1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
13 #include "mifarecmd.h"
16 //-----------------------------------------------------------------------------
17 // Select, Authenticaate, Read an MIFARE tag.
19 //-----------------------------------------------------------------------------
20 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
23 uint8_t blockNo
= arg0
;
24 uint8_t keyType
= arg1
;
26 ui64Key
= bytes_to_num(datain
, 6);
30 byte_t dataoutbuf
[16];
33 struct Crypto1State mpcs
= {0, 0};
34 struct Crypto1State
*pcs
;
39 // iso14a_set_tracing(false);
41 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
48 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
49 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
53 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
54 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
58 if(mifare_classic_readblock(pcs
, cuid
, blockNo
, dataoutbuf
)) {
59 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block error");
63 if(mifare_classic_halt(pcs
, cuid
)) {
64 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
72 // ----------------------------- crypto1 destroy
75 if (MF_DBGLEVEL
>= 2) DbpString("READ BLOCK FINISHED");
79 LogTrace(uid
, 4, 0, 0, TRUE
);
81 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
82 // memcpy(ack.d.asBytes, dataoutbuf, 16);
85 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16);
86 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
91 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
93 // iso14a_set_tracing(TRUE);
97 void MifareUReadBlock(uint8_t arg0
,uint8_t *datain
)
100 uint8_t blockNo
= arg0
;
104 byte_t dataoutbuf
[16];
109 iso14a_clear_trace();
110 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
117 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
118 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
122 if(mifare_ultra_readblock(cuid
, blockNo
, dataoutbuf
)) {
123 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block error");
127 if(mifare_ultra_halt(cuid
)) {
128 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
136 if (MF_DBGLEVEL
>= 2) DbpString("READ BLOCK FINISHED");
139 memset(uid
, 0x44, 4);
140 LogTrace(uid
, 4, 0, 0, TRUE
);
142 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16);
147 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
151 //-----------------------------------------------------------------------------
152 // Select, Authenticaate, Read an MIFARE tag.
153 // read sector (data = 4 x 16 bytes = 64 bytes)
154 //-----------------------------------------------------------------------------
155 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
158 uint8_t sectorNo
= arg0
;
159 uint8_t keyType
= arg1
;
160 uint64_t ui64Key
= 0;
161 ui64Key
= bytes_to_num(datain
, 6);
165 byte_t dataoutbuf
[16 * 4];
168 struct Crypto1State mpcs
= {0, 0};
169 struct Crypto1State
*pcs
;
173 iso14a_clear_trace();
174 // iso14a_set_tracing(false);
176 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
183 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
184 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
188 if(mifare_classic_auth(pcs
, cuid
, sectorNo
* 4, keyType
, ui64Key
, AUTH_FIRST
)) {
189 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
193 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 0, dataoutbuf
+ 16 * 0)) {
194 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 0 error");
197 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 1, dataoutbuf
+ 16 * 1)) {
198 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 1 error");
201 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 2, dataoutbuf
+ 16 * 2)) {
202 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 2 error");
205 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 3, dataoutbuf
+ 16 * 3)) {
206 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 3 error");
210 if(mifare_classic_halt(pcs
, cuid
)) {
211 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
219 // ----------------------------- crypto1 destroy
220 crypto1_destroy(pcs
);
222 if (MF_DBGLEVEL
>= 2) DbpString("READ SECTOR FINISHED");
225 memset(uid
, 0x44, 4);
226 LogTrace(uid
, 4, 0, 0, TRUE
);
228 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
229 // memcpy(ack.d.asBytes, dataoutbuf, 16 * 2);
232 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,32);
233 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
236 // memcpy(ack.d.asBytes, dataoutbuf + 16 * 2, 16 * 2);
237 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
238 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
+32, 32);
242 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
244 // iso14a_set_tracing(TRUE);
248 void MifareUReadCard(uint8_t arg0
, uint8_t *datain
)
251 uint8_t sectorNo
= arg0
;
255 byte_t dataoutbuf
[16 * 4];
260 iso14a_clear_trace();
261 // iso14a_set_tracing(false);
263 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
270 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
271 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
274 for(int sec
=0;sec
<16;sec
++){
275 if(mifare_ultra_readblock(cuid
, sectorNo
* 4 + sec
, dataoutbuf
+ 4 * sec
)) {
276 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block %d error",sec
);
280 if(mifare_ultra_halt(cuid
)) {
281 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
289 if (MF_DBGLEVEL
>= 2) DbpString("READ CARD FINISHED");
292 memset(uid
, 0x44, 4);
293 LogTrace(uid
, 4, 0, 0, TRUE
);
296 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,64);
297 //cmd_send(CMD_ACK,isOK,0,0,dataoutbuf+32, 32);
301 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
303 // iso14a_set_tracing(TRUE);
308 //-----------------------------------------------------------------------------
309 // Select, Authenticaate, Read an MIFARE tag.
311 //-----------------------------------------------------------------------------
312 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
315 uint8_t blockNo
= arg0
;
316 uint8_t keyType
= arg1
;
317 uint64_t ui64Key
= 0;
318 byte_t blockdata
[16];
320 ui64Key
= bytes_to_num(datain
, 6);
321 memcpy(blockdata
, datain
+ 10, 16);
327 struct Crypto1State mpcs
= {0, 0};
328 struct Crypto1State
*pcs
;
332 iso14a_clear_trace();
333 // iso14a_set_tracing(false);
335 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
342 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
343 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
347 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
348 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
352 if(mifare_classic_writeblock(pcs
, cuid
, blockNo
, blockdata
)) {
353 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
357 if(mifare_classic_halt(pcs
, cuid
)) {
358 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
366 // ----------------------------- crypto1 destroy
367 crypto1_destroy(pcs
);
369 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
372 memset(uid
, 0x44, 4);
373 LogTrace(uid
, 4, 0, 0, TRUE
);
375 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
378 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
379 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
384 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
386 // iso14a_set_tracing(TRUE);
390 void MifareUWriteBlock(uint8_t arg0
, uint8_t *datain
)
393 uint8_t blockNo
= arg0
;
394 byte_t blockdata
[16];
396 memset(blockdata
,'\0',16);
397 memcpy(blockdata
, datain
,16);
405 iso14a_clear_trace();
406 // iso14a_set_tracing(false);
408 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
415 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
416 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
420 if(mifare_ultra_writeblock(cuid
, blockNo
, blockdata
)) {
421 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
425 if(mifare_ultra_halt(cuid
)) {
426 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
434 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
437 memset(uid
, 0x44, 4);
438 LogTrace(uid
, 4, 0, 0, TRUE
);
441 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
442 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
447 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
449 // iso14a_set_tracing(TRUE);
453 void MifareUWriteBlock_Special(uint8_t arg0
, uint8_t *datain
)
456 uint8_t blockNo
= arg0
;
459 memcpy(blockdata
, datain
,4);
467 iso14a_clear_trace();
468 // iso14a_set_tracing(false);
470 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
477 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
478 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
482 if(mifare_ultra_special_writeblock(cuid
, blockNo
, blockdata
)) {
483 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
487 if(mifare_ultra_halt(cuid
)) {
488 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
496 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
499 memset(uid
, 0x44, 4);
500 LogTrace(uid
, 4, 0, 0, TRUE
);
503 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
504 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
509 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
511 // iso14a_set_tracing(TRUE);
515 // Return 1 if the nonce is invalid else return 0
516 int valid_nonce(uint32_t Nt
, uint32_t NtEnc
, uint32_t Ks1
, byte_t
* parity
) {
517 return ((oddparity((Nt
>> 24) & 0xFF) == ((parity
[0]) ^ oddparity((NtEnc
>> 24) & 0xFF) ^ BIT(Ks1
,16))) & \
518 (oddparity((Nt
>> 16) & 0xFF) == ((parity
[1]) ^ oddparity((NtEnc
>> 16) & 0xFF) ^ BIT(Ks1
,8))) & \
519 (oddparity((Nt
>> 8) & 0xFF) == ((parity
[2]) ^ oddparity((NtEnc
>> 8) & 0xFF) ^ BIT(Ks1
,0)))) ? 1 : 0;
524 //-----------------------------------------------------------------------------
525 // MIFARE nested authentication.
527 //-----------------------------------------------------------------------------
528 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t calibrate
, uint8_t *datain
)
531 uint8_t blockNo
= arg0
& 0xff;
532 uint8_t keyType
= (arg0
>> 8) & 0xff;
533 uint8_t targetBlockNo
= arg1
& 0xff;
534 uint8_t targetKeyType
= (arg1
>> 8) & 0xff;
535 uint64_t ui64Key
= 0;
537 ui64Key
= bytes_to_num(datain
, 6);
540 uint16_t rtr
, i
, j
, len
;
542 static uint16_t dmin
, dmax
;
544 uint32_t cuid
, nt1
, nt2
, nttmp
, nttest
, par
, ks1
;
545 uint32_t target_nt
[2], target_ks
[2];
547 uint8_t par_array
[4];
549 struct Crypto1State mpcs
= {0, 0};
550 struct Crypto1State
*pcs
;
552 uint8_t* receivedAnswer
= mifare_get_bigbufptr();
554 uint32_t auth1_time
, auth2_time
;
555 static uint16_t delta_time
;
558 iso14a_clear_trace();
559 iso14a_set_tracing(false);
561 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
567 // statistics on nonce distance
568 if (calibrate
) { // for first call only. Otherwise reuse previous calibration
575 for (rtr
= 0; rtr
< 17; rtr
++) {
577 // prepare next select. No need to power down the card.
578 if(mifare_classic_halt(pcs
, cuid
)) {
579 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
584 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
585 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
591 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
592 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
598 auth2_time
= auth1_time
+ delta_time
;
602 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_NESTED
, &nt2
, &auth2_time
)) {
603 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error");
608 nttmp
= prng_successor(nt1
, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
609 for (i
= 101; i
< 1200; i
++) {
610 nttmp
= prng_successor(nttmp
, 1);
611 if (nttmp
== nt2
) break;
621 delta_time
= auth2_time
- auth1_time
+ 32; // allow some slack for proper timing
623 if (MF_DBGLEVEL
>= 3) Dbprintf("Nested: calibrating... ntdist=%d", i
);
627 if (rtr
<= 1) return;
629 davg
= (davg
+ (rtr
- 1)/2) / (rtr
- 1);
631 if (MF_DBGLEVEL
>= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin
, dmax
, davg
, delta_time
);
639 // -------------------------------------------------------------------------------------------------
643 // get crypted nonces for target sector
644 for(i
=0; i
< 2; i
++) { // look for exactly two different nonces
647 while(target_nt
[i
] == 0) { // continue until we have an unambiguous nonce
649 // prepare next select. No need to power down the card.
650 if(mifare_classic_halt(pcs
, cuid
)) {
651 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
655 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
656 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
661 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
662 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
666 // nested authentication
667 auth2_time
= auth1_time
+ delta_time
;
668 len
= mifare_sendcmd_shortex(pcs
, AUTH_NESTED
, 0x60 + (targetKeyType
& 0x01), targetBlockNo
, receivedAnswer
, &par
, &auth2_time
);
670 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error len=%d", len
);
674 nt2
= bytes_to_num(receivedAnswer
, 4);
675 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i
+1, nt1
, nt2
, par
);
677 // Parity validity check
678 for (j
= 0; j
< 4; j
++) {
679 par_array
[j
] = (oddparity(receivedAnswer
[j
]) != ((par
& 0x08) >> 3));
684 nttest
= prng_successor(nt1
, dmin
- 1);
685 for (j
= dmin
; j
< dmax
+ 1; j
++) {
686 nttest
= prng_successor(nttest
, 1);
689 if (valid_nonce(nttest
, nt2
, ks1
, par_array
)){
690 if (ncount
> 0) { // we are only interested in disambiguous nonces, try again
691 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i
+1, j
);
695 target_nt
[i
] = nttest
;
698 if (i
== 1 && target_nt
[1] == target_nt
[0]) { // we need two different nonces
700 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j
);
703 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i
+1, j
);
706 if (target_nt
[i
] == 0 && j
== dmax
+1 && MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i
+1);
712 // ----------------------------- crypto1 destroy
713 crypto1_destroy(pcs
);
716 memset(uid
, 0x44, 4);
717 LogTrace(uid
, 4, 0, 0, TRUE
);
719 byte_t buf
[4 + 4 * 4];
720 memcpy(buf
, &cuid
, 4);
721 memcpy(buf
+4, &target_nt
[0], 4);
722 memcpy(buf
+8, &target_ks
[0], 4);
723 memcpy(buf
+12, &target_nt
[1], 4);
724 memcpy(buf
+16, &target_ks
[1], 4);
727 cmd_send(CMD_ACK
, 0, 2, targetBlockNo
+ (targetKeyType
* 0x100), buf
, sizeof(buf
));
730 if (MF_DBGLEVEL
>= 3) DbpString("NESTED FINISHED");
732 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
734 iso14a_set_tracing(TRUE
);
737 //-----------------------------------------------------------------------------
738 // MIFARE check keys. key count up to 85.
740 //-----------------------------------------------------------------------------
741 void MifareChkKeys(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
744 uint8_t blockNo
= arg0
;
745 uint8_t keyType
= arg1
;
746 uint8_t keyCount
= arg2
;
747 uint64_t ui64Key
= 0;
754 struct Crypto1State mpcs
= {0, 0};
755 struct Crypto1State
*pcs
;
759 int OLD_MF_DBGLEVEL
= MF_DBGLEVEL
;
760 MF_DBGLEVEL
= MF_DBG_NONE
;
763 iso14a_clear_trace();
764 iso14a_set_tracing(TRUE
);
766 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
773 for (i
= 0; i
< keyCount
; i
++) {
774 // FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
776 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
777 // prepare next select by sending a HALT. There is no need to power down the card.
778 if(mifare_classic_halt(pcs
, cuid
)) {
779 if (MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Halt error");
784 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
785 if (OLD_MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Can't select card");
789 ui64Key
= bytes_to_num(datain
+ i
* 6, 6);
790 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
798 // ----------------------------- crypto1 destroy
799 crypto1_destroy(pcs
);
802 memset(uid
, 0x44, 4);
803 LogTrace(uid
, 4, 0, 0, TRUE
);
806 cmd_send(CMD_ACK
,isOK
,0,0,datain
+ i
* 6,6);
810 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
813 // restore debug level
814 MF_DBGLEVEL
= OLD_MF_DBGLEVEL
;
817 //-----------------------------------------------------------------------------
818 // MIFARE commands set debug level
820 //-----------------------------------------------------------------------------
821 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
823 Dbprintf("Debug level: %d", MF_DBGLEVEL
);
826 //-----------------------------------------------------------------------------
827 // Work with emulator memory
829 //-----------------------------------------------------------------------------
830 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
834 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
835 emlSetMem(datain
, arg0
, arg1
); // data, block num, blocks count
838 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
839 // UsbCommand ack = {CMD_ACK, {arg0, arg1, 0}};
842 emlGetMem(buf
, arg0
, arg1
); // data, block num, blocks count
845 cmd_send(CMD_ACK
,arg0
,arg1
,0,buf
,48);
846 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
850 //-----------------------------------------------------------------------------
851 // Load a card into the emulator memory
853 //-----------------------------------------------------------------------------
854 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
856 uint8_t sectorNo
= 0;
857 uint8_t keyType
= arg1
;
858 uint64_t ui64Key
= 0;
860 struct Crypto1State mpcs
= {0, 0};
861 struct Crypto1State
*pcs
;
865 byte_t dataoutbuf
[16];
866 byte_t dataoutbuf2
[16];
870 iso14a_clear_trace();
871 iso14a_set_tracing(false);
873 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
880 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
881 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
885 for (i
= 0; i
< 16; i
++) {
887 ui64Key
= emlGetKey(sectorNo
, keyType
);
890 if(mifare_classic_auth(pcs
, cuid
, sectorNo
* 4, keyType
, ui64Key
, AUTH_FIRST
)) {
891 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%d]. Auth error", i
);
895 if(mifare_classic_auth(pcs
, cuid
, sectorNo
* 4, keyType
, ui64Key
, AUTH_NESTED
)) {
896 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%d]. Auth nested error", i
);
901 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 0, dataoutbuf
)) {
902 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 0 error");
905 emlSetMem(dataoutbuf
, sectorNo
* 4 + 0, 1);
907 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 1, dataoutbuf
)) {
908 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 1 error");
911 emlSetMem(dataoutbuf
, sectorNo
* 4 + 1, 1);
913 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 2, dataoutbuf
)) {
914 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 2 error");
917 emlSetMem(dataoutbuf
, sectorNo
* 4 + 2, 1);
919 // get block 3 bytes 6-9
920 if(mifare_classic_readblock(pcs
, cuid
, sectorNo
* 4 + 3, dataoutbuf
)) {
921 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block 3 error");
924 emlGetMem(dataoutbuf2
, sectorNo
* 4 + 3, 1);
925 memcpy(&dataoutbuf2
[6], &dataoutbuf
[6], 4);
926 emlSetMem(dataoutbuf2
, sectorNo
* 4 + 3, 1);
929 if(mifare_classic_halt(pcs
, cuid
)) {
930 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
937 // ----------------------------- crypto1 destroy
938 crypto1_destroy(pcs
);
940 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
943 if (MF_DBGLEVEL
>= 2) DbpString("EMUL FILL SECTORS FINISHED");
946 memset(uid
, 0x44, 4);
947 LogTrace(uid
, 4, 0, 0, TRUE
);
950 //-----------------------------------------------------------------------------
951 // MIFARE 1k emulator
953 //-----------------------------------------------------------------------------
956 //-----------------------------------------------------------------------------
957 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
959 //-----------------------------------------------------------------------------
960 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
963 uint8_t needWipe
= arg0
;
964 // bit 0 - need get UID
966 // bit 2 - need HALT after sequence
967 // bit 3 - need init FPGA and field before sequence
968 // bit 4 - need reset FPGA and LED
969 uint8_t workFlags
= arg1
;
970 uint8_t blockNo
= arg2
;
973 uint8_t wupC1
[] = { 0x40 };
974 uint8_t wupC2
[] = { 0x43 };
975 uint8_t wipeC
[] = { 0x41 };
983 memset(uid
, 0x00, 10);
984 uint8_t* receivedAnswer
= mifare_get_bigbufptr();
986 if (workFlags
& 0x08) {
988 iso14a_clear_trace();
989 iso14a_set_tracing(TRUE
);
991 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
998 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1000 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_MOD
);
1004 // get UID from chip
1005 if (workFlags
& 0x01) {
1006 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
1007 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
1011 if(mifare_classic_halt(NULL
, cuid
)) {
1012 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1019 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1020 if(!ReaderReceive(receivedAnswer
) || (receivedAnswer
[0] != 0x0a)) {
1021 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1025 ReaderTransmit(wipeC
, sizeof(wipeC
), NULL
);
1026 if(!ReaderReceive(receivedAnswer
) || (receivedAnswer
[0] != 0x0a)) {
1027 if (MF_DBGLEVEL
>= 1) Dbprintf("wipeC error");
1031 if(mifare_classic_halt(NULL
, cuid
)) {
1032 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1038 if (workFlags
& 0x02) {
1039 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1040 if(!ReaderReceive(receivedAnswer
) || (receivedAnswer
[0] != 0x0a)) {
1041 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1045 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1046 if(!ReaderReceive(receivedAnswer
) || (receivedAnswer
[0] != 0x0a)) {
1047 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1052 if ((mifare_sendcmd_short(NULL
, 0, 0xA0, blockNo
, receivedAnswer
, NULL
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1053 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send command error");
1057 memcpy(d_block
, datain
, 16);
1058 AppendCrc14443a(d_block
, 16);
1060 ReaderTransmit(d_block
, sizeof(d_block
), NULL
);
1061 if ((ReaderReceive(receivedAnswer
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1062 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send data error");
1066 if (workFlags
& 0x04) {
1067 if (mifare_classic_halt(NULL
, cuid
)) {
1068 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1077 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
1078 // if (isOK) memcpy(ack.d.asBytes, uid, 4);
1080 // add trace trailer
1082 * Removed by Martin, the uid is overwritten with 0x44,
1083 * which can 't be intended.
1085 * memset(uid, 0x44, 4);
1086 * LogTrace(uid, 4, 0, 0, TRUE);
1091 cmd_send(CMD_ACK
,isOK
,0,0,uid
,4);
1092 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
1095 if ((workFlags
& 0x10) || (!isOK
)) {
1097 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1102 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
1105 // bit 1 - need wupC
1106 // bit 2 - need HALT after sequence
1107 // bit 3 - need init FPGA and field before sequence
1108 // bit 4 - need reset FPGA and LED
1109 uint8_t workFlags
= arg0
;
1110 uint8_t blockNo
= arg2
;
1113 uint8_t wupC1
[] = { 0x40 };
1114 uint8_t wupC2
[] = { 0x43 };
1121 memset(data
, 0x00, 18);
1122 uint8_t* receivedAnswer
= mifare_get_bigbufptr();
1124 if (workFlags
& 0x08) {
1126 iso14a_clear_trace();
1127 iso14a_set_tracing(TRUE
);
1129 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1136 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1138 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A
| FPGA_HF_ISO14443A_READER_MOD
);
1142 if (workFlags
& 0x02) {
1143 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1144 if(!ReaderReceive(receivedAnswer
) || (receivedAnswer
[0] != 0x0a)) {
1145 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1149 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1150 if(!ReaderReceive(receivedAnswer
) || (receivedAnswer
[0] != 0x0a)) {
1151 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1157 if ((mifare_sendcmd_short(NULL
, 0, 0x30, blockNo
, receivedAnswer
, NULL
) != 18)) {
1158 if (MF_DBGLEVEL
>= 1) Dbprintf("read block send command error");
1161 memcpy(data
, receivedAnswer
, 18);
1163 if (workFlags
& 0x04) {
1164 if (mifare_classic_halt(NULL
, cuid
)) {
1165 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1174 // UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
1175 // if (isOK) memcpy(ack.d.asBytes, data, 18);
1177 // add trace trailer
1179 * Removed by Martin, this piece of overwrites the 'data' variable
1180 * which is sent two lines down, and is obviously not correct.
1182 * memset(data, 0x44, 4);
1183 * LogTrace(data, 4, 0, 0, TRUE);
1186 cmd_send(CMD_ACK
,isOK
,0,0,data
,18);
1187 // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
1190 if ((workFlags
& 0x10) || (!isOK
)) {
1192 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);