X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/4abe4f5867e52615c0e053a2bab4b3b129b12d45..873014de8a4be0f68524531cc90fe6c1dfdffded:/armsrc/iso14443a.c

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index efe6bfc4..9e1eea54 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -1,4 +1,5 @@
 //-----------------------------------------------------------------------------
+// Merlok - June 2011
 // Gerhard de Koning Gans - May 2008
 // Hagen Fritsch - June 2010
 //
@@ -1492,6 +1493,16 @@ int ReaderReceive(uint8_t* receivedAnswer)
   return Demod.len;
 }
 
+int ReaderReceivePar(uint8_t* receivedAnswer, uint32_t * parptr)
+{
+  int samples = 0;
+  if (!GetIso14443aAnswerFromTag(receivedAnswer,160,&samples,0)) return FALSE;
+  if (tracing) LogTrace(receivedAnswer,Demod.len,samples,Demod.parityBits,FALSE);
+	*parptr = Demod.parityBits;
+  if(samples == 0) return FALSE;
+  return Demod.len;
+}
+
 /* performs iso14443a anticolision procedure
  * fills the uid pointer unless NULL
  * fills resp_data unless NULL */
@@ -1664,11 +1675,11 @@ void ReaderMifare(uint32_t parameter)
 {
 	// Mifare AUTH
 	uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
-  uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
+	uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
 
-  uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + 3560);	// was 3560 - tied to other size changes
-  traceLen = 0;
-  tracing = false;
+	uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + 3560);	// was 3560 - tied to other size changes
+	traceLen = 0;
+	tracing = false;
 
 	iso14443a_setup();
 
@@ -1676,89 +1687,108 @@ void ReaderMifare(uint32_t parameter)
 	LED_B_OFF();
 	LED_C_OFF();
 
-  byte_t nt_diff = 0;
-  LED_A_OFF();
-  byte_t par = 0;
-  byte_t par_mask = 0xff;
-  byte_t par_low = 0;
-  int led_on = TRUE;
-
-  tracing = FALSE;
-  byte_t nt[4];
-  byte_t nt_attacked[4];
-  byte_t par_list[8];
-  byte_t ks_list[8];
-  num_to_bytes(parameter,4,nt_attacked);
-
-  while(TRUE)
-  {
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    SpinDelay(200);
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+	byte_t nt_diff = 0;
+	LED_A_OFF();
+	byte_t par = 0;
+	byte_t par_mask = 0xff;
+	byte_t par_low = 0;
+	int led_on = TRUE;
+	uint8_t uid[8];
+	uint32_t cuid;
 
-    // Test if the action was cancelled
-    if(BUTTON_PRESS()) {
-      break;
-    }
+	tracing = FALSE;
+	byte_t nt[4] = {0,0,0,0};
+	byte_t nt_attacked[4], nt_noattack[4];
+	byte_t par_list[8] = {0,0,0,0,0,0,0,0};
+	byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
+	num_to_bytes(parameter, 4, nt_noattack);
+	int isOK = 0, isNULL = 0;
 
-    if(!iso14443a_select_card(NULL, NULL, NULL)) continue;
+	while(TRUE)
+	{
+		LED_C_ON();
+		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+		SpinDelay(200);
+		FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+		LED_C_OFF();
+
+		// Test if the action was cancelled
+		if(BUTTON_PRESS()) {
+			break;
+		}
 
-    // Transmit MIFARE_CLASSIC_AUTH
-    ReaderTransmit(mf_auth,sizeof(mf_auth));
+		if(!iso14443a_select_card(uid, NULL, &cuid)) continue;
 
-    // Receive the (16 bit) "random" nonce
-    if (!ReaderReceive(receivedAnswer)) continue;
-    memcpy(nt,receivedAnswer,4);
+		// Transmit MIFARE_CLASSIC_AUTH
+		ReaderTransmit(mf_auth, sizeof(mf_auth));
 
-    // Transmit reader nonce and reader answer
-    ReaderTransmitPar(mf_nr_ar,sizeof(mf_nr_ar),par);
+		// Receive the (16 bit) "random" nonce
+		if (!ReaderReceive(receivedAnswer)) continue;
+		memcpy(nt, receivedAnswer, 4);
 
-    // Receive 4 bit answer
-    if (ReaderReceive(receivedAnswer))
-    {
-      if (nt_diff == 0)
-      {
-        LED_A_ON();
-        memcpy(nt_attacked,nt,4);
-        par_mask = 0xf8;
-        par_low = par & 0x07;
-      }
+		// Transmit reader nonce and reader answer
+		ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar),par);
 
-      if (memcmp(nt,nt_attacked,4) != 0) continue;
+		// Receive 4 bit answer
+		if (ReaderReceive(receivedAnswer))
+		{
+			if ( (parameter != 0) && (memcmp(nt, nt_noattack, 4) == 0) ) continue;
 
-      led_on = !led_on;
-      if(led_on) LED_B_ON(); else LED_B_OFF();
-      par_list[nt_diff] = par;
-      ks_list[nt_diff] = receivedAnswer[0]^0x05;
+			isNULL = (nt_attacked[0] = 0) && (nt_attacked[1] = 0) && (nt_attacked[2] = 0) && (nt_attacked[3] = 0);
+			if ( (isNULL != 0 ) && (memcmp(nt, nt_attacked, 4) != 0) ) continue;
 
-      // Test if the information is complete
-      if (nt_diff == 0x07) break;
+			if (nt_diff == 0)
+			{
+				LED_A_ON();
+				memcpy(nt_attacked, nt, 4);
+				par_mask = 0xf8;
+				par_low = par & 0x07;
+			}
 
-      nt_diff = (nt_diff+1) & 0x07;
-      mf_nr_ar[3] = nt_diff << 5;
-      par = par_low;
-    } else {
-      if (nt_diff == 0)
-      {
-        par++;
-      } else {
-        par = (((par>>3)+1) << 3) | par_low;
-      }
-    }
-  }
+			led_on = !led_on;
+			if(led_on) LED_B_ON(); else LED_B_OFF();
+			par_list[nt_diff] = par;
+			ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
 
-  LogTrace(nt,4,0,GetParity(nt,4),TRUE);
-  LogTrace(par_list,8,0,GetParity(par_list,8),TRUE);
-  LogTrace(ks_list,8,0,GetParity(ks_list,8),TRUE);
+			// Test if the information is complete
+			if (nt_diff == 0x07) {
+				isOK = 1;
+				break;
+			}
 
-  // Thats it...
+			nt_diff = (nt_diff + 1) & 0x07;
+			mf_nr_ar[3] = nt_diff << 5;
+			par = par_low;
+		} else {
+			if (nt_diff == 0)
+			{
+				par++;
+			} else {
+				par = (((par >> 3) + 1) << 3) | par_low;
+			}
+		}
+	}
+
+	LogTrace(nt, 4, 0, GetParity(nt, 4), TRUE);
+	LogTrace(par_list, 8, 0, GetParity(par_list, 8), TRUE);
+	LogTrace(ks_list, 8, 0, GetParity(ks_list, 8), TRUE);
+
+	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
+	memcpy(ack.d.asBytes + 0,  uid, 4);
+	memcpy(ack.d.asBytes + 4,  nt, 4);
+	memcpy(ack.d.asBytes + 8,  par_list, 8);
+	memcpy(ack.d.asBytes + 16, ks_list, 8);
+		
+	LED_B_ON();
+	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+	LED_B_OFF();	
+
+	// Thats it...
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
-  tracing = TRUE;
-  
-    DbpString("COMMAND FINISHED");
-
-    Dbprintf("nt=%x", (int)nt[0]);  
+	tracing = TRUE;
+	
+	if (MF_DBGLEVEL >= 1)	DbpString("COMMAND mifare FINISHED");
 }
 
 //-----------------------------------------------------------------------------
@@ -1776,7 +1806,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	// variables
 	byte_t isOK = 0;
 	byte_t dataoutbuf[16];
-	uint8_t uid[7];
+	uint8_t uid[8];
 	uint32_t cuid;
 	struct Crypto1State mpcs = {0, 0};
 	struct Crypto1State *pcs;
@@ -1794,22 +1824,22 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 
 	while (true) {
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 
 		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
-			Dbprintf("Auth error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Auth error");
 			break;
 		};
 		
 		if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
-			Dbprintf("Read block error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block error");
 			break;
 		};
 
 		if(mifare_classic_halt(pcs, cuid)) {
-			Dbprintf("Halt error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
 			break;
 		};
 		
@@ -1820,7 +1850,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-//    DbpString("READ BLOCK FINISHED");
+	if (MF_DBGLEVEL >= 2)	DbpString("READ BLOCK FINISHED");
 
 	// add trace trailer
 	uid[0] = 0xff;
@@ -1877,34 +1907,34 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 
 	while (true) {
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 
 		if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
-			Dbprintf("Auth error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Auth error");
 			break;
 		};
 		
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf + 16 * 0)) {
-			Dbprintf("Read block 0 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 0 error");
 			break;
 		};
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf + 16 * 1)) {
-			Dbprintf("Read block 1 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 1 error");
 			break;
 		};
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf + 16 * 2)) {
-			Dbprintf("Read block 2 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 2 error");
 			break;
 		};
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf + 16 * 3)) {
-			Dbprintf("Read block 3 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 3 error");
 			break;
 		};
 		
 		if(mifare_classic_halt(pcs, cuid)) {
-			Dbprintf("Halt error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
 			break;
 		};
 
@@ -1915,7 +1945,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-//    DbpString("READ BLOCK FINISHED");
+	if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 
 	// add trace trailer
 	uid[0] = 0xff;
@@ -1977,23 +2007,23 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LED_C_OFF();
 
 	while (true) {
-		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+			if(!iso14443a_select_card(uid, NULL, &cuid)) {
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 
 		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
-			Dbprintf("Auth error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth error");
 			break;
 		};
 		
 		if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
-			Dbprintf("Write block error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Write block error");
 			break;
 		};
 
 		if(mifare_classic_halt(pcs, cuid)) {
-			Dbprintf("Halt error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
 			break;
 		};
 		
@@ -2004,7 +2034,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-//  DbpString("WRITE BLOCK FINISHED");
+	if (MF_DBGLEVEL >= 2)	DbpString("WRITE BLOCK FINISHED");
 
 	// add trace trailer
 	uid[0] = 0xff;
@@ -2027,64 +2057,302 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 
 }
 
+// Return 1 if the nonce is invalid else return 0
+int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
+	return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
+	(oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
+	(oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
+}
+
+
 //-----------------------------------------------------------------------------
 // MIFARE nested authentication. 
 // 
 //-----------------------------------------------------------------------------
-void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
 {
 	// params
 	uint8_t blockNo = arg0;
 	uint8_t keyType = arg1;
+	uint8_t targetBlockNo = arg2 & 0xff;
+	uint8_t targetKeyType = (arg2 >> 8) & 0xff;
 	uint64_t ui64Key = 0;
 
 	ui64Key = bytes_to_num(datain, 6);
 	
 	// variables
-	byte_t isOK = 0;
+	int rtr, i, j, m, len;
+	int davg, dmin, dmax;
 	uint8_t uid[8];
-	uint32_t cuid;
-	uint8_t dataoutbuf[16];
+	uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
+	uint8_t par_array[4];
+	nestedVector nvector[NES_MAX_INFO + 1][10];
+	int nvectorcount[NES_MAX_INFO + 1];
+	int ncount = 0;
+	UsbCommand ack = {CMD_ACK, {0, 0, 0}};
 	struct Crypto1State mpcs = {0, 0};
 	struct Crypto1State *pcs;
 	pcs = &mpcs;
+	uint8_t* receivedAnswer = mifare_get_bigbufptr();
 
+	//init
+	for (i = 0; i < NES_MAX_INFO + 1; i++) nvectorcount[i] = 11;  //  11 - empty block;
+	
 	// clear trace
 	traceLen = 0;
-//  tracing = false;
-
+  tracing = false;
+	
 	iso14443a_setup();
 
 	LED_A_ON();
-	LED_B_OFF();
+	LED_B_ON();
 	LED_C_OFF();
 
-	while (true) {
+  FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+  SpinDelay(200);
+	
+	davg = dmax = 0;
+	dmin = 2000;
+
+	// test nonce distance
+	for (rtr = 0; rtr < 10; rtr++) {
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    SpinDelay(100);
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+
+    // Test if the action was cancelled
+    if(BUTTON_PRESS()) {
+      break;
+    }
+
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 		
-		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
-			Dbprintf("Auth error");
+		if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth1 error");
+			break;
+		};
+
+		if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2)) {
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth2 error");
 			break;
 		};
+		
+		nttmp = prng_successor(nt1, 500);
+		for (i = 501; i < 2000; i++) {
+			nttmp = prng_successor(nttmp, 1);
+			if (nttmp == nt2) break;
+		}
+		
+		if (i != 2000) {
+			davg += i;
+			if (dmin > i) dmin = i;
+			if (dmax < i) dmax = i;
+			if (MF_DBGLEVEL >= 4)	Dbprintf("r=%d nt1=%08x nt2=%08x distance=%d", rtr, nt1, nt2, i);
+		}
+	}
+	
+	if (rtr == 0)	return;
+
+	davg = davg / rtr;
+	if (MF_DBGLEVEL >= 3)	Dbprintf("distance: min=%d max=%d avg=%d", dmin, dmax, davg);
+
+	LED_B_OFF();
+
+//  -------------------------------------------------------------------------------------------------	
+	
+	LED_C_ON();
+
+	//  get crypted nonces for target sector
+	for (rtr = 0; rtr < NS_RETRIES_GETNONCE; rtr++) {
+	if (MF_DBGLEVEL >= 4)			Dbprintf("------------------------------");
 
-		// nested authenticate block = (blockNo + 1)
-		if(mifare_classic_auth(pcs, (uint32_t)bytes_to_num(uid, 4), blockNo + 1, keyType, ui64Key, AUTH_NESTED)) {
-			Dbprintf("Auth error");
+		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    SpinDelay(100);
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+
+    // Test if the action was cancelled
+    if(BUTTON_PRESS()) {
+      break;
+    }
+
+		if(!iso14443a_select_card(uid, NULL, &cuid)) {
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 		
-		if(mifare_classic_readblock(pcs, (uint32_t)bytes_to_num(uid, 4), blockNo + 1, dataoutbuf)) {
-			Dbprintf("Read block error");
+		if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth1 error");
+			break;
+		};
+
+		// nested authentication
+		len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par);
+		if (len != 4) {
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth2 error len=%d", len);
 			break;
 		};
+	
+		nt2 = bytes_to_num(receivedAnswer, 4);		
+		if (MF_DBGLEVEL >= 4)	Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
+		
+		// Parity validity check
+		for (i = 0; i < 4; i++) {
+			par_array[i] = (oddparity(receivedAnswer[i]) != ((par & 0x08) >> 3));
+			par = par << 1;
+		}
+		
+		ncount = 0;
+		for (m = dmin - NS_TOLERANCE; m < dmax + NS_TOLERANCE; m++) {
+			nttest = prng_successor(nt1, m);
+			ks1 = nt2 ^ nttest;
+
+			if (valid_nonce(nttest, nt2, ks1, par_array) && (ncount < 11)){
+				
+				nvector[NES_MAX_INFO][ncount].nt = nttest;
+				nvector[NES_MAX_INFO][ncount].ks1 = ks1;
+				ncount++;
+				nvectorcount[NES_MAX_INFO] = ncount;
+				if (MF_DBGLEVEL >= 4)	Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
+			}
+
+		}
+		
+		// select vector with length less than got
+		if (nvectorcount[NES_MAX_INFO] != 0) {
+			m = NES_MAX_INFO;
+			
+			for (i = 0; i < NES_MAX_INFO; i++)
+				if (nvectorcount[i] > 10) {
+					m = i;
+					break;
+				}
+				
+			if (m == NES_MAX_INFO)
+				for (i = 0; i < NES_MAX_INFO; i++)
+					if (nvectorcount[NES_MAX_INFO] < nvectorcount[i]) {
+						m = i;
+						break;
+					}
+					
+			if (m != NES_MAX_INFO) {
+				for (i = 0; i < nvectorcount[m]; i++) {
+					nvector[m][i] = nvector[NES_MAX_INFO][i];
+				}
+				nvectorcount[m] = nvectorcount[NES_MAX_INFO];
+			}
+		}
+	}
+
+	LED_C_OFF();
+	
+	//  ----------------------------- crypto1 destroy
+	crypto1_destroy(pcs);
+	
+	// add trace trailer
+	uid[0] = 0xff;
+	uid[1] = 0xff;
+	uid[2] = 0xff;
+	uid[3] = 0xff;
+	LogTrace(uid, 4, 0, 0, TRUE);
+
+	for (i = 0; i < NES_MAX_INFO; i++) {
+		if (nvectorcount[i] > 10) continue;
+		
+		for (j = 0; j < nvectorcount[i]; j += 5) {
+			ncount = nvectorcount[i] - j;
+			if (ncount > 5) ncount = 5; 
+
+			ack.arg[0] = 0; // isEOF = 0
+			ack.arg[1] = ncount;
+			ack.arg[2] = targetBlockNo + (targetKeyType * 0x100);
+			memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
+			
+			memcpy(ack.d.asBytes, &cuid, 4);
+			for (m = 0; m < ncount; m++) {
+				memcpy(ack.d.asBytes + 8 + m * 8 + 0, &nvector[i][m + j].nt, 4);
+				memcpy(ack.d.asBytes + 8 + m * 8 + 4, &nvector[i][m + j].ks1, 4);
+			}
+	
+			LED_B_ON();
+			SpinDelay(100);
+			UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+			LED_B_OFF();	
+		}
+	}
+
+	// finalize list
+	ack.arg[0] = 1; // isEOF = 1
+	ack.arg[1] = 0;
+	ack.arg[2] = 0;
+	memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
+	
+	LED_B_ON();
+	SpinDelay(300);
+	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+	LED_B_OFF();	
+
+	if (MF_DBGLEVEL >= 4)	DbpString("NESTED FINISHED");
+
+	// Thats it...
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
+	
+  tracing = TRUE;
+}
+
+//-----------------------------------------------------------------------------
+// MIFARE check keys. key count up to 8. 
+// 
+//-----------------------------------------------------------------------------
+void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+{
+  // params
+	uint8_t blockNo = arg0;
+	uint8_t keyType = arg1;
+	uint8_t keyCount = arg2;
+	uint64_t ui64Key = 0;
+	
+	// variables
+	int i;
+	byte_t isOK = 0;
+	uint8_t uid[8];
+	uint32_t cuid;
+	struct Crypto1State mpcs = {0, 0};
+	struct Crypto1State *pcs;
+	pcs = &mpcs;
+	
+	// clear debug level
+	int OLD_MF_DBGLEVEL = MF_DBGLEVEL;	
+	MF_DBGLEVEL = MF_DBG_NONE;
+	
+	// clear trace
+	traceLen = 0;
+  tracing = TRUE;
+
+	iso14443a_setup();
 
-		if(mifare_classic_halt(pcs, (uint32_t)bytes_to_num(uid, 4))) {
-			Dbprintf("Halt error");
+	LED_A_ON();
+	LED_B_OFF();
+	LED_C_OFF();
+
+	SpinDelay(300);
+	for (i = 0; i < keyCount; i++) {
+		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    SpinDelay(100);
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+
+		if(!iso14443a_select_card(uid, NULL, &cuid)) {
+			if (OLD_MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
+
+		ui64Key = bytes_to_num(datain + i * 6, 6);
+		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
+			continue;
+		};
 		
 		isOK = 1;
 		break;
@@ -2093,8 +2361,6 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-	DbpString("NESTED FINISHED");
-
 	// add trace trailer
 	uid[0] = 0xff;
 	uid[1] = 0xff;
@@ -2103,17 +2369,18 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LogTrace(uid, 4, 0, 0, TRUE);
 
 	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
-	memcpy(ack.d.asBytes, dataoutbuf, 16);
+	if (isOK) memcpy(ack.d.asBytes, datain + i * 6, 6);
 	
 	LED_B_ON();
 	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
-	LED_B_OFF();	
+	LED_B_OFF();
 
-	// Thats it...
+  // Thats it...
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
-//  tracing = TRUE;
 
+	// restore debug level
+	MF_DBGLEVEL = OLD_MF_DBGLEVEL;	
 }
 
 //-----------------------------------------------------------------------------
@@ -2122,4 +2389,39 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 //-----------------------------------------------------------------------------
 void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 {
+	int cardSTATE = MFEMUL_NOFIELD;
+
+	while (true) {
+
+		if(BUTTON_PRESS()) {
+      break;
+    }
+	
+		switch (cardSTATE) {
+			case MFEMUL_NOFIELD:{
+				break;
+			}
+			case MFEMUL_IDLE:{
+				break;
+			}
+			case MFEMUL_SELECT1:{
+				break;
+			}
+			case MFEMUL_SELECT2:{
+				break;
+			}
+			case MFEMUL_AUTH1:{
+				break;
+			}
+			case MFEMUL_AUTH2:{
+				break;
+			}
+			case MFEMUL_HALTED:{
+				break;
+			}
+		
+		}
+	
+	}
+
 }