git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19
  20 #include "des.h"
  21 #include "crc.h"
  22
  23 // the block number for the ISO14443-4 PCB
  24 uint8_t pcb_blocknum = 0;
  25 // Deselect card by sending a s-block. the crc is precalced for speed
  26 static  uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
  27
  28
  29 //-----------------------------------------------------------------------------
  30 // Select, Authenticate, Read a MIFARE tag.
  31 // read block
  32 //-----------------------------------------------------------------------------
  33 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  34 {
  35   // params
  36         uint8_t blockNo = arg0;
  37         uint8_t keyType = arg1;
  38         uint64_t ui64Key = 0;
  39         ui64Key = bytes_to_num(datain, 6);
  40
  41         // variables
  42         byte_t isOK = 0;
  43         byte_t dataoutbuf[16];
  44         uint8_t uid[10];
  45         uint32_t cuid;
  46         struct Crypto1State mpcs = {0, 0};
  47         struct Crypto1State *pcs;
  48         pcs = &mpcs;
  49
  50         // clear trace
  51         clear_trace();
  52         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  53
  54         LED_A_ON();
  55         LED_B_OFF();
  56         LED_C_OFF();
  57
  58         while (true) {
  59                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  60                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  61                         break;
  62                 };
  63
  64                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  65                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  66                         break;
  67                 };
  68
  69                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  70                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  71                         break;
  72                 };
  73
  74                 if(mifare_classic_halt(pcs, cuid)) {
  75                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  76                         break;
  77                 };
  78
  79                 isOK = 1;
  80                 break;
  81         }
  82
  83         //  ----------------------------- crypto1 destroy
  84         crypto1_destroy(pcs);
  85
  86         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  87
  88         LED_B_ON();
  89         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  90         LED_B_OFF();
  91
  92         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  93         LEDsoff();
  94 }
  95
  96 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  97
  98         byte_t dataoutbuf[16] = {0x00};
  99         uint8_t uid[10] = {0x00};
 100         uint32_t cuid = 0x00;
 101
 102         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 103
 104         clear_trace();
 105         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 106
 107         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 108                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 109                 OnError(0);
 110                 return;
 111         };
 112
 113         if(mifare_ultra_auth1(dataoutbuf)){
 114                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
 115                 OnError(1);
 116                 return;
 117         }
 118
 119         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
 120
 121     cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
 122         LEDsoff();
 123 }
 124 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 125
 126         uint8_t key[16] = {0x00};
 127         byte_t dataoutbuf[16] = {0x00};
 128
 129         memcpy(key, datain, 16);
 130
 131         LED_A_ON();     LED_B_OFF(); LED_C_OFF();
 132
 133         if(mifare_ultra_auth2(key, dataoutbuf)){
 134             if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
 135                 OnError(1);
 136                 return;
 137         }
 138
 139         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
 140
 141         cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
 142         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 143         LEDsoff();
 144 }
 145
 146 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 147 {
 148         uint8_t blockNo = arg0;
 149         byte_t dataout[16] = {0x00};
 150         uint8_t uid[10] = {0x00};
 151         uint8_t key[16] = {0x00};
 152         bool usePwd = (arg1 == 1);
 153
 154         LED_A_ON();     LED_B_OFF(); LED_C_OFF();
 155
 156         clear_trace();
 157         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 158
 159         int len = iso14443a_select_card(uid, NULL, NULL);
 160         if(!len) {
 161                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 162                 OnError(1);
 163                 return;
 164         }
 165
 166          // authenticate here.
 167         if ( usePwd ) {
 168
 169                 memcpy(key, datain, 16);
 170
 171                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );
 172                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );
 173
 174                 uint8_t a[8] = {1,1,1,1,1,1,1,1 };
 175                 uint8_t b[8] = {0x00};
 176                 uint8_t enc_b[8] = {0x00};
 177                 uint8_t ab[16] = {0x00};
 178                 uint8_t enc_ab[16] = {0x00};
 179                 uint8_t enc_key[8] = {0x00};
 180
 181                 uint16_t len;
 182                 uint8_t receivedAnswer[MAX_FRAME_SIZE];
 183                 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
 184
 185                 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
 186                 if (len != 11) {
 187                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 188                         OnError(1);
 189                         return;
 190                 }
 191
 192                 // tag nonce.
 193                 memcpy(enc_b,receivedAnswer+1,8);
 194
 195                 // decrypt nonce.
 196                 tdes_2key_dec(b, enc_b, 8, key );
 197
 198                 Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x", enc_b[0],enc_b[1],enc_b[2],enc_b[3],enc_b[4],enc_b[5],enc_b[6],enc_b[7] );
 199                 Dbprintf("    B: %02x %02x %02x %02x %02x %02x %02x %02x", b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7] );
 200                 rol(b,8);
 201
 202                 memcpy(ab  ,a,8);
 203                 memcpy(ab+8,b,8);
 204
 205                 Dbprintf("AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[0],ab[1],ab[2],ab[3],ab[4],ab[5],ab[6],ab[7] );
 206                 Dbprintf("AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[8],ab[9],ab[10],ab[11],ab[12],ab[13],ab[14],ab[15] );
 207
 208                 // encrypt
 209                 tdes_2key_enc(enc_ab, ab, 16, key);
 210
 211                 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", enc_ab[0],enc_ab[1],enc_ab[2],enc_ab[3],enc_ab[4],enc_ab[5],enc_ab[6],enc_ab[7] );
 212                 Dbprintf("e_enc_ab: %02x %02x %02x %02x %02x %02x %02x %02x", enc_ab[8],enc_ab[9],enc_ab[10],enc_ab[11],enc_ab[12],enc_ab[13],enc_ab[14],enc_ab[15] );
 213
 214                 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, enc_ab, receivedAnswer, receivedAnswerPar, NULL);
 215                 if (len != 11) {
 216                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 217                         OnError(1);
 218                         return;
 219                 }
 220
 221                 // the tags' encryption of our nonce, A.
 222                 memcpy(enc_key, receivedAnswer+1, 8);
 223
 224                 // clear B.
 225                 memset(b, 0x00, 8);
 226
 227                 // decrypt
 228                 tdes_2key_dec(b, enc_key, 8, key );
 229                 if ( memcmp(a, b, 8) == 0 )
 230                         Dbprintf("Verified key");
 231                 else
 232                         Dbprintf("failed authentication");
 233
 234                 Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x", a[0],a[1],a[2],a[3],a[4],a[5],a[6],a[7] );
 235                 Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x", b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7] );
 236         }
 237
 238         if( mifare_ultra_readblock(blockNo, dataout) ) {
 239                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 240                 OnError(2);
 241                 return;
 242         }
 243
 244         if( mifare_ultra_halt() ) {
 245                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 246                 OnError(3);
 247                 return;
 248         }
 249
 250         cmd_send(CMD_ACK,1,0,0,dataout,16);
 251         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 252         LEDsoff();
 253 }
 254 //-----------------------------------------------------------------------------
 255 // Select, Authenticate, Read a MIFARE tag.
 256 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 257 //-----------------------------------------------------------------------------
 258 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 259 {
 260   // params
 261         uint8_t sectorNo = arg0;
 262         uint8_t keyType = arg1;
 263         uint64_t ui64Key = 0;
 264         ui64Key = bytes_to_num(datain, 6);
 265
 266         // variables
 267         byte_t isOK = 0;
 268         byte_t dataoutbuf[16 * 16];
 269         uint8_t uid[10];
 270         uint32_t cuid;
 271         struct Crypto1State mpcs = {0, 0};
 272         struct Crypto1State *pcs;
 273         pcs = &mpcs;
 274
 275         // clear trace
 276         clear_trace();
 277
 278         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 279
 280         LED_A_ON();
 281         LED_B_OFF();
 282         LED_C_OFF();
 283
 284         isOK = 1;
 285         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 286                 isOK = 0;
 287                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 288         }
 289
 290
 291         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 292                 isOK = 0;
 293                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 294         }
 295
 296         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 297                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 298                         isOK = 0;
 299                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 300                         break;
 301                 }
 302         }
 303
 304         if(mifare_classic_halt(pcs, cuid)) {
 305                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 306         }
 307
 308         //  ----------------------------- crypto1 destroy
 309         crypto1_destroy(pcs);
 310
 311         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 312
 313         LED_B_ON();
 314         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 315         LED_B_OFF();
 316
 317         // Thats it...
 318         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 319         LEDsoff();
 320 }
 321
 322 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 323 {
 324         // params
 325         uint8_t sectorNo = arg0;
 326         int Pages = arg1;
 327         int countpages = 0;
 328         byte_t dataout[176] = {0x00};;
 329
 330         LEDsoff();
 331         LED_A_ON();
 332         clear_trace();
 333         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 334
 335         int len = iso14443a_select_card(NULL, NULL, NULL);
 336         if (!len) {
 337                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 338                 OnError(1);
 339                 return;
 340         }
 341
 342         for (int i = 0; i < Pages; i++){
 343
 344                 len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);
 345
 346                 if (len) {
 347                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 348                         OnError(2);
 349                         return;
 350                 } else {
 351                         countpages++;
 352                 }
 353         }
 354
 355         len = mifare_ultra_halt();
 356         if (len) {
 357                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 358                 OnError(3);
 359                 return;
 360         }
 361
 362         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Pages read %d", countpages);
 363
 364         len = Pages * 4;
 365
 366         cmd_send(CMD_ACK, 1, 0, 0, dataout, len);
 367         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 368         LEDsoff();
 369 }
 370
 371 //-----------------------------------------------------------------------------
 372 // Select, Authenticate, Write a MIFARE tag.
 373 // read block
 374 //-----------------------------------------------------------------------------
 375 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 376 {
 377         // params
 378         uint8_t blockNo = arg0;
 379         uint8_t keyType = arg1;
 380         uint64_t ui64Key = 0;
 381         byte_t blockdata[16];
 382
 383         ui64Key = bytes_to_num(datain, 6);
 384         memcpy(blockdata, datain + 10, 16);
 385
 386         // variables
 387         byte_t isOK = 0;
 388         uint8_t uid[10];
 389         uint32_t cuid;
 390         struct Crypto1State mpcs = {0, 0};
 391         struct Crypto1State *pcs;
 392         pcs = &mpcs;
 393
 394         // clear trace
 395         clear_trace();
 396
 397         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 398
 399         LED_A_ON();
 400         LED_B_OFF();
 401         LED_C_OFF();
 402
 403         while (true) {
 404                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 405                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 406                         break;
 407                 };
 408
 409                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 410                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 411                         break;
 412                 };
 413
 414                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 415                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 416                         break;
 417                 };
 418
 419                 if(mifare_classic_halt(pcs, cuid)) {
 420                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 421                         break;
 422                 };
 423
 424                 isOK = 1;
 425                 break;
 426         }
 427
 428         //  ----------------------------- crypto1 destroy
 429         crypto1_destroy(pcs);
 430
 431         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 432
 433         LED_B_ON();
 434         cmd_send(CMD_ACK,isOK,0,0,0,0);
 435         LED_B_OFF();
 436
 437
 438         // Thats it...
 439         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 440         LEDsoff();
 441 }
 442
 443 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 444 {
 445         uint8_t blockNo = arg0;
 446         byte_t blockdata[16] = {0x00};
 447
 448         memcpy(blockdata, datain, 16);
 449
 450         uint8_t uid[10] = {0x00};
 451
 452         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 453
 454         clear_trace();
 455         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 456
 457         if(!iso14443a_select_card(uid, NULL, NULL)) {
 458                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 459                 OnError(0);
 460                 return;
 461         };
 462
 463         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 464                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 465                 OnError(0);
 466                 return; };
 467
 468         if(mifare_ultra_halt()) {
 469                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 470                 OnError(0);
 471                 return;
 472         };
 473
 474         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 475
 476         cmd_send(CMD_ACK,1,0,0,0,0);
 477         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 478         LEDsoff();
 479 }
 480
 481 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 482 {
 483         uint8_t blockNo = arg0;
 484         byte_t blockdata[4] = {0x00};
 485
 486         memcpy(blockdata, datain,4);
 487
 488         uint8_t uid[10] = {0x00};
 489
 490         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 491         clear_trace();
 492         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 493
 494         if(!iso14443a_select_card(uid, NULL, NULL)) {
 495                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 496                 OnError(0);
 497                 return;
 498         };
 499
 500         if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
 501                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 502                 OnError(0);
 503                 return;
 504         };
 505
 506         if(mifare_ultra_halt()) {
 507                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 508                 OnError(0);
 509                 return;
 510         };
 511
 512         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 513
 514         cmd_send(CMD_ACK,1,0,0,0,0);
 515         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 516         LEDsoff();
 517 }
 518
 519 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 520
 521         uint8_t pwd[16] = {0x00};
 522         byte_t blockdata[4] = {0x00};
 523
 524         memcpy(pwd, datain, 16);
 525
 526         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 527         clear_trace();
 528         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 529
 530         if(!iso14443a_select_card(NULL, NULL, NULL)) {
 531                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 532                 OnError(0);
 533                 return;
 534         };
 535
 536         blockdata[0] = pwd[7];
 537         blockdata[1] = pwd[6];
 538         blockdata[2] = pwd[5];
 539         blockdata[3] = pwd[4];
 540         if(mifare_ultra_special_writeblock( 44, blockdata)) {
 541                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 542                 OnError(44);
 543                 return;
 544         };
 545
 546         blockdata[0] = pwd[3];
 547         blockdata[1] = pwd[2];
 548         blockdata[2] = pwd[1];
 549         blockdata[3] = pwd[0];
 550         if(mifare_ultra_special_writeblock( 45, blockdata)) {
 551                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 552                 OnError(45);
 553                 return;
 554         };
 555
 556         blockdata[0] = pwd[15];
 557         blockdata[1] = pwd[14];
 558         blockdata[2] = pwd[13];
 559         blockdata[3] = pwd[12];
 560         if(mifare_ultra_special_writeblock( 46, blockdata)) {
 561                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 562                 OnError(46);
 563                 return;
 564         };
 565
 566         blockdata[0] = pwd[11];
 567         blockdata[1] = pwd[10];
 568         blockdata[2] = pwd[9];
 569         blockdata[3] = pwd[8];
 570         if(mifare_ultra_special_writeblock( 47, blockdata)) {
 571                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 572                 OnError(47);
 573                 return;
 574         };
 575
 576         if(mifare_ultra_halt()) {
 577                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 578                 OnError(0);
 579                 return;
 580         };
 581
 582         cmd_send(CMD_ACK,1,0,0,0,0);
 583         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 584         LEDsoff();
 585 }
 586
 587 // Return 1 if the nonce is invalid else return 0
 588 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 589         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 590         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 591         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 592 }
 593
 594
 595 //-----------------------------------------------------------------------------
 596 // MIFARE nested authentication.
 597 //
 598 //-----------------------------------------------------------------------------
 599 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 600 {
 601         // params
 602         uint8_t blockNo = arg0 & 0xff;
 603         uint8_t keyType = (arg0 >> 8) & 0xff;
 604         uint8_t targetBlockNo = arg1 & 0xff;
 605         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 606         uint64_t ui64Key = 0;
 607
 608         ui64Key = bytes_to_num(datain, 6);
 609
 610         // variables
 611         uint16_t rtr, i, j, len;
 612         uint16_t davg;
 613         static uint16_t dmin, dmax;
 614         uint8_t uid[10];
 615         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 616         uint8_t par[1];
 617         uint32_t target_nt[2], target_ks[2];
 618
 619         uint8_t par_array[4];
 620         uint16_t ncount = 0;
 621         struct Crypto1State mpcs = {0, 0};
 622         struct Crypto1State *pcs;
 623         pcs = &mpcs;
 624         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 625
 626         uint32_t auth1_time, auth2_time;
 627         static uint16_t delta_time;
 628
 629         // free eventually allocated BigBuf memory
 630         BigBuf_free();
 631         // clear trace
 632         clear_trace();
 633         set_tracing(false);
 634
 635         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 636
 637         LED_A_ON();
 638         LED_C_OFF();
 639
 640
 641         // statistics on nonce distance
 642         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 643                 LED_B_ON();
 644                 WDT_HIT();
 645
 646                 davg = dmax = 0;
 647                 dmin = 2000;
 648                 delta_time = 0;
 649
 650                 for (rtr = 0; rtr < 17; rtr++) {
 651
 652                         // prepare next select. No need to power down the card.
 653                         if(mifare_classic_halt(pcs, cuid)) {
 654                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 655                                 rtr--;
 656                                 continue;
 657                         }
 658
 659                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 660                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 661                                 rtr--;
 662                                 continue;
 663                         };
 664
 665                         auth1_time = 0;
 666                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 667                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 668                                 rtr--;
 669                                 continue;
 670                         };
 671
 672                         if (delta_time) {
 673                                 auth2_time = auth1_time + delta_time;
 674                         } else {
 675                                 auth2_time = 0;
 676                         }
 677                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 678                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 679                                 rtr--;
 680                                 continue;
 681                         };
 682
 683                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 684                         for (i = 101; i < 1200; i++) {
 685                                 nttmp = prng_successor(nttmp, 1);
 686                                 if (nttmp == nt2) break;
 687                         }
 688
 689                         if (i != 1200) {
 690                                 if (rtr != 0) {
 691                                         davg += i;
 692                                         dmin = MIN(dmin, i);
 693                                         dmax = MAX(dmax, i);
 694                                 }
 695                                 else {
 696                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 697                                 }
 698                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 699                         }
 700                 }
 701
 702                 if (rtr <= 1)   return;
 703
 704                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 705
 706                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 707
 708                 dmin = davg - 2;
 709                 dmax = davg + 2;
 710
 711                 LED_B_OFF();
 712
 713         }
 714 //  -------------------------------------------------------------------------------------------------
 715
 716         LED_C_ON();
 717
 718         //  get crypted nonces for target sector
 719         for(i=0; i < 2; i++) { // look for exactly two different nonces
 720
 721                 target_nt[i] = 0;
 722                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 723
 724                         // prepare next select. No need to power down the card.
 725                         if(mifare_classic_halt(pcs, cuid)) {
 726                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 727                                 continue;
 728                         }
 729
 730                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 731                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 732                                 continue;
 733                         };
 734
 735                         auth1_time = 0;
 736                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 737                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 738                                 continue;
 739                         };
 740
 741                         // nested authentication
 742                         auth2_time = auth1_time + delta_time;
 743                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 744                         if (len != 4) {
 745                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 746                                 continue;
 747                         };
 748
 749                         nt2 = bytes_to_num(receivedAnswer, 4);
 750                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 751
 752                         // Parity validity check
 753                         for (j = 0; j < 4; j++) {
 754                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 755                         }
 756
 757                         ncount = 0;
 758                         nttest = prng_successor(nt1, dmin - 1);
 759                         for (j = dmin; j < dmax + 1; j++) {
 760                                 nttest = prng_successor(nttest, 1);
 761                                 ks1 = nt2 ^ nttest;
 762
 763                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 764                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 765                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 766                                                 target_nt[i] = 0;
 767                                                 break;
 768                                         }
 769                                         target_nt[i] = nttest;
 770                                         target_ks[i] = ks1;
 771                                         ncount++;
 772                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 773                                                 target_nt[i] = 0;
 774                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 775                                                 break;
 776                                         }
 777                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 778                                 }
 779                         }
 780                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 781                 }
 782         }
 783
 784         LED_C_OFF();
 785
 786         //  ----------------------------- crypto1 destroy
 787         crypto1_destroy(pcs);
 788
 789         byte_t buf[4 + 4 * 4];
 790         memcpy(buf, &cuid, 4);
 791         memcpy(buf+4, &target_nt[0], 4);
 792         memcpy(buf+8, &target_ks[0], 4);
 793         memcpy(buf+12, &target_nt[1], 4);
 794         memcpy(buf+16, &target_ks[1], 4);
 795
 796         LED_B_ON();
 797         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 798         LED_B_OFF();
 799
 800         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 801
 802         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 803         LEDsoff();
 804         set_tracing(TRUE);
 805 }
 806
 807 //-----------------------------------------------------------------------------
 808 // MIFARE check keys. key count up to 85.
 809 //
 810 //-----------------------------------------------------------------------------
 811 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 812 {
 813   // params
 814         uint8_t blockNo = arg0;
 815         uint8_t keyType = arg1;
 816         uint8_t keyCount = arg2;
 817         uint64_t ui64Key = 0;
 818
 819         // variables
 820         int i;
 821         byte_t isOK = 0;
 822         uint8_t uid[10];
 823         uint32_t cuid;
 824         struct Crypto1State mpcs = {0, 0};
 825         struct Crypto1State *pcs;
 826         pcs = &mpcs;
 827
 828         // clear debug level
 829         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 830         MF_DBGLEVEL = MF_DBG_NONE;
 831
 832         // clear trace
 833         clear_trace();
 834         set_tracing(TRUE);
 835
 836         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 837
 838         LED_A_ON();
 839         LED_B_OFF();
 840         LED_C_OFF();
 841
 842         for (i = 0; i < keyCount; i++) {
 843                 if(mifare_classic_halt(pcs, cuid)) {
 844                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 845                 }
 846
 847                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 848                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 849                         break;
 850                 };
 851
 852                 ui64Key = bytes_to_num(datain + i * 6, 6);
 853                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 854                         continue;
 855                 };
 856
 857                 isOK = 1;
 858                 break;
 859         }
 860
 861         //  ----------------------------- crypto1 destroy
 862         crypto1_destroy(pcs);
 863
 864         LED_B_ON();
 865     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 866         LED_B_OFF();
 867
 868         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 869         LEDsoff();
 870
 871         // restore debug level
 872         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 873 }
 874
 875 //-----------------------------------------------------------------------------
 876 // MIFARE commands set debug level
 877 //
 878 //-----------------------------------------------------------------------------
 879 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 880         MF_DBGLEVEL = arg0;
 881         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 882 }
 883
 884 //-----------------------------------------------------------------------------
 885 // Work with emulator memory
 886 //
 887 //-----------------------------------------------------------------------------
 888 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 889         emlClearMem();
 890 }
 891
 892 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 893         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 894 }
 895
 896 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 897         byte_t buf[USB_CMD_DATA_SIZE];
 898         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 899
 900         LED_B_ON();
 901         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 902         LED_B_OFF();
 903 }
 904
 905 //-----------------------------------------------------------------------------
 906 // Load a card into the emulator memory
 907 //
 908 //-----------------------------------------------------------------------------
 909 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 910         uint8_t numSectors = arg0;
 911         uint8_t keyType = arg1;
 912         uint64_t ui64Key = 0;
 913         uint32_t cuid;
 914         struct Crypto1State mpcs = {0, 0};
 915         struct Crypto1State *pcs;
 916         pcs = &mpcs;
 917
 918         // variables
 919         byte_t dataoutbuf[16];
 920         byte_t dataoutbuf2[16];
 921         uint8_t uid[10];
 922
 923         // clear trace
 924         clear_trace();
 925         set_tracing(false);
 926
 927         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 928
 929         LED_A_ON();
 930         LED_B_OFF();
 931         LED_C_OFF();
 932
 933         bool isOK = true;
 934
 935         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 936                 isOK = false;
 937                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 938         }
 939
 940         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 941                 ui64Key = emlGetKey(sectorNo, keyType);
 942                 if (sectorNo == 0){
 943                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 944                                 isOK = false;
 945                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 946                                 break;
 947                         }
 948                 } else {
 949                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 950                                 isOK = false;
 951                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 952                                 break;
 953                         }
 954                 }
 955
 956                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 957                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 958                                 isOK = false;
 959                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 960                                 break;
 961                         };
 962                         if (isOK) {
 963                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 964                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 965                                 } else {        // sector trailer, keep the keys, set only the AC
 966                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 967                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 968                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 969                                 }
 970                         }
 971                 }
 972
 973         }
 974
 975         if(mifare_classic_halt(pcs, cuid)) {
 976                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 977         };
 978
 979         //  ----------------------------- crypto1 destroy
 980         crypto1_destroy(pcs);
 981
 982         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 983         LEDsoff();
 984
 985         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 986
 987 }
 988
 989
 990 //-----------------------------------------------------------------------------
 991 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 992 //
 993 //-----------------------------------------------------------------------------
 994 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 995
 996   // params
 997         uint8_t needWipe = arg0;
 998         // bit 0 - need get UID
 999         // bit 1 - need wupC
1000         // bit 2 - need HALT after sequence
1001         // bit 3 - need init FPGA and field before sequence
1002         // bit 4 - need reset FPGA and LED
1003         uint8_t workFlags = arg1;
1004         uint8_t blockNo = arg2;
1005
1006         // card commands
1007         uint8_t wupC1[]       = { 0x40 };
1008         uint8_t wupC2[]       = { 0x43 };
1009         uint8_t wipeC[]       = { 0x41 };
1010
1011         // variables
1012         byte_t isOK = 0;
1013         uint8_t uid[10] = {0x00};
1014         uint8_t d_block[18] = {0x00};
1015         uint32_t cuid;
1016
1017         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1018         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1019
1020         // reset FPGA and LED
1021         if (workFlags & 0x08) {
1022                 LED_A_ON();
1023                 LED_B_OFF();
1024                 LED_C_OFF();
1025
1026                 clear_trace();
1027                 set_tracing(TRUE);
1028                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1029         }
1030
1031         while (true) {
1032
1033                 // get UID from chip
1034                 if (workFlags & 0x01) {
1035                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
1036                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1037                                 break;
1038                         };
1039
1040                         if(mifare_classic_halt(NULL, cuid)) {
1041                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1042                                 break;
1043                         };
1044                 };
1045
1046                 // reset chip
1047                 if (needWipe){
1048                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1049                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1050                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1051                                 break;
1052                         };
1053
1054                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1055                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1056                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
1057                                 break;
1058                         };
1059
1060                         if(mifare_classic_halt(NULL, cuid)) {
1061                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1062                                 break;
1063                         };
1064                 };
1065
1066                 // write block
1067                 if (workFlags & 0x02) {
1068                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1069                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1070                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1071                                 break;
1072                         };
1073
1074                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1075                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1076                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1077                                 break;
1078                         };
1079                 }
1080
1081                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1082                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
1083                         break;
1084                 };
1085
1086                 memcpy(d_block, datain, 16);
1087                 AppendCrc14443a(d_block, 16);
1088
1089                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1090                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1091                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1092                         break;
1093                 };
1094
1095                 if (workFlags & 0x04) {
1096                         if (mifare_classic_halt(NULL, cuid)) {
1097                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1098                                 break;
1099                         };
1100                 }
1101
1102                 isOK = 1;
1103                 break;
1104         }
1105
1106         LED_B_ON();
1107         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1108         LED_B_OFF();
1109
1110         if ((workFlags & 0x10) || (!isOK)) {
1111                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1112                 LEDsoff();
1113         }
1114 }
1115
1116
1117 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1118
1119   // params
1120         // bit 1 - need wupC
1121         // bit 2 - need HALT after sequence
1122         // bit 3 - need init FPGA and field before sequence
1123         // bit 4 - need reset FPGA and LED
1124         uint8_t workFlags = arg0;
1125         uint8_t blockNo = arg2;
1126
1127         // card commands
1128         uint8_t wupC1[]       = { 0x40 };
1129         uint8_t wupC2[]       = { 0x43 };
1130
1131         // variables
1132         byte_t isOK = 0;
1133         uint8_t data[18] = {0x00};
1134         uint32_t cuid = 0;
1135
1136         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1137         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1138
1139         if (workFlags & 0x08) {
1140                 LED_A_ON();
1141                 LED_B_OFF();
1142                 LED_C_OFF();
1143
1144                 clear_trace();
1145                 set_tracing(TRUE);
1146                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1147         }
1148
1149         while (true) {
1150                 if (workFlags & 0x02) {
1151                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1152                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1153                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1154                                 break;
1155                         };
1156
1157                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1158                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1159                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1160                                 break;
1161                         };
1162                 }
1163
1164                 // read block
1165                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1166                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1167                         break;
1168                 };
1169                 memcpy(data, receivedAnswer, 18);
1170
1171                 if (workFlags & 0x04) {
1172                         if (mifare_classic_halt(NULL, cuid)) {
1173                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1174                                 break;
1175                         };
1176                 }
1177
1178                 isOK = 1;
1179                 break;
1180         }
1181
1182         LED_B_ON();
1183         cmd_send(CMD_ACK,isOK,0,0,data,18);
1184         LED_B_OFF();
1185
1186         if ((workFlags & 0x10) || (!isOK)) {
1187                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1188                 LEDsoff();
1189         }
1190 }
1191
1192 void MifareCIdent(){
1193
1194         // card commands
1195         uint8_t wupC1[]       = { 0x40 };
1196         uint8_t wupC2[]       = { 0x43 };
1197
1198         // variables
1199         byte_t isOK = 1;
1200
1201         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1202         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1203
1204         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1205         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1206                 isOK = 0;
1207         };
1208
1209         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1210         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1211                 isOK = 0;
1212         };
1213
1214         if (mifare_classic_halt(NULL, 0)) {
1215                 isOK = 0;
1216         };
1217
1218         cmd_send(CMD_ACK,isOK,0,0,0,0);
1219 }
1220
1221                         //
1222 // DESFIRE
1223 //
1224
1225 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1226
1227         byte_t dataout[11] = {0x00};
1228         uint8_t uid[10] = {0x00};
1229         uint32_t cuid;
1230
1231         clear_trace();
1232         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1233
1234         int len = iso14443a_select_card(uid, NULL, &cuid);
1235         if(!len) {
1236                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1237                         Dbprintf("Can't select card");
1238                 //OnError(1);
1239                 return;
1240         };
1241
1242         if(mifare_desfire_des_auth1(cuid, dataout)){
1243                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1244                         Dbprintf("Authentication part1: Fail.");
1245                 //OnError(4);
1246                 return;
1247         }
1248
1249         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1250
1251     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1252 }
1253
1254 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1255
1256         uint32_t cuid = arg0;
1257         uint8_t key[16] = {0x00};
1258         byte_t isOK = 0;
1259         byte_t dataout[12] = {0x00};
1260
1261         memcpy(key, datain, 16);
1262
1263         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1264
1265         if( isOK) {
1266             if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1267                         Dbprintf("Authentication part2: Failed");
1268                 //OnError(4);
1269                 return;
1270         }
1271
1272         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1273                 DbpString("AUTH 2 FINISHED");
1274
1275         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1276         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1277         LEDsoff();
1278 }
1279
1280 void OnSuccess(){
1281         pcb_blocknum = 0;
1282         ReaderTransmit(deselect_cmd, 3 , NULL);
1283         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1284         LEDsoff();
1285 }
1286
1287 void OnError(uint8_t reason){
1288         pcb_blocknum = 0;
1289         ReaderTransmit(deselect_cmd, 3 , NULL);
1290         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1291         cmd_send(CMD_ACK,0,reason,0,0,0);
1292         LEDsoff();
1293 }