X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/63e1d35a07b1faa00e5c864024129a9faf8210c1..75377d29d6f63cf67e427727706fe19149640861:/armsrc/mifarecmd.c

diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c
index 3a932409..c51a30dc 100644
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@@ -143,6 +143,9 @@ void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 	LEDsoff();
 }
 
+// Arg0 = BlockNo,
+// Arg1 = UsePwd bool
+// datain = PWD bytes,
 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 {
 	uint8_t blockNo = arg0;
@@ -151,8 +154,8 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 	uint8_t key[16] = {0x00};
 	bool usePwd = (arg1 == 1);
 
-	LED_A_ON();	LED_B_OFF(); LED_C_OFF();
-
+	LEDsoff();
+	LED_A_ON();
 	clear_trace();
 	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 
@@ -193,10 +196,7 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 
 		// decrypt nonce.
 		tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
-
-	
 		rol(random_b,8);
-		
 		memcpy(rnd_ab  ,random_a,8);
 		memcpy(rnd_ab+8,random_b,8);
 
@@ -221,7 +221,6 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 		// encrypt    out, in, length, key, iv
 		tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
 
-		
 		len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
 		if (len != 11) {
 			if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
@@ -342,13 +341,14 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LEDsoff();
 }
 
-void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
+void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 {
 	// params
-	uint8_t sectorNo = arg0;
-	int Pages = arg1;
-	int countpages = 0;
-	byte_t dataout[176] = {0x00};;
+	uint8_t blockNo = arg0;
+	uint16_t blocks = arg1;
+	bool useKey = (arg2 == 1);
+	int countblocks = 0;
+	uint8_t dataout[176] = {0x00};
 
 	LEDsoff();
 	LED_A_ON();
@@ -361,32 +361,81 @@ void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 		OnError(1);
 		return;
 	}
-	
-	for (int i = 0; i < Pages; i++){
-	
-		len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);
-		
+
+	// authenticate
+	if ( useKey ) {
+		uint8_t key[16] = {0x00};
+		memcpy(key, datain, 16);
+
+		uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
+		uint8_t random_b[8] = {0x00};
+		uint8_t enc_random_b[8] = {0x00};
+		uint8_t rnd_ab[16] = {0x00};
+		uint8_t IV[8] = {0x00};
+
+		uint16_t len;
+		uint8_t receivedAnswer[MAX_FRAME_SIZE];
+		uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
+
+		len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
+		if (len != 11) {
+			if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
+			OnError(1);
+			return;
+		}
+
+		// tag nonce.
+		memcpy(enc_random_b,receivedAnswer+1,8);
+
+		// decrypt nonce.
+		tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
+		rol(random_b,8);
+		memcpy(rnd_ab  ,random_a,8);
+		memcpy(rnd_ab+8,random_b,8);
+
+		// encrypt    out, in, length, key, iv
+		tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
+
+		len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
+		if (len != 11) {
+			OnError(1);
+			return;
+		}
+
+		uint8_t enc_resp[8] = { 0 };
+		uint8_t resp_random_a[8] = { 0 };
+		memcpy(enc_resp, receivedAnswer+1, 8);
+
+		// decrypt    out, in, length, key, iv 
+		tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
+		if ( memcmp(resp_random_a, random_a, 8) != 0 )
+			Dbprintf("failed authentication");	
+	}
+
+	for (int i = 0; i < blocks; i++){
+		len = mifare_ultra_readblock(blockNo * 4 + i, dataout + 4 * i);
+
 		if (len) {
 			if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 			OnError(2);
 			return;
 		} else {
-			countpages++;
+			countblocks++;
 		}
 	}
-		
+
 	len = mifare_ultra_halt();
 	if (len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 		OnError(3);
 		return;
 	}
-	
-	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Pages read %d", countpages);
 
-	len = Pages * 4;
+	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
+
+	len = blocks * 4;
 
-	cmd_send(CMD_ACK, 1, 0, 0, dataout, len);	
+	cmd_send(CMD_ACK, 1, len, 0, dataout, len);	
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
 }