]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/mifarecmd.c
projects / proxmark3-svn / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Removed dependency on openssl, added AES implementation from polarssl instead
[proxmark3-svn] / armsrc / mifarecmd.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------\r
2// Merlok - June 2011, 2012\r
3// Gerhard de Koning Gans - May 2008\r
4// Hagen Fritsch - June 2010\r
5// Midnitesnake - Dec 2013\r
6// Andy Davies - Apr 2014\r
7// Iceman - May 2014\r
8//\r
9// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
10// at your option, any later version. See the LICENSE.txt file for the text of\r
11// the license.\r
12//-----------------------------------------------------------------------------\r
13// Routines to support ISO 14443 type A.\r
14//-----------------------------------------------------------------------------\r
15\r
16#include "mifarecmd.h"\r
17#include "apps.h"\r
18#include "util.h"\r
19\r
20//-----------------------------------------------------------------------------\r
21// Select, Authenticate, Read a MIFARE tag. \r
22// read block\r
23//-----------------------------------------------------------------------------\r
24void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
25{\r
26 // params\r
27 uint8_t blockNo = arg0;\r
28 uint8_t keyType = arg1;\r
29 uint64_t ui64Key = 0;\r
30 ui64Key = bytes_to_num(datain, 6);\r
31 \r
32 // variables\r
33 byte_t isOK = 0;\r
34 byte_t dataoutbuf[16];\r
35 uint8_t uid[10];\r
36 uint32_t cuid;\r
37 struct Crypto1State mpcs = {0, 0};\r
38 struct Crypto1State *pcs;\r
39 pcs = &mpcs;\r
40\r
41 // clear trace\r
42 iso14a_clear_trace();\r
43 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
44\r
45 LED_A_ON();\r
46 LED_B_OFF();\r
47 LED_C_OFF();\r
48\r
49 while (true) {\r
50 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
51 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
52 break;\r
53 };\r
54\r
55 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
56 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
57 break;\r
58 };\r
59 \r
60 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r
61 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r
62 break;\r
63 };\r
64\r
65 if(mifare_classic_halt(pcs, cuid)) {\r
66 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
67 break;\r
68 };\r
69 \r
70 isOK = 1;\r
71 break;\r
72 }\r
73 \r
74 // ----------------------------- crypto1 destroy\r
75 crypto1_destroy(pcs);\r
76 \r
77 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r
78\r
79 LED_B_ON();\r
80 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r
81 LED_B_OFF();\r
82\r
83 // Thats it...\r
84 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
85 LEDsoff();\r
86}\r
87\r
88void MifareUReadBlock(uint8_t arg0,uint8_t *datain)\r
89{\r
90 uint8_t blockNo = arg0;\r
91 byte_t dataout[16] = {0x00};\r
92 uint8_t uid[10] = {0x00};\r
93 uint32_t cuid;\r
94 \r
95 LED_A_ON();\r
96 LED_B_OFF();\r
97 LED_C_OFF();\r
98 \r
99 iso14a_clear_trace();\r
100 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
101 \r
102 int len = iso14443a_select_card(uid, NULL, &cuid);\r
103 if(!len) {\r
104 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
105 //OnError(1);\r
106 return;\r
107 };\r
108 \r
109 len = mifare_ultra_readblock(cuid, blockNo, dataout);\r
110 if(len) {\r
111 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r
112 //OnError(2);\r
113 return;\r
114 };\r
115 \r
116 len = mifare_ultra_halt(cuid);\r
117 if(len) {\r
118 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
119 //OnError(3);\r
120 return;\r
121 };\r
122 \r
123 cmd_send(CMD_ACK,1,0,0,dataout,16);\r
124 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
125 LEDsoff();\r
126}\r
127\r
128//-----------------------------------------------------------------------------\r
129// Select, Authenticate, Read a MIFARE tag. \r
130// read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r
131//-----------------------------------------------------------------------------\r
132void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
133{\r
134 // params\r
135 uint8_t sectorNo = arg0;\r
136 uint8_t keyType = arg1;\r
137 uint64_t ui64Key = 0;\r
138 ui64Key = bytes_to_num(datain, 6);\r
139 \r
140 // variables\r
141 byte_t isOK = 0;\r
142 byte_t dataoutbuf[16 * 16];\r
143 uint8_t uid[10];\r
144 uint32_t cuid;\r
145 struct Crypto1State mpcs = {0, 0};\r
146 struct Crypto1State *pcs;\r
147 pcs = &mpcs;\r
148\r
149 // clear trace\r
150 iso14a_clear_trace();\r
151\r
152 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
153\r
154 LED_A_ON();\r
155 LED_B_OFF();\r
156 LED_C_OFF();\r
157\r
158 isOK = 1;\r
159 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
160 isOK = 0;\r
161 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
162 }\r
163\r
164 \r
165 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
166 isOK = 0;\r
167 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
168 }\r
169 \r
170 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
171 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r
172 isOK = 0;\r
173 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r
174 break;\r
175 }\r
176 }\r
177 \r
178 if(mifare_classic_halt(pcs, cuid)) {\r
179 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
180 }\r
181\r
182 // ----------------------------- crypto1 destroy\r
183 crypto1_destroy(pcs);\r
184 \r
185 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r
186\r
187 LED_B_ON();\r
188 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r
189 LED_B_OFF();\r
190\r
191 // Thats it...\r
192 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
193 LEDsoff();\r
194}\r
195\r
196void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)\r
197{\r
198 // params\r
199 uint8_t sectorNo = arg0;\r
200 int Pages = arg1;\r
201 int count_Pages = 0;\r
202 byte_t dataout[176] = {0x00};;\r
203 uint8_t uid[10] = {0x00};\r
204 uint32_t cuid;\r
205\r
206 LED_A_ON();\r
207 LED_B_OFF();\r
208 LED_C_OFF();\r
209\r
210 if (MF_DBGLEVEL >= MF_DBG_ALL) \r
211 Dbprintf("Pages %d",Pages);\r
212 \r
213 iso14a_clear_trace();\r
214 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
215\r
216 int len = iso14443a_select_card(uid, NULL, &cuid);\r
217 \r
218 if (!len) {\r
219 if (MF_DBGLEVEL >= MF_DBG_ERROR)\r
220 Dbprintf("Can't select card");\r
221 //OnError(1);\r
222 return;\r
223 }\r
224 \r
225 for (int i = 0; i < Pages; i++){\r
226 \r
227 len = mifare_ultra_readblock(cuid, sectorNo * 4 + i, dataout + 4 * i);\r
228 \r
229 if (len) {\r
230 if (MF_DBGLEVEL >= MF_DBG_ERROR)\r
231 Dbprintf("Read block %d error",i);\r
232 //OnError(2);\r
233 return;\r
234 } else {\r
235 count_Pages++;\r
236 }\r
237 }\r
238 \r
239 len = mifare_ultra_halt(cuid);\r
240 if (len) {\r
241 if (MF_DBGLEVEL >= MF_DBG_ERROR)\r
242 Dbprintf("Halt error");\r
243 //OnError(3);\r
244 return;\r
245 }\r
246 \r
247 if (MF_DBGLEVEL >= MF_DBG_ALL) {\r
248 Dbprintf("Pages read %d", count_Pages);\r
249 }\r
250\r
251 len = 16*4; //64 bytes\r
252 \r
253 // Read a UL-C\r
254 if (Pages == 44 && count_Pages > 16) \r
255 len = 176;\r
256\r
257 cmd_send(CMD_ACK, 1, 0, 0, dataout, len); \r
258 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
259 LEDsoff();\r
260}\r
261\r
262\r
263//-----------------------------------------------------------------------------\r
264// Select, Authenticate, Write a MIFARE tag. \r
265// read block\r
266//-----------------------------------------------------------------------------\r
267void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
268{\r
269 // params\r
270 uint8_t blockNo = arg0;\r
271 uint8_t keyType = arg1;\r
272 uint64_t ui64Key = 0;\r
273 byte_t blockdata[16];\r
274\r
275 ui64Key = bytes_to_num(datain, 6);\r
276 memcpy(blockdata, datain + 10, 16);\r
277 \r
278 // variables\r
279 byte_t isOK = 0;\r
280 uint8_t uid[10];\r
281 uint32_t cuid;\r
282 struct Crypto1State mpcs = {0, 0};\r
283 struct Crypto1State *pcs;\r
284 pcs = &mpcs;\r
285\r
286 // clear trace\r
287 iso14a_clear_trace();\r
288\r
289 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
290\r
291 LED_A_ON();\r
292 LED_B_OFF();\r
293 LED_C_OFF();\r
294\r
295 while (true) {\r
296 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
297 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
298 break;\r
299 };\r
300\r
301 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
302 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
303 break;\r
304 };\r
305 \r
306 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r
307 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
308 break;\r
309 };\r
310\r
311 if(mifare_classic_halt(pcs, cuid)) {\r
312 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
313 break;\r
314 };\r
315 \r
316 isOK = 1;\r
317 break;\r
318 }\r
319 \r
320 // ----------------------------- crypto1 destroy\r
321 crypto1_destroy(pcs);\r
322 \r
323 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
324\r
325 LED_B_ON();\r
326 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
327 LED_B_OFF();\r
328\r
329\r
330 // Thats it...\r
331 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
332 LEDsoff();\r
333}\r
334\r
335void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)\r
336{\r
337 // params\r
338 uint8_t blockNo = arg0;\r
339 byte_t blockdata[16] = {0x00};\r
340\r
341 memcpy(blockdata, datain,16);\r
342 \r
343 // variables\r
344 byte_t isOK = 0;\r
345 uint8_t uid[10] = {0x00};\r
346 uint32_t cuid;\r
347\r
348 iso14a_clear_trace();\r
349 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
350\r
351 LED_A_ON();\r
352 LED_B_OFF();\r
353 LED_C_OFF();\r
354\r
355 while (true) {\r
356 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
357 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
358 break;\r
359 };\r
360\r
361 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {\r
362 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
363 break;\r
364 };\r
365\r
366 if(mifare_ultra_halt(cuid)) {\r
367 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
368 break;\r
369 };\r
370 \r
371 isOK = 1;\r
372 break;\r
373 }\r
374 \r
375 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
376\r
377 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
378 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
379 LEDsoff();\r
380}\r
381\r
382void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)\r
383{\r
384 // params\r
385 uint8_t blockNo = arg0;\r
386 byte_t blockdata[4] = {0x00};\r
387 \r
388 memcpy(blockdata, datain,4);\r
389\r
390 // variables\r
391 byte_t isOK = 0;\r
392 uint8_t uid[10] = {0x00};\r
393 uint32_t cuid;\r
394\r
395 iso14a_clear_trace();\r
396 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
397\r
398 LED_A_ON();\r
399 LED_B_OFF();\r
400 LED_C_OFF();\r
401\r
402 while (true) {\r
403 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
404 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
405 break;\r
406 };\r
407\r
408 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {\r
409 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
410 break;\r
411 };\r
412\r
413 if(mifare_ultra_halt(cuid)) {\r
414 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
415 break;\r
416 };\r
417\r
418 isOK = 1;\r
419 break;\r
420 }\r
421\r
422 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
423\r
424 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
425 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
426 LEDsoff();\r
427}\r
428\r
429// Return 1 if the nonce is invalid else return 0\r
430int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r
431 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r
432 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r
433 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r
434}\r
435\r
436\r
437//-----------------------------------------------------------------------------\r
438// MIFARE nested authentication. \r
439// \r
440//-----------------------------------------------------------------------------\r
441void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r
442{\r
443 // params\r
444 uint8_t blockNo = arg0 & 0xff;\r
445 uint8_t keyType = (arg0 >> 8) & 0xff;\r
446 uint8_t targetBlockNo = arg1 & 0xff;\r
447 uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
448 uint64_t ui64Key = 0;\r
449\r
450 ui64Key = bytes_to_num(datain, 6);\r
451 \r
452 // variables\r
453 uint16_t rtr, i, j, len;\r
454 uint16_t davg;\r
455 static uint16_t dmin, dmax;\r
456 uint8_t uid[10];\r
457 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r
458 uint8_t par[1];\r
459 uint32_t target_nt[2], target_ks[2];\r
460 \r
461 uint8_t par_array[4];\r
462 uint16_t ncount = 0;\r
463 struct Crypto1State mpcs = {0, 0};\r
464 struct Crypto1State *pcs;\r
465 pcs = &mpcs;\r
466 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r
467\r
468 uint32_t auth1_time, auth2_time;\r
469 static uint16_t delta_time;\r
470\r
471 // clear trace\r
472 iso14a_clear_trace();\r
473 iso14a_set_tracing(false);\r
474 \r
475 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
476\r
477 LED_A_ON();\r
478 LED_C_OFF();\r
479\r
480\r
481 // statistics on nonce distance\r
482 if (calibrate) { // for first call only. Otherwise reuse previous calibration\r
483 LED_B_ON();\r
484 WDT_HIT();\r
485\r
486 davg = dmax = 0;\r
487 dmin = 2000;\r
488 delta_time = 0;\r
489 \r
490 for (rtr = 0; rtr < 17; rtr++) {\r
491\r
492 // prepare next select. No need to power down the card.\r
493 if(mifare_classic_halt(pcs, cuid)) {\r
494 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
495 rtr--;\r
496 continue;\r
497 }\r
498\r
499 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
500 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
501 rtr--;\r
502 continue;\r
503 };\r
504\r
505 auth1_time = 0;\r
506 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
507 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
508 rtr--;\r
509 continue;\r
510 };\r
511\r
512 if (delta_time) {\r
513 auth2_time = auth1_time + delta_time;\r
514 } else {\r
515 auth2_time = 0;\r
516 }\r
517 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r
518 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
519 rtr--;\r
520 continue;\r
521 };\r
522\r
523 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r
524 for (i = 101; i < 1200; i++) {\r
525 nttmp = prng_successor(nttmp, 1);\r
526 if (nttmp == nt2) break;\r
527 }\r
528\r
529 if (i != 1200) {\r
530 if (rtr != 0) {\r
531 davg += i;\r
532 dmin = MIN(dmin, i);\r
533 dmax = MAX(dmax, i);\r
534 }\r
535 else {\r
536 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r
537 }\r
538 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r
539 }\r
540 }\r
541 \r
542 if (rtr <= 1) return;\r
543\r
544 davg = (davg + (rtr - 1)/2) / (rtr - 1);\r
545 \r
546 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);\r
547\r
548 dmin = davg - 2;\r
549 dmax = davg + 2;\r
550 \r
551 LED_B_OFF();\r
552 \r
553 }\r
554// ------------------------------------------------------------------------------------------------- \r
555 \r
556 LED_C_ON();\r
557\r
558 // get crypted nonces for target sector\r
559 for(i=0; i < 2; i++) { // look for exactly two different nonces\r
560\r
561 target_nt[i] = 0;\r
562 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r
563 \r
564 // prepare next select. No need to power down the card.\r
565 if(mifare_classic_halt(pcs, cuid)) {\r
566 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
567 continue;\r
568 }\r
569\r
570 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
571 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
572 continue;\r
573 };\r
574 \r
575 auth1_time = 0;\r
576 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
577 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
578 continue;\r
579 };\r
580\r
581 // nested authentication\r
582 auth2_time = auth1_time + delta_time;\r
583 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r
584 if (len != 4) {\r
585 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r
586 continue;\r
587 };\r
588 \r
589 nt2 = bytes_to_num(receivedAnswer, 4); \r
590 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r
591 \r
592 // Parity validity check\r
593 for (j = 0; j < 4; j++) {\r
594 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r
595 }\r
596 \r
597 ncount = 0;\r
598 nttest = prng_successor(nt1, dmin - 1);\r
599 for (j = dmin; j < dmax + 1; j++) {\r
600 nttest = prng_successor(nttest, 1);\r
601 ks1 = nt2 ^ nttest;\r
602\r
603 if (valid_nonce(nttest, nt2, ks1, par_array)){\r
604 if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r
605 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r
606 target_nt[i] = 0;\r
607 break;\r
608 }\r
609 target_nt[i] = nttest;\r
610 target_ks[i] = ks1;\r
611 ncount++;\r
612 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r
613 target_nt[i] = 0;\r
614 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r
615 break;\r
616 }\r
617 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r
618 }\r
619 }\r
620 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r
621 }\r
622 }\r
623\r
624 LED_C_OFF();\r
625 \r
626 // ----------------------------- crypto1 destroy\r
627 crypto1_destroy(pcs);\r
628 \r
629 byte_t buf[4 + 4 * 4];\r
630 memcpy(buf, &cuid, 4);\r
631 memcpy(buf+4, &target_nt[0], 4);\r
632 memcpy(buf+8, &target_ks[0], 4);\r
633 memcpy(buf+12, &target_nt[1], 4);\r
634 memcpy(buf+16, &target_ks[1], 4);\r
635 \r
636 LED_B_ON();\r
637 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
638 LED_B_OFF();\r
639\r
640 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r
641\r
642 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
643 LEDsoff();\r
644 iso14a_set_tracing(TRUE);\r
645}\r
646\r
647//-----------------------------------------------------------------------------\r
648// MIFARE check keys. key count up to 85. \r
649// \r
650//-----------------------------------------------------------------------------\r
651void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
652{\r
653 // params\r
654 uint8_t blockNo = arg0;\r
655 uint8_t keyType = arg1;\r
656 uint8_t keyCount = arg2;\r
657 uint64_t ui64Key = 0;\r
658 \r
659 // variables\r
660 int i;\r
661 byte_t isOK = 0;\r
662 uint8_t uid[10];\r
663 uint32_t cuid;\r
664 struct Crypto1State mpcs = {0, 0};\r
665 struct Crypto1State *pcs;\r
666 pcs = &mpcs;\r
667 \r
668 // clear debug level\r
669 int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r
670 MF_DBGLEVEL = MF_DBG_NONE;\r
671 \r
672 // clear trace\r
673 iso14a_clear_trace();\r
674 iso14a_set_tracing(TRUE);\r
675\r
676 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
677\r
678 LED_A_ON();\r
679 LED_B_OFF();\r
680 LED_C_OFF();\r
681\r
682 for (i = 0; i < keyCount; i++) {\r
683 if(mifare_classic_halt(pcs, cuid)) {\r
684 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r
685 }\r
686\r
687 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
688 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r
689 break;\r
690 };\r
691\r
692 ui64Key = bytes_to_num(datain + i * 6, 6);\r
693 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
694 continue;\r
695 };\r
696 \r
697 isOK = 1;\r
698 break;\r
699 }\r
700 \r
701 // ----------------------------- crypto1 destroy\r
702 crypto1_destroy(pcs);\r
703 \r
704 LED_B_ON();\r
705 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r
706 LED_B_OFF();\r
707\r
708 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
709 LEDsoff();\r
710\r
711 // restore debug level\r
712 MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r
713}\r
714\r
715//-----------------------------------------------------------------------------\r
716// MIFARE commands set debug level\r
717// \r
718//-----------------------------------------------------------------------------\r
719void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
720 MF_DBGLEVEL = arg0;\r
721 Dbprintf("Debug level: %d", MF_DBGLEVEL);\r
722}\r
723\r
724//-----------------------------------------------------------------------------\r
725// Work with emulator memory\r
726// \r
727//-----------------------------------------------------------------------------\r
728void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
729 emlClearMem();\r
730}\r
731\r
732void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
733 emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r
734}\r
735\r
736void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
737 byte_t buf[USB_CMD_DATA_SIZE];\r
738 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r
739\r
740 LED_B_ON();\r
741 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r
742 LED_B_OFF();\r
743}\r
744\r
745//-----------------------------------------------------------------------------\r
746// Load a card into the emulator memory\r
747// \r
748//-----------------------------------------------------------------------------\r
749void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
750 uint8_t numSectors = arg0;\r
751 uint8_t keyType = arg1;\r
752 uint64_t ui64Key = 0;\r
753 uint32_t cuid;\r
754 struct Crypto1State mpcs = {0, 0};\r
755 struct Crypto1State *pcs;\r
756 pcs = &mpcs;\r
757\r
758 // variables\r
759 byte_t dataoutbuf[16];\r
760 byte_t dataoutbuf2[16];\r
761 uint8_t uid[10];\r
762\r
763 // clear trace\r
764 iso14a_clear_trace();\r
765 iso14a_set_tracing(false);\r
766 \r
767 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
768\r
769 LED_A_ON();\r
770 LED_B_OFF();\r
771 LED_C_OFF();\r
772 \r
773 bool isOK = true;\r
774\r
775 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
776 isOK = false;\r
777 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
778 }\r
779 \r
780 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
781 ui64Key = emlGetKey(sectorNo, keyType);\r
782 if (sectorNo == 0){\r
783 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
784 isOK = false;\r
785 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r
786 break;\r
787 }\r
788 } else {\r
789 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r
790 isOK = false;\r
791 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r
792 break;\r
793 }\r
794 }\r
795 \r
796 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
797 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r
798 isOK = false;\r
799 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r
800 break;\r
801 };\r
802 if (isOK) {\r
803 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r
804 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
805 } else { // sector trailer, keep the keys, set only the AC\r
806 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
807 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r
808 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
809 }\r
810 }\r
811 }\r
812\r
813 }\r
814\r
815 if(mifare_classic_halt(pcs, cuid)) {\r
816 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
817 };\r
818\r
819 // ----------------------------- crypto1 destroy\r
820 crypto1_destroy(pcs);\r
821\r
822 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
823 LEDsoff();\r
824 \r
825 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r
826\r
827}\r
828\r
829\r
830//-----------------------------------------------------------------------------\r
831// Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r
832// \r
833//-----------------------------------------------------------------------------\r
834void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
835 \r
836 // params\r
837 uint8_t needWipe = arg0;\r
838 // bit 0 - need get UID\r
839 // bit 1 - need wupC\r
840 // bit 2 - need HALT after sequence\r
841 // bit 3 - need init FPGA and field before sequence\r
842 // bit 4 - need reset FPGA and LED\r
843 uint8_t workFlags = arg1;\r
844 uint8_t blockNo = arg2;\r
845 \r
846 // card commands\r
847 uint8_t wupC1[] = { 0x40 }; \r
848 uint8_t wupC2[] = { 0x43 }; \r
849 uint8_t wipeC[] = { 0x41 }; \r
850 \r
851 // variables\r
852 byte_t isOK = 0;\r
853 uint8_t uid[10] = {0x00};\r
854 uint8_t d_block[18] = {0x00};\r
855 uint32_t cuid;\r
856 \r
857 uint8_t *receivedAnswer = get_bigbufptr_recvrespbuf();\r
858 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r
859\r
860 // reset FPGA and LED\r
861 if (workFlags & 0x08) {\r
862 LED_A_ON();\r
863 LED_B_OFF();\r
864 LED_C_OFF();\r
865 \r
866 iso14a_clear_trace();\r
867 iso14a_set_tracing(TRUE);\r
868 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
869 }\r
870\r
871 while (true) {\r
872\r
873 // get UID from chip\r
874 if (workFlags & 0x01) {\r
875 if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
876 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
877 break;\r
878 };\r
879\r
880 if(mifare_classic_halt(NULL, cuid)) {\r
881 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
882 break;\r
883 };\r
884 };\r
885 \r
886 // reset chip\r
887 if (needWipe){\r
888 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
889 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
890 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
891 break;\r
892 };\r
893\r
894 ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r
895 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
896 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r
897 break;\r
898 };\r
899\r
900 if(mifare_classic_halt(NULL, cuid)) {\r
901 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
902 break;\r
903 };\r
904 }; \r
905\r
906 // write block\r
907 if (workFlags & 0x02) {\r
908 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
909 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
910 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
911 break;\r
912 };\r
913\r
914 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
915 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
916 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
917 break;\r
918 };\r
919 }\r
920\r
921 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r
922 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r
923 break;\r
924 };\r
925 \r
926 memcpy(d_block, datain, 16);\r
927 AppendCrc14443a(d_block, 16);\r
928 \r
929 ReaderTransmit(d_block, sizeof(d_block), NULL);\r
930 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r
931 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r
932 break;\r
933 }; \r
934 \r
935 if (workFlags & 0x04) {\r
936 if (mifare_classic_halt(NULL, cuid)) {\r
937 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
938 break;\r
939 };\r
940 }\r
941 \r
942 isOK = 1;\r
943 break;\r
944 }\r
945 \r
946 LED_B_ON();\r
947 cmd_send(CMD_ACK,isOK,0,0,uid,4);\r
948 LED_B_OFF();\r
949\r
950 if ((workFlags & 0x10) || (!isOK)) {\r
951 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
952 LEDsoff();\r
953 }\r
954}\r
955\r
956\r
957void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
958 \r
959 // params\r
960 // bit 1 - need wupC\r
961 // bit 2 - need HALT after sequence\r
962 // bit 3 - need init FPGA and field before sequence\r
963 // bit 4 - need reset FPGA and LED\r
964 uint8_t workFlags = arg0;\r
965 uint8_t blockNo = arg2;\r
966 \r
967 // card commands\r
968 uint8_t wupC1[] = { 0x40 }; \r
969 uint8_t wupC2[] = { 0x43 }; \r
970 \r
971 // variables\r
972 byte_t isOK = 0;\r
973 uint8_t data[18] = {0x00};\r
974 uint32_t cuid = 0;\r
975 \r
976 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r
977 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r
978 \r
979 if (workFlags & 0x08) {\r
980 LED_A_ON();\r
981 LED_B_OFF();\r
982 LED_C_OFF();\r
983 \r
984 iso14a_clear_trace();\r
985 iso14a_set_tracing(TRUE);\r
986 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
987 }\r
988\r
989 while (true) {\r
990 if (workFlags & 0x02) {\r
991 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
992 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
993 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
994 break;\r
995 };\r
996\r
997 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
998 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
999 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
1000 break;\r
1001 };\r
1002 }\r
1003\r
1004 // read block\r
1005 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r
1006 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r
1007 break;\r
1008 };\r
1009 memcpy(data, receivedAnswer, 18);\r
1010 \r
1011 if (workFlags & 0x04) {\r
1012 if (mifare_classic_halt(NULL, cuid)) {\r
1013 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
1014 break;\r
1015 };\r
1016 }\r
1017 \r
1018 isOK = 1;\r
1019 break;\r
1020 }\r
1021 \r
1022 LED_B_ON();\r
1023 cmd_send(CMD_ACK,isOK,0,0,data,18);\r
1024 LED_B_OFF();\r
1025\r
1026 if ((workFlags & 0x10) || (!isOK)) {\r
1027 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
1028 LEDsoff();\r
1029 }\r
1030}\r
1031\r
1032void MifareCIdent(){\r
1033 \r
1034 // card commands\r
1035 uint8_t wupC1[] = { 0x40 }; \r
1036 uint8_t wupC2[] = { 0x43 }; \r
1037 \r
1038 // variables\r
1039 byte_t isOK = 1;\r
1040 \r
1041 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r
1042 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r
1043\r
1044 ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
1045 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1046 isOK = 0;\r
1047 };\r
1048\r
1049 ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
1050 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r
1051 isOK = 0;\r
1052 };\r
1053\r
1054 if (mifare_classic_halt(NULL, 0)) {\r
1055 isOK = 0;\r
1056 };\r
1057\r
1058 cmd_send(CMD_ACK,isOK,0,0,0,0);\r
1059}\r
1060\r
1061 //\r
1062// DESFIRE\r
1063//\r
Proxmark3 GIT tracking
Impressum, Datenschutz