FIX: increased the limit to 0xE6 for MIFARE_ULEV1_FASTREAD

[proxmark3-svn] / armsrc / mifarecmd.c

diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c
index 1004e3422655680623f4662685dbce697576f6be..6bb04caf26f13f9b649aa5d63575356d8fbd2b1a 100644 (file)
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@@ -138,16 +138,18 @@ void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
        LEDsoff();\r
 }\r
 \r
+// Arg0 = BlockNo,\r
+// Arg1 = UsePwd bool\r
+// datain = PWD bytes,  \r
 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r
 {\r
        uint8_t blockNo = arg0;\r
        byte_t dataout[16] = {0x00};\r
        uint8_t uid[10] = {0x00};\r
-       uint8_t key[16] = {0x00};\r
     bool usePwd = (arg1 == 1);\r
-       \r
-       LED_A_ON();     LED_B_OFF(); LED_C_OFF();\r
-    \r
+\r
+       LEDsoff();      \r
+       LED_A_ON();    \r
        clear_trace();\r
        iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
     \r
@@ -160,7 +162,8 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
        \r
         // authenticate here.\r
        if ( usePwd ) {\r
-               \r
+\r
+               uint8_t key[16] = {0x00};       \r
                memcpy(key, datain, 16);\r
                 \r
                uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };\r
@@ -185,10 +188,7 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 \r
                // decrypt nonce.\r
                tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );\r
-\r
-       \r
                rol(random_b,8);\r
-               \r
                memcpy(rnd_ab  ,random_a,8);\r
                memcpy(rnd_ab+8,random_b,8);\r
 \r
@@ -333,11 +333,16 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        LEDsoff();\r
 }\r
 \r
-void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)\r
+// arg0 = blockNo (start)\r
+// arg1 = Pages (number of blocks)\r
+// arg2 = useKey\r
+// datain = KEY bytes\r
+void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r
 {\r
        // params\r
-       uint8_t sectorNo = arg0;\r
-       int Pages = arg1;\r
+       uint8_t blockNo = arg0;\r
+       uint16_t blocks = arg1;\r
+       bool useKey = (arg2 == 1);\r
        int countpages = 0;\r
        uint8_t dataout[176] = {0x00};;\r
 \r
@@ -353,9 +358,60 @@ void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
                return;\r
        }\r
        \r
-       for (int i = 0; i < Pages; i++){\r
+       // authenticate\r
+       if ( useKey ) {\r
+               \r
+               uint8_t key[16] = {0x00};       \r
+               memcpy(key, datain, 16);\r
+                \r
+               uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };\r
+               uint8_t random_b[8] = {0x00};\r
+               uint8_t enc_random_b[8] = {0x00};\r
+               uint8_t rnd_ab[16] = {0x00};\r
+               uint8_t IV[8] = {0x00};\r
+               \r
+               uint16_t len;\r
+               uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
+               uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
+       \r
+               len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r
+               if (len != 11) {\r
+                       if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
+                       OnError(1);\r
+                       return;\r
+               }\r
        \r
-               len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);\r
+               // tag nonce.\r
+               memcpy(enc_random_b,receivedAnswer+1,8);\r
+\r
+               // decrypt nonce.\r
+               tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );\r
+               rol(random_b,8);\r
+               memcpy(rnd_ab  ,random_a,8);\r
+               memcpy(rnd_ab+8,random_b,8);\r
+       \r
+               // encrypt    out, in, length, key, iv\r
+               tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);\r
+\r
+               len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);\r
+               if (len != 11) {\r
+                       OnError(1);\r
+                       return;\r
+               }\r
+\r
+               uint8_t enc_resp[8] = { 0 };\r
+               uint8_t resp_random_a[8] = { 0 };\r
+               memcpy(enc_resp, receivedAnswer+1, 8);\r
+       \r
+               // decrypt    out, in, length, key, iv \r
+               tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);\r
+               if ( memcmp(resp_random_a, random_a, 8) != 0 )\r
+                       Dbprintf("failed authentication");\r
+       }\r
+       \r
+       for (int i = 0; i < blocks; i++){\r
+       \r
+               len = mifare_ultra_readblock(blockNo * 4 + i, dataout + 4 * i);\r
                \r
                if (len) {\r
                        if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r
@@ -372,11 +428,11 @@ void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
                return;\r
        }\r
        \r
-       if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Pages read %d", countpages);\r
+       if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("blocks read %d", countpages);\r
 \r
-               len = Pages*4;\r
+       len = blocks*4;\r
 \r
-       cmd_send(CMD_ACK, 1, 0, 0, dataout, len);       \r
+       cmd_send(CMD_ACK, 1, len, 0, dataout, len);     \r
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
        LEDsoff();\r
 }\r
@@ -495,12 +551,12 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 {\r
        uint8_t blockNo = arg0;\r
        byte_t blockdata[4] = {0x00};\r
+       uint8_t uid[10] = {0x00};\r
        \r
        memcpy(blockdata, datain,4);\r
-\r
-       uint8_t uid[10] = {0x00};\r
        \r
-       LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
+       LEDsoff();\r
+       LED_A_ON();\r
        clear_trace();\r
        iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
 \r
@@ -1294,7 +1350,6 @@ void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
                packLen -= packSize;\r
                packNum++;\r
        }\r
-\r
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
        LEDsoff();\r
 }\r