]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
f328b1231f63600cb687b98ea13417d953c5c29b
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "mifarecmd.h"
14 #include "apps.h"
15
16 //-----------------------------------------------------------------------------
17 // Select, Authenticaate, Read an MIFARE tag.
18 // read block
19 //-----------------------------------------------------------------------------
20 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
21 {
22 // params
23 uint8_t blockNo = arg0;
24 uint8_t keyType = arg1;
25 uint64_t ui64Key = 0;
26 ui64Key = bytes_to_num(datain, 6);
27
28 // variables
29 byte_t isOK = 0;
30 byte_t dataoutbuf[16];
31 uint8_t uid[8];
32 uint32_t cuid;
33 struct Crypto1State mpcs = {0, 0};
34 struct Crypto1State *pcs;
35 pcs = &mpcs;
36
37 // clear trace
38 iso14a_clear_trace();
39 // iso14a_set_tracing(false);
40
41 iso14443a_setup();
42
43 LED_A_ON();
44 LED_B_OFF();
45 LED_C_OFF();
46
47 while (true) {
48 if(!iso14443a_select_card(uid, NULL, &cuid)) {
49 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
50 break;
51 };
52
53 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
54 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
55 break;
56 };
57
58 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
59 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
60 break;
61 };
62
63 if(mifare_classic_halt(pcs, cuid)) {
64 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
65 break;
66 };
67
68 isOK = 1;
69 break;
70 }
71
72 // ----------------------------- crypto1 destroy
73 crypto1_destroy(pcs);
74
75 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
76
77 // add trace trailer
78 memset(uid, 0x44, 4);
79 LogTrace(uid, 4, 0, 0, TRUE);
80
81 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
82 // memcpy(ack.d.asBytes, dataoutbuf, 16);
83
84 LED_B_ON();
85 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
86 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
87 LED_B_OFF();
88
89
90 // Thats it...
91 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
92 LEDsoff();
93 // iso14a_set_tracing(TRUE);
94
95 }
96
97 //-----------------------------------------------------------------------------
98 // Select, Authenticaate, Read an MIFARE tag.
99 // read sector (data = 4 x 16 bytes = 64 bytes)
100 //-----------------------------------------------------------------------------
101 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
102 {
103 // params
104 uint8_t sectorNo = arg0;
105 uint8_t keyType = arg1;
106 uint64_t ui64Key = 0;
107 ui64Key = bytes_to_num(datain, 6);
108
109 // variables
110 byte_t isOK = 0;
111 byte_t dataoutbuf[16 * 4];
112 uint8_t uid[8];
113 uint32_t cuid;
114 struct Crypto1State mpcs = {0, 0};
115 struct Crypto1State *pcs;
116 pcs = &mpcs;
117
118 // clear trace
119 iso14a_clear_trace();
120 // iso14a_set_tracing(false);
121
122 iso14443a_setup();
123
124 LED_A_ON();
125 LED_B_OFF();
126 LED_C_OFF();
127
128 while (true) {
129 if(!iso14443a_select_card(uid, NULL, &cuid)) {
130 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
131 break;
132 };
133
134 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
135 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
136 break;
137 };
138
139 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf + 16 * 0)) {
140 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 0 error");
141 break;
142 };
143 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf + 16 * 1)) {
144 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 1 error");
145 break;
146 };
147 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf + 16 * 2)) {
148 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 2 error");
149 break;
150 };
151 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf + 16 * 3)) {
152 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 3 error");
153 break;
154 };
155
156 if(mifare_classic_halt(pcs, cuid)) {
157 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
158 break;
159 };
160
161 isOK = 1;
162 break;
163 }
164
165 // ----------------------------- crypto1 destroy
166 crypto1_destroy(pcs);
167
168 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
169
170 // add trace trailer
171 memset(uid, 0x44, 4);
172 LogTrace(uid, 4, 0, 0, TRUE);
173
174 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
175 // memcpy(ack.d.asBytes, dataoutbuf, 16 * 2);
176
177 LED_B_ON();
178 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,32);
179 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
180 // SpinDelay(100);
181
182 // memcpy(ack.d.asBytes, dataoutbuf + 16 * 2, 16 * 2);
183 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
184 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf+32, 32);
185 LED_B_OFF();
186
187 // Thats it...
188 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
189 LEDsoff();
190 // iso14a_set_tracing(TRUE);
191
192 }
193
194 //-----------------------------------------------------------------------------
195 // Select, Authenticaate, Read an MIFARE tag.
196 // read block
197 //-----------------------------------------------------------------------------
198 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
199 {
200 // params
201 uint8_t blockNo = arg0;
202 uint8_t keyType = arg1;
203 uint64_t ui64Key = 0;
204 byte_t blockdata[16];
205
206 ui64Key = bytes_to_num(datain, 6);
207 memcpy(blockdata, datain + 10, 16);
208
209 // variables
210 byte_t isOK = 0;
211 uint8_t uid[8];
212 uint32_t cuid;
213 struct Crypto1State mpcs = {0, 0};
214 struct Crypto1State *pcs;
215 pcs = &mpcs;
216
217 // clear trace
218 iso14a_clear_trace();
219 // iso14a_set_tracing(false);
220
221 iso14443a_setup();
222
223 LED_A_ON();
224 LED_B_OFF();
225 LED_C_OFF();
226
227 while (true) {
228 if(!iso14443a_select_card(uid, NULL, &cuid)) {
229 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
230 break;
231 };
232
233 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
234 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
235 break;
236 };
237
238 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
239 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
240 break;
241 };
242
243 if(mifare_classic_halt(pcs, cuid)) {
244 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
245 break;
246 };
247
248 isOK = 1;
249 break;
250 }
251
252 // ----------------------------- crypto1 destroy
253 crypto1_destroy(pcs);
254
255 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
256
257 // add trace trailer
258 memset(uid, 0x44, 4);
259 LogTrace(uid, 4, 0, 0, TRUE);
260
261 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
262
263 LED_B_ON();
264 cmd_send(CMD_ACK,isOK,0,0,0,0);
265 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
266 LED_B_OFF();
267
268
269 // Thats it...
270 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
271 LEDsoff();
272 // iso14a_set_tracing(TRUE);
273
274 }
275
276 // Return 1 if the nonce is invalid else return 0
277 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
278 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
279 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
280 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
281 }
282
283 //-----------------------------------------------------------------------------
284 // MIFARE nested authentication.
285 //
286 //-----------------------------------------------------------------------------
287 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
288 {
289 // params
290 uint8_t blockNo = arg0;
291 uint8_t keyType = arg1;
292 uint8_t targetBlockNo = arg2 & 0xff;
293 uint8_t targetKeyType = (arg2 >> 8) & 0xff;
294 uint64_t ui64Key = 0;
295
296 ui64Key = bytes_to_num(datain, 6);
297
298 // variables
299 int rtr, i, j, m, len;
300 int davg, dmin, dmax;
301 uint8_t uid[8];
302 uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
303 uint8_t par_array[4];
304 nestedVector nvector[NES_MAX_INFO + 1][11];
305 int nvectorcount[NES_MAX_INFO + 1];
306 int ncount = 0;
307 struct Crypto1State mpcs = {0, 0};
308 struct Crypto1State *pcs;
309 pcs = &mpcs;
310 uint8_t* receivedAnswer = mifare_get_bigbufptr();
311
312 //init
313 for (i = 0; i < NES_MAX_INFO + 1; i++) nvectorcount[i] = 11; // 11 - empty block;
314
315 // clear trace
316 iso14a_clear_trace();
317 iso14a_set_tracing(false);
318
319 iso14443a_setup();
320
321 LED_A_ON();
322 LED_B_ON();
323 LED_C_OFF();
324
325 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
326 SpinDelay(200);
327
328 davg = dmax = 0;
329 dmin = 2000;
330
331 // test nonce distance
332 for (rtr = 0; rtr < 10; rtr++) {
333 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
334 SpinDelay(100);
335 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
336
337 // Test if the action was cancelled
338 if(BUTTON_PRESS()) {
339 break;
340 }
341
342 if(!iso14443a_select_card(uid, NULL, &cuid)) {
343 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
344 break;
345 };
346
347 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
348 if (MF_DBGLEVEL >= 1) Dbprintf("Auth1 error");
349 break;
350 };
351
352 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2)) {
353 if (MF_DBGLEVEL >= 1) Dbprintf("Auth2 error");
354 break;
355 };
356
357 nttmp = prng_successor(nt1, 500);
358 for (i = 501; i < 2000; i++) {
359 nttmp = prng_successor(nttmp, 1);
360 if (nttmp == nt2) break;
361 }
362
363 if (i != 2000) {
364 davg += i;
365 if (dmin > i) dmin = i;
366 if (dmax < i) dmax = i;
367 if (MF_DBGLEVEL >= 4) Dbprintf("r=%d nt1=%08x nt2=%08x distance=%d", rtr, nt1, nt2, i);
368 }
369 }
370
371 if (rtr == 0) return;
372
373 davg = davg / rtr;
374 if (MF_DBGLEVEL >= 3) Dbprintf("distance: min=%d max=%d avg=%d", dmin, dmax, davg);
375
376 LED_B_OFF();
377
378 // -------------------------------------------------------------------------------------------------
379
380 LED_C_ON();
381
382 // get crypted nonces for target sector
383 for (rtr = 0; rtr < NS_RETRIES_GETNONCE; rtr++) {
384 if (MF_DBGLEVEL >= 4) Dbprintf("------------------------------");
385
386 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
387 SpinDelay(100);
388 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
389
390 // Test if the action was cancelled
391 if(BUTTON_PRESS()) {
392 break;
393 }
394
395 if(!iso14443a_select_card(uid, NULL, &cuid)) {
396 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
397 break;
398 };
399
400 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
401 if (MF_DBGLEVEL >= 1) Dbprintf("Auth1 error");
402 break;
403 };
404
405 // nested authentication
406 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par);
407 if (len != 4) {
408 if (MF_DBGLEVEL >= 1) Dbprintf("Auth2 error len=%d", len);
409 break;
410 };
411
412 nt2 = bytes_to_num(receivedAnswer, 4);
413 if (MF_DBGLEVEL >= 4) Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
414
415 // Parity validity check
416 for (i = 0; i < 4; i++) {
417 par_array[i] = (oddparity(receivedAnswer[i]) != ((par & 0x08) >> 3));
418 par = par << 1;
419 }
420
421 ncount = 0;
422 nttest = prng_successor(nt1, dmin - NS_TOLERANCE);
423 for (m = dmin - NS_TOLERANCE + 1; m < dmax + NS_TOLERANCE; m++) {
424 nttest = prng_successor(nttest, 1);
425 ks1 = nt2 ^ nttest;
426
427 if (valid_nonce(nttest, nt2, ks1, par_array) && (ncount < 11)){
428
429 nvector[NES_MAX_INFO][ncount].nt = nttest;
430 nvector[NES_MAX_INFO][ncount].ks1 = ks1;
431 ncount++;
432 nvectorcount[NES_MAX_INFO] = ncount;
433 if (MF_DBGLEVEL >= 4) Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
434 }
435
436 }
437
438 // select vector with length less than got
439 if (nvectorcount[NES_MAX_INFO] != 0) {
440 m = NES_MAX_INFO;
441
442 for (i = 0; i < NES_MAX_INFO; i++)
443 if (nvectorcount[i] > 10) {
444 m = i;
445 break;
446 }
447
448 if (m == NES_MAX_INFO)
449 for (i = 0; i < NES_MAX_INFO; i++)
450 if (nvectorcount[NES_MAX_INFO] < nvectorcount[i]) {
451 m = i;
452 break;
453 }
454
455 if (m != NES_MAX_INFO) {
456 for (i = 0; i < nvectorcount[m]; i++) {
457 nvector[m][i] = nvector[NES_MAX_INFO][i];
458 }
459 nvectorcount[m] = nvectorcount[NES_MAX_INFO];
460 }
461 }
462 }
463
464 LED_C_OFF();
465
466 // ----------------------------- crypto1 destroy
467 crypto1_destroy(pcs);
468
469 // add trace trailer
470 memset(uid, 0x44, 4);
471 LogTrace(uid, 4, 0, 0, TRUE);
472
473 // UsbCommand ack = {CMD_ACK, {0, 0, 0}};
474
475 for (i = 0; i < NES_MAX_INFO; i++) {
476 if (nvectorcount[i] > 10) continue;
477
478 for (j = 0; j < nvectorcount[i]; j += 5) {
479 ncount = nvectorcount[i] - j;
480 if (ncount > 5) ncount = 5;
481
482 // ack.arg[0] = 0; // isEOF = 0
483 // ack.arg[1] = ncount;
484 // ack.arg[2] = targetBlockNo + (targetKeyType * 0x100);
485 // memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
486
487 byte_t buf[48];
488 memset(buf, 0x00, sizeof(buf));
489 memcpy(buf, &cuid, 4);
490 for (m = 0; m < ncount; m++) {
491 memcpy(buf + 8 + m * 8 + 0, &nvector[i][m + j].nt, 4);
492 memcpy(buf + 8 + m * 8 + 4, &nvector[i][m + j].ks1, 4);
493 }
494
495 LED_B_ON();
496 SpinDelay(100);
497 cmd_send(CMD_ACK,0,ncount,targetBlockNo + (targetKeyType * 0x100),buf,48);
498 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
499 LED_B_OFF();
500 }
501 }
502
503 // finalize list
504 // ack.arg[0] = 1; // isEOF = 1
505 // ack.arg[1] = 0;
506 // ack.arg[2] = 0;
507 // memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
508
509 LED_B_ON();
510 SpinDelay(300);
511 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
512 cmd_send(CMD_ACK,1,0,0,0,0);
513 LED_B_OFF();
514
515 if (MF_DBGLEVEL >= 4) DbpString("NESTED FINISHED");
516
517 // Thats it...
518 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
519 LEDsoff();
520
521 iso14a_set_tracing(TRUE);
522 }
523
524 //-----------------------------------------------------------------------------
525 // MIFARE check keys. key count up to 8.
526 //
527 //-----------------------------------------------------------------------------
528 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
529 {
530 // params
531 uint8_t blockNo = arg0;
532 uint8_t keyType = arg1;
533 uint8_t keyCount = arg2;
534 uint64_t ui64Key = 0;
535
536 // variables
537 int i;
538 byte_t isOK = 0;
539 uint8_t uid[8];
540 uint32_t cuid;
541 struct Crypto1State mpcs = {0, 0};
542 struct Crypto1State *pcs;
543 pcs = &mpcs;
544
545 // clear debug level
546 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
547 MF_DBGLEVEL = MF_DBG_NONE;
548
549 // clear trace
550 iso14a_clear_trace();
551 iso14a_set_tracing(TRUE);
552
553 iso14443a_setup();
554
555 LED_A_ON();
556 LED_B_OFF();
557 LED_C_OFF();
558
559 SpinDelay(300);
560 for (i = 0; i < keyCount; i++) {
561 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
562 SpinDelay(100);
563 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
564
565 if(!iso14443a_select_card(uid, NULL, &cuid)) {
566 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
567 break;
568 };
569
570 ui64Key = bytes_to_num(datain + i * 6, 6);
571 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
572 continue;
573 };
574
575 isOK = 1;
576 break;
577 }
578
579 // ----------------------------- crypto1 destroy
580 crypto1_destroy(pcs);
581
582 // add trace trailer
583 memset(uid, 0x44, 4);
584 LogTrace(uid, 4, 0, 0, TRUE);
585
586 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
587 // if (isOK) memcpy(ack.d.asBytes, datain + i * 6, 6);
588
589 LED_B_ON();
590 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
591 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
592 LED_B_OFF();
593
594 // Thats it...
595 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
596 LEDsoff();
597
598 // restore debug level
599 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
600 }
601
602 //-----------------------------------------------------------------------------
603 // MIFARE commands set debug level
604 //
605 //-----------------------------------------------------------------------------
606 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
607 MF_DBGLEVEL = arg0;
608 Dbprintf("Debug level: %d", MF_DBGLEVEL);
609 }
610
611 //-----------------------------------------------------------------------------
612 // Work with emulator memory
613 //
614 //-----------------------------------------------------------------------------
615 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
616 emlClearMem();
617 }
618
619 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
620 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
621 }
622
623 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
624 // UsbCommand ack = {CMD_ACK, {arg0, arg1, 0}};
625
626 byte_t buf[48];
627 emlGetMem(buf, arg0, arg1); // data, block num, blocks count
628
629 LED_B_ON();
630 cmd_send(CMD_ACK,arg0,arg1,0,buf,48);
631 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
632 LED_B_OFF();
633 }
634
635 //-----------------------------------------------------------------------------
636 // Load a card into the emulator memory
637 //
638 //-----------------------------------------------------------------------------
639 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
640 int i;
641 uint8_t sectorNo = 0;
642 uint8_t keyType = arg1;
643 uint64_t ui64Key = 0;
644 uint32_t cuid;
645 struct Crypto1State mpcs = {0, 0};
646 struct Crypto1State *pcs;
647 pcs = &mpcs;
648
649 // variables
650 byte_t dataoutbuf[16];
651 byte_t dataoutbuf2[16];
652 uint8_t uid[8];
653
654 // clear trace
655 iso14a_clear_trace();
656 iso14a_set_tracing(false);
657
658 iso14443a_setup();
659
660 LED_A_ON();
661 LED_B_OFF();
662 LED_C_OFF();
663
664 while (true) {
665 if(!iso14443a_select_card(uid, NULL, &cuid)) {
666 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
667 break;
668 };
669
670 for (i = 0; i < 16; i++) {
671 sectorNo = i;
672 ui64Key = emlGetKey(sectorNo, keyType);
673
674 if (!i){
675 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
676 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%d]. Auth error", i);
677 break;
678 }
679 } else {
680 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_NESTED)) {
681 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%d]. Auth nested error", i);
682 break;
683 }
684 }
685
686 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf)) {
687 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 0 error");
688 break;
689 };
690 emlSetMem(dataoutbuf, sectorNo * 4 + 0, 1);
691
692 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf)) {
693 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 1 error");
694 break;
695 };
696 emlSetMem(dataoutbuf, sectorNo * 4 + 1, 1);
697
698 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf)) {
699 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 2 error");
700 break;
701 };
702 emlSetMem(dataoutbuf, sectorNo * 4 + 2, 1);
703
704 // get block 3 bytes 6-9
705 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf)) {
706 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 3 error");
707 break;
708 };
709 emlGetMem(dataoutbuf2, sectorNo * 4 + 3, 1);
710 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
711 emlSetMem(dataoutbuf2, sectorNo * 4 + 3, 1);
712 }
713
714 if(mifare_classic_halt(pcs, cuid)) {
715 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
716 break;
717 };
718
719 break;
720 }
721
722 // ----------------------------- crypto1 destroy
723 crypto1_destroy(pcs);
724
725 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
726 LEDsoff();
727
728 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
729
730 // add trace trailer
731 memset(uid, 0x44, 4);
732 LogTrace(uid, 4, 0, 0, TRUE);
733 }
734
735 //-----------------------------------------------------------------------------
736 // MIFARE 1k emulator
737 //
738 //-----------------------------------------------------------------------------
739
740
741 //-----------------------------------------------------------------------------
742 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
743 //
744 //-----------------------------------------------------------------------------
745 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
746
747 // params
748 uint8_t needWipe = arg0;
749 // bit 0 - need get UID
750 // bit 1 - need wupC
751 // bit 2 - need HALT after sequence
752 // bit 3 - need init FPGA and field before sequence
753 // bit 4 - need reset FPGA and LED
754 uint8_t workFlags = arg1;
755 uint8_t blockNo = arg2;
756
757 // card commands
758 uint8_t wupC1[] = { 0x40 };
759 uint8_t wupC2[] = { 0x43 };
760 uint8_t wipeC[] = { 0x41 };
761
762 // variables
763 byte_t isOK = 0;
764 uint8_t uid[8];
765 uint8_t d_block[18];
766 uint32_t cuid;
767
768 memset(uid, 0x00, 8);
769 uint8_t* receivedAnswer = mifare_get_bigbufptr();
770
771 if (workFlags & 0x08) {
772 // clear trace
773 iso14a_clear_trace();
774 iso14a_set_tracing(TRUE);
775
776 iso14443a_setup();
777
778 LED_A_ON();
779 LED_B_OFF();
780 LED_C_OFF();
781
782 SpinDelay(300);
783 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
784 SpinDelay(100);
785 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
786 }
787
788 while (true) {
789 // get UID from chip
790 if (workFlags & 0x01) {
791 if(!iso14443a_select_card(uid, NULL, &cuid)) {
792 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
793 break;
794 };
795
796 if(mifare_classic_halt(NULL, cuid)) {
797 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
798 break;
799 };
800 };
801
802 // reset chip
803 if (needWipe){
804 ReaderTransmitBitsPar(wupC1,7,0);
805 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
806 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
807 break;
808 };
809
810 ReaderTransmit(wipeC, sizeof(wipeC));
811 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
812 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
813 break;
814 };
815
816 if(mifare_classic_halt(NULL, cuid)) {
817 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
818 break;
819 };
820 };
821
822 // write block
823 if (workFlags & 0x02) {
824 ReaderTransmitBitsPar(wupC1,7,0);
825 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
826 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
827 break;
828 };
829
830 ReaderTransmit(wupC2, sizeof(wupC2));
831 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
832 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
833 break;
834 };
835 }
836
837 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer) != 1) || (receivedAnswer[0] != 0x0a)) {
838 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
839 break;
840 };
841
842 memcpy(d_block, datain, 16);
843 AppendCrc14443a(d_block, 16);
844
845 ReaderTransmit(d_block, sizeof(d_block));
846 if ((ReaderReceive(receivedAnswer) != 1) || (receivedAnswer[0] != 0x0a)) {
847 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
848 break;
849 };
850
851 if (workFlags & 0x04) {
852 if (mifare_classic_halt(NULL, cuid)) {
853 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
854 break;
855 };
856 }
857
858 isOK = 1;
859 break;
860 }
861
862 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
863 // if (isOK) memcpy(ack.d.asBytes, uid, 4);
864
865 // add trace trailer
866 /**
867 * Removed by Martin, the uid is overwritten with 0x44,
868 * which can 't be intended.
869 *
870 * memset(uid, 0x44, 4);
871 * LogTrace(uid, 4, 0, 0, TRUE);
872 **/
873
874
875 LED_B_ON();
876 cmd_send(CMD_ACK,isOK,0,0,uid,4);
877 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
878 LED_B_OFF();
879
880 if ((workFlags & 0x10) || (!isOK)) {
881 // Thats it...
882 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
883 LEDsoff();
884 }
885 }
886
887 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
888
889 // params
890 // bit 1 - need wupC
891 // bit 2 - need HALT after sequence
892 // bit 3 - need init FPGA and field before sequence
893 // bit 4 - need reset FPGA and LED
894 uint8_t workFlags = arg0;
895 uint8_t blockNo = arg2;
896
897 // card commands
898 uint8_t wupC1[] = { 0x40 };
899 uint8_t wupC2[] = { 0x43 };
900
901 // variables
902 byte_t isOK = 0;
903 uint8_t data[18];
904 uint32_t cuid = 0;
905
906 memset(data, 0x00, 18);
907 uint8_t* receivedAnswer = mifare_get_bigbufptr();
908
909 if (workFlags & 0x08) {
910 // clear trace
911 iso14a_clear_trace();
912 iso14a_set_tracing(TRUE);
913
914 iso14443a_setup();
915
916 LED_A_ON();
917 LED_B_OFF();
918 LED_C_OFF();
919
920 SpinDelay(300);
921 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
922 SpinDelay(100);
923 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
924 }
925
926 while (true) {
927 if (workFlags & 0x02) {
928 ReaderTransmitBitsPar(wupC1,7,0);
929 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
930 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
931 break;
932 };
933
934 ReaderTransmit(wupC2, sizeof(wupC2));
935 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
936 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
937 break;
938 };
939 }
940
941 // read block
942 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer) != 18)) {
943 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
944 break;
945 };
946 memcpy(data, receivedAnswer, 18);
947
948 if (workFlags & 0x04) {
949 if (mifare_classic_halt(NULL, cuid)) {
950 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
951 break;
952 };
953 }
954
955 isOK = 1;
956 break;
957 }
958
959 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
960 // if (isOK) memcpy(ack.d.asBytes, data, 18);
961
962 // add trace trailer
963 /*
964 * Removed by Martin, this piece of overwrites the 'data' variable
965 * which is sent two lines down, and is obviously not correct.
966 *
967 * memset(data, 0x44, 4);
968 * LogTrace(data, 4, 0, 0, TRUE);
969 */
970 LED_B_ON();
971 cmd_send(CMD_ACK,isOK,0,0,data,18);
972 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
973 LED_B_OFF();
974
975 if ((workFlags & 0x10) || (!isOK)) {
976 // Thats it...
977 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
978 LEDsoff();
979 }
980 }
981
Impressum, Datenschutz