git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19
  20 #include "des.h"
  21 #include "crc.h"
  22
  23 // the block number for the ISO14443-4 PCB
  24 uint8_t pcb_blocknum = 0;
  25 // Deselect card by sending a s-block. the crc is precalced for speed
  26 static  uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
  27
  28
  29 //-----------------------------------------------------------------------------
  30 // Select, Authenticate, Read a MIFARE tag.
  31 // read block
  32 //-----------------------------------------------------------------------------
  33 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  34 {
  35   // params
  36         uint8_t blockNo = arg0;
  37         uint8_t keyType = arg1;
  38         uint64_t ui64Key = 0;
  39         ui64Key = bytes_to_num(datain, 6);
  40
  41         // variables
  42         byte_t isOK = 0;
  43         byte_t dataoutbuf[16];
  44         uint8_t uid[10];
  45         uint32_t cuid;
  46         struct Crypto1State mpcs = {0, 0};
  47         struct Crypto1State *pcs;
  48         pcs = &mpcs;
  49
  50         // clear trace
  51         clear_trace();
  52         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  53
  54         LED_A_ON();
  55         LED_B_OFF();
  56         LED_C_OFF();
  57
  58         while (true) {
  59                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  60                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  61                         break;
  62                 };
  63
  64                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  65                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  66                         break;
  67                 };
  68
  69                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  70                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  71                         break;
  72                 };
  73
  74                 if(mifare_classic_halt(pcs, cuid)) {
  75                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  76                         break;
  77                 };
  78
  79                 isOK = 1;
  80                 break;
  81         }
  82
  83         //  ----------------------------- crypto1 destroy
  84         crypto1_destroy(pcs);
  85
  86         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  87
  88         LED_B_ON();
  89         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  90         LED_B_OFF();
  91
  92         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  93         LEDsoff();
  94 }
  95
  96 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  97
  98         byte_t dataoutbuf[16] = {0x00};
  99         uint8_t uid[10] = {0x00};
 100         uint32_t cuid = 0x00;
 101
 102         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 103
 104         clear_trace();
 105         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 106
 107         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 108                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 109                 OnError(0);
 110                 return;
 111         };
 112
 113         if(mifare_ultra_auth1(dataoutbuf)){
 114                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
 115                 OnError(1);
 116                 return;
 117         }
 118
 119         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
 120
 121     cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
 122         LEDsoff();
 123 }
 124 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 125
 126         uint8_t key[16] = {0x00};
 127         byte_t dataoutbuf[16] = {0x00};
 128
 129         memcpy(key, datain, 16);
 130
 131         LED_A_ON();     LED_B_OFF(); LED_C_OFF();
 132
 133         if(mifare_ultra_auth2(key, dataoutbuf)){
 134             if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
 135                 OnError(1);
 136                 return;
 137         }
 138
 139         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
 140
 141         cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
 142         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 143         LEDsoff();
 144 }
 145
 146 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 147 {
 148         uint8_t blockNo = arg0;
 149         byte_t dataout[16] = {0x00};
 150         uint8_t uid[10] = {0x00};
 151         uint8_t key[16] = {0x00};
 152         bool usePwd = (arg1 == 1);
 153
 154         LED_A_ON();     LED_B_OFF(); LED_C_OFF();
 155
 156         clear_trace();
 157         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 158
 159         int len = iso14443a_select_card(uid, NULL, NULL);
 160         if(!len) {
 161                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 162                 OnError(1);
 163                 return;
 164         }
 165
 166          // authenticate here.
 167         if ( usePwd ) {
 168
 169                 memcpy(key, datain, 16);
 170
 171                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );
 172                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );
 173
 174                 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
 175                 uint8_t random_b[8] = {0x00};
 176                 uint8_t enc_random_b[8] = {0x00};
 177                 uint8_t rnd_ab[16] = {0x00};
 178                 uint8_t IV[8] = {0x00};
 179
 180                 uint16_t len;
 181                 uint8_t receivedAnswer[MAX_FRAME_SIZE];
 182                 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
 183
 184                 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
 185                 if (len != 11) {
 186                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 187                         OnError(1);
 188                         return;
 189                 }
 190
 191                 // tag nonce.
 192                 memcpy(enc_random_b,receivedAnswer+1,8);
 193
 194                 // decrypt nonce.
 195                 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
 196
 197
 198                 rol(random_b,8);
 199
 200                 memcpy(rnd_ab  ,random_a,8);
 201                 memcpy(rnd_ab+8,random_b,8);
 202
 203                 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
 204                         Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
 205                                 enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],
 206                                 enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
 207
 208                         Dbprintf("    B: %02x %02x %02x %02x %02x %02x %02x %02x",
 209                                 random_b[0],random_b[1],random_b[2],random_b[3],
 210                                 random_b[4],random_b[5],random_b[6],random_b[7]);
 211
 212                         Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
 213                                         rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
 214                                         rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
 215
 216                         Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
 217                                         rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
 218                                         rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
 219                 }
 220
 221                 // encrypt    out, in, length, key, iv
 222                 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
 223
 224
 225                 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
 226                 if (len != 11) {
 227                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 228                         OnError(1);
 229                         return;
 230                 }
 231
 232                 uint8_t enc_resp[8] = { 0 };
 233                 uint8_t resp_random_a[8] = { 0 };
 234                 memcpy(enc_resp, receivedAnswer+1, 8);
 235
 236                 // decrypt    out, in, length, key, iv
 237                 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
 238                 if ( memcmp(resp_random_a, random_a, 8) != 0 )
 239                         Dbprintf("failed authentication");
 240
 241                 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
 242                         Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
 243                                         rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
 244                                         rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
 245
 246                         Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
 247                                         rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
 248                                         rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
 249
 250                         Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
 251                                         random_a[0],random_a[1],random_a[2],random_a[3],
 252                                         random_a[4],random_a[5],random_a[6],random_a[7]);
 253
 254                         Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
 255                                         resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
 256                                         resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
 257                 }
 258         }
 259
 260         if( mifare_ultra_readblock(blockNo, dataout) ) {
 261                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 262                 OnError(2);
 263                 return;
 264         }
 265
 266         if( mifare_ultra_halt() ) {
 267                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 268                 OnError(3);
 269                 return;
 270         }
 271
 272     cmd_send(CMD_ACK,1,0,0,dataout,16);
 273         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 274         LEDsoff();
 275 }
 276
 277 //-----------------------------------------------------------------------------
 278 // Select, Authenticate, Read a MIFARE tag.
 279 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 280 //-----------------------------------------------------------------------------
 281 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 282 {
 283   // params
 284         uint8_t sectorNo = arg0;
 285         uint8_t keyType = arg1;
 286         uint64_t ui64Key = 0;
 287         ui64Key = bytes_to_num(datain, 6);
 288
 289         // variables
 290         byte_t isOK = 0;
 291         byte_t dataoutbuf[16 * 16];
 292         uint8_t uid[10];
 293         uint32_t cuid;
 294         struct Crypto1State mpcs = {0, 0};
 295         struct Crypto1State *pcs;
 296         pcs = &mpcs;
 297
 298         // clear trace
 299         clear_trace();
 300
 301         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 302
 303         LED_A_ON();
 304         LED_B_OFF();
 305         LED_C_OFF();
 306
 307         isOK = 1;
 308         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 309                 isOK = 0;
 310                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 311         }
 312
 313
 314         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 315                 isOK = 0;
 316                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 317         }
 318
 319         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 320                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 321                         isOK = 0;
 322                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 323                         break;
 324                 }
 325         }
 326
 327         if(mifare_classic_halt(pcs, cuid)) {
 328                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 329         }
 330
 331         //  ----------------------------- crypto1 destroy
 332         crypto1_destroy(pcs);
 333
 334         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 335
 336         LED_B_ON();
 337         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 338         LED_B_OFF();
 339
 340         // Thats it...
 341         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 342         LEDsoff();
 343 }
 344
 345 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 346 {
 347         // params
 348         uint8_t sectorNo = arg0;
 349         int Pages = arg1;
 350         int countpages = 0;
 351         byte_t dataout[176] = {0x00};;
 352
 353         LEDsoff();
 354         LED_A_ON();
 355         clear_trace();
 356         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 357
 358         int len = iso14443a_select_card(NULL, NULL, NULL);
 359         if (!len) {
 360                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 361                 OnError(1);
 362                 return;
 363         }
 364
 365         for (int i = 0; i < Pages; i++){
 366
 367                 len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);
 368
 369                 if (len) {
 370                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 371                         OnError(2);
 372                         return;
 373                 } else {
 374                         countpages++;
 375                 }
 376         }
 377
 378         len = mifare_ultra_halt();
 379         if (len) {
 380                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 381                 OnError(3);
 382                 return;
 383         }
 384
 385         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Pages read %d", countpages);
 386
 387         len = Pages * 4;
 388
 389         cmd_send(CMD_ACK, 1, 0, 0, dataout, len);
 390         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 391         LEDsoff();
 392 }
 393
 394 //-----------------------------------------------------------------------------
 395 // Select, Authenticate, Write a MIFARE tag.
 396 // read block
 397 //-----------------------------------------------------------------------------
 398 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 399 {
 400         // params
 401         uint8_t blockNo = arg0;
 402         uint8_t keyType = arg1;
 403         uint64_t ui64Key = 0;
 404         byte_t blockdata[16];
 405
 406         ui64Key = bytes_to_num(datain, 6);
 407         memcpy(blockdata, datain + 10, 16);
 408
 409         // variables
 410         byte_t isOK = 0;
 411         uint8_t uid[10];
 412         uint32_t cuid;
 413         struct Crypto1State mpcs = {0, 0};
 414         struct Crypto1State *pcs;
 415         pcs = &mpcs;
 416
 417         // clear trace
 418         clear_trace();
 419
 420         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 421
 422         LED_A_ON();
 423         LED_B_OFF();
 424         LED_C_OFF();
 425
 426         while (true) {
 427                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 428                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 429                         break;
 430                 };
 431
 432                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 433                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 434                         break;
 435                 };
 436
 437                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 438                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 439                         break;
 440                 };
 441
 442                 if(mifare_classic_halt(pcs, cuid)) {
 443                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 444                         break;
 445                 };
 446
 447                 isOK = 1;
 448                 break;
 449         }
 450
 451         //  ----------------------------- crypto1 destroy
 452         crypto1_destroy(pcs);
 453
 454         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 455
 456         LED_B_ON();
 457         cmd_send(CMD_ACK,isOK,0,0,0,0);
 458         LED_B_OFF();
 459
 460
 461         // Thats it...
 462         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 463         LEDsoff();
 464 }
 465
 466 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 467 {
 468         uint8_t blockNo = arg0;
 469         byte_t blockdata[16] = {0x00};
 470
 471         memcpy(blockdata, datain, 16);
 472
 473         uint8_t uid[10] = {0x00};
 474
 475         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 476
 477         clear_trace();
 478         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 479
 480         if(!iso14443a_select_card(uid, NULL, NULL)) {
 481                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 482                 OnError(0);
 483                 return;
 484         };
 485
 486         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 487                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 488                 OnError(0);
 489                 return; };
 490
 491         if(mifare_ultra_halt()) {
 492                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 493                 OnError(0);
 494                 return;
 495         };
 496
 497         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 498
 499         cmd_send(CMD_ACK,1,0,0,0,0);
 500         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 501         LEDsoff();
 502 }
 503
 504 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 505 {
 506         uint8_t blockNo = arg0;
 507         byte_t blockdata[4] = {0x00};
 508
 509         memcpy(blockdata, datain,4);
 510
 511         uint8_t uid[10] = {0x00};
 512
 513         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 514         clear_trace();
 515         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 516
 517         if(!iso14443a_select_card(uid, NULL, NULL)) {
 518                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 519                 OnError(0);
 520                 return;
 521         };
 522
 523         if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
 524                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 525                 OnError(0);
 526                 return;
 527         };
 528
 529         if(mifare_ultra_halt()) {
 530                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 531                 OnError(0);
 532                 return;
 533         };
 534
 535         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 536
 537         cmd_send(CMD_ACK,1,0,0,0,0);
 538         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 539         LEDsoff();
 540 }
 541
 542 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 543
 544         uint8_t pwd[16] = {0x00};
 545         byte_t blockdata[4] = {0x00};
 546
 547         memcpy(pwd, datain, 16);
 548
 549         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 550         clear_trace();
 551         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 552
 553         if(!iso14443a_select_card(NULL, NULL, NULL)) {
 554                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 555                 OnError(0);
 556                 return;
 557         };
 558
 559         blockdata[0] = pwd[7];
 560         blockdata[1] = pwd[6];
 561         blockdata[2] = pwd[5];
 562         blockdata[3] = pwd[4];
 563         if(mifare_ultra_special_writeblock( 44, blockdata)) {
 564                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 565                 OnError(44);
 566                 return;
 567         };
 568
 569         blockdata[0] = pwd[3];
 570         blockdata[1] = pwd[2];
 571         blockdata[2] = pwd[1];
 572         blockdata[3] = pwd[0];
 573         if(mifare_ultra_special_writeblock( 45, blockdata)) {
 574                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 575                 OnError(45);
 576                 return;
 577         };
 578
 579         blockdata[0] = pwd[15];
 580         blockdata[1] = pwd[14];
 581         blockdata[2] = pwd[13];
 582         blockdata[3] = pwd[12];
 583         if(mifare_ultra_special_writeblock( 46, blockdata)) {
 584                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 585                 OnError(46);
 586                 return;
 587         };
 588
 589         blockdata[0] = pwd[11];
 590         blockdata[1] = pwd[10];
 591         blockdata[2] = pwd[9];
 592         blockdata[3] = pwd[8];
 593         if(mifare_ultra_special_writeblock( 47, blockdata)) {
 594                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 595                 OnError(47);
 596                 return;
 597         };
 598
 599         if(mifare_ultra_halt()) {
 600                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 601                 OnError(0);
 602                 return;
 603         };
 604
 605         cmd_send(CMD_ACK,1,0,0,0,0);
 606         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 607         LEDsoff();
 608 }
 609
 610 // Return 1 if the nonce is invalid else return 0
 611 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 612         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 613         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 614         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 615 }
 616
 617
 618 //-----------------------------------------------------------------------------
 619 // MIFARE nested authentication.
 620 //
 621 //-----------------------------------------------------------------------------
 622 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 623 {
 624         // params
 625         uint8_t blockNo = arg0 & 0xff;
 626         uint8_t keyType = (arg0 >> 8) & 0xff;
 627         uint8_t targetBlockNo = arg1 & 0xff;
 628         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 629         uint64_t ui64Key = 0;
 630
 631         ui64Key = bytes_to_num(datain, 6);
 632
 633         // variables
 634         uint16_t rtr, i, j, len;
 635         uint16_t davg;
 636         static uint16_t dmin, dmax;
 637         uint8_t uid[10];
 638         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 639         uint8_t par[1];
 640         uint32_t target_nt[2], target_ks[2];
 641
 642         uint8_t par_array[4];
 643         uint16_t ncount = 0;
 644         struct Crypto1State mpcs = {0, 0};
 645         struct Crypto1State *pcs;
 646         pcs = &mpcs;
 647         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 648
 649         uint32_t auth1_time, auth2_time;
 650         static uint16_t delta_time;
 651
 652         // free eventually allocated BigBuf memory
 653         BigBuf_free();
 654         // clear trace
 655         clear_trace();
 656         set_tracing(false);
 657
 658         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 659
 660         LED_A_ON();
 661         LED_C_OFF();
 662
 663
 664         // statistics on nonce distance
 665         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 666                 LED_B_ON();
 667                 WDT_HIT();
 668
 669                 davg = dmax = 0;
 670                 dmin = 2000;
 671                 delta_time = 0;
 672
 673                 for (rtr = 0; rtr < 17; rtr++) {
 674
 675                         // prepare next select. No need to power down the card.
 676                         if(mifare_classic_halt(pcs, cuid)) {
 677                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 678                                 rtr--;
 679                                 continue;
 680                         }
 681
 682                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 683                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 684                                 rtr--;
 685                                 continue;
 686                         };
 687
 688                         auth1_time = 0;
 689                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 690                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 691                                 rtr--;
 692                                 continue;
 693                         };
 694
 695                         if (delta_time) {
 696                                 auth2_time = auth1_time + delta_time;
 697                         } else {
 698                                 auth2_time = 0;
 699                         }
 700                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 701                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 702                                 rtr--;
 703                                 continue;
 704                         };
 705
 706                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 707                         for (i = 101; i < 1200; i++) {
 708                                 nttmp = prng_successor(nttmp, 1);
 709                                 if (nttmp == nt2) break;
 710                         }
 711
 712                         if (i != 1200) {
 713                                 if (rtr != 0) {
 714                                         davg += i;
 715                                         dmin = MIN(dmin, i);
 716                                         dmax = MAX(dmax, i);
 717                                 }
 718                                 else {
 719                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 720                                 }
 721                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 722                         }
 723                 }
 724
 725                 if (rtr <= 1)   return;
 726
 727                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 728
 729                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 730
 731                 dmin = davg - 2;
 732                 dmax = davg + 2;
 733
 734                 LED_B_OFF();
 735
 736         }
 737 //  -------------------------------------------------------------------------------------------------
 738
 739         LED_C_ON();
 740
 741         //  get crypted nonces for target sector
 742         for(i=0; i < 2; i++) { // look for exactly two different nonces
 743
 744                 target_nt[i] = 0;
 745                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 746
 747                         // prepare next select. No need to power down the card.
 748                         if(mifare_classic_halt(pcs, cuid)) {
 749                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 750                                 continue;
 751                         }
 752
 753                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 754                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 755                                 continue;
 756                         };
 757
 758                         auth1_time = 0;
 759                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 760                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 761                                 continue;
 762                         };
 763
 764                         // nested authentication
 765                         auth2_time = auth1_time + delta_time;
 766                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 767                         if (len != 4) {
 768                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 769                                 continue;
 770                         };
 771
 772                         nt2 = bytes_to_num(receivedAnswer, 4);
 773                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 774
 775                         // Parity validity check
 776                         for (j = 0; j < 4; j++) {
 777                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 778                         }
 779
 780                         ncount = 0;
 781                         nttest = prng_successor(nt1, dmin - 1);
 782                         for (j = dmin; j < dmax + 1; j++) {
 783                                 nttest = prng_successor(nttest, 1);
 784                                 ks1 = nt2 ^ nttest;
 785
 786                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 787                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 788                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 789                                                 target_nt[i] = 0;
 790                                                 break;
 791                                         }
 792                                         target_nt[i] = nttest;
 793                                         target_ks[i] = ks1;
 794                                         ncount++;
 795                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 796                                                 target_nt[i] = 0;
 797                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 798                                                 break;
 799                                         }
 800                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 801                                 }
 802                         }
 803                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 804                 }
 805         }
 806
 807         LED_C_OFF();
 808
 809         //  ----------------------------- crypto1 destroy
 810         crypto1_destroy(pcs);
 811
 812         byte_t buf[4 + 4 * 4];
 813         memcpy(buf, &cuid, 4);
 814         memcpy(buf+4, &target_nt[0], 4);
 815         memcpy(buf+8, &target_ks[0], 4);
 816         memcpy(buf+12, &target_nt[1], 4);
 817         memcpy(buf+16, &target_ks[1], 4);
 818
 819         LED_B_ON();
 820         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 821         LED_B_OFF();
 822
 823         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 824
 825         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 826         LEDsoff();
 827         set_tracing(TRUE);
 828 }
 829
 830 //-----------------------------------------------------------------------------
 831 // MIFARE check keys. key count up to 85.
 832 //
 833 //-----------------------------------------------------------------------------
 834 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 835 {
 836   // params
 837         uint8_t blockNo = arg0;
 838         uint8_t keyType = arg1;
 839         uint8_t keyCount = arg2;
 840         uint64_t ui64Key = 0;
 841
 842         // variables
 843         int i;
 844         byte_t isOK = 0;
 845         uint8_t uid[10];
 846         uint32_t cuid;
 847         struct Crypto1State mpcs = {0, 0};
 848         struct Crypto1State *pcs;
 849         pcs = &mpcs;
 850
 851         // clear debug level
 852         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 853         MF_DBGLEVEL = MF_DBG_NONE;
 854
 855         // clear trace
 856         clear_trace();
 857         set_tracing(TRUE);
 858
 859         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 860
 861         LED_A_ON();
 862         LED_B_OFF();
 863         LED_C_OFF();
 864
 865         for (i = 0; i < keyCount; i++) {
 866                 if(mifare_classic_halt(pcs, cuid)) {
 867                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 868                 }
 869
 870                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 871                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 872                         break;
 873                 };
 874
 875                 ui64Key = bytes_to_num(datain + i * 6, 6);
 876                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 877                         continue;
 878                 };
 879
 880                 isOK = 1;
 881                 break;
 882         }
 883
 884         //  ----------------------------- crypto1 destroy
 885         crypto1_destroy(pcs);
 886
 887         LED_B_ON();
 888     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 889         LED_B_OFF();
 890
 891         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 892         LEDsoff();
 893
 894         // restore debug level
 895         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 896 }
 897
 898 //-----------------------------------------------------------------------------
 899 // MIFARE commands set debug level
 900 //
 901 //-----------------------------------------------------------------------------
 902 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 903         MF_DBGLEVEL = arg0;
 904         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 905 }
 906
 907 //-----------------------------------------------------------------------------
 908 // Work with emulator memory
 909 //
 910 //-----------------------------------------------------------------------------
 911 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 912         emlClearMem();
 913 }
 914
 915 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 916         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 917 }
 918
 919 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 920         byte_t buf[USB_CMD_DATA_SIZE];
 921         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 922
 923         LED_B_ON();
 924         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 925         LED_B_OFF();
 926 }
 927
 928 //-----------------------------------------------------------------------------
 929 // Load a card into the emulator memory
 930 //
 931 //-----------------------------------------------------------------------------
 932 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 933         uint8_t numSectors = arg0;
 934         uint8_t keyType = arg1;
 935         uint64_t ui64Key = 0;
 936         uint32_t cuid;
 937         struct Crypto1State mpcs = {0, 0};
 938         struct Crypto1State *pcs;
 939         pcs = &mpcs;
 940
 941         // variables
 942         byte_t dataoutbuf[16];
 943         byte_t dataoutbuf2[16];
 944         uint8_t uid[10];
 945
 946         // clear trace
 947         clear_trace();
 948         set_tracing(false);
 949
 950         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 951
 952         LED_A_ON();
 953         LED_B_OFF();
 954         LED_C_OFF();
 955
 956         bool isOK = true;
 957
 958         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 959                 isOK = false;
 960                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 961         }
 962
 963         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 964                 ui64Key = emlGetKey(sectorNo, keyType);
 965                 if (sectorNo == 0){
 966                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 967                                 isOK = false;
 968                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 969                                 break;
 970                         }
 971                 } else {
 972                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 973                                 isOK = false;
 974                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 975                                 break;
 976                         }
 977                 }
 978
 979                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 980                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 981                                 isOK = false;
 982                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 983                                 break;
 984                         };
 985                         if (isOK) {
 986                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 987                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 988                                 } else {        // sector trailer, keep the keys, set only the AC
 989                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 990                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 991                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 992                                 }
 993                         }
 994                 }
 995
 996         }
 997
 998         if(mifare_classic_halt(pcs, cuid)) {
 999                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1000         };
1001
1002         //  ----------------------------- crypto1 destroy
1003         crypto1_destroy(pcs);
1004
1005         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1006         LEDsoff();
1007
1008         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1009
1010 }
1011
1012
1013 //-----------------------------------------------------------------------------
1014 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1015 //
1016 //-----------------------------------------------------------------------------
1017 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1018
1019   // params
1020         uint8_t needWipe = arg0;
1021         // bit 0 - need get UID
1022         // bit 1 - need wupC
1023         // bit 2 - need HALT after sequence
1024         // bit 3 - need init FPGA and field before sequence
1025         // bit 4 - need reset FPGA and LED
1026         uint8_t workFlags = arg1;
1027         uint8_t blockNo = arg2;
1028
1029         // card commands
1030         uint8_t wupC1[]       = { 0x40 };
1031         uint8_t wupC2[]       = { 0x43 };
1032         uint8_t wipeC[]       = { 0x41 };
1033
1034         // variables
1035         byte_t isOK = 0;
1036         uint8_t uid[10] = {0x00};
1037         uint8_t d_block[18] = {0x00};
1038         uint32_t cuid;
1039
1040         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1041         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1042
1043         // reset FPGA and LED
1044         if (workFlags & 0x08) {
1045                 LED_A_ON();
1046                 LED_B_OFF();
1047                 LED_C_OFF();
1048
1049                 clear_trace();
1050                 set_tracing(TRUE);
1051                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1052         }
1053
1054         while (true) {
1055
1056                 // get UID from chip
1057                 if (workFlags & 0x01) {
1058                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
1059                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1060                                 break;
1061                         };
1062
1063                         if(mifare_classic_halt(NULL, cuid)) {
1064                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1065                                 break;
1066                         };
1067                 };
1068
1069                 // reset chip
1070                 if (needWipe){
1071                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1072                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1073                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1074                                 break;
1075                         };
1076
1077                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1078                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1079                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
1080                                 break;
1081                         };
1082
1083                         if(mifare_classic_halt(NULL, cuid)) {
1084                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1085                                 break;
1086                         };
1087                 };
1088
1089                 // write block
1090                 if (workFlags & 0x02) {
1091                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1092                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1093                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1094                                 break;
1095                         };
1096
1097                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1098                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1099                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1100                                 break;
1101                         };
1102                 }
1103
1104                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1105                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
1106                         break;
1107                 };
1108
1109                 memcpy(d_block, datain, 16);
1110                 AppendCrc14443a(d_block, 16);
1111
1112                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1113                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1114                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1115                         break;
1116                 };
1117
1118                 if (workFlags & 0x04) {
1119                         if (mifare_classic_halt(NULL, cuid)) {
1120                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1121                                 break;
1122                         };
1123                 }
1124
1125                 isOK = 1;
1126                 break;
1127         }
1128
1129         LED_B_ON();
1130         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1131         LED_B_OFF();
1132
1133         if ((workFlags & 0x10) || (!isOK)) {
1134                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1135                 LEDsoff();
1136         }
1137 }
1138
1139
1140 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1141
1142   // params
1143         // bit 1 - need wupC
1144         // bit 2 - need HALT after sequence
1145         // bit 3 - need init FPGA and field before sequence
1146         // bit 4 - need reset FPGA and LED
1147         uint8_t workFlags = arg0;
1148         uint8_t blockNo = arg2;
1149
1150         // card commands
1151         uint8_t wupC1[]       = { 0x40 };
1152         uint8_t wupC2[]       = { 0x43 };
1153
1154         // variables
1155         byte_t isOK = 0;
1156         uint8_t data[18] = {0x00};
1157         uint32_t cuid = 0;
1158
1159         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1160         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1161
1162         if (workFlags & 0x08) {
1163                 LED_A_ON();
1164                 LED_B_OFF();
1165                 LED_C_OFF();
1166
1167                 clear_trace();
1168                 set_tracing(TRUE);
1169                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1170         }
1171
1172         while (true) {
1173                 if (workFlags & 0x02) {
1174                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1175                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1176                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1177                                 break;
1178                         };
1179
1180                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1181                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1182                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1183                                 break;
1184                         };
1185                 }
1186
1187                 // read block
1188                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1189                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1190                         break;
1191                 };
1192                 memcpy(data, receivedAnswer, 18);
1193
1194                 if (workFlags & 0x04) {
1195                         if (mifare_classic_halt(NULL, cuid)) {
1196                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1197                                 break;
1198                         };
1199                 }
1200
1201                 isOK = 1;
1202                 break;
1203         }
1204
1205         LED_B_ON();
1206         cmd_send(CMD_ACK,isOK,0,0,data,18);
1207         LED_B_OFF();
1208
1209         if ((workFlags & 0x10) || (!isOK)) {
1210                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1211                 LEDsoff();
1212         }
1213 }
1214
1215 void MifareCIdent(){
1216
1217         // card commands
1218         uint8_t wupC1[]       = { 0x40 };
1219         uint8_t wupC2[]       = { 0x43 };
1220
1221         // variables
1222         byte_t isOK = 1;
1223
1224         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1225         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1226
1227         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1228         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1229                 isOK = 0;
1230         };
1231
1232         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1233         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1234                 isOK = 0;
1235         };
1236
1237         if (mifare_classic_halt(NULL, 0)) {
1238                 isOK = 0;
1239         };
1240
1241         cmd_send(CMD_ACK,isOK,0,0,0,0);
1242 }
1243
1244                         //
1245 // DESFIRE
1246 //
1247
1248 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1249
1250         byte_t dataout[11] = {0x00};
1251         uint8_t uid[10] = {0x00};
1252         uint32_t cuid;
1253
1254         clear_trace();
1255         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1256
1257         int len = iso14443a_select_card(uid, NULL, &cuid);
1258         if(!len) {
1259                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1260                         Dbprintf("Can't select card");
1261                 //OnError(1);
1262                 return;
1263         };
1264
1265         if(mifare_desfire_des_auth1(cuid, dataout)){
1266                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1267                         Dbprintf("Authentication part1: Fail.");
1268                 //OnError(4);
1269                 return;
1270         }
1271
1272         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1273
1274     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1275 }
1276
1277 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1278
1279         uint32_t cuid = arg0;
1280         uint8_t key[16] = {0x00};
1281         byte_t isOK = 0;
1282         byte_t dataout[12] = {0x00};
1283
1284         memcpy(key, datain, 16);
1285
1286         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1287
1288         if( isOK) {
1289             if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1290                         Dbprintf("Authentication part2: Failed");
1291                 //OnError(4);
1292                 return;
1293         }
1294
1295         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1296                 DbpString("AUTH 2 FINISHED");
1297
1298         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1299         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1300         LEDsoff();
1301 }
1302
1303 void OnSuccess(){
1304         pcb_blocknum = 0;
1305         ReaderTransmit(deselect_cmd, 3 , NULL);
1306         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1307         LEDsoff();
1308 }
1309
1310 void OnError(uint8_t reason){
1311         pcb_blocknum = 0;
1312         ReaderTransmit(deselect_cmd, 3 , NULL);
1313         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1314         cmd_send(CMD_ACK,0,reason,0,0,0);
1315         LEDsoff();
1316 }