]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
FIX: ELOAD/ESAVE/CLOAD/CSAVE filename bufferoverflow, and filename generation if...
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17 #include "apps.h"
18 #include "util.h"
19
20 #include "crc.h"
21
22 //-----------------------------------------------------------------------------
23 // Select, Authenticate, Read a MIFARE tag.
24 // read block
25 //-----------------------------------------------------------------------------
26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
27 {
28 // params
29 uint8_t blockNo = arg0;
30 uint8_t keyType = arg1;
31 uint64_t ui64Key = 0;
32 ui64Key = bytes_to_num(datain, 6);
33
34 // variables
35 byte_t isOK = 0;
36 byte_t dataoutbuf[16];
37 uint8_t uid[10];
38 uint32_t cuid;
39 struct Crypto1State mpcs = {0, 0};
40 struct Crypto1State *pcs;
41 pcs = &mpcs;
42
43 // clear trace
44 clear_trace();
45 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
46
47 LED_A_ON();
48 LED_B_OFF();
49 LED_C_OFF();
50
51 while (true) {
52 if(!iso14443a_select_card(uid, NULL, &cuid)) {
53 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
54 break;
55 };
56
57 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
58 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
59 break;
60 };
61
62 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
63 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
64 break;
65 };
66
67 if(mifare_classic_halt(pcs, cuid)) {
68 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
69 break;
70 };
71
72 isOK = 1;
73 break;
74 }
75
76 // ----------------------------- crypto1 destroy
77 crypto1_destroy(pcs);
78
79 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
80
81 LED_B_ON();
82 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
83 LED_B_OFF();
84
85 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
86 LEDsoff();
87 }
88
89 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
90
91 bool turnOffField = (arg0 == 1);
92
93 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
94 clear_trace();
95 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
96
97 if(!iso14443a_select_card(NULL, NULL, NULL)) {
98 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
99 OnError(0);
100 return;
101 };
102
103 if(!mifare_ultra_auth(keybytes)){
104 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
105 OnError(1);
106 return;
107 }
108
109 if (turnOffField) {
110 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
111 LEDsoff();
112 }
113 cmd_send(CMD_ACK,1,0,0,0,0);
114 }
115
116 // Arg0 = BlockNo,
117 // Arg1 = UsePwd bool
118 // datain = PWD bytes,
119 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
120 {
121 uint8_t blockNo = arg0;
122 byte_t dataout[16] = {0x00};
123 bool useKey = (arg1 == 1); //UL_C
124 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
125
126 LEDsoff();
127 LED_A_ON();
128 clear_trace();
129 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
130
131 int len = iso14443a_select_card(NULL, NULL, NULL);
132 if(!len) {
133 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
134 OnError(1);
135 return;
136 }
137
138 // UL-C authentication
139 if ( useKey ) {
140 uint8_t key[16] = {0x00};
141 memcpy(key, datain, sizeof(key) );
142
143 if ( !mifare_ultra_auth(key) ) {
144 OnError(1);
145 return;
146 }
147 }
148
149 // UL-EV1 / NTAG authentication
150 if ( usePwd ) {
151 uint8_t pwd[4] = {0x00};
152 memcpy(pwd, datain, 4);
153 uint8_t pack[4] = {0,0,0,0};
154 if (!mifare_ul_ev1_auth(pwd, pack)) {
155 OnError(1);
156 return;
157 }
158 }
159
160 if( mifare_ultra_readblock(blockNo, dataout) ) {
161 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
162 OnError(2);
163 return;
164 }
165
166 if( mifare_ultra_halt() ) {
167 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
168 OnError(3);
169 return;
170 }
171
172 cmd_send(CMD_ACK,1,0,0,dataout,16);
173 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
174 LEDsoff();
175 }
176
177 //-----------------------------------------------------------------------------
178 // Select, Authenticate, Read a MIFARE tag.
179 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
180 //-----------------------------------------------------------------------------
181 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
182 {
183 // params
184 uint8_t sectorNo = arg0;
185 uint8_t keyType = arg1;
186 uint64_t ui64Key = 0;
187 ui64Key = bytes_to_num(datain, 6);
188
189 // variables
190 byte_t isOK = 0;
191 byte_t dataoutbuf[16 * 16];
192 uint8_t uid[10];
193 uint32_t cuid;
194 struct Crypto1State mpcs = {0, 0};
195 struct Crypto1State *pcs;
196 pcs = &mpcs;
197
198 // clear trace
199 clear_trace();
200
201 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
202
203 LED_A_ON();
204 LED_B_OFF();
205 LED_C_OFF();
206
207 isOK = 1;
208 if(!iso14443a_select_card(uid, NULL, &cuid)) {
209 isOK = 0;
210 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
211 }
212
213
214 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
215 isOK = 0;
216 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
217 }
218
219 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
220 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
221 isOK = 0;
222 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
223 break;
224 }
225 }
226
227 if(mifare_classic_halt(pcs, cuid)) {
228 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
229 }
230
231 // ----------------------------- crypto1 destroy
232 crypto1_destroy(pcs);
233
234 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
235
236 LED_B_ON();
237 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
238 LED_B_OFF();
239
240 // Thats it...
241 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
242 LEDsoff();
243 }
244
245 // arg0 = blockNo (start)
246 // arg1 = Pages (number of blocks)
247 // arg2 = useKey
248 // datain = KEY bytes
249 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
250 {
251 // free eventually allocated BigBuf memory
252 BigBuf_free();
253 clear_trace();
254
255 // params
256 uint8_t blockNo = arg0;
257 uint16_t blocks = arg1;
258 bool useKey = (arg2 == 1); //UL_C
259 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
260 uint32_t countblocks = 0;
261 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
262 if (dataout == NULL){
263 Dbprintf("out of memory");
264 OnError(1);
265 return;
266 }
267
268 LEDsoff();
269 LED_A_ON();
270 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
271
272 int len = iso14443a_select_card(NULL, NULL, NULL);
273 if (!len) {
274 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
275 OnError(1);
276 return;
277 }
278
279 // UL-C authentication
280 if ( useKey ) {
281 uint8_t key[16] = {0x00};
282 memcpy(key, datain, sizeof(key) );
283
284 if ( !mifare_ultra_auth(key) ) {
285 OnError(1);
286 return;
287 }
288 }
289
290 // UL-EV1 / NTAG authentication
291 if (usePwd) {
292 uint8_t pwd[4] = {0x00};
293 memcpy(pwd, datain, sizeof(pwd));
294 uint8_t pack[4] = {0,0,0,0};
295
296 if (!mifare_ul_ev1_auth(pwd, pack)){
297 OnError(1);
298 return;
299 }
300 }
301
302 for (int i = 0; i < blocks; i++){
303 if ((i*4) + 4 > CARD_MEMORY_SIZE) {
304 Dbprintf("Data exceeds buffer!!");
305 break;
306 }
307
308 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
309
310 if (len) {
311 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
312 // if no blocks read - error out
313 if (i==0){
314 OnError(2);
315 return;
316 } else {
317 //stop at last successful read block and return what we got
318 break;
319 }
320 } else {
321 countblocks++;
322 }
323 }
324
325 len = mifare_ultra_halt();
326 if (len) {
327 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
328 OnError(3);
329 return;
330 }
331
332 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
333
334 countblocks *= 4;
335 cmd_send(CMD_ACK, 1, countblocks, countblocks, 0, 0);
336 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
337 LEDsoff();
338 }
339
340 //-----------------------------------------------------------------------------
341 // Select, Authenticate, Write a MIFARE tag.
342 // read block
343 //-----------------------------------------------------------------------------
344 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
345 {
346 // params
347 uint8_t blockNo = arg0;
348 uint8_t keyType = arg1;
349 uint64_t ui64Key = 0;
350 byte_t blockdata[16];
351
352 ui64Key = bytes_to_num(datain, 6);
353 memcpy(blockdata, datain + 10, 16);
354
355 // variables
356 byte_t isOK = 0;
357 uint8_t uid[10];
358 uint32_t cuid;
359 struct Crypto1State mpcs = {0, 0};
360 struct Crypto1State *pcs;
361 pcs = &mpcs;
362
363 // clear trace
364 clear_trace();
365
366 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
367
368 LED_A_ON();
369 LED_B_OFF();
370 LED_C_OFF();
371
372 while (true) {
373 if(!iso14443a_select_card(uid, NULL, &cuid)) {
374 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
375 break;
376 };
377
378 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
379 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
380 break;
381 };
382
383 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
384 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
385 break;
386 };
387
388 if(mifare_classic_halt(pcs, cuid)) {
389 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
390 break;
391 };
392
393 isOK = 1;
394 break;
395 }
396
397 // ----------------------------- crypto1 destroy
398 crypto1_destroy(pcs);
399
400 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
401
402 LED_B_ON();
403 cmd_send(CMD_ACK,isOK,0,0,0,0);
404 LED_B_OFF();
405
406
407 // Thats it...
408 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
409 LEDsoff();
410 }
411
412 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
413 {
414 uint8_t blockNo = arg0;
415 byte_t blockdata[16] = {0x00};
416
417 memcpy(blockdata, datain, 16);
418
419 uint8_t uid[10] = {0x00};
420
421 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
422
423 clear_trace();
424 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
425
426 if(!iso14443a_select_card(uid, NULL, NULL)) {
427 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
428 OnError(0);
429 return;
430 };
431
432 if(mifare_ultra_writeblock(blockNo, blockdata)) {
433 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
434 OnError(0);
435 return; };
436
437 if(mifare_ultra_halt()) {
438 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
439 OnError(0);
440 return;
441 };
442
443 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
444
445 cmd_send(CMD_ACK,1,0,0,0,0);
446 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
447 LEDsoff();
448 }
449
450 // Arg0 : Block to write to.
451 // Arg1 : 0 = use no authentication.
452 // 1 = use 0x1A authentication.
453 // 2 = use 0x1B authentication.
454 // datain : 4 first bytes is data to be written.
455 // : 4/16 next bytes is authentication key.
456 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t arg1, uint8_t *datain)
457 {
458 uint8_t blockNo = arg0;
459 bool useKey = (arg1 == 1); //UL_C
460 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
461 byte_t blockdata[4] = {0x00};
462
463 memcpy(blockdata, datain,4);
464
465 LEDsoff();
466 LED_A_ON();
467 clear_trace();
468 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
469
470 if(!iso14443a_select_card(NULL, NULL, NULL)) {
471 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
472 OnError(0);
473 return;
474 };
475
476 // UL-C authentication
477 if ( useKey ) {
478 uint8_t key[16] = {0x00};
479 memcpy(key, datain+4, sizeof(key) );
480
481 if ( !mifare_ultra_auth(key) ) {
482 OnError(1);
483 return;
484 }
485 }
486
487 // UL-EV1 / NTAG authentication
488 if (usePwd) {
489 uint8_t pwd[4] = {0x00};
490 memcpy(pwd, datain+4, 4);
491 uint8_t pack[4] = {0,0,0,0};
492 if (!mifare_ul_ev1_auth(pwd, pack)) {
493 OnError(1);
494 return;
495 }
496 }
497
498 if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
499 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
500 OnError(0);
501 return;
502 };
503
504 if(mifare_ultra_halt()) {
505 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
506 OnError(0);
507 return;
508 };
509
510 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
511
512 cmd_send(CMD_ACK,1,0,0,0,0);
513 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
514 LEDsoff();
515 }
516
517 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
518
519 uint8_t pwd[16] = {0x00};
520 byte_t blockdata[4] = {0x00};
521
522 memcpy(pwd, datain, 16);
523
524 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
525 clear_trace();
526 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
527
528 if(!iso14443a_select_card(NULL, NULL, NULL)) {
529 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
530 OnError(0);
531 return;
532 };
533
534 blockdata[0] = pwd[7];
535 blockdata[1] = pwd[6];
536 blockdata[2] = pwd[5];
537 blockdata[3] = pwd[4];
538 if(mifare_ultra_special_writeblock( 44, blockdata)) {
539 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
540 OnError(44);
541 return;
542 };
543
544 blockdata[0] = pwd[3];
545 blockdata[1] = pwd[2];
546 blockdata[2] = pwd[1];
547 blockdata[3] = pwd[0];
548 if(mifare_ultra_special_writeblock( 45, blockdata)) {
549 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
550 OnError(45);
551 return;
552 };
553
554 blockdata[0] = pwd[15];
555 blockdata[1] = pwd[14];
556 blockdata[2] = pwd[13];
557 blockdata[3] = pwd[12];
558 if(mifare_ultra_special_writeblock( 46, blockdata)) {
559 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
560 OnError(46);
561 return;
562 };
563
564 blockdata[0] = pwd[11];
565 blockdata[1] = pwd[10];
566 blockdata[2] = pwd[9];
567 blockdata[3] = pwd[8];
568 if(mifare_ultra_special_writeblock( 47, blockdata)) {
569 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
570 OnError(47);
571 return;
572 };
573
574 if(mifare_ultra_halt()) {
575 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
576 OnError(0);
577 return;
578 };
579
580 cmd_send(CMD_ACK,1,0,0,0,0);
581 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
582 LEDsoff();
583 }
584
585 // Return 1 if the nonce is invalid else return 0
586 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
587 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
588 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
589 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
590 }
591
592
593 //-----------------------------------------------------------------------------
594 // MIFARE nested authentication.
595 //
596 //-----------------------------------------------------------------------------
597 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
598 {
599 // params
600 uint8_t blockNo = arg0 & 0xff;
601 uint8_t keyType = (arg0 >> 8) & 0xff;
602 uint8_t targetBlockNo = arg1 & 0xff;
603 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
604 uint64_t ui64Key = 0;
605
606 ui64Key = bytes_to_num(datain, 6);
607
608 // variables
609 uint16_t rtr, i, j, len;
610 uint16_t davg;
611 static uint16_t dmin, dmax;
612 uint8_t uid[10];
613 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
614 uint8_t par[1];
615 uint32_t target_nt[2], target_ks[2];
616
617 uint8_t par_array[4];
618 uint16_t ncount = 0;
619 struct Crypto1State mpcs = {0, 0};
620 struct Crypto1State *pcs;
621 pcs = &mpcs;
622 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
623
624 uint32_t auth1_time, auth2_time;
625 static uint16_t delta_time;
626
627 // free eventually allocated BigBuf memory
628 BigBuf_free();
629 // clear trace
630 clear_trace();
631 set_tracing(false);
632
633 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
634
635 LED_A_ON();
636 LED_C_OFF();
637
638
639 // statistics on nonce distance
640 if (calibrate) { // for first call only. Otherwise reuse previous calibration
641 LED_B_ON();
642 WDT_HIT();
643
644 davg = dmax = 0;
645 dmin = 2000;
646 delta_time = 0;
647
648 for (rtr = 0; rtr < 17; rtr++) {
649
650 // prepare next select. No need to power down the card.
651 if(mifare_classic_halt(pcs, cuid)) {
652 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
653 rtr--;
654 continue;
655 }
656
657 if(!iso14443a_select_card(uid, NULL, &cuid)) {
658 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
659 rtr--;
660 continue;
661 };
662
663 auth1_time = 0;
664 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
665 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
666 rtr--;
667 continue;
668 };
669
670 if (delta_time) {
671 auth2_time = auth1_time + delta_time;
672 } else {
673 auth2_time = 0;
674 }
675 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
676 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
677 rtr--;
678 continue;
679 };
680
681 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
682 for (i = 101; i < 1200; i++) {
683 nttmp = prng_successor(nttmp, 1);
684 if (nttmp == nt2) break;
685 }
686
687 if (i != 1200) {
688 if (rtr != 0) {
689 davg += i;
690 dmin = MIN(dmin, i);
691 dmax = MAX(dmax, i);
692 }
693 else {
694 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
695 }
696 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
697 }
698 }
699
700 if (rtr <= 1) return;
701
702 davg = (davg + (rtr - 1)/2) / (rtr - 1);
703
704 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
705
706 dmin = davg - 2;
707 dmax = davg + 2;
708
709 LED_B_OFF();
710
711 }
712 // -------------------------------------------------------------------------------------------------
713
714 LED_C_ON();
715
716 // get crypted nonces for target sector
717 for(i=0; i < 2; i++) { // look for exactly two different nonces
718
719 target_nt[i] = 0;
720 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
721
722 // prepare next select. No need to power down the card.
723 if(mifare_classic_halt(pcs, cuid)) {
724 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
725 continue;
726 }
727
728 if(!iso14443a_select_card(uid, NULL, &cuid)) {
729 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
730 continue;
731 };
732
733 auth1_time = 0;
734 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
735 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
736 continue;
737 };
738
739 // nested authentication
740 auth2_time = auth1_time + delta_time;
741 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
742 if (len != 4) {
743 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
744 continue;
745 };
746
747 nt2 = bytes_to_num(receivedAnswer, 4);
748 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
749
750 // Parity validity check
751 for (j = 0; j < 4; j++) {
752 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
753 }
754
755 ncount = 0;
756 nttest = prng_successor(nt1, dmin - 1);
757 for (j = dmin; j < dmax + 1; j++) {
758 nttest = prng_successor(nttest, 1);
759 ks1 = nt2 ^ nttest;
760
761 if (valid_nonce(nttest, nt2, ks1, par_array)){
762 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
763 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
764 target_nt[i] = 0;
765 break;
766 }
767 target_nt[i] = nttest;
768 target_ks[i] = ks1;
769 ncount++;
770 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
771 target_nt[i] = 0;
772 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
773 break;
774 }
775 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
776 }
777 }
778 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
779 }
780 }
781
782 LED_C_OFF();
783
784 // ----------------------------- crypto1 destroy
785 crypto1_destroy(pcs);
786
787 byte_t buf[4 + 4 * 4];
788 memcpy(buf, &cuid, 4);
789 memcpy(buf+4, &target_nt[0], 4);
790 memcpy(buf+8, &target_ks[0], 4);
791 memcpy(buf+12, &target_nt[1], 4);
792 memcpy(buf+16, &target_ks[1], 4);
793
794 LED_B_ON();
795 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
796 LED_B_OFF();
797
798 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
799
800 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
801 LEDsoff();
802 set_tracing(TRUE);
803 }
804
805 //-----------------------------------------------------------------------------
806 // MIFARE check keys. key count up to 85.
807 //
808 //-----------------------------------------------------------------------------
809 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
810 {
811 // params
812 uint8_t blockNo = arg0;
813 uint8_t keyType = arg1;
814 uint8_t keyCount = arg2;
815 uint64_t ui64Key = 0;
816
817 // variables
818 int i;
819 byte_t isOK = 0;
820 uint8_t uid[10];
821 uint32_t cuid;
822 struct Crypto1State mpcs = {0, 0};
823 struct Crypto1State *pcs;
824 pcs = &mpcs;
825
826 // clear debug level
827 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
828 MF_DBGLEVEL = MF_DBG_NONE;
829
830 // clear trace
831 clear_trace();
832 set_tracing(TRUE);
833
834 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
835
836 LED_A_ON();
837 LED_B_OFF();
838 LED_C_OFF();
839
840 for (i = 0; i < keyCount; i++) {
841 if(mifare_classic_halt(pcs, cuid)) {
842 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
843 }
844
845 if(!iso14443a_select_card(uid, NULL, &cuid)) {
846 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
847 break;
848 };
849
850 ui64Key = bytes_to_num(datain + i * 6, 6);
851 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
852 continue;
853 };
854
855 isOK = 1;
856 break;
857 }
858
859 // ----------------------------- crypto1 destroy
860 crypto1_destroy(pcs);
861
862 LED_B_ON();
863 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
864 LED_B_OFF();
865
866 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
867 LEDsoff();
868
869 // restore debug level
870 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
871 }
872
873 //-----------------------------------------------------------------------------
874 // MIFARE commands set debug level
875 //
876 //-----------------------------------------------------------------------------
877 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
878 MF_DBGLEVEL = arg0;
879 Dbprintf("Debug level: %d", MF_DBGLEVEL);
880 }
881
882 //-----------------------------------------------------------------------------
883 // Work with emulator memory
884 //
885 //-----------------------------------------------------------------------------
886 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
887 emlClearMem();
888 }
889
890 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
891 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
892 }
893
894 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
895 byte_t buf[USB_CMD_DATA_SIZE];
896 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
897
898 LED_B_ON();
899 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
900 LED_B_OFF();
901 }
902
903 //-----------------------------------------------------------------------------
904 // Load a card into the emulator memory
905 //
906 //-----------------------------------------------------------------------------
907 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
908 uint8_t numSectors = arg0;
909 uint8_t keyType = arg1;
910 uint64_t ui64Key = 0;
911 uint32_t cuid;
912 struct Crypto1State mpcs = {0, 0};
913 struct Crypto1State *pcs;
914 pcs = &mpcs;
915
916 // variables
917 byte_t dataoutbuf[16];
918 byte_t dataoutbuf2[16];
919 uint8_t uid[10];
920
921 // clear trace
922 clear_trace();
923 set_tracing(false);
924
925 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
926
927 LED_A_ON();
928 LED_B_OFF();
929 LED_C_OFF();
930
931 bool isOK = true;
932
933 if(!iso14443a_select_card(uid, NULL, &cuid)) {
934 isOK = false;
935 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
936 }
937
938 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
939 ui64Key = emlGetKey(sectorNo, keyType);
940 if (sectorNo == 0){
941 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
942 isOK = false;
943 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
944 break;
945 }
946 } else {
947 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
948 isOK = false;
949 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
950 break;
951 }
952 }
953
954 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
955 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
956 isOK = false;
957 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
958 break;
959 };
960 if (isOK) {
961 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
962 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
963 } else { // sector trailer, keep the keys, set only the AC
964 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
965 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
966 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
967 }
968 }
969 }
970
971 }
972
973 if(mifare_classic_halt(pcs, cuid)) {
974 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
975 };
976
977 // ----------------------------- crypto1 destroy
978 crypto1_destroy(pcs);
979
980 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
981 LEDsoff();
982
983 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
984
985 }
986
987
988 //-----------------------------------------------------------------------------
989 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
990 //
991 //-----------------------------------------------------------------------------
992 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
993
994 // params
995 uint8_t needWipe = arg0;
996 // bit 0 - need get UID
997 // bit 1 - need wupC
998 // bit 2 - need HALT after sequence
999 // bit 3 - need init FPGA and field before sequence
1000 // bit 4 - need reset FPGA and LED
1001 uint8_t workFlags = arg1;
1002 uint8_t blockNo = arg2;
1003
1004 // card commands
1005 uint8_t wupC1[] = { 0x40 };
1006 uint8_t wupC2[] = { 0x43 };
1007 uint8_t wipeC[] = { 0x41 };
1008
1009 // variables
1010 byte_t isOK = 0;
1011 uint8_t uid[10] = {0x00};
1012 uint8_t d_block[18] = {0x00};
1013 uint32_t cuid;
1014
1015 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1016 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1017
1018 // reset FPGA and LED
1019 if (workFlags & 0x08) {
1020 LED_A_ON();
1021 LED_B_OFF();
1022 LED_C_OFF();
1023
1024 clear_trace();
1025 set_tracing(TRUE);
1026 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1027 }
1028
1029 while (true) {
1030
1031 // get UID from chip
1032 if (workFlags & 0x01) {
1033 if(!iso14443a_select_card(uid, NULL, &cuid)) {
1034 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1035 //break;
1036 };
1037
1038 if(mifare_classic_halt(NULL, cuid)) {
1039 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1040 //break;
1041 };
1042 };
1043
1044 // reset chip
1045 if (needWipe){
1046 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1047 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1048 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1049 break;
1050 };
1051
1052 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1053 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1054 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1055 break;
1056 };
1057
1058 if(mifare_classic_halt(NULL, cuid)) {
1059 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1060 break;
1061 };
1062 };
1063
1064 // write block
1065 if (workFlags & 0x02) {
1066 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1067 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1068 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1069 break;
1070 };
1071
1072 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1073 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1074 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1075 break;
1076 };
1077 }
1078
1079 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1080 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1081 break;
1082 };
1083
1084 memcpy(d_block, datain, 16);
1085 AppendCrc14443a(d_block, 16);
1086
1087 ReaderTransmit(d_block, sizeof(d_block), NULL);
1088 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1089 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1090 break;
1091 };
1092
1093 if (workFlags & 0x04) {
1094 if (mifare_classic_halt(NULL, cuid)) {
1095 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1096 break;
1097 };
1098 }
1099
1100 isOK = 1;
1101 break;
1102 }
1103
1104 LED_B_ON();
1105 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1106 LED_B_OFF();
1107
1108 if ((workFlags & 0x10) || (!isOK)) {
1109 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1110 LEDsoff();
1111 }
1112 }
1113
1114
1115 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1116
1117 // params
1118 // bit 1 - need wupC
1119 // bit 2 - need HALT after sequence
1120 // bit 3 - need init FPGA and field before sequence
1121 // bit 4 - need reset FPGA and LED
1122 uint8_t workFlags = arg0;
1123 uint8_t blockNo = arg2;
1124
1125 // card commands
1126 uint8_t wupC1[] = { 0x40 };
1127 uint8_t wupC2[] = { 0x43 };
1128
1129 // variables
1130 byte_t isOK = 0;
1131 uint8_t data[18] = {0x00};
1132 uint32_t cuid = 0;
1133
1134 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1135 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1136
1137 if (workFlags & 0x08) {
1138 LED_A_ON();
1139 LED_B_OFF();
1140 LED_C_OFF();
1141
1142 clear_trace();
1143 set_tracing(TRUE);
1144 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1145 }
1146
1147 while (true) {
1148 if (workFlags & 0x02) {
1149 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1150 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1151 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1152 break;
1153 };
1154
1155 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1156 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1157 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1158 break;
1159 };
1160 }
1161
1162 // read block
1163 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1164 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1165 break;
1166 };
1167 memcpy(data, receivedAnswer, 18);
1168
1169 if (workFlags & 0x04) {
1170 if (mifare_classic_halt(NULL, cuid)) {
1171 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1172 break;
1173 };
1174 }
1175
1176 isOK = 1;
1177 break;
1178 }
1179
1180 LED_B_ON();
1181 cmd_send(CMD_ACK,isOK,0,0,data,18);
1182 LED_B_OFF();
1183
1184 if ((workFlags & 0x10) || (!isOK)) {
1185 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1186 LEDsoff();
1187 }
1188 }
1189
1190 void MifareCIdent(){
1191
1192 // card commands
1193 uint8_t wupC1[] = { 0x40 };
1194 uint8_t wupC2[] = { 0x43 };
1195
1196 // variables
1197 byte_t isOK = 1;
1198
1199 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1200 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1201
1202 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1203 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1204 isOK = 0;
1205 };
1206
1207 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1208 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1209 isOK = 0;
1210 };
1211
1212 if (mifare_classic_halt(NULL, 0)) {
1213 isOK = 0;
1214 };
1215
1216 cmd_send(CMD_ACK,isOK,0,0,0,0);
1217 }
1218
1219 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1220
1221 BigBuf_free();
1222
1223 uint32_t iterations = arg0;
1224 uint8_t uid[10] = {0x00};
1225
1226 uint8_t *response = BigBuf_malloc(MAX_MIFARE_FRAME_SIZE);
1227 uint8_t *responsePar = BigBuf_malloc(MAX_MIFARE_PARITY_SIZE);
1228
1229 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1230
1231 // get memory from BigBuf.
1232 uint8_t *nonces = BigBuf_malloc(iterations * 4);
1233
1234 LED_A_ON();
1235 LED_B_OFF();
1236 LED_C_OFF();
1237
1238 clear_trace();
1239 set_tracing(TRUE);
1240 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1241
1242 for (int i = 0; i < iterations; i++) {
1243
1244 WDT_HIT();
1245
1246 // Test if the action was cancelled
1247 if(BUTTON_PRESS()) break;
1248
1249 // if(mifare_classic_halt(pcs, cuid)) {
1250 // if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1251 //}
1252
1253 if(!iso14443a_select_card(uid, NULL, NULL)) {
1254 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1255 continue;
1256 };
1257
1258 // Transmit MIFARE_CLASSIC_AUTH.
1259 ReaderTransmit(mf_auth, sizeof(mf_auth), NULL);
1260
1261 // Receive the (4 Byte) "random" nonce
1262 if (!ReaderReceive(response, responsePar)) {
1263 if (MF_DBGLEVEL >= 1) Dbprintf("Couldn't receive tag nonce");
1264 continue;
1265 }
1266
1267 nonces[i*4] = bytes_to_num(response, 4);
1268 }
1269
1270 int packLen = iterations * 4;
1271 int packSize = 0;
1272 int packNum = 0;
1273 while (packLen > 0) {
1274 packSize = MIN(USB_CMD_DATA_SIZE, packLen);
1275 LED_B_ON();
1276 cmd_send(CMD_ACK, 77, 0, packSize, nonces - packLen, packSize);
1277 LED_B_OFF();
1278
1279 packLen -= packSize;
1280 packNum++;
1281 }
1282 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1283 LEDsoff();
1284 }
1285
1286 //
1287 // DESFIRE
1288 //
1289
1290 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1291
1292 byte_t dataout[11] = {0x00};
1293 uint8_t uid[10] = {0x00};
1294 uint32_t cuid = 0x00;
1295
1296 clear_trace();
1297 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1298
1299 int len = iso14443a_select_card(uid, NULL, &cuid);
1300 if(!len) {
1301 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1302 OnError(1);
1303 return;
1304 };
1305
1306 if(mifare_desfire_des_auth1(cuid, dataout)){
1307 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1308 OnError(4);
1309 return;
1310 }
1311
1312 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1313 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1314 }
1315
1316 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1317
1318 uint32_t cuid = arg0;
1319 uint8_t key[16] = {0x00};
1320 byte_t dataout[12] = {0x00};
1321 byte_t isOK = 0;
1322
1323 memcpy(key, datain, 16);
1324
1325 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1326
1327 if( isOK) {
1328 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1329 OnError(4);
1330 return;
1331 }
1332
1333 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1334
1335 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1336 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1337 LEDsoff();
1338 }
Impressum, Datenschutz