitBitsPar(wupC1, 7, 0, NULL);
1244
1245                         // gen1b magic tag : do no issue wupC2 and don't expect 0x0a response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1246                         if (!gen1b) {
1247
1248                                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1249                                         if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1250                                         break;
1251                                 };
1252
1253                                 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1254                                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1255                                         if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1256                                         break;
1257                                 };
1258                         }
1259
1260                         // send blocks command
1261                         for (int blockNo = 0; blockNo < numBlocks; blockNo++) {
1262                                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1263                                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
1264                                         break;
1265                                 };
1266
1267                                 // check type of block and add crc
1268                                 if (!isBlockTrailer(blockNo)){
1269                                         memcpy(d_block, block1, 16);
1270                                 } else {
1271                                         memcpy(d_block, blockK, 16);
1272                                 }
1273                                 if (blockNo == 0) {
1274                                         memcpy(d_block, block0, 16);
1275                                 }
1276                                 AppendCrc14443a(d_block, 16);
1277
1278                                 // send write command
1279                                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1280                                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1281                                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1282                                         break;
1283                                 };
1284                         }
1285
1286                         // halt
1287                         // do no issue halt command for gen1b
1288                         if (!gen1b) {
1289                                 if (mifare_classic_halt(NULL, 0)) {
1290                                         if (MF_DBGLEVEL > 2)    Dbprintf("Halt error");
1291                                                 break;
1292                                 }
1293                         }
1294                 }
1295                 break;
1296         }
1297
1298         // send USB response
1299         LED_B_ON();
1300         cmd_send(CMD_ACK,isOK,0,0,NULL,0);
1301         LED_B_OFF();
1302
1303         // reset fpga
1304         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1305         LEDsoff();
1306
1307         return;
1308 }
1309
1310 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1311
1312   // params
1313         uint8_t needWipe = arg0;
1314         // bit 0 - need get UID
1315         // bit 1 - need wupC
1316         // bit 2 - need HALT after sequence
1317         // bit 3 - need init FPGA and field before sequence
1318         // bit 4 - need reset FPGA and LED
1319         // bit 6 - gen1b backdoor type
1320         uint8_t workFlags = arg1;
1321         uint8_t blockNo = arg2;
1322
1323         // card commands
1324         uint8_t wupC1[]       = { 0x40 };
1325         uint8_t wupC2[]       = { 0x43 };
1326         uint8_t wipeC[]       = { 0x41 };
1327
1328         // variables
1329         byte_t isOK = 0;
1330         uint8_t uid[10] = {0x00};
1331         uint8_t d_block[18] = {0x00};
1332         uint32_t cuid;
1333
1334         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1335         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1336
1337         // reset FPGA and LED
1338         if (workFlags & 0x08) {
1339                 LED_A_ON();
1340                 LED_B_OFF();
1341                 LED_C_OFF();
1342                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1343
1344                 clear_trace();
1345                 set_tracing(true);
1346         }
1347
1348         while (true) {
1349
1350                 // get UID from chip
1351                 if (workFlags & 0x01) {
1352                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1353                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1354                                 // Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work.
1355                                 //break;
1356                                 };
1357
1358                                 if(mifare_classic_halt(NULL, cuid)) {
1359                                         if (MF_DBGLEVEL > 2)    Dbprintf("Halt error");
1360                                         // Continue, some magic tags misbehavies and send an answer to it.
1361                                         // break;
1362                                 };
1363                 };
1364
1365                 // reset chip
1366                 // Wipe command don't work with gen1b
1367                 if (needWipe && !(workFlags & 0x40)){
1368                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1369                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1370                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1371                                 break;
1372                         };
1373
1374                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1375                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1376                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
1377                                 break;
1378                         };
1379
1380                         if(mifare_classic_halt(NULL, 0)) {
1381                                 if (MF_DBGLEVEL > 2)    Dbprintf("Halt error");
1382                                 // Continue, some magic tags misbehavies and send an answer to it.
1383                                 // break;
1384                         };
1385                 };
1386
1387                 // write block
1388                 if (workFlags & 0x02) {
1389                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1390
1391                         // gen1b magic tag : do no issue wupC2 and don't expect 0x0a response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1392                         if (!(workFlags & 0x40)) {
1393
1394                                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1395                                         if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1396                                         break;
1397                                 };
1398
1399                                 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1400                                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1401                                         if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1402                                         break;
1403                                 };
1404                         }
1405                 }
1406
1407                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1408                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
1409                         break;
1410                 };
1411
1412                 memcpy(d_block, datain, 16);
1413                 AppendCrc14443a(d_block, 16);
1414
1415                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1416                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1417                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1418                         break;
1419                 };
1420
1421                 if (workFlags & 0x04) {
1422                         // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1423                         if (!(workFlags & 0x40)) {
1424                                 if (mifare_classic_halt(NULL, 0)) {
1425                                         if (MF_DBGLEVEL > 2)    Dbprintf("Halt error");
1426                                         // Continue, some magic tags misbehavies and send an answer to it.
1427                                         // break;
1428                                 }
1429                         }
1430                 }
1431
1432                 isOK = 1;
1433                 break;
1434         }
1435
1436         LED_B_ON();
1437         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1438         LED_B_OFF();
1439
1440         if ((workFlags & 0x10) || (!isOK)) {
1441                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1442                 LEDsoff();
1443         }
1444 }
1445
1446
1447 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1448
1449         // params
1450         // bit 1 - need wupC
1451         // bit 2 - need HALT after sequence
1452         // bit 3 - need init FPGA and field before sequence
1453         // bit 4 - need reset FPGA and LED
1454         // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1455         // bit 6 - gen1b backdoor type
1456         uint8_t workFlags = arg0;
1457         uint8_t blockNo = arg2;
1458
1459         // card commands
1460         uint8_t wupC1[]       = { 0x40 };
1461         uint8_t wupC2[]       = { 0x43 };
1462
1463         // variables
1464         byte_t isOK = 0;
1465         uint8_t data[18] = {0x00};
1466         uint32_t cuid = 0;
1467
1468         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1469         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1470
1471         if (workFlags & 0x08) {
1472                 LED_A_ON();
1473                 LED_B_OFF();
1474                 LED_C_OFF();
1475                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1476
1477                 clear_trace();
1478                 set_tracing(true);
1479         }
1480
1481         while (true) {
1482                 if (workFlags & 0x02) {
1483                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1484                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1485                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1486                                 break;
1487                 };
1488                 // do no issue for gen1b magic tag
1489                 if (!(workFlags & 0x40)) {
1490                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1491                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1492                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1493                                 break;
1494                         };
1495                 }
1496         }
1497
1498                 // read block
1499                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1500                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1501                         break;
1502                 };
1503                 memcpy(data, receivedAnswer, 18);
1504
1505                 if (workFlags & 0x04) {
1506                         // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1507                         if (!(workFlags & 0x40)) {
1508                                 if (mifare_classic_halt(NULL, cuid)) {
1509                                         if (MF_DBGLEVEL > 1)    Dbprintf("Halt error");
1510                                         // Continue, some magic tags misbehavies and send an answer to it.
1511                                         //              break;
1512                                 }
1513                         }
1514                 }
1515
1516                 isOK = 1;
1517                 break;
1518         }
1519
1520         LED_B_ON();
1521         if (workFlags & 0x20) {
1522                 if (isOK)
1523                         memcpy(datain, data, 18);
1524         }
1525         else
1526                 cmd_send(CMD_ACK,isOK,0,0,data,18);
1527         LED_B_OFF();
1528
1529         if ((workFlags & 0x10) || (!isOK)) {
1530                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1531                 LEDsoff();
1532         }
1533 }
1534
1535 void MifareCIdent(){
1536
1537         // card commands
1538         uint8_t wupC1[]       = { 0x40 };
1539         uint8_t wupC2[]       = { 0x43 };
1540
1541         // variables
1542         byte_t isOK = 0;
1543
1544         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1545         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1546
1547         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1548         if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == 0x0a)) {
1549                 isOK = 2;
1550
1551                 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1552                 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == 0x0a)) {
1553                         isOK = 1;
1554                 };
1555         };
1556
1557         // From iceman1001: removed the if,  since some magic tags misbehavies and send an answer to it.
1558         mifare_classic_halt(NULL, 0);
1559
1560         cmd_send(CMD_ACK,isOK,0,0,0,0);
1561 }
1562
1563 //
1564 // DESFIRE
1565 //
1566
1567 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1568
1569         byte_t dataout[11] = {0x00};
1570         uint8_t uid[10] = {0x00};
1571         uint32_t cuid;
1572
1573         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1574         clear_trace();
1575
1576         int len = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
1577         if(!len) {
1578                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1579                 OnError(1);
1580                 return;
1581         };
1582
1583         if(mifare_desfire_des_auth1(cuid, dataout)){
1584                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1585                 OnError(4);
1586                 return;
1587         }
1588
1589         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1590     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1591 }
1592
1593 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1594
1595         uint32_t cuid = arg0;
1596         uint8_t key[16] = {0x00};
1597         byte_t isOK = 0;
1598         byte_t dataout[12] = {0x00};
1599
1600         memcpy(key, datain, 16);
1601
1602         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1603
1604         if( isOK) {
1605                 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1606                 OnError(4);
1607                 return;
1608         }
1609
1610         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1611
1612         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1613         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1614         LEDsoff();
1615 }
1616
1617 void OnSuccess(){
1618         pcb_blocknum = 0;
1619         ReaderTransmit(deselect_cmd, 3 , NULL);
1620         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1621         LEDsoff();
1622 }
1623
1624 void OnError(uint8_t reason){
1625         pcb_blocknum = 0;
1626         ReaderTransmit(deselect_cmd, 3 , NULL);
1627         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1628         cmd_send(CMD_ACK,0,reason,0,0,0);
1629         LEDsoff();
1630 }