X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/50193c1e3eb7f904bdc4be84618b1b045539597b..9ca155ba443e8f2a9feb7640f4b461842cce9e35:/armsrc/iso14443a.c

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index b64a1942..fb50cc82 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -932,6 +932,7 @@ static int GetIso14443aCommandFromReader(uint8_t *received, int *len, int maxLen
         }
     }
 }
+static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, int correctionNeeded);
 
 //-----------------------------------------------------------------------------
 // Main loop of simulated tag: receive commands from reader, decide what
@@ -1180,8 +1181,13 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
 		}
 
         if(respLen <= 0) continue;
+		//----------------------------
+		u = 0;
+		b = 0x00;
+		fdt_indicator = FALSE;
 
-        // Modulate Manchester
+		EmSendCmd14443aRaw(resp, respLen, receivedCmd[0] == 0x52);
+/*        // Modulate Manchester
 		FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
         AT91C_BASE_SSC->SSC_THR = 0x00;
         FpgaSetupSsc();
@@ -1213,7 +1219,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
 			    break;
 			}
         }
-
+*/
     }
 
 	Dbprintf("%x %x %x", happened, happened2, cmdsRecvd);
@@ -1398,6 +1404,133 @@ void CodeIso14443aAsReaderPar(const uint8_t * cmd, int len, uint32_t dwParity)
   ToSendMax++;
 }
 
+//-----------------------------------------------------------------------------
+// Wait for commands from reader
+// Stop when button is pressed (return 1) or field was gone (return 2)
+// Or return 0 when command is captured
+//-----------------------------------------------------------------------------
+static int EmGetCmd(uint8_t *received, int *len, int maxLen)
+{
+	*len = 0;
+
+	uint32_t timer = 0, vtime = 0;
+	int analogCnt = 0;
+	int analogAVG = 0;
+
+	// Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
+	// only, since we are receiving, not transmitting).
+	// Signal field is off with the appropriate LED
+	LED_D_OFF();
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
+
+	// Set ADC to read field strength
+	AT91C_BASE_ADC->ADC_CR = AT91C_ADC_SWRST;
+	AT91C_BASE_ADC->ADC_MR =
+				ADC_MODE_PRESCALE(32) |
+				ADC_MODE_STARTUP_TIME(16) |
+				ADC_MODE_SAMPLE_HOLD_TIME(8);
+	AT91C_BASE_ADC->ADC_CHER = ADC_CHANNEL(ADC_CHAN_HF);
+	// start ADC
+	AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
+	
+	// Now run a 'software UART' on the stream of incoming samples.
+	Uart.output = received;
+	Uart.byteCntMax = maxLen;
+	Uart.state = STATE_UNSYNCD;
+
+	for(;;) {
+		WDT_HIT();
+
+		if (BUTTON_PRESS()) return 1;
+
+		// test if the field exists
+		if (AT91C_BASE_ADC->ADC_SR & ADC_END_OF_CONVERSION(ADC_CHAN_HF)) {
+			analogCnt++;
+			analogAVG += AT91C_BASE_ADC->ADC_CDR[ADC_CHAN_HF];
+			AT91C_BASE_ADC->ADC_CR = AT91C_ADC_START;
+			if (analogCnt >= 32) {
+				if ((33000 * (analogAVG / analogCnt) >> 10) < MF_MINFIELDV) {
+					vtime = GetTickCount();
+					if (!timer) timer = vtime;
+					// 50ms no field --> card to idle state
+					if (vtime - timer > 50) return 2;
+				} else
+					if (timer) timer = 0;
+				analogCnt = 0;
+				analogAVG = 0;
+			}
+		}
+		// transmit none
+		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+			AT91C_BASE_SSC->SSC_THR = 0x00;
+		}
+		// receive and test the miller decoding
+		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
+			volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+			if(MillerDecoding((b & 0xf0) >> 4)) {
+				*len = Uart.byteCnt;
+				return 0;
+			}
+			if(MillerDecoding(b & 0x0f)) {
+				*len = Uart.byteCnt;
+				return 0;
+			}
+		}
+	}
+}
+
+static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, int correctionNeeded)
+{
+	int i, u = 0;
+	uint8_t b = 0;
+
+	// Modulate Manchester
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_MOD);
+	AT91C_BASE_SSC->SSC_THR = 0x00;
+	FpgaSetupSsc();
+	
+	// include correction bit
+	i = 1;
+	if((Uart.parityBits & 0x01) || correctionNeeded) {
+		// 1236, so correction bit needed
+		i = 0;
+	}
+	
+	// send cycle
+	for(;;) {
+		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
+			volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
+			(void)b;
+		}
+		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+			if(i > respLen) {
+				b = 0x00;
+				u++;
+			} else {
+				b = resp[i];
+				i++;
+			}
+			AT91C_BASE_SSC->SSC_THR = b;
+
+			if(u > 4) break;
+		}
+		if(BUTTON_PRESS()) {
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int EmSendCmdEx(uint8_t *resp, int respLen, int correctionNeeded){
+  CodeIso14443aAsTag(resp, respLen);
+	return EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
+}
+
+static int EmSendCmd(uint8_t *resp, int respLen){
+	return EmSendCmdEx(resp, respLen, 0);
+}
+
 //-----------------------------------------------------------------------------
 // Wait a certain time for tag response
 //  If a response is captured return TRUE
@@ -1698,12 +1831,12 @@ void ReaderMifare(uint32_t parameter)
 
 	tracing = FALSE;
 	byte_t nt[4] = {0,0,0,0};
-	byte_t nt_attacked[4];
+	byte_t nt_attacked[4], nt_noattack[4];
 	byte_t par_list[8] = {0,0,0,0,0,0,0,0};
 	byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
-	num_to_bytes(parameter, 4, nt_attacked);
+	num_to_bytes(parameter, 4, nt_noattack);
 	int isOK = 0, isNULL = 0;
-	
+
 	while(TRUE)
 	{
 		LED_C_ON();
@@ -1732,6 +1865,8 @@ void ReaderMifare(uint32_t parameter)
 		// Receive 4 bit answer
 		if (ReaderReceive(receivedAnswer))
 		{
+			if ( (parameter != 0) && (memcmp(nt, nt_noattack, 4) == 0) ) continue;
+
 			isNULL = (nt_attacked[0] = 0) && (nt_attacked[1] = 0) && (nt_attacked[2] = 0) && (nt_attacked[3] = 0);
 			if ( (isNULL != 0 ) && (memcmp(nt, nt_attacked, 4) != 0) ) continue;
 
@@ -1786,7 +1921,7 @@ void ReaderMifare(uint32_t parameter)
 	LEDsoff();
 	tracing = TRUE;
 	
-//	DbpString("COMMAND mifare FINISHED");
+	if (MF_DBGLEVEL >= 1)	DbpString("COMMAND mifare FINISHED");
 }
 
 //-----------------------------------------------------------------------------
@@ -1822,22 +1957,22 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 
 	while (true) {
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 
 		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
-			Dbprintf("Auth error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Auth error");
 			break;
 		};
 		
 		if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
-			Dbprintf("Read block error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block error");
 			break;
 		};
 
 		if(mifare_classic_halt(pcs, cuid)) {
-			Dbprintf("Halt error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
 			break;
 		};
 		
@@ -1848,7 +1983,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-//    DbpString("READ BLOCK FINISHED");
+	if (MF_DBGLEVEL >= 2)	DbpString("READ BLOCK FINISHED");
 
 	// add trace trailer
 	uid[0] = 0xff;
@@ -1905,34 +2040,34 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 
 	while (true) {
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 
 		if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
-			Dbprintf("Auth error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Auth error");
 			break;
 		};
 		
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf + 16 * 0)) {
-			Dbprintf("Read block 0 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 0 error");
 			break;
 		};
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf + 16 * 1)) {
-			Dbprintf("Read block 1 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 1 error");
 			break;
 		};
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf + 16 * 2)) {
-			Dbprintf("Read block 2 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 2 error");
 			break;
 		};
 		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf + 16 * 3)) {
-			Dbprintf("Read block 3 error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 3 error");
 			break;
 		};
 		
 		if(mifare_classic_halt(pcs, cuid)) {
-			Dbprintf("Halt error");
+		if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
 			break;
 		};
 
@@ -1943,7 +2078,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-//    DbpString("READ BLOCK FINISHED");
+	if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 
 	// add trace trailer
 	uid[0] = 0xff;
@@ -2005,23 +2140,23 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LED_C_OFF();
 
 	while (true) {
-		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+			if(!iso14443a_select_card(uid, NULL, &cuid)) {
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 
 		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
-			Dbprintf("Auth error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth error");
 			break;
 		};
 		
 		if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
-			Dbprintf("Write block error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Write block error");
 			break;
 		};
 
 		if(mifare_classic_halt(pcs, cuid)) {
-			Dbprintf("Halt error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
 			break;
 		};
 		
@@ -2032,7 +2167,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-//  DbpString("WRITE BLOCK FINISHED");
+	if (MF_DBGLEVEL >= 2)	DbpString("WRITE BLOCK FINISHED");
 
 	// add trace trailer
 	uid[0] = 0xff;
@@ -2067,25 +2202,25 @@ int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
 // MIFARE nested authentication. 
 // 
 //-----------------------------------------------------------------------------
-void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
 {
 	// params
 	uint8_t blockNo = arg0;
 	uint8_t keyType = arg1;
+	uint8_t targetBlockNo = arg2 & 0xff;
+	uint8_t targetKeyType = (arg2 >> 8) & 0xff;
 	uint64_t ui64Key = 0;
 
 	ui64Key = bytes_to_num(datain, 6);
 	
 	// variables
-	uint8_t targetBlockNo = blockNo + 1;
-	uint8_t targetKeyType = keyType;
 	int rtr, i, j, m, len;
 	int davg, dmin, dmax;
 	uint8_t uid[8];
 	uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
 	uint8_t par_array[4];
-	nestedVector nvector[3][10];
-	int nvectorcount[3] = {10, 10, 10};
+	nestedVector nvector[NES_MAX_INFO + 1][10];
+	int nvectorcount[NES_MAX_INFO + 1];
 	int ncount = 0;
 	UsbCommand ack = {CMD_ACK, {0, 0, 0}};
 	struct Crypto1State mpcs = {0, 0};
@@ -2093,10 +2228,13 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	pcs = &mpcs;
 	uint8_t* receivedAnswer = mifare_get_bigbufptr();
 
+	//init
+	for (i = 0; i < NES_MAX_INFO + 1; i++) nvectorcount[i] = 11;  //  11 - empty block;
+	
 	// clear trace
 	traceLen = 0;
   tracing = false;
-
+	
 	iso14443a_setup();
 
 	LED_A_ON();
@@ -2121,17 +2259,17 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
     }
 
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 		
 		if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
-			Dbprintf("Auth1 error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth1 error");
 			break;
 		};
 
 		if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2)) {
-			Dbprintf("Auth2 error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth2 error");
 			break;
 		};
 		
@@ -2145,24 +2283,24 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 			davg += i;
 			if (dmin > i) dmin = i;
 			if (dmax < i) dmax = i;
-//			Dbprintf("r=%d nt1=%08x nt2=%08x distance=%d", rtr, nt1, nt2, i);
+			if (MF_DBGLEVEL >= 4)	Dbprintf("r=%d nt1=%08x nt2=%08x distance=%d", rtr, nt1, nt2, i);
 		}
 	}
 	
 	if (rtr == 0)	return;
 
 	davg = davg / rtr;
-	Dbprintf("distance: min=%d max=%d avg=%d", dmin, dmax, davg);
+	if (MF_DBGLEVEL >= 3)	Dbprintf("distance: min=%d max=%d avg=%d", dmin, dmax, davg);
 
 	LED_B_OFF();
 
-  tracing = true;
+//  -------------------------------------------------------------------------------------------------	
 	
 	LED_C_ON();
 
 	//  get crypted nonces for target sector
-	for (rtr = 0; rtr < 2; rtr++) {
-//		Dbprintf("------------------------------");
+	for (rtr = 0; rtr < NS_RETRIES_GETNONCE; rtr++) {
+	if (MF_DBGLEVEL >= 4)			Dbprintf("------------------------------");
 
 		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     SpinDelay(100);
@@ -2174,47 +2312,24 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
     }
 
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
-			Dbprintf("Can't select card");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
 			break;
 		};
 		
 		if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
-			Dbprintf("Auth1 error");
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth1 error");
 			break;
 		};
 
 		// nested authentication
 		len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par);
 		if (len != 4) {
-			Dbprintf("Auth2 error len=%d", len);
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Auth2 error len=%d", len);
 			break;
 		};
 	
 		nt2 = bytes_to_num(receivedAnswer, 4);		
-//		Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
-		
-// -----------------------  test		
-/*	uint32_t d_nt, d_ks1, d_ks2, d_ks3, reader_challenge;
-	byte_t ar[4];
-
-	ar[0] = 0x55;
-	ar[1] = 0x41;
-	ar[2] = 0x49;
-	ar[3] = 0x92; 
-
-	crypto1_destroy(pcs);
-	crypto1_create(pcs, ui64Key);
-
-	// decrypt nt with help of new key 
-	d_nt = crypto1_word(pcs, nt2 ^ cuid, 1) ^ nt2;
-	
-	reader_challenge = d_nt;//(uint32_t)bytes_to_num(ar, 4); 
-	d_ks1 = crypto1_word(pcs, reader_challenge, 0);
-	d_ks2 = crypto1_word(pcs, 0, 0);
-	d_ks3 = crypto1_word(pcs, 0,0);
-		
-	Dbprintf("TST: ks1=%08x nt=%08x", d_ks1, d_nt);*/
-// -----------------------  test		
+		if (MF_DBGLEVEL >= 4)	Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
 		
 		// Parity validity check
 		for (i = 0; i < 4; i++) {
@@ -2223,45 +2338,48 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 		}
 		
 		ncount = 0;
-		for (m = dmin - 10; m < dmax + 10; m++) {
+		for (m = dmin - NS_TOLERANCE; m < dmax + NS_TOLERANCE; m++) {
 			nttest = prng_successor(nt1, m);
 			ks1 = nt2 ^ nttest;
 
-//--------------------------------------  test
-/*			if (nttest == d_nt){
-				Dbprintf("nttest=d_nt!  m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
-			}*/
-//--------------------------------------  test
 			if (valid_nonce(nttest, nt2, ks1, par_array) && (ncount < 11)){
 				
-				nvector[2][ncount].nt = nttest;
-				nvector[2][ncount].ks1 = ks1;
+				nvector[NES_MAX_INFO][ncount].nt = nttest;
+				nvector[NES_MAX_INFO][ncount].ks1 = ks1;
 				ncount++;
-				nvectorcount[2] = ncount;
-				
-//				Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
+				nvectorcount[NES_MAX_INFO] = ncount;
+				if (MF_DBGLEVEL >= 4)	Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
 			}
 
 		}
 		
 		// select vector with length less than got
-		if (nvectorcount[2] != 0) {
-			m = 2;
-			if (nvectorcount[2] < nvectorcount[1]) m = 1;
-			if (nvectorcount[2] < nvectorcount[0]) m = 0;
-			if (m != 2) {
+		if (nvectorcount[NES_MAX_INFO] != 0) {
+			m = NES_MAX_INFO;
+			
+			for (i = 0; i < NES_MAX_INFO; i++)
+				if (nvectorcount[i] > 10) {
+					m = i;
+					break;
+				}
+				
+			if (m == NES_MAX_INFO)
+				for (i = 0; i < NES_MAX_INFO; i++)
+					if (nvectorcount[NES_MAX_INFO] < nvectorcount[i]) {
+						m = i;
+						break;
+					}
+					
+			if (m != NES_MAX_INFO) {
 				for (i = 0; i < nvectorcount[m]; i++) {
-					nvector[m][i] = nvector[2][i];
+					nvector[m][i] = nvector[NES_MAX_INFO][i];
 				}
-				nvectorcount[m] = nvectorcount[2];
+				nvectorcount[m] = nvectorcount[NES_MAX_INFO];
 			}
 		}
-		
-//		Dbprintf("vector count: 1=%d 2=%d 3=%d", nvectorcount[0], nvectorcount[1], nvectorcount[2]);
 	}
 
 	LED_C_OFF();
-
 	
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
@@ -2273,7 +2391,9 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	uid[3] = 0xff;
 	LogTrace(uid, 4, 0, 0, TRUE);
 
-	for (i = 0; i < 2; i++) {
+	for (i = 0; i < NES_MAX_INFO; i++) {
+		if (nvectorcount[i] > 10) continue;
+		
 		for (j = 0; j < nvectorcount[i]; j += 5) {
 			ncount = nvectorcount[i] - j;
 			if (ncount > 5) ncount = 5; 
@@ -2307,13 +2427,93 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 	LED_B_OFF();	
 
-	DbpString("NESTED FINISHED");
+	if (MF_DBGLEVEL >= 4)	DbpString("NESTED FINISHED");
 
 	// Thats it...
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
-//  tracing = TRUE;
+	
+  tracing = TRUE;
+}
 
+//-----------------------------------------------------------------------------
+// MIFARE check keys. key count up to 8. 
+// 
+//-----------------------------------------------------------------------------
+void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+{
+  // params
+	uint8_t blockNo = arg0;
+	uint8_t keyType = arg1;
+	uint8_t keyCount = arg2;
+	uint64_t ui64Key = 0;
+	
+	// variables
+	int i;
+	byte_t isOK = 0;
+	uint8_t uid[8];
+	uint32_t cuid;
+	struct Crypto1State mpcs = {0, 0};
+	struct Crypto1State *pcs;
+	pcs = &mpcs;
+	
+	// clear debug level
+	int OLD_MF_DBGLEVEL = MF_DBGLEVEL;	
+	MF_DBGLEVEL = MF_DBG_NONE;
+	
+	// clear trace
+	traceLen = 0;
+  tracing = TRUE;
+
+	iso14443a_setup();
+
+	LED_A_ON();
+	LED_B_OFF();
+	LED_C_OFF();
+
+	SpinDelay(300);
+	for (i = 0; i < keyCount; i++) {
+		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    SpinDelay(100);
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+
+		if(!iso14443a_select_card(uid, NULL, &cuid)) {
+			if (OLD_MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
+			break;
+		};
+
+		ui64Key = bytes_to_num(datain + i * 6, 6);
+		if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
+			continue;
+		};
+		
+		isOK = 1;
+		break;
+	}
+	
+	//  ----------------------------- crypto1 destroy
+	crypto1_destroy(pcs);
+	
+	// add trace trailer
+	uid[0] = 0xff;
+	uid[1] = 0xff;
+	uid[2] = 0xff;
+	uid[3] = 0xff;
+	LogTrace(uid, 4, 0, 0, TRUE);
+
+	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
+	if (isOK) memcpy(ack.d.asBytes, datain + i * 6, 6);
+	
+	LED_B_ON();
+	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+	LED_B_OFF();
+
+  // Thats it...
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
+
+	// restore debug level
+	MF_DBGLEVEL = OLD_MF_DBGLEVEL;	
 }
 
 //-----------------------------------------------------------------------------
@@ -2323,33 +2523,161 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 {
 	int cardSTATE = MFEMUL_NOFIELD;
+	int vHf = 0;	// in mV
+	int res;
+	uint32_t timer = 0;
+	int len = 0;
+	uint8_t cardAUTHSC = 0;
+	uint8_t cardAUTHKEY = 0xff;  // no authentication
+	uint32_t cuid = 0;
+	struct Crypto1State mpcs = {0, 0};
+	struct Crypto1State *pcs;
+	pcs = &mpcs;
+	
+	uint64_t key64 = 0xffffffffffffULL;
+	
+	uint8_t* receivedCmd = mifare_get_bigbufptr();
+	
+	static uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k
 
-	while (true) {
+	static uint8_t rUIDBCC1[] = {0xde,  0xad,  0xbe,  0xaf,  0x62}; 
+	static uint8_t rUIDBCC2[] = {0xde,  0xad,  0xbe,  0xaf,  0x62}; // !!!
+		
+	static uint8_t rSAK[] = {0x08,  0xb6,  0xdd};
 
+	static uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
+	
+// --------------------------------------	test area
+
+
+// --------------------------------------	END test area
+
+	// We need to listen to the high-frequency, peak-detected path.
+	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+	FpgaSetupSsc();
+
+  FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
+	SpinDelay(200);
+
+Dbprintf("--> start");
+	while (true) {
+		WDT_HIT();
+//		timer = GetTickCount();
+//		Dbprintf("time: %d", GetTickCount() - timer);
+
+		// find reader field
+		// Vref = 3300mV, and an 10:1 voltage divider on the input
+		// can measure voltages up to 33000 mV
+		if (cardSTATE == MFEMUL_NOFIELD) {
+			vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
+			if (vHf > MF_MINFIELDV) {
+				cardSTATE = MFEMUL_IDLE;
+				LED_A_ON();
+			}
+		} 
+
+		if (cardSTATE != MFEMUL_NOFIELD) {
+			res = EmGetCmd(receivedCmd, &len, 100);
+			if (res == 2) {
+				cardSTATE = MFEMUL_NOFIELD;
+				LEDsoff();
+				continue;
+			}
+			if(res) break;
+		}
+		
 		if(BUTTON_PRESS()) {
-      break;
-    }
+			break;
+		}
 	
+//		if (len) Dbprintf("len:%d cmd: %02x %02x %02x %02x", len, receivedCmd[0], receivedCmd[1], receivedCmd[2], receivedCmd[3]);
+		
 		switch (cardSTATE) {
 			case MFEMUL_NOFIELD:{
 				break;
 			}
+			case MFEMUL_HALTED:{
+				// WUP request
+				if (!(len == 1 && receivedCmd[0] == 0x52)) break;
+			}
 			case MFEMUL_IDLE:{
+				// REQ or WUP request
+				if (len == 1 && (receivedCmd[0] == 0x26 || receivedCmd[0] == 0x52)) {
+timer = GetTickCount();
+					EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
+					cardSTATE = MFEMUL_SELECT1;
+					
+					// init crypto block
+					crypto1_destroy(pcs);
+					cardAUTHKEY = 0xff;
+				}
 				break;
 			}
 			case MFEMUL_SELECT1:{
+				// select all
+				if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
+					EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
+
+					if (rUIDBCC1[0] == 0x88) {
+						cardSTATE = MFEMUL_SELECT2;
+					}
+				}
+
+				// select card
+				if (len == 9 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70)) {
+					EmSendCmd(rSAK, sizeof(rSAK));
+
+					cuid = bytes_to_num(rUIDBCC1, 4);
+					cardSTATE = MFEMUL_WORK;
+					LED_B_ON();
+Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - timer);
+				}
+				
 				break;
 			}
 			case MFEMUL_SELECT2:{
+					EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
+
+				cuid = bytes_to_num(rUIDBCC2, 4);
+				cardSTATE = MFEMUL_WORK;
+				LED_B_ON();
+Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - timer);
 				break;
 			}
 			case MFEMUL_AUTH1:{
+if (len) Dbprintf("au1 len:%d cmd: %02x %02x %02x %02x", len, receivedCmd[0], receivedCmd[1], receivedCmd[2], receivedCmd[3]);
+				if (len == 8) {
+				
+				}
 				break;
 			}
 			case MFEMUL_AUTH2:{
+
+				LED_C_ON();
+Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - timer);
 				break;
 			}
-			case MFEMUL_HALTED:{
+			case MFEMUL_WORK:{
+				// auth
+				if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
+timer = GetTickCount();
+					crypto1_create(pcs, key64);
+//					if (cardAUTHKEY == 0xff) { // first auth
+					crypto1_word(pcs, cuid ^ bytes_to_num(rAUTH_NT, 4), 0); // uid ^ nonce
+//					} else { // nested auth
+//					}
+
+					EmSendCmd(rAUTH_NT, sizeof(rAUTH_NT));
+					cardAUTHSC = receivedCmd[1];
+					cardAUTHKEY = receivedCmd[0] - 0x60;
+					cardSTATE = MFEMUL_AUTH1;
+				}
+				
+				// halt
+				if (len == 4 && (receivedCmd[0] == 0x50 || receivedCmd[0] == 0x00)) {
+					cardSTATE = MFEMUL_HALTED;
+					LED_B_OFF();
+				}
 				break;
 			}
 		
@@ -2357,4 +2685,8 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	
 	}
 
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
+
+	DbpString("Emulator stopped.");
 }