]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Fix #912
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17
18 #include <stdint.h>
19
20 #include "proxmark3.h"
21 #include "usb_cdc.h"
22 #include "crapto1/crapto1.h"
23 #include "iso14443a.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "apps.h"
27 #include "protocols.h"
28 #include "util.h"
29 #include "parity.h"
30 #include "crc.h"
31 #include "fpgaloader.h"
32
33 #define HARDNESTED_AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)
34 #define HARDNESTED_PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication
35
36 /*
37 // the block number for the ISO14443-4 PCB
38 static uint8_t pcb_blocknum = 0;
39 // Deselect card by sending a s-block. the crc is precalced for speed
40 static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
41
42 static void OnSuccess(){
43 pcb_blocknum = 0;
44 ReaderTransmit(deselect_cmd, 3 , NULL);
45 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
46 LEDsoff();
47 }
48 */
49
50 static void OnError(uint8_t reason){
51 // pcb_blocknum = 0;
52 // ReaderTransmit(deselect_cmd, 3 , NULL);
53 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
54 LED_D_OFF();
55 cmd_send(CMD_ACK,0,reason,0,0,0);
56 LED_A_OFF();
57 }
58
59 //-----------------------------------------------------------------------------
60 // Select, Authenticate, Read a MIFARE tag.
61 // read block
62 //-----------------------------------------------------------------------------
63 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
64 {
65 LED_A_ON();
66
67 uint8_t blockNo = arg0;
68 uint8_t keyType = arg1;
69 uint64_t ui64Key = 0;
70 ui64Key = bytes_to_num(datain, 6);
71
72 byte_t isOK = 0;
73 byte_t dataoutbuf[16];
74 uint8_t uid[10];
75 uint32_t cuid;
76 struct Crypto1State mpcs = {0, 0};
77 struct Crypto1State *pcs;
78 pcs = &mpcs;
79
80 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
81
82 clear_trace();
83
84 while (true) {
85 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
86 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
87 break;
88 };
89
90 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
91 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
92 break;
93 };
94
95 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
96 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
97 break;
98 };
99
100 if(mifare_classic_halt(pcs, cuid)) {
101 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
102 break;
103 };
104
105 isOK = 1;
106 break;
107 }
108
109 // ----------------------------- crypto1 destroy
110 crypto1_destroy(pcs);
111
112 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
113
114 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
115
116 LED_B_ON();
117 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
118 LED_B_OFF();
119
120 LEDsoff();
121 }
122
123 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
124
125 LED_A_ON();
126 bool turnOffField = (arg0 == 1);
127
128 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
129
130 if (!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
131 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
132 OnError(0);
133 return;
134 };
135
136 if (!mifare_ultra_auth(keybytes)){
137 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
138 OnError(1);
139 return;
140 }
141
142 if (turnOffField) {
143 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
144 LED_D_OFF();
145 }
146
147 cmd_send(CMD_ACK,1,0,0,0,0);
148 LED_A_OFF();
149 }
150
151 // Arg0 = BlockNo,
152 // Arg1 = UsePwd bool
153 // datain = PWD bytes,
154 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
155 {
156 LED_A_ON();
157
158 uint8_t blockNo = arg0;
159 byte_t dataout[16] = {0x00};
160 bool useKey = (arg1 == 1); //UL_C
161 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
162
163 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
164
165 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
166 if(!len) {
167 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
168 OnError(1);
169 return;
170 }
171
172 // UL-C authentication
173 if (useKey) {
174 uint8_t key[16] = {0x00};
175 memcpy(key, datain, sizeof(key) );
176
177 if ( !mifare_ultra_auth(key) ) {
178 OnError(1);
179 return;
180 }
181 }
182
183 // UL-EV1 / NTAG authentication
184 if (usePwd) {
185 uint8_t pwd[4] = {0x00};
186 memcpy(pwd, datain, 4);
187 uint8_t pack[4] = {0,0,0,0};
188 if (!mifare_ul_ev1_auth(pwd, pack)) {
189 OnError(1);
190 return;
191 }
192 }
193
194 if (mifare_ultra_readblock(blockNo, dataout)) {
195 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
196 OnError(2);
197 return;
198 }
199
200 if (mifare_ultra_halt()) {
201 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
202 OnError(3);
203 return;
204 }
205
206 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
207 LED_D_OFF();
208
209 cmd_send(CMD_ACK,1,0,0,dataout,16);
210 LED_A_OFF();
211 }
212
213 //-----------------------------------------------------------------------------
214 // Select, Authenticate, Read a MIFARE tag.
215 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
216 //-----------------------------------------------------------------------------
217 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
218 {
219 // params
220 uint8_t sectorNo = arg0;
221 uint8_t keyType = arg1;
222 uint64_t ui64Key = 0;
223 ui64Key = bytes_to_num(datain, 6);
224
225 // variables
226 byte_t isOK = 0;
227 byte_t dataoutbuf[16 * 16];
228 uint8_t uid[10];
229 uint32_t cuid;
230 struct Crypto1State mpcs = {0, 0};
231 struct Crypto1State *pcs;
232 pcs = &mpcs;
233
234 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
235
236 clear_trace();
237
238 LED_A_ON();
239 LED_B_OFF();
240 LED_C_OFF();
241
242 isOK = 1;
243 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
244 isOK = 0;
245 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
246 }
247
248
249 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
250 isOK = 0;
251 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
252 }
253
254 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
255 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
256 isOK = 0;
257 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
258 break;
259 }
260 }
261
262 if(mifare_classic_halt(pcs, cuid)) {
263 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
264 }
265
266 // ----------------------------- crypto1 destroy
267 crypto1_destroy(pcs);
268
269 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
270
271 // Thats it...
272 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
273
274 LED_B_ON();
275 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
276 LED_B_OFF();
277
278 LEDsoff();
279 }
280
281 // arg0 = blockNo (start)
282 // arg1 = Pages (number of blocks)
283 // arg2 = useKey
284 // datain = KEY bytes
285 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
286 {
287 LED_A_ON();
288 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
289
290 // free eventually allocated BigBuf memory
291 BigBuf_free();
292
293 // params
294 uint8_t blockNo = arg0;
295 uint16_t blocks = arg1;
296 bool useKey = (arg2 == 1); //UL_C
297 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
298 uint32_t countblocks = 0;
299 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
300 if (dataout == NULL){
301 Dbprintf("out of memory");
302 OnError(1);
303 return;
304 }
305
306 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
307 if (!len) {
308 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
309 OnError(1);
310 return;
311 }
312
313 // UL-C authentication
314 if (useKey) {
315 uint8_t key[16] = {0x00};
316 memcpy(key, datain, sizeof(key) );
317
318 if ( !mifare_ultra_auth(key) ) {
319 OnError(1);
320 return;
321 }
322 }
323
324 // UL-EV1 / NTAG authentication
325 if (usePwd) {
326 uint8_t pwd[4] = {0x00};
327 memcpy(pwd, datain, sizeof(pwd));
328 uint8_t pack[4] = {0,0,0,0};
329
330 if (!mifare_ul_ev1_auth(pwd, pack)){
331 OnError(1);
332 return;
333 }
334 }
335
336 for (int i = 0; i < blocks; i++){
337 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
338 Dbprintf("Data exceeds buffer!!");
339 break;
340 }
341
342 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
343
344 if (len) {
345 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
346 // if no blocks read - error out
347 if (i==0){
348 OnError(2);
349 return;
350 } else {
351 //stop at last successful read block and return what we got
352 break;
353 }
354 } else {
355 countblocks++;
356 }
357 }
358
359 len = mifare_ultra_halt();
360 if (len) {
361 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
362 OnError(3);
363 return;
364 }
365
366 if (MF_DBGLEVEL >= MF_DBG_DEBUG) Dbprintf("Blocks read %d", countblocks);
367
368 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
369 LED_D_OFF();
370
371 cmd_send(CMD_ACK, 1, countblocks*4, BigBuf_max_traceLen(), 0, 0);
372
373 BigBuf_free();
374 LED_A_OFF();
375 }
376
377 //-----------------------------------------------------------------------------
378 // Select, Authenticate, Write a MIFARE tag.
379 // read block
380 //-----------------------------------------------------------------------------
381 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
382 {
383 // params
384 uint8_t blockNo = arg0;
385 uint8_t keyType = arg1;
386 uint64_t ui64Key = 0;
387 byte_t blockdata[16];
388
389 ui64Key = bytes_to_num(datain, 6);
390 memcpy(blockdata, datain + 10, 16);
391
392 // variables
393 byte_t isOK = 0;
394 uint8_t uid[10];
395 uint32_t cuid;
396 struct Crypto1State mpcs = {0, 0};
397 struct Crypto1State *pcs;
398 pcs = &mpcs;
399
400 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
401
402 clear_trace();
403
404 LED_A_ON();
405 LED_B_OFF();
406 LED_C_OFF();
407
408 while (true) {
409 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
410 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
411 break;
412 };
413
414 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
415 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
416 break;
417 };
418
419 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
420 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
421 break;
422 };
423
424 if(mifare_classic_halt(pcs, cuid)) {
425 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
426 break;
427 };
428
429 isOK = 1;
430 break;
431 }
432
433 // ----------------------------- crypto1 destroy
434 crypto1_destroy(pcs);
435
436 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
437
438 // Thats it...
439 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
440
441 LED_B_ON();
442 cmd_send(CMD_ACK,isOK,0,0,0,0);
443 LED_B_OFF();
444
445
446 LEDsoff();
447 }
448
449 /* // Command not needed but left for future testing
450 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
451 {
452 uint8_t blockNo = arg0;
453 byte_t blockdata[16] = {0x00};
454
455 memcpy(blockdata, datain, 16);
456
457 uint8_t uid[10] = {0x00};
458
459 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
460
461 clear_trace();
462 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
463
464 if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
465 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
466 OnError(0);
467 return;
468 };
469
470 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
471 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
472 OnError(0);
473 return; };
474
475 if(mifare_ultra_halt()) {
476 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
477 OnError(0);
478 return;
479 };
480
481 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
482
483 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
484
485 cmd_send(CMD_ACK,1,0,0,0,0);
486 LEDsoff();
487 }
488 */
489
490 // Arg0 : Block to write to.
491 // Arg1 : 0 = use no authentication.
492 // 1 = use 0x1A authentication.
493 // 2 = use 0x1B authentication.
494 // datain : 4 first bytes is data to be written.
495 // : 4/16 next bytes is authentication key.
496 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
497 {
498 uint8_t blockNo = arg0;
499 bool useKey = (arg1 == 1); //UL_C
500 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
501 byte_t blockdata[4] = {0x00};
502
503 memcpy(blockdata, datain,4);
504
505 LEDsoff();
506 LED_A_ON();
507 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
508
509 clear_trace();
510
511 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
512 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
513 OnError(0);
514 return;
515 };
516
517 // UL-C authentication
518 if ( useKey ) {
519 uint8_t key[16] = {0x00};
520 memcpy(key, datain+4, sizeof(key) );
521
522 if ( !mifare_ultra_auth(key) ) {
523 OnError(1);
524 return;
525 }
526 }
527
528 // UL-EV1 / NTAG authentication
529 if (usePwd) {
530 uint8_t pwd[4] = {0x00};
531 memcpy(pwd, datain+4, 4);
532 uint8_t pack[4] = {0,0,0,0};
533 if (!mifare_ul_ev1_auth(pwd, pack)) {
534 OnError(1);
535 return;
536 }
537 }
538
539 if(mifare_ultra_writeblock(blockNo, blockdata)) {
540 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
541 OnError(0);
542 return;
543 };
544
545 if(mifare_ultra_halt()) {
546 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
547 OnError(0);
548 return;
549 };
550
551 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
552
553 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
554
555 cmd_send(CMD_ACK,1,0,0,0,0);
556 LEDsoff();
557 }
558
559 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
560
561 uint8_t pwd[16] = {0x00};
562 byte_t blockdata[4] = {0x00};
563
564 memcpy(pwd, datain, 16);
565
566 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
567 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
568
569 clear_trace();
570
571 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
572 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
573 OnError(0);
574 return;
575 };
576
577 blockdata[0] = pwd[7];
578 blockdata[1] = pwd[6];
579 blockdata[2] = pwd[5];
580 blockdata[3] = pwd[4];
581 if(mifare_ultra_writeblock( 44, blockdata)) {
582 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
583 OnError(44);
584 return;
585 };
586
587 blockdata[0] = pwd[3];
588 blockdata[1] = pwd[2];
589 blockdata[2] = pwd[1];
590 blockdata[3] = pwd[0];
591 if(mifare_ultra_writeblock( 45, blockdata)) {
592 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
593 OnError(45);
594 return;
595 };
596
597 blockdata[0] = pwd[15];
598 blockdata[1] = pwd[14];
599 blockdata[2] = pwd[13];
600 blockdata[3] = pwd[12];
601 if(mifare_ultra_writeblock( 46, blockdata)) {
602 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
603 OnError(46);
604 return;
605 };
606
607 blockdata[0] = pwd[11];
608 blockdata[1] = pwd[10];
609 blockdata[2] = pwd[9];
610 blockdata[3] = pwd[8];
611 if(mifare_ultra_writeblock( 47, blockdata)) {
612 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
613 OnError(47);
614 return;
615 };
616
617 if(mifare_ultra_halt()) {
618 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
619 OnError(0);
620 return;
621 };
622
623 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
624
625 cmd_send(CMD_ACK,1,0,0,0,0);
626 LEDsoff();
627 }
628
629 // Return 1 if the nonce is invalid else return 0
630 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
631 return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
632 (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
633 (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
634 }
635
636
637 //-----------------------------------------------------------------------------
638 // acquire encrypted nonces in order to perform the attack described in
639 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
640 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
641 // Computer and Communications Security, 2015
642 //-----------------------------------------------------------------------------
643 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
644 {
645 uint64_t ui64Key = 0;
646 uint8_t uid[10];
647 uint32_t cuid;
648 uint8_t cascade_levels = 0;
649 struct Crypto1State mpcs = {0, 0};
650 struct Crypto1State *pcs;
651 pcs = &mpcs;
652 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
653 int16_t isOK = 0;
654 uint8_t par_enc[1];
655 uint8_t nt_par_enc = 0;
656 uint8_t buf[USB_CMD_DATA_SIZE];
657 uint32_t timeout;
658
659 uint8_t blockNo = arg0 & 0xff;
660 uint8_t keyType = (arg0 >> 8) & 0xff;
661 uint8_t targetBlockNo = arg1 & 0xff;
662 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
663 ui64Key = bytes_to_num(datain, 6);
664 bool initialize = flags & 0x0001;
665 bool slow = flags & 0x0002;
666 bool field_off = flags & 0x0004;
667
668 LED_A_ON();
669 LED_C_OFF();
670
671 if (initialize) {
672 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
673 clear_trace();
674 set_tracing(true);
675 }
676
677 LED_C_ON();
678
679 uint16_t num_nonces = 0;
680 bool have_uid = false;
681 for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
682
683 // Test if the action was cancelled
684 if(BUTTON_PRESS()) {
685 isOK = 2;
686 field_off = true;
687 break;
688 }
689
690 if (!have_uid) { // need a full select cycle to get the uid first
691 iso14a_card_select_t card_info;
692 if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
693 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");
694 continue;
695 }
696 switch (card_info.uidlen) {
697 case 4 : cascade_levels = 1; break;
698 case 7 : cascade_levels = 2; break;
699 case 10: cascade_levels = 3; break;
700 default: break;
701 }
702 have_uid = true;
703 } else { // no need for anticollision. We can directly select the card
704 if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
705 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");
706 continue;
707 }
708 }
709
710 if (slow) {
711 timeout = GetCountSspClk() + HARDNESTED_PRE_AUTHENTICATION_LEADTIME;
712 while(GetCountSspClk() < timeout);
713 }
714
715 uint32_t nt1;
716 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL, NULL)) {
717 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
718 continue;
719 }
720
721 // nested authentication
722 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
723 if (len != 4) {
724 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
725 continue;
726 }
727
728 // send an incomplete dummy response in order to trigger the card's authentication failure timeout
729 uint8_t dummy_answer[1] = {0};
730 ReaderTransmit(dummy_answer, 1, NULL);
731
732 timeout = GetCountSspClk() + HARDNESTED_AUTHENTICATION_TIMEOUT;
733
734 num_nonces++;
735 if (num_nonces % 2) {
736 memcpy(buf+i, receivedAnswer, 4);
737 nt_par_enc = par_enc[0] & 0xf0;
738 } else {
739 nt_par_enc |= par_enc[0] >> 4;
740 memcpy(buf+i+4, receivedAnswer, 4);
741 memcpy(buf+i+8, &nt_par_enc, 1);
742 i += 9;
743 }
744
745 // wait for the card to become ready again
746 while(GetCountSspClk() < timeout);
747
748 }
749
750 LED_C_OFF();
751
752 crypto1_destroy(pcs);
753
754 if (field_off) {
755 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
756 LEDsoff();
757 }
758
759 LED_B_ON();
760 cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
761 LED_B_OFF();
762
763 if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
764
765 }
766
767
768 //-----------------------------------------------------------------------------
769 // MIFARE nested authentication.
770 //
771 //-----------------------------------------------------------------------------
772 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) {
773
774 uint8_t blockNo = arg0 & 0xff;
775 uint8_t keyType = (arg0 >> 8) & 0xff;
776 uint8_t targetBlockNo = arg1 & 0xff;
777 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
778 uint64_t ui64Key = 0;
779
780 ui64Key = bytes_to_num(datain, 6);
781
782 uint16_t rtr, i, j, len;
783 uint16_t davg;
784 static uint16_t dmin, dmax;
785 uint8_t uid[10];
786 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
787 uint8_t par[1];
788 uint32_t target_nt[2], target_ks[2];
789 uint8_t target_nt_duplicate_count = 0;
790
791 uint8_t par_array[4];
792 uint16_t ncount = 0;
793 struct Crypto1State mpcs = {0, 0};
794 struct Crypto1State *pcs;
795 pcs = &mpcs;
796 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
797
798 uint32_t auth1_time, auth2_time, authentication_timeout = 0;
799 static uint16_t delta_time;
800
801 LED_A_ON();
802 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
803
804 // free eventually allocated BigBuf memory
805 BigBuf_free();
806
807 if (calibrate) clear_trace();
808 set_tracing(true);
809
810 // statistics on nonce distance
811 int16_t isOK = 0;
812 #define NESTED_MAX_TRIES 12
813 uint16_t unsuccessfull_tries = 0;
814 if (calibrate) { // for first call only. Otherwise reuse previous calibration
815 LED_B_ON();
816 WDT_HIT();
817
818 davg = dmax = 0;
819 dmin = 2000;
820 delta_time = 0;
821
822 for (rtr = 0; rtr < 17; rtr++) {
823
824 // prepare next select. No need to power down the card.
825 if (mifare_classic_halt(pcs, cuid)) {
826 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
827 rtr--;
828 continue;
829 }
830
831 // Test if the action was cancelled
832 if (BUTTON_PRESS()) {
833 isOK = -2;
834 break;
835 }
836
837 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
838 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
839 rtr--;
840 continue;
841 };
842
843 auth1_time = 0;
844 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, NULL)) {
845 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
846 rtr--;
847 continue;
848 };
849
850 if (delta_time) {
851 auth2_time = auth1_time + delta_time;
852 } else {
853 auth2_time = 0;
854 }
855 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {
856 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
857 rtr--;
858 continue;
859 };
860
861 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
862 for (i = 101; i < 1200; i++) {
863 nttmp = prng_successor(nttmp, 1);
864 if (nttmp == nt2) break;
865 }
866
867 if (i != 1200) {
868 if (rtr != 0) {
869 davg += i;
870 dmin = MIN(dmin, i);
871 dmax = MAX(dmax, i);
872 }
873 else {
874 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
875 }
876 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
877 } else {
878 unsuccessfull_tries++;
879 if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)
880 isOK = -3;
881 }
882 }
883 }
884
885 davg = (davg + (rtr - 1)/2) / (rtr - 1);
886
887 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
888
889 dmin = davg - 2;
890 dmax = davg + 2;
891
892 LED_B_OFF();
893
894 }
895 // -------------------------------------------------------------------------------------------------
896
897 LED_C_ON();
898
899 // get crypted nonces for target sector
900 for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
901
902 target_nt[i] = 0;
903 while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
904
905 // prepare next select. No need to power down the card.
906 if(mifare_classic_halt(pcs, cuid)) {
907 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
908 continue;
909 }
910
911 // break out of the loop on button press
912 if (BUTTON_PRESS()) {
913 isOK = -2;
914 break;
915 }
916
917 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
918 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
919 continue;
920 }
921
922 auth1_time = 0;
923 authentication_timeout = 0;
924 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, &authentication_timeout)) {
925 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
926 continue;
927 }
928
929 // nested authentication
930 auth2_time = auth1_time + delta_time;
931 len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
932 if (len != 4) {
933 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
934 continue;
935 }
936
937 nt2 = bytes_to_num(receivedAnswer, 4);
938 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
939
940 // Parity validity check
941 for (j = 0; j < 4; j++) {
942 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
943 }
944
945 ncount = 0;
946 nttest = prng_successor(nt1, dmin - 1);
947 for (j = dmin; j < dmax + 1; j++) {
948 nttest = prng_successor(nttest, 1);
949 ks1 = nt2 ^ nttest;
950
951 if (valid_nonce(nttest, nt2, ks1, par_array)){
952 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
953 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
954 target_nt[i] = 0;
955 break;
956 }
957 target_nt[i] = nttest;
958 target_ks[i] = ks1;
959 ncount++;
960 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
961 if( ++target_nt_duplicate_count >= NESTED_MAX_TRIES ) { // unable to get a 2nd nonce after NESTED_MAX_TRIES tries, probably a fixed nonce
962 if (MF_DBGLEVEL >= 2) Dbprintf("Nonce#2: cannot get nonce that != nonce#1, continuing anyway with single nonce! ntdist=%d", j);
963 break;
964 }
965
966 target_nt[1] = 0;
967 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
968 break;
969 }
970 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
971 }
972 }
973 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
974 }
975 }
976
977 LED_C_OFF();
978
979 // ----------------------------- crypto1 destroy
980 crypto1_destroy(pcs);
981
982 uint8_t buf[4 + 4 * 4 + 4];
983 memcpy(buf, &cuid, 4);
984 memcpy(buf+4, &target_nt[0], 4);
985 memcpy(buf+8, &target_ks[0], 4);
986 memcpy(buf+12, &target_nt[1], 4);
987 memcpy(buf+16, &target_ks[1], 4);
988 memcpy(buf+20, &authentication_timeout, 4);
989
990 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
991
992 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
993
994 LED_B_ON();
995 cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
996 LED_B_OFF();
997
998 LEDsoff();
999 }
1000
1001
1002 //-----------------------------------------------------------------------------
1003 // MIFARE check keys. key count up to 85.
1004 //
1005 //-----------------------------------------------------------------------------
1006 void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain) {
1007
1008 uint8_t blockNo = arg0 & 0xff;
1009 uint8_t keyType = arg0 >> 8;
1010 bool clearTrace = arg1 & 0x01;
1011 bool multisectorCheck = arg1 & 0x02;
1012 bool init = arg1 & 0x04;
1013 bool drop_field = arg1 & 0x08;
1014 uint32_t auth_timeout = arg1 >> 16;
1015 uint8_t keyCount = arg2;
1016
1017 LED_A_ON();
1018
1019 if (init) {
1020 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1021 }
1022
1023 if (clearTrace) {
1024 clear_trace();
1025 }
1026 set_tracing(true);
1027
1028 // clear debug level. We are expecting lots of authentication failures...
1029 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
1030 MF_DBGLEVEL = MF_DBG_NONE;
1031
1032 int res = 0;
1033 if (multisectorCheck) {
1034 TKeyIndex keyIndex = {{0}};
1035 uint8_t sectorCnt = blockNo;
1036 res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, &auth_timeout, OLD_MF_DBGLEVEL, &keyIndex);
1037 if (res >= 0) {
1038 cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);
1039 } else {
1040 cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
1041 }
1042 } else {
1043 res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
1044 if (res > 0) {
1045 cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
1046 } else {
1047 cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
1048 }
1049 }
1050
1051 if (drop_field || res != 0) {
1052 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1053 LED_D_OFF();
1054 }
1055
1056 // restore debug level
1057 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1058
1059 LED_A_OFF();
1060 }
1061
1062
1063 //-----------------------------------------------------------------------------
1064 // MIFARE Personalize UID. Only for Mifare Classic EV1 7Byte UID
1065 //-----------------------------------------------------------------------------
1066 void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data) {
1067
1068 uint8_t uid[10];
1069 uint32_t cuid;
1070 struct Crypto1State mpcs = {0, 0};
1071 struct Crypto1State *pcs;
1072 pcs = &mpcs;
1073
1074 LED_A_ON();
1075 clear_trace();
1076
1077 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1078
1079 bool isOK = false;
1080 while (true) {
1081 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1082 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1083 break;
1084 }
1085
1086 uint8_t block_number = 0;
1087 uint64_t key = bytes_to_num(data, 6);
1088 if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST, NULL)) {
1089 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
1090 break;
1091 }
1092
1093 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1094 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1095 int len = mifare_sendcmd_short(pcs, true, MIFARE_EV1_PERSONAL_UID, perso_option, receivedAnswer, receivedAnswerPar, NULL);
1096 if (len != 1 || receivedAnswer[0] != CARD_ACK) {
1097 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
1098 break;;
1099 }
1100 isOK = true;
1101 break;
1102 }
1103
1104 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1105 LED_D_OFF();
1106
1107 crypto1_destroy(pcs);
1108
1109 if (MF_DBGLEVEL >= 2) DbpString("PERSONALIZE UID FINISHED");
1110
1111 cmd_send(CMD_ACK, isOK, 0, 0, NULL, 0);
1112
1113 LED_A_OFF();
1114 }
1115
1116 //-----------------------------------------------------------------------------
1117 // MIFARE commands set debug level
1118 //
1119 //-----------------------------------------------------------------------------
1120 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1121 MF_DBGLEVEL = arg0;
1122 Dbprintf("Debug level: %d", MF_DBGLEVEL);
1123 }
1124
1125 //-----------------------------------------------------------------------------
1126 // Work with emulator memory
1127 //
1128 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1129 // involved in dealing with emulator memory. But if it is called later, it might
1130 // destroy the Emulator Memory.
1131 //-----------------------------------------------------------------------------
1132
1133 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1134 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1135 emlClearMem();
1136 }
1137
1138 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1139 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1140 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
1141 }
1142
1143 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1144 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1145 byte_t buf[USB_CMD_DATA_SIZE];
1146 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1147
1148 LED_B_ON();
1149 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1150 LED_B_OFF();
1151 }
1152
1153 //-----------------------------------------------------------------------------
1154 // Load a card into the emulator memory
1155 //
1156 //-----------------------------------------------------------------------------
1157 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1158 uint8_t numSectors = arg0;
1159 uint8_t keyType = arg1;
1160 uint64_t ui64Key = 0;
1161 uint32_t cuid;
1162 struct Crypto1State mpcs = {0, 0};
1163 struct Crypto1State *pcs;
1164 pcs = &mpcs;
1165
1166 // variables
1167 byte_t dataoutbuf[16];
1168 byte_t dataoutbuf2[16];
1169 uint8_t uid[10];
1170
1171 LED_A_ON();
1172 LED_B_OFF();
1173 LED_C_OFF();
1174 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1175
1176 clear_trace();
1177 set_tracing(false);
1178
1179 bool isOK = true;
1180
1181 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1182 isOK = false;
1183 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1184 }
1185
1186 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1187 ui64Key = emlGetKey(sectorNo, keyType);
1188 if (sectorNo == 0){
1189 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
1190 isOK = false;
1191 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1192 break;
1193 }
1194 } else {
1195 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED, NULL)) {
1196 isOK = false;
1197 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1198 break;
1199 }
1200 }
1201
1202 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1203 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1204 isOK = false;
1205 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1206 break;
1207 };
1208 if (isOK) {
1209 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1210 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1211 } else { // sector trailer, keep the keys, set only the AC
1212 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1213 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1214 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1215 }
1216 }
1217 }
1218
1219 }
1220
1221 if(mifare_classic_halt(pcs, cuid)) {
1222 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1223 };
1224
1225 // ----------------------------- crypto1 destroy
1226 crypto1_destroy(pcs);
1227
1228 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1229 LEDsoff();
1230
1231 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1232
1233 }
1234
1235
1236 //-----------------------------------------------------------------------------
1237 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1238 //
1239 //-----------------------------------------------------------------------------
1240
1241 static bool isBlockTrailer(int blockN) {
1242 if (blockN >= 0 && blockN < 128) {
1243 return ((blockN & 0x03) == 0x03);
1244 }
1245 if (blockN >= 128 && blockN <= 256) {
1246 return ((blockN & 0x0F) == 0x0F);
1247 }
1248 return false;
1249 }
1250
1251 void MifareCWipe(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1252 // var
1253 byte_t isOK = 0;
1254 uint32_t numBlocks = arg0;
1255 // cmdParams:
1256 // bit 0 - wipe gen1a
1257 // bit 1 - fill card with default data
1258 // bit 2 - gen1a = 0, gen1b = 1
1259 uint8_t cmdParams = arg1;
1260 bool needWipe = cmdParams & 0x01;
1261 bool needFill = cmdParams & 0x02;
1262 bool gen1b = cmdParams & 0x04;
1263
1264 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1265 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1266
1267 uint8_t block0[16] = {0x01, 0x02, 0x03, 0x04, 0x04, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0xAF};
1268 uint8_t block1[16] = {0x00};
1269 uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
1270 uint8_t d_block[18] = {0x00};
1271
1272 // card commands
1273 uint8_t wupC1[] = { 0x40 };
1274 uint8_t wupC2[] = { 0x43 };
1275 uint8_t wipeC[] = { 0x41 };
1276
1277 // iso14443 setup
1278 LED_A_ON();
1279 LED_B_OFF();
1280 LED_C_OFF();
1281 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1282
1283 // tracing
1284 clear_trace();
1285 set_tracing(true);
1286
1287 while (true){
1288 // wipe
1289 if (needWipe){
1290 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1291 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1292 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1293 break;
1294 };
1295
1296 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1297 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1298 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1299 break;
1300 };
1301
1302 if(mifare_classic_halt(NULL, 0)) {
1303 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1304 };
1305 };
1306
1307 // put default data
1308 if (needFill){
1309 // select commands
1310 ReaderTransmitBitsPar(wupC1, 7, 0, NULL);
1311
1312 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1313 if (!gen1b) {
1314
1315 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1316 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1317 break;
1318 };
1319
1320 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1321 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1322 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1323 break;
1324 };
1325 }
1326
1327 // send blocks command
1328 for (int blockNo = 0; blockNo < numBlocks; blockNo++) {
1329 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1330 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1331 break;
1332 };
1333
1334 // check type of block and add crc
1335 if (!isBlockTrailer(blockNo)){
1336 memcpy(d_block, block1, 16);
1337 } else {
1338 memcpy(d_block, blockK, 16);
1339 }
1340 if (blockNo == 0) {
1341 memcpy(d_block, block0, 16);
1342 }
1343 AppendCrc14443a(d_block, 16);
1344
1345 // send write command
1346 ReaderTransmit(d_block, sizeof(d_block), NULL);
1347 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1348 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1349 break;
1350 };
1351 }
1352
1353 // halt
1354 // do no issue halt command for gen1b
1355 if (!gen1b) {
1356 if (mifare_classic_halt(NULL, 0)) {
1357 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1358 break;
1359 }
1360 }
1361 }
1362 break;
1363 }
1364
1365 // reset fpga
1366 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1367
1368 // send USB response
1369 LED_B_ON();
1370 cmd_send(CMD_ACK,isOK,0,0,NULL,0);
1371 LED_B_OFF();
1372
1373 LEDsoff();
1374
1375 return;
1376 }
1377
1378 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1379
1380 // params
1381 uint8_t needWipe = arg0;
1382 // bit 0 - need get UID
1383 // bit 1 - need wupC
1384 // bit 2 - need HALT after sequence
1385 // bit 3 - need init FPGA and field before sequence
1386 // bit 4 - need reset FPGA and LED
1387 // bit 6 - gen1b backdoor type
1388 uint8_t workFlags = arg1;
1389 uint8_t blockNo = arg2;
1390
1391 // card commands
1392 uint8_t wupC1[] = { 0x40 };
1393 uint8_t wupC2[] = { 0x43 };
1394 uint8_t wipeC[] = { 0x41 };
1395
1396 // variables
1397 byte_t isOK = 0;
1398 uint8_t uid[10] = {0x00};
1399 uint8_t d_block[18] = {0x00};
1400 uint32_t cuid;
1401
1402 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1403 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1404
1405 // reset FPGA and LED
1406 if (workFlags & 0x08) {
1407 LED_A_ON();
1408 LED_B_OFF();
1409 LED_C_OFF();
1410 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1411
1412 clear_trace();
1413 set_tracing(true);
1414 }
1415
1416 while (true) {
1417
1418 // get UID from chip
1419 if (workFlags & 0x01) {
1420 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1421 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1422 // Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work.
1423 //break;
1424 };
1425
1426 if(mifare_classic_halt(NULL, cuid)) {
1427 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1428 // Continue, some magic tags misbehavies and send an answer to it.
1429 // break;
1430 };
1431 };
1432
1433 // reset chip
1434 // Wipe command don't work with gen1b
1435 if (needWipe && !(workFlags & 0x40)){
1436 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1437 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1438 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1439 break;
1440 };
1441
1442 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1443 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1444 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1445 break;
1446 };
1447
1448 if(mifare_classic_halt(NULL, 0)) {
1449 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1450 // Continue, some magic tags misbehavies and send an answer to it.
1451 // break;
1452 };
1453 };
1454
1455 // write block
1456 if (workFlags & 0x02) {
1457 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1458
1459 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1460 if (!(workFlags & 0x40)) {
1461
1462 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1463 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1464 break;
1465 };
1466
1467 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1468 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1469 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1470 break;
1471 };
1472 }
1473 }
1474
1475 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1476 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1477 break;
1478 };
1479
1480 memcpy(d_block, datain, 16);
1481 AppendCrc14443a(d_block, 16);
1482
1483 ReaderTransmit(d_block, sizeof(d_block), NULL);
1484 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1485 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1486 break;
1487 };
1488
1489 if (workFlags & 0x04) {
1490 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1491 if (!(workFlags & 0x40)) {
1492 if (mifare_classic_halt(NULL, 0)) {
1493 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1494 // Continue, some magic tags misbehavies and send an answer to it.
1495 // break;
1496 }
1497 }
1498 }
1499
1500 isOK = 1;
1501 break;
1502 }
1503
1504 if ((workFlags & 0x10) || (!isOK)) {
1505 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1506 }
1507
1508 LED_B_ON();
1509 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1510 LED_B_OFF();
1511
1512 LEDsoff();
1513 }
1514
1515
1516 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1517
1518 // params
1519 // bit 1 - need wupC
1520 // bit 2 - need HALT after sequence
1521 // bit 3 - need init FPGA and field before sequence
1522 // bit 4 - need reset FPGA and LED
1523 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1524 // bit 6 - gen1b backdoor type
1525 uint8_t workFlags = arg0;
1526 uint8_t blockNo = arg2;
1527
1528 // card commands
1529 uint8_t wupC1[] = { 0x40 };
1530 uint8_t wupC2[] = { 0x43 };
1531
1532 // variables
1533 byte_t isOK = 0;
1534 uint8_t data[18] = {0x00};
1535 uint32_t cuid = 0;
1536
1537 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1538 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1539
1540 if (workFlags & 0x08) {
1541 LED_A_ON();
1542 LED_B_OFF();
1543 LED_C_OFF();
1544 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1545
1546 clear_trace();
1547 set_tracing(true);
1548 }
1549
1550 while (true) {
1551 if (workFlags & 0x02) {
1552 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1553 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1554 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1555 break;
1556 };
1557 // do no issue for gen1b magic tag
1558 if (!(workFlags & 0x40)) {
1559 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1560 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1561 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1562 break;
1563 };
1564 }
1565 }
1566
1567 // read block
1568 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1569 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1570 break;
1571 };
1572 memcpy(data, receivedAnswer, 18);
1573
1574 if (workFlags & 0x04) {
1575 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1576 if (!(workFlags & 0x40)) {
1577 if (mifare_classic_halt(NULL, cuid)) {
1578 if (MF_DBGLEVEL > 1) Dbprintf("Halt error");
1579 // Continue, some magic tags misbehavies and send an answer to it.
1580 // break;
1581 }
1582 }
1583 }
1584
1585 isOK = 1;
1586 break;
1587 }
1588
1589 if ((workFlags & 0x10) || (!isOK)) {
1590 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1591 }
1592
1593 LED_B_ON();
1594 if (workFlags & 0x20) {
1595 if (isOK)
1596 memcpy(datain, data, 18);
1597 }
1598 else
1599 cmd_send(CMD_ACK,isOK,0,0,data,18);
1600 LED_B_OFF();
1601
1602 LEDsoff();
1603 }
1604
1605 void MifareCIdent(){
1606
1607 // card commands
1608 uint8_t wupC1[] = { 0x40 };
1609 uint8_t wupC2[] = { 0x43 };
1610
1611 // variables
1612 byte_t isOK = 0;
1613
1614 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1615 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1616
1617 LED_A_ON();
1618 LED_B_OFF();
1619 LED_C_OFF();
1620 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1621
1622 clear_trace();
1623 set_tracing(true);
1624
1625 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1626 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1627 isOK = 2;
1628
1629 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1630 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1631 isOK = 1;
1632 };
1633 };
1634
1635 // From iceman1001: removed the if, since some magic tags misbehavies and send an answer to it.
1636 mifare_classic_halt(NULL, 0);
1637
1638 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1639
1640 LED_B_ON();
1641 cmd_send(CMD_ACK,isOK,0,0,0,0);
1642 LED_B_OFF();
1643
1644 LEDsoff();
1645 }
1646
1647 //
1648 // DESFIRE
1649 //
1650
1651 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1652
1653 byte_t dataout[11] = {0x00};
1654 uint8_t uid[10] = {0x00};
1655 uint32_t cuid;
1656
1657 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1658 clear_trace();
1659
1660 int len = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
1661 if(!len) {
1662 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1663 OnError(1);
1664 return;
1665 };
1666
1667 if(mifare_desfire_des_auth1(cuid, dataout)){
1668 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1669 OnError(4);
1670 return;
1671 }
1672
1673 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1674
1675 cmd_send(CMD_ACK, 1, cuid, 0, dataout, sizeof(dataout));
1676 }
1677
1678 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1679
1680 uint32_t cuid = arg0;
1681 uint8_t key[16] = {0x00};
1682 byte_t isOK = 0;
1683 byte_t dataout[12] = {0x00};
1684
1685 memcpy(key, datain, 16);
1686
1687 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1688
1689 if (isOK) {
1690 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1691 OnError(4);
1692 return;
1693 }
1694
1695 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1696
1697 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1698
1699 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1700 LEDsoff();
1701 }
1702
Proxmark3 GIT tracking
Impressum, Datenschutz