git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19
  20 #include "des.h"
  21 #include "crc.h"
  22
  23 // the block number for the ISO14443-4 PCB
  24 uint8_t pcb_blocknum = 0;
  25 // Deselect card by sending a s-block. the crc is precalced for speed
  26 static  uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
  27
  28
  29 //-----------------------------------------------------------------------------
  30 // Select, Authenticate, Read a MIFARE tag.
  31 // read block
  32 //-----------------------------------------------------------------------------
  33 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  34 {
  35   // params
  36         uint8_t blockNo = arg0;
  37         uint8_t keyType = arg1;
  38         uint64_t ui64Key = 0;
  39         ui64Key = bytes_to_num(datain, 6);
  40
  41         // variables
  42         byte_t isOK = 0;
  43         byte_t dataoutbuf[16];
  44         uint8_t uid[10];
  45         uint32_t cuid;
  46         struct Crypto1State mpcs = {0, 0};
  47         struct Crypto1State *pcs;
  48         pcs = &mpcs;
  49
  50         // clear trace
  51         clear_trace();
  52         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  53
  54         LED_A_ON();
  55         LED_B_OFF();
  56         LED_C_OFF();
  57
  58         while (true) {
  59                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  60                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  61                         break;
  62                 };
  63
  64                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  65                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  66                         break;
  67                 };
  68
  69                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  70                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  71                         break;
  72                 };
  73
  74                 if(mifare_classic_halt(pcs, cuid)) {
  75                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  76                         break;
  77                 };
  78
  79                 isOK = 1;
  80                 break;
  81         }
  82
  83         //  ----------------------------- crypto1 destroy
  84         crypto1_destroy(pcs);
  85
  86         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  87
  88         LED_B_ON();
  89         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  90         LED_B_OFF();
  91
  92         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  93         LEDsoff();
  94 }
  95
  96 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  97
  98         byte_t dataoutbuf[16] = {0x00};
  99         uint8_t uid[10] = {0x00};
 100         uint32_t cuid = 0x00;
 101
 102         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 103
 104         clear_trace();
 105         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 106
 107         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 108                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 109                 OnError(0);
 110                 return;
 111         };
 112
 113         if(mifare_ultra_auth1(dataoutbuf)){
 114                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
 115                 OnError(1);
 116                 return;
 117         }
 118
 119         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
 120
 121     cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
 122         LEDsoff();
 123 }
 124 void MifareUC_Auth2(uint8_t arg0, uint8_t *datain){
 125
 126         uint8_t key[16] = {0x00};
 127         byte_t dataoutbuf[16] = {0x00};
 128
 129         memcpy(key, datain, 16);
 130
 131         LED_A_ON();     LED_B_OFF(); LED_C_OFF();
 132
 133         if(mifare_ultra_auth2(key, dataoutbuf)){
 134             if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
 135                 OnError(1);
 136                 return;
 137         }
 138
 139         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
 140
 141         cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
 142         if (arg0) {
 143                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 144                 LEDsoff();
 145         }
 146 }
 147
 148 // Arg0 = BlockNo,
 149 // Arg1 = UsePwd bool
 150 // datain = PWD bytes,
 151 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 152 {
 153         uint8_t blockNo = arg0;
 154         byte_t dataout[16] = {0x00};
 155         uint8_t uid[10] = {0x00};
 156         uint8_t key[16] = {0x00};
 157         bool usePwd = (arg1 == 1);
 158
 159         LEDsoff();
 160         LED_A_ON();
 161         clear_trace();
 162         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 163
 164         int len = iso14443a_select_card(uid, NULL, NULL);
 165         if(!len) {
 166                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 167                 OnError(1);
 168                 return;
 169         }
 170
 171          // authenticate here.
 172         if ( usePwd ) {
 173
 174                 memcpy(key, datain, 16);
 175
 176                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );
 177                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );
 178
 179                 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
 180                 uint8_t random_b[8] = {0x00};
 181                 uint8_t enc_random_b[8] = {0x00};
 182                 uint8_t rnd_ab[16] = {0x00};
 183                 uint8_t IV[8] = {0x00};
 184
 185                 uint16_t len;
 186                 uint8_t receivedAnswer[MAX_FRAME_SIZE];
 187                 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
 188
 189                 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
 190                 if (len != 11) {
 191                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 192                         OnError(1);
 193                         return;
 194                 }
 195
 196                 // tag nonce.
 197                 memcpy(enc_random_b,receivedAnswer+1,8);
 198
 199                 // decrypt nonce.
 200                 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
 201                 rol(random_b,8);
 202                 memcpy(rnd_ab  ,random_a,8);
 203                 memcpy(rnd_ab+8,random_b,8);
 204
 205                 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
 206                         Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
 207                                 enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],
 208                                 enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
 209
 210                         Dbprintf("    B: %02x %02x %02x %02x %02x %02x %02x %02x",
 211                                 random_b[0],random_b[1],random_b[2],random_b[3],
 212                                 random_b[4],random_b[5],random_b[6],random_b[7]);
 213
 214                         Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
 215                                         rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
 216                                         rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
 217
 218                         Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
 219                                         rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
 220                                         rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
 221                 }
 222
 223                 // encrypt    out, in, length, key, iv
 224                 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
 225
 226                 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
 227                 if (len != 11) {
 228                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 229                         OnError(1);
 230                         return;
 231                 }
 232
 233                 uint8_t enc_resp[8] = { 0 };
 234                 uint8_t resp_random_a[8] = { 0 };
 235                 memcpy(enc_resp, receivedAnswer+1, 8);
 236
 237                 // decrypt    out, in, length, key, iv
 238                 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
 239                 if ( memcmp(resp_random_a, random_a, 8) != 0 )
 240                         Dbprintf("failed authentication");
 241
 242                 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
 243                         Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
 244                                         rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
 245                                         rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
 246
 247                         Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
 248                                         rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
 249                                         rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
 250
 251                         Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
 252                                         random_a[0],random_a[1],random_a[2],random_a[3],
 253                                         random_a[4],random_a[5],random_a[6],random_a[7]);
 254
 255                         Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
 256                                         resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
 257                                         resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
 258                 }
 259         }
 260
 261         if( mifare_ultra_readblock(blockNo, dataout) ) {
 262                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 263                 OnError(2);
 264                 return;
 265         }
 266
 267         if( mifare_ultra_halt() ) {
 268                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 269                 OnError(3);
 270                 return;
 271         }
 272
 273     cmd_send(CMD_ACK,1,0,0,dataout,16);
 274         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 275         LEDsoff();
 276 }
 277
 278 //-----------------------------------------------------------------------------
 279 // Select, Authenticate, Read a MIFARE tag.
 280 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 281 //-----------------------------------------------------------------------------
 282 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 283 {
 284   // params
 285         uint8_t sectorNo = arg0;
 286         uint8_t keyType = arg1;
 287         uint64_t ui64Key = 0;
 288         ui64Key = bytes_to_num(datain, 6);
 289
 290         // variables
 291         byte_t isOK = 0;
 292         byte_t dataoutbuf[16 * 16];
 293         uint8_t uid[10];
 294         uint32_t cuid;
 295         struct Crypto1State mpcs = {0, 0};
 296         struct Crypto1State *pcs;
 297         pcs = &mpcs;
 298
 299         // clear trace
 300         clear_trace();
 301
 302         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 303
 304         LED_A_ON();
 305         LED_B_OFF();
 306         LED_C_OFF();
 307
 308         isOK = 1;
 309         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 310                 isOK = 0;
 311                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 312         }
 313
 314
 315         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 316                 isOK = 0;
 317                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 318         }
 319
 320         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 321                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 322                         isOK = 0;
 323                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 324                         break;
 325                 }
 326         }
 327
 328         if(mifare_classic_halt(pcs, cuid)) {
 329                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 330         }
 331
 332         //  ----------------------------- crypto1 destroy
 333         crypto1_destroy(pcs);
 334
 335         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 336
 337         LED_B_ON();
 338         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 339         LED_B_OFF();
 340
 341         // Thats it...
 342         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 343         LEDsoff();
 344 }
 345
 346 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 347 {
 348         // params
 349         uint8_t blockNo = arg0;
 350         uint16_t blocks = arg1;
 351         bool useKey = (arg2 == 1); //UL_C
 352         bool usePwd = (arg2 == 2); //UL_EV1/NTAG
 353         int countblocks = 0;
 354         uint8_t dataout[176] = {0x00};
 355
 356         LEDsoff();
 357         LED_A_ON();
 358         clear_trace();
 359         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 360
 361         int len = iso14443a_select_card(NULL, NULL, NULL);
 362         if (!len) {
 363                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 364                 OnError(1);
 365                 return;
 366         }
 367
 368         // authenticate
 369         if ( useKey ) {
 370                 uint8_t key[16] = {0x00};
 371                 memcpy(key, datain, 16);
 372
 373                 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
 374                 uint8_t random_b[8] = {0x00};
 375                 uint8_t enc_random_b[8] = {0x00};
 376                 uint8_t rnd_ab[16] = {0x00};
 377                 uint8_t IV[8] = {0x00};
 378
 379                 uint16_t len2;
 380                 uint8_t receivedAnswer[MAX_FRAME_SIZE];
 381                 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
 382
 383                 len2 = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
 384                 if (len2 != 11) {
 385                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 386                         OnError(1);
 387                         return;
 388                 }
 389
 390                 // tag nonce.
 391                 memcpy(enc_random_b,receivedAnswer+1,8);
 392
 393                 // decrypt nonce.
 394                 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
 395                 rol(random_b,8);
 396                 memcpy(rnd_ab  ,random_a,8);
 397                 memcpy(rnd_ab+8,random_b,8);
 398
 399                 // encrypt    out, in, length, key, iv
 400                 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
 401
 402                 len2 = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
 403                 if (len2 != 11) {
 404                         OnError(1);
 405                         return;
 406                 }
 407
 408                 uint8_t enc_resp[8] = { 0 };
 409                 uint8_t resp_random_a[8] = { 0 };
 410                 memcpy(enc_resp, receivedAnswer+1, 8);
 411
 412                 // decrypt    out, in, length, key, iv
 413                 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
 414                 if ( memcmp(resp_random_a, random_a, 8) != 0 )
 415                         Dbprintf("failed authentication");
 416         }
 417
 418         if (usePwd) { //ev1 or ntag auth
 419                 uint8_t Pwd[4] = {0x00};
 420                 memcpy(Pwd, datain, 4);
 421                 uint8_t pack[4] = {0,0,0,0};
 422
 423                 if (mifare_ul_ev1_auth(Pwd, pack)){
 424                         OnError(1);
 425                         Dbprintf("failed authentication");
 426                         return;
 427                 }
 428         }
 429
 430         for (int i = 0; i < blocks; i++){
 431                 len = mifare_ultra_readblock(blockNo * 4 + i, dataout + 4 * i);
 432
 433                 if (len) {
 434                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 435                         OnError(2);
 436                         return;
 437                 } else {
 438                         countblocks++;
 439                 }
 440         }
 441
 442         len = mifare_ultra_halt();
 443         if (len) {
 444                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 445                 OnError(3);
 446                 return;
 447         }
 448
 449         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 450
 451         len = blocks * 4;
 452
 453         cmd_send(CMD_ACK, 1, len, 0, dataout, len);
 454         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 455         LEDsoff();
 456 }
 457
 458 //-----------------------------------------------------------------------------
 459 // Select, Authenticate, Write a MIFARE tag.
 460 // read block
 461 //-----------------------------------------------------------------------------
 462 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 463 {
 464         // params
 465         uint8_t blockNo = arg0;
 466         uint8_t keyType = arg1;
 467         uint64_t ui64Key = 0;
 468         byte_t blockdata[16];
 469
 470         ui64Key = bytes_to_num(datain, 6);
 471         memcpy(blockdata, datain + 10, 16);
 472
 473         // variables
 474         byte_t isOK = 0;
 475         uint8_t uid[10];
 476         uint32_t cuid;
 477         struct Crypto1State mpcs = {0, 0};
 478         struct Crypto1State *pcs;
 479         pcs = &mpcs;
 480
 481         // clear trace
 482         clear_trace();
 483
 484         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 485
 486         LED_A_ON();
 487         LED_B_OFF();
 488         LED_C_OFF();
 489
 490         while (true) {
 491                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 492                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 493                         break;
 494                 };
 495
 496                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 497                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 498                         break;
 499                 };
 500
 501                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 502                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 503                         break;
 504                 };
 505
 506                 if(mifare_classic_halt(pcs, cuid)) {
 507                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 508                         break;
 509                 };
 510
 511                 isOK = 1;
 512                 break;
 513         }
 514
 515         //  ----------------------------- crypto1 destroy
 516         crypto1_destroy(pcs);
 517
 518         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 519
 520         LED_B_ON();
 521         cmd_send(CMD_ACK,isOK,0,0,0,0);
 522         LED_B_OFF();
 523
 524
 525         // Thats it...
 526         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 527         LEDsoff();
 528 }
 529
 530 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 531 {
 532         uint8_t blockNo = arg0;
 533         byte_t blockdata[16] = {0x00};
 534
 535         memcpy(blockdata, datain, 16);
 536
 537         uint8_t uid[10] = {0x00};
 538
 539         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 540
 541         clear_trace();
 542         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 543
 544         if(!iso14443a_select_card(uid, NULL, NULL)) {
 545                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 546                 OnError(0);
 547                 return;
 548         };
 549
 550         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 551                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 552                 OnError(0);
 553                 return; };
 554
 555         if(mifare_ultra_halt()) {
 556                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 557                 OnError(0);
 558                 return;
 559         };
 560
 561         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 562
 563         cmd_send(CMD_ACK,1,0,0,0,0);
 564         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 565         LEDsoff();
 566 }
 567
 568 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 569 {
 570         uint8_t blockNo = arg0;
 571         byte_t blockdata[4] = {0x00};
 572
 573         memcpy(blockdata, datain,4);
 574
 575         uint8_t uid[10] = {0x00};
 576
 577         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 578         clear_trace();
 579         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 580
 581         if(!iso14443a_select_card(uid, NULL, NULL)) {
 582                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 583                 OnError(0);
 584                 return;
 585         };
 586
 587         if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
 588                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 589                 OnError(0);
 590                 return;
 591         };
 592
 593         if(mifare_ultra_halt()) {
 594                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 595                 OnError(0);
 596                 return;
 597         };
 598
 599         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 600
 601         cmd_send(CMD_ACK,1,0,0,0,0);
 602         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 603         LEDsoff();
 604 }
 605
 606 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 607
 608         uint8_t pwd[16] = {0x00};
 609         byte_t blockdata[4] = {0x00};
 610
 611         memcpy(pwd, datain, 16);
 612
 613         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 614         clear_trace();
 615         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 616
 617         if(!iso14443a_select_card(NULL, NULL, NULL)) {
 618                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 619                 OnError(0);
 620                 return;
 621         };
 622
 623         blockdata[0] = pwd[7];
 624         blockdata[1] = pwd[6];
 625         blockdata[2] = pwd[5];
 626         blockdata[3] = pwd[4];
 627         if(mifare_ultra_special_writeblock( 44, blockdata)) {
 628                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 629                 OnError(44);
 630                 return;
 631         };
 632
 633         blockdata[0] = pwd[3];
 634         blockdata[1] = pwd[2];
 635         blockdata[2] = pwd[1];
 636         blockdata[3] = pwd[0];
 637         if(mifare_ultra_special_writeblock( 45, blockdata)) {
 638                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 639                 OnError(45);
 640                 return;
 641         };
 642
 643         blockdata[0] = pwd[15];
 644         blockdata[1] = pwd[14];
 645         blockdata[2] = pwd[13];
 646         blockdata[3] = pwd[12];
 647         if(mifare_ultra_special_writeblock( 46, blockdata)) {
 648                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 649                 OnError(46);
 650                 return;
 651         };
 652
 653         blockdata[0] = pwd[11];
 654         blockdata[1] = pwd[10];
 655         blockdata[2] = pwd[9];
 656         blockdata[3] = pwd[8];
 657         if(mifare_ultra_special_writeblock( 47, blockdata)) {
 658                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 659                 OnError(47);
 660                 return;
 661         };
 662
 663         if(mifare_ultra_halt()) {
 664                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 665                 OnError(0);
 666                 return;
 667         };
 668
 669         cmd_send(CMD_ACK,1,0,0,0,0);
 670         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 671         LEDsoff();
 672 }
 673
 674 // Return 1 if the nonce is invalid else return 0
 675 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 676         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 677         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 678         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 679 }
 680
 681
 682 //-----------------------------------------------------------------------------
 683 // MIFARE nested authentication.
 684 //
 685 //-----------------------------------------------------------------------------
 686 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 687 {
 688         // params
 689         uint8_t blockNo = arg0 & 0xff;
 690         uint8_t keyType = (arg0 >> 8) & 0xff;
 691         uint8_t targetBlockNo = arg1 & 0xff;
 692         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 693         uint64_t ui64Key = 0;
 694
 695         ui64Key = bytes_to_num(datain, 6);
 696
 697         // variables
 698         uint16_t rtr, i, j, len;
 699         uint16_t davg;
 700         static uint16_t dmin, dmax;
 701         uint8_t uid[10];
 702         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 703         uint8_t par[1];
 704         uint32_t target_nt[2], target_ks[2];
 705
 706         uint8_t par_array[4];
 707         uint16_t ncount = 0;
 708         struct Crypto1State mpcs = {0, 0};
 709         struct Crypto1State *pcs;
 710         pcs = &mpcs;
 711         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 712
 713         uint32_t auth1_time, auth2_time;
 714         static uint16_t delta_time;
 715
 716         // free eventually allocated BigBuf memory
 717         BigBuf_free();
 718         // clear trace
 719         clear_trace();
 720         set_tracing(false);
 721
 722         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 723
 724         LED_A_ON();
 725         LED_C_OFF();
 726
 727
 728         // statistics on nonce distance
 729         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 730                 LED_B_ON();
 731                 WDT_HIT();
 732
 733                 davg = dmax = 0;
 734                 dmin = 2000;
 735                 delta_time = 0;
 736
 737                 for (rtr = 0; rtr < 17; rtr++) {
 738
 739                         // prepare next select. No need to power down the card.
 740                         if(mifare_classic_halt(pcs, cuid)) {
 741                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 742                                 rtr--;
 743                                 continue;
 744                         }
 745
 746                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 747                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 748                                 rtr--;
 749                                 continue;
 750                         };
 751
 752                         auth1_time = 0;
 753                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 754                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 755                                 rtr--;
 756                                 continue;
 757                         };
 758
 759                         if (delta_time) {
 760                                 auth2_time = auth1_time + delta_time;
 761                         } else {
 762                                 auth2_time = 0;
 763                         }
 764                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 765                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 766                                 rtr--;
 767                                 continue;
 768                         };
 769
 770                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 771                         for (i = 101; i < 1200; i++) {
 772                                 nttmp = prng_successor(nttmp, 1);
 773                                 if (nttmp == nt2) break;
 774                         }
 775
 776                         if (i != 1200) {
 777                                 if (rtr != 0) {
 778                                         davg += i;
 779                                         dmin = MIN(dmin, i);
 780                                         dmax = MAX(dmax, i);
 781                                 }
 782                                 else {
 783                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 784                                 }
 785                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 786                         }
 787                 }
 788
 789                 if (rtr <= 1)   return;
 790
 791                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 792
 793                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 794
 795                 dmin = davg - 2;
 796                 dmax = davg + 2;
 797
 798                 LED_B_OFF();
 799
 800         }
 801 //  -------------------------------------------------------------------------------------------------
 802
 803         LED_C_ON();
 804
 805         //  get crypted nonces for target sector
 806         for(i=0; i < 2; i++) { // look for exactly two different nonces
 807
 808                 target_nt[i] = 0;
 809                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 810
 811                         // prepare next select. No need to power down the card.
 812                         if(mifare_classic_halt(pcs, cuid)) {
 813                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 814                                 continue;
 815                         }
 816
 817                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 818                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 819                                 continue;
 820                         };
 821
 822                         auth1_time = 0;
 823                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 824                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 825                                 continue;
 826                         };
 827
 828                         // nested authentication
 829                         auth2_time = auth1_time + delta_time;
 830                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 831                         if (len != 4) {
 832                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 833                                 continue;
 834                         };
 835
 836                         nt2 = bytes_to_num(receivedAnswer, 4);
 837                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 838
 839                         // Parity validity check
 840                         for (j = 0; j < 4; j++) {
 841                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 842                         }
 843
 844                         ncount = 0;
 845                         nttest = prng_successor(nt1, dmin - 1);
 846                         for (j = dmin; j < dmax + 1; j++) {
 847                                 nttest = prng_successor(nttest, 1);
 848                                 ks1 = nt2 ^ nttest;
 849
 850                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 851                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 852                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 853                                                 target_nt[i] = 0;
 854                                                 break;
 855                                         }
 856                                         target_nt[i] = nttest;
 857                                         target_ks[i] = ks1;
 858                                         ncount++;
 859                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 860                                                 target_nt[i] = 0;
 861                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 862                                                 break;
 863                                         }
 864                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 865                                 }
 866                         }
 867                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 868                 }
 869         }
 870
 871         LED_C_OFF();
 872
 873         //  ----------------------------- crypto1 destroy
 874         crypto1_destroy(pcs);
 875
 876         byte_t buf[4 + 4 * 4];
 877         memcpy(buf, &cuid, 4);
 878         memcpy(buf+4, &target_nt[0], 4);
 879         memcpy(buf+8, &target_ks[0], 4);
 880         memcpy(buf+12, &target_nt[1], 4);
 881         memcpy(buf+16, &target_ks[1], 4);
 882
 883         LED_B_ON();
 884         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 885         LED_B_OFF();
 886
 887         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 888
 889         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 890         LEDsoff();
 891         set_tracing(TRUE);
 892 }
 893
 894 //-----------------------------------------------------------------------------
 895 // MIFARE check keys. key count up to 85.
 896 //
 897 //-----------------------------------------------------------------------------
 898 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 899 {
 900   // params
 901         uint8_t blockNo = arg0;
 902         uint8_t keyType = arg1;
 903         uint8_t keyCount = arg2;
 904         uint64_t ui64Key = 0;
 905
 906         // variables
 907         int i;
 908         byte_t isOK = 0;
 909         uint8_t uid[10];
 910         uint32_t cuid;
 911         struct Crypto1State mpcs = {0, 0};
 912         struct Crypto1State *pcs;
 913         pcs = &mpcs;
 914
 915         // clear debug level
 916         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 917         MF_DBGLEVEL = MF_DBG_NONE;
 918
 919         // clear trace
 920         clear_trace();
 921         set_tracing(TRUE);
 922
 923         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 924
 925         LED_A_ON();
 926         LED_B_OFF();
 927         LED_C_OFF();
 928
 929         for (i = 0; i < keyCount; i++) {
 930                 if(mifare_classic_halt(pcs, cuid)) {
 931                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 932                 }
 933
 934                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 935                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 936                         break;
 937                 };
 938
 939                 ui64Key = bytes_to_num(datain + i * 6, 6);
 940                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 941                         continue;
 942                 };
 943
 944                 isOK = 1;
 945                 break;
 946         }
 947
 948         //  ----------------------------- crypto1 destroy
 949         crypto1_destroy(pcs);
 950
 951         LED_B_ON();
 952     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 953         LED_B_OFF();
 954
 955         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 956         LEDsoff();
 957
 958         // restore debug level
 959         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 960 }
 961
 962 //-----------------------------------------------------------------------------
 963 // MIFARE commands set debug level
 964 //
 965 //-----------------------------------------------------------------------------
 966 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 967         MF_DBGLEVEL = arg0;
 968         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 969 }
 970
 971 //-----------------------------------------------------------------------------
 972 // Work with emulator memory
 973 //
 974 //-----------------------------------------------------------------------------
 975 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 976         emlClearMem();
 977 }
 978
 979 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 980         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 981 }
 982
 983 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 984         byte_t buf[USB_CMD_DATA_SIZE];
 985         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 986
 987         LED_B_ON();
 988         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 989         LED_B_OFF();
 990 }
 991
 992 //-----------------------------------------------------------------------------
 993 // Load a card into the emulator memory
 994 //
 995 //-----------------------------------------------------------------------------
 996 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 997         uint8_t numSectors = arg0;
 998         uint8_t keyType = arg1;
 999         uint64_t ui64Key = 0;
1000         uint32_t cuid;
1001         struct Crypto1State mpcs = {0, 0};
1002         struct Crypto1State *pcs;
1003         pcs = &mpcs;
1004
1005         // variables
1006         byte_t dataoutbuf[16];
1007         byte_t dataoutbuf2[16];
1008         uint8_t uid[10];
1009
1010         // clear trace
1011         clear_trace();
1012         set_tracing(false);
1013
1014         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1015
1016         LED_A_ON();
1017         LED_B_OFF();
1018         LED_C_OFF();
1019
1020         bool isOK = true;
1021
1022         if(!iso14443a_select_card(uid, NULL, &cuid)) {
1023                 isOK = false;
1024                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1025         }
1026
1027         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1028                 ui64Key = emlGetKey(sectorNo, keyType);
1029                 if (sectorNo == 0){
1030                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1031                                 isOK = false;
1032                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
1033                                 break;
1034                         }
1035                 } else {
1036                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1037                                 isOK = false;
1038                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1039                                 break;
1040                         }
1041                 }
1042
1043                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1044                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1045                                 isOK = false;
1046                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1047                                 break;
1048                         };
1049                         if (isOK) {
1050                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1051                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1052                                 } else {        // sector trailer, keep the keys, set only the AC
1053                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1054                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1055                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
1056                                 }
1057                         }
1058                 }
1059
1060         }
1061
1062         if(mifare_classic_halt(pcs, cuid)) {
1063                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1064         };
1065
1066         //  ----------------------------- crypto1 destroy
1067         crypto1_destroy(pcs);
1068
1069         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1070         LEDsoff();
1071
1072         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1073
1074 }
1075
1076
1077 //-----------------------------------------------------------------------------
1078 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1079 //
1080 //-----------------------------------------------------------------------------
1081 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1082
1083   // params
1084         uint8_t needWipe = arg0;
1085         // bit 0 - need get UID
1086         // bit 1 - need wupC
1087         // bit 2 - need HALT after sequence
1088         // bit 3 - need init FPGA and field before sequence
1089         // bit 4 - need reset FPGA and LED
1090         uint8_t workFlags = arg1;
1091         uint8_t blockNo = arg2;
1092
1093         // card commands
1094         uint8_t wupC1[]       = { 0x40 };
1095         uint8_t wupC2[]       = { 0x43 };
1096         uint8_t wipeC[]       = { 0x41 };
1097
1098         // variables
1099         byte_t isOK = 0;
1100         uint8_t uid[10] = {0x00};
1101         uint8_t d_block[18] = {0x00};
1102         uint32_t cuid;
1103
1104         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1105         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1106
1107         // reset FPGA and LED
1108         if (workFlags & 0x08) {
1109                 LED_A_ON();
1110                 LED_B_OFF();
1111                 LED_C_OFF();
1112
1113                 clear_trace();
1114                 set_tracing(TRUE);
1115                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1116         }
1117
1118         while (true) {
1119
1120                 // get UID from chip
1121                 if (workFlags & 0x01) {
1122                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
1123                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1124                                 break;
1125                         };
1126
1127                         if(mifare_classic_halt(NULL, cuid)) {
1128                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1129                                 break;
1130                         };
1131                 };
1132
1133                 // reset chip
1134                 if (needWipe){
1135                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1136                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1137                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1138                                 break;
1139                         };
1140
1141                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1142                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1143                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
1144                                 break;
1145                         };
1146
1147                         if(mifare_classic_halt(NULL, cuid)) {
1148                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1149                                 break;
1150                         };
1151                 };
1152
1153                 // write block
1154                 if (workFlags & 0x02) {
1155                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1156                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1157                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1158                                 break;
1159                         };
1160
1161                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1162                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1163                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1164                                 break;
1165                         };
1166                 }
1167
1168                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1169                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
1170                         break;
1171                 };
1172
1173                 memcpy(d_block, datain, 16);
1174                 AppendCrc14443a(d_block, 16);
1175
1176                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1177                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1178                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1179                         break;
1180                 };
1181
1182                 if (workFlags & 0x04) {
1183                         if (mifare_classic_halt(NULL, cuid)) {
1184                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1185                                 break;
1186                         };
1187                 }
1188
1189                 isOK = 1;
1190                 break;
1191         }
1192
1193         LED_B_ON();
1194         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1195         LED_B_OFF();
1196
1197         if ((workFlags & 0x10) || (!isOK)) {
1198                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1199                 LEDsoff();
1200         }
1201 }
1202
1203
1204 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1205
1206   // params
1207         // bit 1 - need wupC
1208         // bit 2 - need HALT after sequence
1209         // bit 3 - need init FPGA and field before sequence
1210         // bit 4 - need reset FPGA and LED
1211         uint8_t workFlags = arg0;
1212         uint8_t blockNo = arg2;
1213
1214         // card commands
1215         uint8_t wupC1[]       = { 0x40 };
1216         uint8_t wupC2[]       = { 0x43 };
1217
1218         // variables
1219         byte_t isOK = 0;
1220         uint8_t data[18] = {0x00};
1221         uint32_t cuid = 0;
1222
1223         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1224         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1225
1226         if (workFlags & 0x08) {
1227                 LED_A_ON();
1228                 LED_B_OFF();
1229                 LED_C_OFF();
1230
1231                 clear_trace();
1232                 set_tracing(TRUE);
1233                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1234         }
1235
1236         while (true) {
1237                 if (workFlags & 0x02) {
1238                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1239                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1240                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1241                                 break;
1242                         };
1243
1244                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1245                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1246                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1247                                 break;
1248                         };
1249                 }
1250
1251                 // read block
1252                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1253                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1254                         break;
1255                 };
1256                 memcpy(data, receivedAnswer, 18);
1257
1258                 if (workFlags & 0x04) {
1259                         if (mifare_classic_halt(NULL, cuid)) {
1260                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1261                                 break;
1262                         };
1263                 }
1264
1265                 isOK = 1;
1266                 break;
1267         }
1268
1269         LED_B_ON();
1270         cmd_send(CMD_ACK,isOK,0,0,data,18);
1271         LED_B_OFF();
1272
1273         if ((workFlags & 0x10) || (!isOK)) {
1274                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1275                 LEDsoff();
1276         }
1277 }
1278
1279 void MifareCIdent(){
1280
1281         // card commands
1282         uint8_t wupC1[]       = { 0x40 };
1283         uint8_t wupC2[]       = { 0x43 };
1284
1285         // variables
1286         byte_t isOK = 1;
1287
1288         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1289         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1290
1291         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1292         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1293                 isOK = 0;
1294         };
1295
1296         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1297         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1298                 isOK = 0;
1299         };
1300
1301         if (mifare_classic_halt(NULL, 0)) {
1302                 isOK = 0;
1303         };
1304
1305         cmd_send(CMD_ACK,isOK,0,0,0,0);
1306 }
1307
1308                         //
1309 // DESFIRE
1310 //
1311
1312 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1313
1314         byte_t dataout[11] = {0x00};
1315         uint8_t uid[10] = {0x00};
1316         uint32_t cuid;
1317
1318         clear_trace();
1319         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1320
1321         int len = iso14443a_select_card(uid, NULL, &cuid);
1322         if(!len) {
1323                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1324                         Dbprintf("Can't select card");
1325                 //OnError(1);
1326                 return;
1327         };
1328
1329         if(mifare_desfire_des_auth1(cuid, dataout)){
1330                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1331                         Dbprintf("Authentication part1: Fail.");
1332                 //OnError(4);
1333                 return;
1334         }
1335
1336         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1337
1338     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1339 }
1340
1341 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1342
1343         uint32_t cuid = arg0;
1344         uint8_t key[16] = {0x00};
1345         byte_t isOK = 0;
1346         byte_t dataout[12] = {0x00};
1347
1348         memcpy(key, datain, 16);
1349
1350         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1351
1352         if( isOK) {
1353             if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1354                         Dbprintf("Authentication part2: Failed");
1355                 //OnError(4);
1356                 return;
1357         }
1358
1359         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1360                 DbpString("AUTH 2 FINISHED");
1361
1362         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1363         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1364         LEDsoff();
1365 }
1366
1367 void OnSuccess(){
1368         pcb_blocknum = 0;
1369         ReaderTransmit(deselect_cmd, 3 , NULL);
1370         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1371         LEDsoff();
1372 }
1373
1374 void OnError(uint8_t reason){
1375         pcb_blocknum = 0;
1376         ReaderTransmit(deselect_cmd, 3 , NULL);
1377         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1378         cmd_send(CMD_ACK,0,reason,0,0,0);
1379         LEDsoff();
1380 }