From: Iceman <iceman@iuse.se>
Date: Sat, 2 Dec 2017 17:39:14 +0000 (+0100)
Subject: Merge pull request #493 from merlokk/emv2
X-Git-Tag: v3.1.0~112
X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/2db66b01daff84d5a43aadda72fbb37b0b6f240c?hp=d2172825411456bf0f5dd65af911b06b4cb70309

Merge pull request #493 from merlokk/emv2

Emv2. next part of EMV work
---

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fabd04b0..644f6c0f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,6 +42,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Added `hf emv` group of commands (Merlok)
 - Added `hf emv search` `hf emv pse` - commands for selection of EMV application (Merlok)
 - Added `hf emv select` - command for select EMV application (Merlok)
+- Added `hf emv exec` - command for execute EMV transaction (Merlok)
+- Added to `hf emv exec` MSD path for VISA and Mastercard and some other compatible EMV cards (Merlok)
 
 ## [3.0.1][2017-06-08]
 
diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 3c3c1f11..b188555e 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -402,12 +402,12 @@ int CmdHFEMVExec(const char *cmd) {
 		TLVPrintFromBuffer(buf, len);
 	PrintAndLog("* Selected.");
 	
-PrintAndLog("-----BREAK.");
-return 0;
 	PrintAndLog("\n* Init transaction parameters.");
 
     //9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
-	TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // E6
+	TLV_ADD(0x9F66, "\x86\x00\x00\x00"); // MSD
+//	TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
+//	TLV_ADD(0x9F66, "\x8e\x00\x00\x00"); // CDA
     //9F02:(Amount, Authorised (Numeric)) len:6
 	TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
     //9F1A:(Terminal Country Code) len:2
@@ -421,8 +421,10 @@ return 0;
 	TLV_ADD(0x9C,   "\x00");
 	// 9F37 Unpredictable Number len:4
 	TLV_ADD(0x9F37, "\x01\x02\x03\x04");
+	// 9F6A Unpredictable Number (MSD for UDOL) len:4
+	TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
 
-	TLVPrintFromTLV(tlvRoot);
+	TLVPrintFromTLV(tlvRoot); // TODO delete!!!
 	
 	PrintAndLog("\n* Calc PDOL.");
 	struct tlv *pdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x9f38, NULL), tlvRoot, 0x83);
@@ -439,8 +441,6 @@ return 0;
 	}
 	PrintAndLog("PDOL data[%d]: %s", pdol_data_tlv_data_len, sprint_hex(pdol_data_tlv_data, pdol_data_tlv_data_len));
 
-//PrintAndLog("-----BREAK.");
-//return 0;
 	PrintAndLog("\n* GPO.");
 	res = EMVGPO(true, pdol_data_tlv_data, pdol_data_tlv_data_len, buf, sizeof(buf), &len, &sw, tlvRoot);
 	
@@ -453,21 +453,49 @@ return 0;
 
 	// process response template format 1 [id:80  2b AIP + x4b AFL] and format 2 [id:77 TLV]
 	if (buf[0] == 0x80) {
-		
-		
-		
 		if (decodeTLV){
 			PrintAndLog("GPO response format1:");
 			TLVPrintFromBuffer(buf, len);
 		}
-	} else {
-		
-		
 		
+		if (len < 4 || (len - 4) % 4) {
+			PrintAndLog("ERROR: GPO response format1 parsing error. length=%d", len);
+		} else {
+			// AIP
+			struct tlvdb * f1AIP = tlvdb_fixed(0x82, 2, buf + 2);
+			tlvdb_add(tlvRoot, f1AIP);
+			if (decodeTLV){
+				PrintAndLog("\n* * Decode response format 1 (0x80) AIP and AFL:");
+				TLVPrintFromTLV(f1AIP);
+			}
+
+			// AFL
+			struct tlvdb * f1AFL = tlvdb_fixed(0x94, len - 4, buf + 2 + 2);
+			tlvdb_add(tlvRoot, f1AFL);
+			if (decodeTLV)
+				TLVPrintFromTLV(f1AFL);
+		}		
+	} else {
 		if (decodeTLV)
 			TLVPrintFromBuffer(buf, len);
 	}
 	
+	// extract PAN from track2
+	{
+		const struct tlv *track2 = tlvdb_get(tlvRoot, 0x57, NULL);
+		if (!tlvdb_get(tlvRoot, 0x5a, NULL) && track2 && track2->len >= 8) {
+			struct tlvdb *pan = GetPANFromTrack2(track2);
+			if (pan) {
+				tlvdb_add(tlvRoot, pan); 
+				
+				const struct tlv *pantlv = tlvdb_get(tlvRoot, 0x5a, NULL);	
+				PrintAndLog("\n* * Extracted PAN from track2: %s", sprint_hex(pantlv->value, pantlv->len));
+			} else {
+				PrintAndLog("\n* * WARNING: Can't extract PAN from track2.");
+			}
+		}
+	}
+	
 	PrintAndLog("\n* Read records from AFL.");
 	const struct tlv *AFL = tlvdb_get(tlvRoot, 0x94, NULL);
 	if (!AFL || !AFL->len) {
@@ -516,7 +544,114 @@ return 0;
 		break;
 	}	
 	
-	// additional contacless EMV commands (fDDA, CDA, external authenticate)
+	// transaction check
+	const struct tlv *AIPtlv = tlvdb_get(tlvRoot, 0x82, NULL);	
+	uint16_t AIP = AIPtlv->value[0] + AIPtlv->value[1] * 0x100;
+	PrintAndLog("* * AIP=%x", AIP);
+
+	// qVSDC
+	{
+		// 9F26: Application Cryptogram
+		const struct tlv *AC = tlvdb_get(tlvRoot, 0x9F26, NULL);
+		if (AC) {
+			PrintAndLog("\n--> qVSDC transaction.");
+			PrintAndLog("* AC path");
+			
+			// 9F36: Application Transaction Counter (ATC)
+			const struct tlv *ATC = tlvdb_get(tlvRoot, 0x9F36, NULL);
+			if (ATC) {
+			
+				// 9F10: Issuer Application Data - optional
+				const struct tlv *IAD = tlvdb_get(tlvRoot, 0x9F10, NULL);
+
+				// print AC data
+				PrintAndLog("ATC: %s", sprint_hex(ATC->value, ATC->len));
+				PrintAndLog("AC: %s", sprint_hex(AC->value, AC->len));
+				if (IAD){
+					PrintAndLog("IAD: %s", sprint_hex(IAD->value, IAD->len));
+					
+					if (IAD->len >= IAD->value[0] + 1) {
+						PrintAndLog("\tKey index:  0x%02x", IAD->value[1]);
+						PrintAndLog("\tCrypto ver: 0x%02x(%03d)", IAD->value[2], IAD->value[2]);
+						PrintAndLog("\tCVR:", sprint_hex(&IAD->value[3], IAD->value[0] - 2));
+						struct tlvdb * cvr = tlvdb_fixed(0x20, IAD->value[0] - 2, &IAD->value[3]);
+						TLVPrintFromTLVLev(cvr, 1);
+					}
+				} else {
+					PrintAndLog("WARNING: IAD not found.");
+				}
+				
+			} else {
+				PrintAndLog("ERROR AC: Application Transaction Counter (ATC) not found.");
+			}
+		}
+	}
+	
+	// TODO: Mastercard M/CHIP
+	{
+		const struct tlv *CDOL1 = tlvdb_get(tlvRoot, 0x8c, NULL);
+		if (CDOL1 && GetCardPSVendor(AID, AIDlen) == CV_MASTERCARD) { // and m/chip transaction flag
+		
+		}
+	}
+		
+	// MSD
+	if (AIP & 0x8000) {
+		PrintAndLog("\n--> MSD transaction.");
+		
+		
+		PrintAndLog("* MSD dCVV path. Check dCVV");
+
+		const struct tlv *track2 = tlvdb_get(tlvRoot, 0x57, NULL);
+		if (track2) {
+			PrintAndLog("Track2: %s", sprint_hex(track2->value, track2->len));
+
+			struct tlvdb *dCVV = GetdCVVRawFromTrack2(track2);
+			PrintAndLog("dCVV raw data:");
+			TLVPrintFromTLV(dCVV);
+			
+			if (GetCardPSVendor(AID, AIDlen) == CV_MASTERCARD) {
+				PrintAndLog("\n* Mastercard calculate UDOL");
+
+				// UDOL (9F69)
+				const struct tlv *UDOL = tlvdb_get(tlvRoot, 0x9F69, NULL);
+				// UDOL(9F69) default: 9F6A (Unpredictable number) 4 bytes
+				const struct tlv defUDOL = {
+					.tag = 0x01,
+					.len = 3,
+					.value = (uint8_t *)"\x9f\x6a\x04",
+				};
+				if (!UDOL)
+					PrintAndLog("Use default UDOL.");
+
+				struct tlv *udol_data_tlv = dol_process(UDOL ? UDOL : &defUDOL, tlvRoot, 0x01); // 0x01 - fake tag!
+				if (!udol_data_tlv){
+					PrintAndLog("ERROR: can't create UDOL TLV.");
+					return 4;
+				}
+
+				PrintAndLog("UDOL data[%d]: %s", udol_data_tlv->len, sprint_hex(udol_data_tlv->value, udol_data_tlv->len));
+				
+				PrintAndLog("\n* Mastercard compute cryptographic checksum(UDOL)");
+				
+				res = MSCComputeCryptoChecksum(true, (uint8_t *)udol_data_tlv->value, udol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
+				if (res) {
+					PrintAndLog("ERROR Compute Crypto Checksum. APDU error %4x", sw);
+					return 5;
+				}
+				
+				if (decodeTLV) {
+					TLVPrintFromBuffer(buf, len);
+					PrintAndLog("");
+				}
+
+			}
+		} else {
+			PrintAndLog("ERROR MSD: Track2 data not found.");
+		}
+	}
+	
+	// additional contacless EMV commands (fDDA, external authenticate)
 	
 	
 	// DropField
diff --git a/client/emv/emv_tags.c b/client/emv/emv_tags.c
index a7c11c3e..a69d7196 100644
--- a/client/emv/emv_tags.c
+++ b/client/emv/emv_tags.c
@@ -21,6 +21,7 @@
 #include "emv_tags.h"
 
 #include <stdlib.h>
+#include <string.h>
 
 #define PRINT_INDENT(level) 	{for (int i = 0; i < (level); i++) fprintf(f, "\t");}
 
@@ -33,6 +34,7 @@ enum emv_tag_t {
 	EMV_TAG_STRING,
 	EMV_TAG_NUMERIC,
 	EMV_TAG_YYMMDD,
+	EMV_TAG_CVR,
 };
 
 struct emv_tag {
@@ -144,12 +146,38 @@ static const struct emv_tag_bit EMV_TTQ[] = {
 	EMV_BIT_FINISH,
 };
 
+static const struct emv_tag_bit EMV_CVR[] = {
+	// mask 0F 0F F0 0F
+	{ EMV_BIT(1, 4), "CDA Performed" },
+	{ EMV_BIT(1, 3), "Offline DDA Performed" },
+	{ EMV_BIT(1, 2), "Issuer Authentication Not Performed" },
+	{ EMV_BIT(1, 1), "Issuer Authentication performed and Failed" },
+	{ EMV_BIT(2, 4), "Offline PIN Verification Performed" },
+	{ EMV_BIT(2, 3), "Offline PIN Verification Performed and PIN Not Successfully Verified" },
+	{ EMV_BIT(2, 2), "PIN Try Limit Exceeded" },
+	{ EMV_BIT(2, 1), "Last Online Transaction Not Completed" },
+	{ EMV_BIT(3, 8), "Lower Offline Transaction Count Limit Exceeded" },
+	{ EMV_BIT(3, 7), "Upper Offline Transaction Count Limit Exceeded" },
+	{ EMV_BIT(3, 6), "Lower Cumulative Offline Amount Limit Exceeded" },
+	{ EMV_BIT(3, 5), "Upper Cumulative Offline Amount Limit Exceeded" },
+	{ EMV_BIT(4, 4), "Issuer script processing failed on last transaction" },
+	{ EMV_BIT(4, 3), "Offline data authentication failed on previous transaction and transaction declined offline" },
+	{ EMV_BIT(4, 2), "Go Online on Next Transaction Was Set" },
+	{ EMV_BIT(4, 1), "Unable to go Online" },
+	EMV_BIT_FINISH,
+};
+
 // All Data Elements by Tags used in TLV structure (according to the EMV 4.2 Standard )
 // https://www.eftlab.co.uk/index.php/site-map/knowledge-base/145-emv-nfc-tags
 // http://dexterous-programmer.blogspot.in/2012/05/emv-tags.html
 static const struct emv_tag emv_tags[] = {
+	// internal
 	{ 0x00  , "Unknown ???" },
 	{ 0x01  , "", EMV_TAG_STRING }, // string for headers
+	{ 0x02  , "Raw data", }, // data
+	{ 0x20  , "Cardholder Verification Results (CVR)", EMV_TAG_CVR }, // not standard!
+
+	// EMV
 	{ 0x41  , "Country code and national data" },
 	{ 0x42  , "Issuer Identification Number (IIN)" },
 	{ 0x4f  , "Application Dedicated File (ADF) Name" },
@@ -228,6 +256,8 @@ static const struct emv_tag emv_tags[] = {
 	{ 0x9f4c, "ICC Dynamic Number" },
 	{ 0x9f4d, "Log Entry" },
 	{ 0x9f4f, "Log Format", EMV_TAG_DOL },
+	{ 0x9f60, "CVC3 (Track1)" },
+	{ 0x9f61, "CVC3 (Track2)" },
 	{ 0x9f62, "PCVC3(Track1)" },
 	{ 0x9f63, "PUNATC(Track1)" },
 	{ 0x9f64, "NATC(Track1)" },
@@ -375,6 +405,72 @@ static uint32_t emv_get_binary(const unsigned char *S)
 	return (S[0] << 24) | (S[1] << 16) | (S[2] << 8) | (S[3] << 0);
 }
 
+// https://github.com/binaryfoo/emv-bertlv/blob/master/src/main/resources/fields/visa-cvr.txt
+static void emv_tag_dump_cvr(const struct tlv *tlv, const struct emv_tag *tag, FILE *f, int level) {
+	if (!tlv || tlv->len < 1) {
+		PRINT_INDENT(level);
+		fprintf(f, "\tINVALID!\n");
+		return;
+	}
+	
+	if (tlv->len != tlv->value[0] + 1) {
+		PRINT_INDENT(level);
+		fprintf(f, "\tINVALID length!\n");
+		return;
+	}
+	
+	if (tlv->len >= 2) {
+		// AC1
+		PRINT_INDENT(level);
+		if ((tlv->value[1] & 0xC0) == 0x00)	fprintf(f, "\tAC1: AAC (Transaction declined)\n");
+		if ((tlv->value[1] & 0xC0) == 0x40)	fprintf(f, "\tAC1: TC (Transaction approved)\n");
+		if ((tlv->value[1] & 0xC0) == 0x80)	fprintf(f, "\tAC1: ARQC (Online authorisation requested)\n");
+		if ((tlv->value[1] & 0xC0) == 0xC0)	fprintf(f, "\tAC1: RFU\n");
+		// AC2
+		PRINT_INDENT(level);
+		if ((tlv->value[1] & 0x30) == 0x00)	fprintf(f, "\tAC2: AAC (Transaction declined)\n");
+		if ((tlv->value[1] & 0x30) == 0x10)	fprintf(f, "\tAC2: TC (Transaction approved)\n");
+		if ((tlv->value[1] & 0x30) == 0x20)	fprintf(f, "\tAC2: not requested (ARQC)\n");
+		if ((tlv->value[1] & 0x30) == 0x30)	fprintf(f, "\tAC2: RFU\n");
+	}
+	if (tlv->len >= 3 && (tlv->value[2] >> 4)) {
+		PRINT_INDENT(level);
+		fprintf(f, "\tPIN try: %x\n", tlv->value[2] >> 4);
+	}
+	if (tlv->len >= 4 && (tlv->value[3] & 0x0F)) {
+		PRINT_INDENT(level);
+		fprintf(f, "\tIssuer discretionary bits: %x\n", tlv->value[3] & 0x0F);
+	}
+	if (tlv->len >= 5 && (tlv->value[4] >> 4)) {
+		PRINT_INDENT(level);
+		fprintf(f, "\tSuccessfully processed issuer script commands: %x\n", tlv->value[4] >> 4);
+	}
+	
+	// mask 0F 0F F0 0F
+	uint8_t data[20] = {0};
+	memcpy(data, &tlv->value[1], tlv->len - 1);
+	data[0] &= 0x0F;
+	data[1] &= 0x0F;
+	data[2] &= 0xF0;
+	data[3] &= 0x0F;
+	const struct tlv bit_tlv = {
+		.tag = tlv->tag,
+		.len = tlv->len - 1,
+		.value = data,
+	};
+	const struct emv_tag bit_tag = {
+		.tag = tag->tag,
+		.name = tag->name,
+		.type = EMV_TAG_BITMASK,
+		.data = EMV_CVR,
+	};
+	
+	if (data[0] || data[1] || data[2] || data[3])
+		emv_tag_dump_bitmask(&bit_tlv, &bit_tag, f, level);
+	
+	return;
+}
+
 static void emv_tag_dump_cvm_list(const struct tlv *tlv, const struct emv_tag *tag, FILE *f, int level)
 {
 	uint32_t X, Y;
@@ -528,6 +624,10 @@ bool emv_tag_dump(const struct tlv *tlv, FILE *f, int level)
 	case EMV_TAG_YYMMDD:
 		emv_tag_dump_yymmdd(tlv, tag, f, level);
 		break;
+	case EMV_TAG_CVR:
+		fprintf(f, "\n");
+		emv_tag_dump_cvr(tlv, tag, f, level);
+		break;
 	};
 
 	return true;
diff --git a/client/emv/emvcore.c b/client/emv/emvcore.c
index 5c737b05..825e9bf9 100644
--- a/client/emv/emvcore.c
+++ b/client/emv/emvcore.c
@@ -12,75 +12,96 @@
 
 // Got from here. Thanks)
 // https://eftlab.co.uk/index.php/site-map/knowledge-base/211-emv-aid-rid-pix
-const char *PSElist [] = { 
+static const char *PSElist [] = { 
 	"325041592E5359532E4444463031", // 2PAY.SYS.DDF01 - Visa Proximity Payment System Environment - PPSE
 	"315041592E5359532E4444463031"  // 1PAY.SYS.DDF01 - Visa Payment System Environment - PSE
 };
-const size_t PSElistLen = sizeof(PSElist)/sizeof(char*);
+static const size_t PSElistLen = sizeof(PSElist)/sizeof(char*);
 
-const char *AIDlist [] = { 
+typedef struct {
+	enum CardPSVendor vendor;
+	const char* aid;
+} TAIDList;
+
+static const TAIDList AIDlist [] = { 
 	// Visa International
-	"A00000000305076010",	// VISA ELO Credit	
-	"A0000000031010",		// VISA Debit/Credit (Classic)	
-	"A0000000031010",		// ddddddddddddddddddddddddddddddddddddddddddddddddddddddddd	
-	"A000000003101001",		// VISA Credit	
-	"A000000003101002",		// VISA Debit	
-	"A0000000032010",		// VISA Electron
-	"A0000000032020",		// VISA	
-	"A0000000033010",		// VISA Interlink	
-	"A0000000034010",		// VISA Specific	
-	"A0000000035010",		// VISA Specific	
-	"A0000000036010",		// Domestic Visa Cash Stored Value	
-	"A0000000036020",		// International Visa Cash Stored Value	
-	"A0000000038002",		// VISA Auth, VisaRemAuthen EMV-CAP (DPA)	
-	"A0000000038010",		// VISA Plus	
-	"A0000000039010",		// VISA Loyalty	
-	"A000000003999910",		// VISA Proprietary ATM	
+	{ CV_VISA, 	"A00000000305076010"},			// VISA ELO Credit	
+	{ CV_VISA, 	"A0000000031010" },				// VISA Debit/Credit (Classic)	
+	{ CV_VISA, 	"A000000003101001" },			// VISA Credit	
+	{ CV_VISA, 	"A000000003101002" },			// VISA Debit	
+	{ CV_VISA, 	"A0000000032010" },				// VISA Electron
+	{ CV_VISA, 	"A0000000032020" },				// VISA	
+	{ CV_VISA, 	"A0000000033010" },				// VISA Interlink	
+	{ CV_VISA, 	"A0000000034010" },				// VISA Specific	
+	{ CV_VISA, 	"A0000000035010" },				// VISA Specific	
+	{ CV_VISA, 	"A0000000036010" },				// Domestic Visa Cash Stored Value	
+	{ CV_VISA, 	"A0000000036020" },				// International Visa Cash Stored Value	
+	{ CV_VISA, 	"A0000000038002" },				// VISA Auth, VisaRemAuthen EMV-CAP (DPA)	
+	{ CV_VISA, 	"A0000000038010" },				// VISA Plus	
+	{ CV_VISA, 	"A0000000039010" },				// VISA Loyalty	
+	{ CV_VISA, 	"A000000003999910" },			// VISA Proprietary ATM	
 	// Visa USA
-	"A000000098",			// Debit Card
-	"A0000000980848",		// Debit Card
+	{ CV_VISA, 	"A000000098" },					// Debit Card
+	{ CV_VISA, 	"A0000000980848" },				// Debit Card
 	// Mastercard International
-	"A00000000401",			// MasterCard PayPass	
-	"A0000000041010",		// MasterCard Credit
-	"A00000000410101213",	// MasterCard Credit
-	"A00000000410101215",	// MasterCard Credit
-	"A0000000042010",		// MasterCard Specific
-	"A0000000043010",		// MasterCard Specific
-	"A0000000043060",		// Maestro (Debit)
-	"A000000004306001",		// Maestro (Debit)
-	"A0000000044010",		// MasterCard Specific
-	"A0000000045010",		// MasterCard Specific
-	"A0000000046000",		// Cirrus
-	"A0000000048002",		// SecureCode Auth EMV-CAP
-	"A0000000049999",		// MasterCard PayPass	
+	{ CV_MASTERCARD, "A00000000401" },			// MasterCard PayPass	
+	{ CV_MASTERCARD, "A0000000041010" },		// MasterCard Credit
+	{ CV_MASTERCARD, "A00000000410101213" },	// MasterCard Credit
+	{ CV_MASTERCARD, "A00000000410101215" },	// MasterCard Credit
+	{ CV_MASTERCARD, "A0000000042010" },		// MasterCard Specific
+	{ CV_MASTERCARD, "A0000000043010" },		// MasterCard Specific
+	{ CV_MASTERCARD, "A0000000043060" },		// Maestro (Debit)
+	{ CV_MASTERCARD, "A000000004306001" },		// Maestro (Debit)
+	{ CV_MASTERCARD, "A0000000044010" },		// MasterCard Specific
+	{ CV_MASTERCARD, "A0000000045010" },		// MasterCard Specific
+	{ CV_MASTERCARD, "A0000000046000" },		// Cirrus
+	{ CV_MASTERCARD, "A0000000048002" },		// SecureCode Auth EMV-CAP
+	{ CV_MASTERCARD, "A0000000049999" },		// MasterCard PayPass	
 	// American Express
-	"A000000025",
-	"A0000000250000",
-	"A00000002501",
-	"A000000025010402",
-	"A000000025010701",
-	"A000000025010801",
+	{ CV_AMERICANEXPRESS, "A000000025" },
+	{ CV_AMERICANEXPRESS, "A0000000250000" },
+	{ CV_AMERICANEXPRESS, "A00000002501" },
+	{ CV_AMERICANEXPRESS, "A000000025010402" },
+	{ CV_AMERICANEXPRESS, "A000000025010701" },
+	{ CV_AMERICANEXPRESS, "A000000025010801" },
 	// Groupement des Cartes Bancaires "CB"
-	"A0000000421010",		// Cartes Bancaire EMV Card	
-	"A0000000422010",		
-	"A0000000423010",		
-	"A0000000424010",		
-	"A0000000425010",		
+	{ CV_CB, "A0000000421010" },				// Cartes Bancaire EMV Card	
+	{ CV_CB, "A0000000422010" },		
+	{ CV_CB, "A0000000423010" },		
+	{ CV_CB, "A0000000424010" },		
+	{ CV_CB, "A0000000425010" },		
 	// JCB CO., LTD.
-	"A00000006510",			// JCB	
-	"A0000000651010",		// JCB J Smart Credit	
-	"A0000001544442",		// Banricompras Debito - Banrisul - Banco do Estado do Rio Grande do SUL - S.A.
-	"F0000000030001",		// BRADESCO
-	"A0000005241010",		// RuPay - RuPay
-	"D5780000021010"		// Bankaxept - Bankaxept	
+	{ CV_JCB, "A00000006510" },					// JCB	
+	{ CV_JCB, "A0000000651010" },				// JCB J Smart Credit	
+	// Other
+	{ CV_OTHER, "A0000001544442" },				// Banricompras Debito - Banrisul - Banco do Estado do Rio Grande do SUL - S.A.
+	{ CV_OTHER, "F0000000030001" },				// BRADESCO
+	{ CV_OTHER, "A0000005241010" },				// RuPay - RuPay
+	{ CV_OTHER, "D5780000021010" }				// Bankaxept - Bankaxept
 };
-const size_t AIDlistLen = sizeof(AIDlist)/sizeof(char*);
+static const size_t AIDlistLen = sizeof(AIDlist)/sizeof(TAIDList);
 
 static bool APDULogging = false;
 void SetAPDULogging(bool logging) {
 	APDULogging = logging;
 }
 
+enum CardPSVendor GetCardPSVendor(uint8_t * AID, size_t AIDlen) {
+	char buf[100] = {0};
+	if (AIDlen < 1)
+		return CV_NA;
+
+	hex_to_buffer((uint8_t *)buf, AID, AIDlen, sizeof(buf) - 1, 0, 0, true);
+
+	for(int i = 0; i < AIDlistLen; i ++) {
+		if (strncmp(AIDlist[i].aid, buf, strlen(AIDlist[i].aid)) == 0){
+			return AIDlist[i].vendor;
+		}
+	}	
+	
+	return CV_NA;
+}
+
 static bool print_cb(void *data, const struct tlv *tlv, int level, bool is_leaf) {
 	emv_tag_dump(tlv, stdout, level);
 	if (is_leaf) {
@@ -103,11 +124,15 @@ void TLVPrintFromBuffer(uint8_t *data, int datalen) {
 	}
 }
 
-void TLVPrintFromTLV(struct tlvdb *tlv) {
+void TLVPrintFromTLVLev(struct tlvdb *tlv, int level) {
 	if (!tlv) 
 		return;
 	
-	tlvdb_visit(tlv, print_cb, NULL, 0);
+	tlvdb_visit(tlv, print_cb, NULL, level);
+}
+
+void TLVPrintFromTLV(struct tlvdb *tlv) {
+	TLVPrintFromTLVLev(tlv, 0);
 }
 
 void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv) {
@@ -136,28 +161,86 @@ void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv) {
 	PrintAndLog("|------------------|--------|-------------------------|");
 }
 
+struct tlvdb *GetPANFromTrack2(const struct tlv *track2) {
+	char track2Hex[200] = {0};
+	uint8_t PAN[100] = {0};
+	int PANlen = 0;
+	char *tmp = track2Hex;
 
-int EMVSelect(bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+	if (!track2)
+		return NULL;
+
+	for (int i = 0; i < track2->len; ++i, tmp += 2)
+		sprintf(tmp, "%02x", (unsigned int)track2->value[i]);
+	
+	int posD = strchr(track2Hex, 'd') - track2Hex;
+	if (posD < 1)
+		return NULL;
+	
+	track2Hex[posD] = 0;
+	if (strlen(track2Hex) % 2) {
+		track2Hex[posD] = 'F';
+		track2Hex[posD + 1] = '\0';
+	}
+	
+	param_gethex_to_eol(track2Hex, 0, PAN, sizeof(PAN), &PANlen);
+	
+  return tlvdb_fixed(0x5a, PANlen, PAN);
+}
+
+struct tlvdb *GetdCVVRawFromTrack2(const struct tlv *track2) {
+	char track2Hex[200] = {0};
+	char dCVVHex[100] = {0};
+	uint8_t dCVV[100] = {0};
+	int dCVVlen = 0;
+	const int PINlen = 5; // must calculated from 9F67 MSD Offset but i have not seen this tag)
+	char *tmp = track2Hex;
+	
+	if (!track2)
+		return NULL;
+	
+	for (int i = 0; i < track2->len; ++i, tmp += 2)
+		sprintf(tmp, "%02x", (unsigned int)track2->value[i]);
+	
+	int posD = strchr(track2Hex, 'd') - track2Hex;
+	if (posD < 1)
+		return NULL;
+
+	memset(dCVVHex, '0', 32);
+	// ATC
+	memcpy(dCVVHex + 0, track2Hex + posD + PINlen + 11, 4);
+	// PAN 5 hex
+	memcpy(dCVVHex + 4, track2Hex, 5);
+	// expire date
+	memcpy(dCVVHex + 9, track2Hex + posD + 1, 4);
+	// service code
+	memcpy(dCVVHex + 13, track2Hex + posD + 5, 3);
+	
+	param_gethex_to_eol(dCVVHex, 0, dCVV, sizeof(dCVV), &dCVVlen);
+	
+  return tlvdb_fixed(0x02, dCVVlen, dCVV);
+}
+
+int EMVExchangeEx(bool ActivateField, bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
 	uint8_t data[APDU_RES_LEN] = {0};
+
 	*ResultLen = 0;
 	if (sw)	*sw = 0;
 	uint16_t isw = 0;
 	
-	// select APDU
-	data[0] = 0x00;
-	data[1] = 0xA4;
-	data[2] = 0x04;
-	data[3] = 0x00;
-	data[4] = AIDLen;
-	memcpy(&data[5], AID, AIDLen);
-	
 	if (ActivateField)
 		DropField();
 	
+	// COMPUTE APDU
+	memcpy(data, &apdu, 5);
+	if (apdu.data)
+		memcpy(&data[5], apdu.data, apdu.Lc);
+	
 	if (APDULogging)
-		PrintAndLog(">>>> %s", sprint_hex(data, AIDLen + 6));
+		PrintAndLog(">>>> %s", sprint_hex(data, 6 + apdu.Lc));
 
-	int res = ExchangeAPDU14a(data, AIDLen + 6, ActivateField, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
+	// 6 byes + data = INS + CLA + P1 + P2 + Lc + <data = Nc> + Le
+	int res = ExchangeAPDU14a(data, 6 + apdu.Lc, ActivateField, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
 	
 	if (APDULogging)
 		PrintAndLog("<<<< %s", sprint_hex(Result, *ResultLen));
@@ -165,12 +248,7 @@ int EMVSelect(bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen
 	if (res) {
 		return res;
 	}
-	
-	if (*ResultLen < 2) {
-		PrintAndLog("SELECT ERROR: returned %d bytes", *ResultLen);
-		return 5;
-	}
-	
+
 	*ResultLen -= 2;
 	isw = Result[*ResultLen] * 0x0100 + Result[*ResultLen + 1];
 	if (sw)
@@ -178,7 +256,7 @@ int EMVSelect(bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen
 
 	if (isw != 0x9000) {
 		if (APDULogging)
-			PrintAndLog("SELECT ERROR: [%4X] %s", isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
+			PrintAndLog("APDU(%02x%02x) ERROR: [%4X] %s", apdu.CLA, apdu.INS, isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
 		return 5;
 	}
 
@@ -191,6 +269,14 @@ int EMVSelect(bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen
 	return 0;
 }
 
+int EMVExchange(bool LeaveFieldON, sAPDU apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+	return EMVExchangeEx(false, LeaveFieldON, apdu, Result, MaxResultLen, ResultLen, sw, tlv);
+}
+
+int EMVSelect(bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+	return EMVExchangeEx(ActivateField, LeaveFieldON, (sAPDU){0x00, 0xa4, 0x04, 0x00, AIDLen, AID}, Result, MaxResultLen, ResultLen, sw, tlv);
+}
+
 int EMVSelectPSE(bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw) {
 	uint8_t buf[APDU_AID_LEN] = {0};
 	*ResultLen = 0;
@@ -291,7 +377,7 @@ int EMVSearch(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvd
 	int res = 0;
 	int retrycnt = 0;
 	for(int i = 0; i < AIDlistLen; i ++) {
-		param_gethex_to_eol(AIDlist[i], 0, aidbuf, sizeof(aidbuf), &aidlen);
+		param_gethex_to_eol(AIDlist[i].aid, 0, aidbuf, sizeof(aidbuf), &aidlen);
 		res = EMVSelect((i == 0) ? ActivateField : false, (i == AIDlistLen - 1) ? LeaveFieldON : true, aidbuf, aidlen, data, sizeof(data), &datalen, &sw, tlv);
 		// retry if error and not returned sw error
 		if (res && res != 5) {
@@ -305,7 +391,7 @@ int EMVSearch(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvd
 				}
 				
 				retrycnt = 0;
-				PrintAndLog("Retry failed [%s]. Skiped...", AIDlist[i]);
+				PrintAndLog("Retry failed [%s]. Skiped...", AIDlist[i].aid);
 			}
 			continue;
 		}
@@ -315,7 +401,7 @@ int EMVSearch(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvd
 			continue;
 		
 		if (decodeTLV){
-			PrintAndLog("%s:", AIDlist[i]);
+			PrintAndLog("%s:", AIDlist[i].aid);
 			TLVPrintFromBuffer(data, datalen);
 		}
 	}
@@ -324,7 +410,7 @@ int EMVSearch(bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvd
 }
 
 int EMVSelectApplication(struct tlvdb *tlv, uint8_t *AID, size_t *AIDlen) {
-	// needs to check priority. 0x00 - highest
+	// check priority. 0x00 - highest
 	int prio = 0xffff;
 	
 	*AIDlen = 0;
@@ -363,101 +449,21 @@ int EMVSelectApplication(struct tlvdb *tlv, uint8_t *AID, size_t *AIDlen) {
 }
 
 int EMVGPO(bool LeaveFieldON, uint8_t *PDOL, size_t PDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-	uint8_t data[APDU_RES_LEN] = {0};
-	*ResultLen = 0;
-	if (sw)	*sw = 0;
-	uint16_t isw = 0;
-	
-	// GPO APDU
-	data[0] = 0x80;
-	data[1] = 0xA8;
-	data[2] = 0x00;
-	data[3] = 0x00;
-	data[4] = PDOLLen;
-	if (PDOL)
-		memcpy(&data[5], PDOL, PDOLLen);
-	
-	
-	if (APDULogging)
-		PrintAndLog(">>>> %s", sprint_hex(data, PDOLLen + 5));
-
-	int res = ExchangeAPDU14a(data, PDOLLen + 5, false, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
-	
-	if (APDULogging)
-		PrintAndLog("<<<< %s", sprint_hex(Result, *ResultLen));
-	
-	if (res) {
-		return res;
-	}
-	
-	if (*ResultLen < 2) {
-		PrintAndLog("GPO ERROR: returned %d bytes", *ResultLen);
-		return 5;
-	}
-	
-	*ResultLen -= 2;
-	isw = Result[*ResultLen] * 0x0100 + Result[*ResultLen + 1];
-	if (sw)
-		*sw = isw;
-
-	if (isw != 0x9000) {
-		if (APDULogging)
-			PrintAndLog("GPO ERROR: [%4X] %s", isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
-		return 5;
-	}
-
-	// add to tlv tree
-	if (tlv) {
-		struct tlvdb *t = tlvdb_parse_multi(Result, *ResultLen);
-		tlvdb_add(tlv, t);
-	}
-	
-	return 0;
+	return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
 }
 
 int EMVReadRecord(bool LeaveFieldON, uint8_t SFI, uint8_t SFIrec, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-	uint8_t data[10] = {0};
-	*ResultLen = 0;
-	if (sw)	*sw = 0;
-	uint16_t isw = 0;
-	
-	// read record APDU
-	data[0] = 0x00;
-	data[1] = 0xb2;
-	data[2] = SFIrec;
-	data[3] = (SFI << 3) | 0x04;
-	data[4] = 0;
-	
-	if (APDULogging)
-		PrintAndLog(">>>> %s", sprint_hex(data, 5));
-
-	int res = ExchangeAPDU14a(data, 5, false, LeaveFieldON, Result, (int)MaxResultLen, (int *)ResultLen);
-	
-	if (APDULogging)
-		PrintAndLog("<<<< %s", sprint_hex(Result, *ResultLen));
-	
-	if (res) {
-		return res;
-	}
-
-	*ResultLen -= 2;
-	isw = Result[*ResultLen] * 0x0100 + Result[*ResultLen + 1];
-	if (sw)
-		*sw = isw;
-
-	if (isw != 0x9000) {
-		if (APDULogging)
-			PrintAndLog("Read record ERROR: [%4X] %s", isw, GetAPDUCodeDescription(*sw >> 8, *sw & 0xff));
-		return 5;
-	}
+	return EMVExchange(LeaveFieldON, (sAPDU){0x00, 0xb2, SFIrec, (SFI << 3) | 0x04, 0, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);
+}
 
-	// add to tlv tree
-	if (tlv) {
-		struct tlvdb *t = tlvdb_parse_multi(Result, *ResultLen);
-		tlvdb_add(tlv, t);
-	}
-	
-	return 0;
+int EMVAC(bool LeaveFieldON, uint8_t RefControl, uint8_t *CDOL, size_t CDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+	return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0xae, RefControl, 0x00, CDOLLen, CDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
 }
 
+int EMVGenerateChallenge(bool LeaveFieldON, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+	return EMVExchange(LeaveFieldON, (sAPDU){0x00, 0x84, 0x00, 0x00, 0x00, NULL}, Result, MaxResultLen, ResultLen, sw, tlv);
+}
 
+int MSCComputeCryptoChecksum(bool LeaveFieldON, uint8_t *UDOL, uint8_t UDOLlen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
+	return EMVExchange(LeaveFieldON, (sAPDU){0x80, 0x2a, 0x8e, 0x80, UDOLlen, UDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
+}
diff --git a/client/emv/emvcore.h b/client/emv/emvcore.h
index fdd3ab86..03d5c956 100644
--- a/client/emv/emvcore.h
+++ b/client/emv/emvcore.h
@@ -29,10 +29,34 @@
 #define APDU_RES_LEN 260
 #define APDU_AID_LEN 50
 
+typedef struct {
+	uint8_t CLA;
+	uint8_t INS;
+	uint8_t P1;
+	uint8_t P2;
+	uint8_t Lc;
+	uint8_t *data;
+} sAPDU;
+
+enum CardPSVendor {
+	CV_NA,
+	CV_VISA,
+	CV_MASTERCARD,
+	CV_AMERICANEXPRESS,
+	CV_JCB,
+	CV_CB,
+	CV_OTHER,
+};
+extern enum CardPSVendor GetCardPSVendor(uint8_t * AID, size_t AIDlen);
+
 extern void TLVPrintFromBuffer(uint8_t *data, int datalen);
 extern void TLVPrintFromTLV(struct tlvdb *tlv);
+extern void TLVPrintFromTLVLev(struct tlvdb *tlv, int level);
 extern void TLVPrintAIDlistFromSelectTLV(struct tlvdb *tlv);
 
+extern struct tlvdb *GetPANFromTrack2(const struct tlv *track2);
+extern struct tlvdb *GetdCVVRawFromTrack2(const struct tlv *track2);
+
 extern void SetAPDULogging(bool logging);
 
 // search application
@@ -45,6 +69,8 @@ extern int EMVSelectApplication(struct tlvdb *tlv, uint8_t *AID, size_t *AIDlen)
 // Get Processing Options
 extern int EMVGPO(bool LeaveFieldON, uint8_t *PDOL, size_t PDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv);
 extern int EMVReadRecord(bool LeaveFieldON, uint8_t SFI, uint8_t SFIrec, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv);
+// Mastercard
+int MSCComputeCryptoChecksum(bool LeaveFieldON, uint8_t *UDOL, uint8_t UDOLlen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv);
 
 #endif
 
diff --git a/client/util.c b/client/util.c
index 92b0e7a6..b7f07bde 100644
--- a/client/util.c
+++ b/client/util.c
@@ -111,6 +111,31 @@ void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount)
 	sprintf(fnameptr, "%s", ext); 
 }
 
+void hex_to_buffer(const uint8_t *buf, const uint8_t *hex_data, const size_t hex_len, const size_t hex_max_len, 
+	const size_t min_str_len, const size_t spaces_between, bool uppercase) {
+		
+	char *tmp = (char *)buf;
+	size_t i;
+
+	int maxLen = ( hex_len > hex_max_len) ? hex_max_len : hex_len;
+
+	for (i = 0; i < maxLen; ++i, tmp += 2 + spaces_between) {
+		sprintf(tmp, (uppercase) ? "%02X" : "%02x", (unsigned int) hex_data[i]); 
+		
+		for (int j = 0; j < spaces_between; j++)
+			sprintf(tmp + 2 + j, " ");
+	}
+	
+	i *= (2 + spaces_between);
+	int minStrLen = min_str_len > i ? min_str_len : 0;
+	if (minStrLen > hex_max_len)
+		minStrLen = hex_max_len;
+	for(; i < minStrLen; i++, tmp += 1) 
+		sprintf(tmp, " ");
+
+	return;
+}
+
 // printing and converting functions
 
 void print_hex(const uint8_t * data, const size_t len)
@@ -141,33 +166,17 @@ void print_hex_break(const uint8_t *data, const size_t len, uint8_t breaks) {
 }
 
 char *sprint_hex(const uint8_t *data, const size_t len) {
+	static char buf[1025] = {0};
 	
-	int maxLen = ( len > 1024/3) ? 1024/3 : len;
-	static char buf[1024];
-	memset(buf, 0x00, 1024);
-	char *tmp = buf;
-	size_t i;
-
-	for (i=0; i < maxLen; ++i, tmp += 3)
-		sprintf(tmp, "%02x ", (unsigned int) data[i]);
+	hex_to_buffer((uint8_t *)buf, data, len, sizeof(buf) - 1, 0, 1, false);
 
 	return buf;
 }
 
 char *sprint_hex_inrow_ex(const uint8_t *data, const size_t len, const size_t min_str_len) {
-	
-	int maxLen = ( len > 1024/2) ? 1024/2 : len;
-	static char buf[1024] = {0};
-	char *tmp = buf;
-	size_t i;
+	static char buf[1025] = {0};
 
-	for (i = 0; i < maxLen; ++i, tmp += 2)
-		sprintf(tmp, "%02x", (unsigned int) data[i]);
-	
-	i *= 2;
-	int minStrLen = min_str_len > i ? min_str_len : 0;
-	for(; i < minStrLen; i++, tmp += 1) 
-		sprintf(tmp, " ");
+	hex_to_buffer((uint8_t *)buf, data, len, sizeof(buf) - 1, min_str_len, 0, false);
 
 	return buf;
 }
diff --git a/client/util.h b/client/util.h
index e9c48b03..fd7ceaff 100644
--- a/client/util.h
+++ b/client/util.h
@@ -12,6 +12,7 @@
 #define UTIL_H__
 
 #include <stdint.h>
+#include <stdbool.h>
 #include <stddef.h>
 
 #ifndef ROTR
@@ -35,6 +36,9 @@ extern void AddLogUint64(char *fileName, char *extData, const uint64_t data);
 extern void AddLogCurrentDT(char *fileName);
 extern void FillFileNameByUID(char *fileName, uint8_t * uid, char *ext, int byteCount);
 
+extern void hex_to_buffer(const uint8_t *buf, const uint8_t *hex_data, const size_t hex_len, 
+	const size_t hex_max_len, const size_t min_str_len, const size_t spaces_between, bool uppercase);
+
 extern void print_hex(const uint8_t * data, const size_t len);
 extern char *sprint_hex(const uint8_t * data, const size_t len);
 extern char *sprint_hex_inrow(const uint8_t *data, const size_t len);