git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "crc.h"
  20 #include "protocols.h"
  21 #include "parity.h"
  22
  23 //-----------------------------------------------------------------------------
  24 // Select, Authenticate, Read a MIFARE tag.
  25 // read block
  26 //-----------------------------------------------------------------------------
  27 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  28 {
  29   // params
  30         uint8_t blockNo = arg0;
  31         uint8_t keyType = arg1;
  32         uint64_t ui64Key = 0;
  33         ui64Key = bytes_to_num(datain, 6);
  34
  35         // variables
  36         byte_t isOK = 0;
  37         byte_t dataoutbuf[16] = {0x00};
  38         uint8_t uid[10] = {0x00};
  39         uint32_t cuid = 0;
  40         struct Crypto1State mpcs = {0, 0};
  41         struct Crypto1State *pcs;
  42         pcs = &mpcs;
  43
  44         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  45
  46         clear_trace();
  47         set_tracing(true);
  48
  49         LED_A_ON();
  50         LED_B_OFF();
  51         LED_C_OFF();
  52
  53         while (true) {
  54                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
  55                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  56                         break;
  57                 };
  58
  59                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  60                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  61                         break;
  62                 };
  63
  64                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  65                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  66                         break;
  67                 };
  68
  69                 if(mifare_classic_halt(pcs, cuid)) {
  70                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  71                         break;
  72                 };
  73
  74                 isOK = 1;
  75                 break;
  76         }
  77
  78         //  ----------------------------- crypto1 destroy
  79         crypto1_destroy(pcs);
  80
  81         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  82
  83         LED_B_ON();
  84         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  85         LED_B_OFF();
  86
  87         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  88         LEDsoff();
  89 }
  90
  91 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
  92
  93         bool turnOffField = (arg0 == 1);
  94
  95         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
  96
  97         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  98
  99         clear_trace();
 100         set_tracing(true);
 101
 102         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 103                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 104                 OnError(0);
 105                 return;
 106         };
 107
 108         if(!mifare_ultra_auth(keybytes)){
 109                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
 110                 OnError(1);
 111                 return;
 112         }
 113
 114         if (turnOffField) {
 115                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 116                 LEDsoff();
 117         }
 118         cmd_send(CMD_ACK,1,0,0,0,0);
 119 }
 120
 121 // Arg0 = BlockNo,
 122 // Arg1 = UsePwd bool
 123 // datain = PWD bytes,
 124 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 125 {
 126         uint8_t blockNo = arg0;
 127         byte_t dataout[16] = {0x00};
 128         bool useKey = (arg1 == 1); //UL_C
 129         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 130
 131         LEDsoff();
 132         LED_A_ON();
 133         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 134
 135         clear_trace();
 136         set_tracing(true);
 137
 138         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 139         if(!len) {
 140                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 141                 OnError(1);
 142                 return;
 143         }
 144
 145         // UL-C authentication
 146         if ( useKey ) {
 147                 uint8_t key[16] = {0x00};
 148                 memcpy(key, datain, sizeof(key) );
 149
 150                 if ( !mifare_ultra_auth(key) ) {
 151                         OnError(1);
 152                         return;
 153                 }
 154         }
 155
 156         // UL-EV1 / NTAG authentication
 157         if ( usePwd ) {
 158                 uint8_t pwd[4] = {0x00};
 159                 memcpy(pwd, datain, 4);
 160                 uint8_t pack[4] = {0,0,0,0};
 161                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 162                         OnError(1);
 163                         return;
 164                 }
 165         }
 166
 167         if( mifare_ultra_readblock(blockNo, dataout) ) {
 168                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 169                 OnError(2);
 170                 return;
 171         }
 172
 173         if( mifare_ultra_halt() ) {
 174                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 175                 OnError(3);
 176                 return;
 177         }
 178
 179     cmd_send(CMD_ACK,1,0,0,dataout,16);
 180         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 181         LEDsoff();
 182 }
 183
 184 //-----------------------------------------------------------------------------
 185 // Select, Authenticate, Read a MIFARE tag.
 186 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 187 //-----------------------------------------------------------------------------
 188 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 189 {
 190   // params
 191         uint8_t sectorNo = arg0;
 192         uint8_t keyType = arg1;
 193         uint64_t ui64Key = 0;
 194         ui64Key = bytes_to_num(datain, 6);
 195
 196         // variables
 197         byte_t isOK = 0;
 198         byte_t dataoutbuf[16 * 16];
 199         uint8_t uid[10] = {0x00};
 200         uint32_t cuid = 0;
 201         struct Crypto1State mpcs = {0, 0};
 202         struct Crypto1State *pcs;
 203         pcs = &mpcs;
 204
 205         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 206
 207         clear_trace();
 208         set_tracing(true);
 209
 210         LED_A_ON();
 211         LED_B_OFF();
 212         LED_C_OFF();
 213
 214         isOK = 1;
 215         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 216                 isOK = 0;
 217                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 218         }
 219
 220
 221         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 222                 isOK = 0;
 223                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 224         }
 225
 226         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 227                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 228                         isOK = 0;
 229                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 230                         break;
 231                 }
 232         }
 233
 234         if(mifare_classic_halt(pcs, cuid)) {
 235                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 236         }
 237
 238         //  ----------------------------- crypto1 destroy
 239         crypto1_destroy(pcs);
 240
 241         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 242
 243         LED_B_ON();
 244         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 245         LED_B_OFF();
 246
 247         // Thats it...
 248         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 249         LEDsoff();
 250 }
 251
 252 // arg0 = blockNo (start)
 253 // arg1 = Pages (number of blocks)
 254 // arg2 = useKey
 255 // datain = KEY bytes
 256 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 257 {
 258         LEDsoff();
 259         LED_A_ON();
 260         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 261
 262         // free eventually allocated BigBuf memory
 263         BigBuf_free(); BigBuf_Clear_ext(false);
 264         clear_trace();
 265         set_tracing(true);
 266
 267         // params
 268         uint8_t blockNo = arg0;
 269         uint16_t blocks = arg1;
 270         bool useKey = (arg2 == 1); //UL_C
 271         bool usePwd = (arg2 == 2); //UL_EV1/NTAG
 272         uint32_t countblocks = 0;
 273         uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
 274         if (dataout == NULL){
 275                 Dbprintf("out of memory");
 276                 OnError(1);
 277                 return;
 278         }
 279
 280         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 281         if (!len) {
 282                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 283                 OnError(1);
 284                 return;
 285         }
 286
 287         // UL-C authentication
 288         if ( useKey ) {
 289                 uint8_t key[16] = {0x00};
 290                 memcpy(key, datain, sizeof(key) );
 291
 292                 if ( !mifare_ultra_auth(key) ) {
 293                         OnError(1);
 294                         return;
 295                 }
 296         }
 297
 298         // UL-EV1 / NTAG authentication
 299         if (usePwd) {
 300                 uint8_t pwd[4] = {0x00};
 301                 memcpy(pwd, datain, sizeof(pwd));
 302                 uint8_t pack[4] = {0,0,0,0};
 303
 304                 if (!mifare_ul_ev1_auth(pwd, pack)){
 305                         OnError(1);
 306                         return;
 307                 }
 308         }
 309
 310         for (int i = 0; i < blocks; i++){
 311                 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
 312                         Dbprintf("Data exceeds buffer!!");
 313                         break;
 314                 }
 315
 316                 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
 317
 318                 if (len) {
 319                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 320                         // if no blocks read - error out
 321                         if (i==0){
 322                                 OnError(2);
 323                         return;
 324                         } else {
 325                                 //stop at last successful read block and return what we got
 326                                 break;
 327                         }
 328                 } else {
 329                         countblocks++;
 330                 }
 331         }
 332
 333         len = mifare_ultra_halt();
 334         if (len) {
 335                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 336                 OnError(3);
 337                 return;
 338         }
 339
 340         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 341
 342         countblocks *= 4;
 343
 344         cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
 345         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 346         LEDsoff();
 347         BigBuf_free();
 348 }
 349
 350 //-----------------------------------------------------------------------------
 351 // Select, Authenticate, Write a MIFARE tag.
 352 // read block
 353 //-----------------------------------------------------------------------------
 354 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 355 {
 356         // params
 357         uint8_t blockNo = arg0;
 358         uint8_t keyType = arg1;
 359         uint64_t ui64Key = 0;
 360         byte_t blockdata[16] = {0x00};
 361
 362         ui64Key = bytes_to_num(datain, 6);
 363         memcpy(blockdata, datain + 10, 16);
 364
 365         // variables
 366         byte_t isOK = 0;
 367         uint8_t uid[10] = {0x00};
 368         uint32_t cuid = 0;
 369         struct Crypto1State mpcs = {0, 0};
 370         struct Crypto1State *pcs;
 371         pcs = &mpcs;
 372
 373         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 374
 375         clear_trace();
 376         set_tracing(true);
 377
 378         LED_A_ON();
 379         LED_B_OFF();
 380         LED_C_OFF();
 381
 382         while (true) {
 383                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 384                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 385                         break;
 386                 };
 387
 388                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 389                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 390                         break;
 391                 };
 392
 393                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 394                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 395                         break;
 396                 };
 397
 398                 if(mifare_classic_halt(pcs, cuid)) {
 399                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 400                         break;
 401                 };
 402
 403                 isOK = 1;
 404                 break;
 405         }
 406
 407         //  ----------------------------- crypto1 destroy
 408         crypto1_destroy(pcs);
 409
 410         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 411
 412         LED_B_ON();
 413         cmd_send(CMD_ACK,isOK,0,0,0,0);
 414         LED_B_OFF();
 415
 416
 417         // Thats it...
 418         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 419         LEDsoff();
 420 }
 421
 422 /* // Command not needed but left for future testing
 423 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
 424 {
 425         uint8_t blockNo = arg0;
 426         byte_t blockdata[16] = {0x00};
 427
 428         memcpy(blockdata, datain, 16);
 429
 430         uint8_t uid[10] = {0x00};
 431
 432         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 433
 434         clear_trace();
 435         set_tracing(true);
 436         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 437
 438         if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
 439                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 440                 OnError(0);
 441                 return;
 442         };
 443
 444         if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
 445                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 446                 OnError(0);
 447                 return; };
 448
 449         if(mifare_ultra_halt()) {
 450                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 451                 OnError(0);
 452                 return;
 453         };
 454
 455         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 456
 457         cmd_send(CMD_ACK,1,0,0,0,0);
 458         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 459         LEDsoff();
 460 }
 461 */
 462
 463 // Arg0   : Block to write to.
 464 // Arg1   : 0 = use no authentication.
 465 //          1 = use 0x1A authentication.
 466 //          2 = use 0x1B authentication.
 467 // datain : 4 first bytes is data to be written.
 468 //        : 4/16 next bytes is authentication key.
 469 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 470 {
 471         uint8_t blockNo = arg0;
 472         bool useKey = (arg1 == 1); //UL_C
 473         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 474         byte_t blockdata[4] = {0x00};
 475
 476         memcpy(blockdata, datain,4);
 477
 478         LEDsoff();
 479         LED_A_ON();
 480         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 481
 482         clear_trace();
 483         set_tracing(true);
 484
 485         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 486                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 487                 OnError(0);
 488                 return;
 489         };
 490
 491         // UL-C authentication
 492         if ( useKey ) {
 493                 uint8_t key[16] = {0x00};
 494                 memcpy(key, datain+4, sizeof(key) );
 495
 496                 if ( !mifare_ultra_auth(key) ) {
 497                         OnError(1);
 498                         return;
 499                 }
 500         }
 501
 502         // UL-EV1 / NTAG authentication
 503         if (usePwd) {
 504                 uint8_t pwd[4] = {0x00};
 505                 memcpy(pwd, datain+4, 4);
 506                 uint8_t pack[4] = {0,0,0,0};
 507                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 508                         OnError(1);
 509                         return;
 510                 }
 511         }
 512
 513         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 514                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 515                 OnError(0);
 516                 return;
 517         };
 518
 519         if(mifare_ultra_halt()) {
 520                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 521                 OnError(0);
 522                 return;
 523         };
 524
 525         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 526
 527         cmd_send(CMD_ACK,1,0,0,0,0);
 528         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 529         LEDsoff();
 530 }
 531
 532 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 533
 534         uint8_t pwd[16] = {0x00};
 535         byte_t blockdata[4] = {0x00};
 536
 537         memcpy(pwd, datain, 16);
 538
 539         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 540         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 541
 542         clear_trace();
 543         set_tracing(true);
 544
 545         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 546                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 547                 OnError(0);
 548                 return;
 549         };
 550
 551         blockdata[0] = pwd[7];
 552         blockdata[1] = pwd[6];
 553         blockdata[2] = pwd[5];
 554         blockdata[3] = pwd[4];
 555         if(mifare_ultra_writeblock( 44, blockdata)) {
 556                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 557                 OnError(44);
 558                 return;
 559         };
 560
 561         blockdata[0] = pwd[3];
 562         blockdata[1] = pwd[2];
 563         blockdata[2] = pwd[1];
 564         blockdata[3] = pwd[0];
 565         if(mifare_ultra_writeblock( 45, blockdata)) {
 566                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 567                 OnError(45);
 568                 return;
 569         };
 570
 571         blockdata[0] = pwd[15];
 572         blockdata[1] = pwd[14];
 573         blockdata[2] = pwd[13];
 574         blockdata[3] = pwd[12];
 575         if(mifare_ultra_writeblock( 46, blockdata)) {
 576                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 577                 OnError(46);
 578                 return;
 579         };
 580
 581         blockdata[0] = pwd[11];
 582         blockdata[1] = pwd[10];
 583         blockdata[2] = pwd[9];
 584         blockdata[3] = pwd[8];
 585         if(mifare_ultra_writeblock( 47, blockdata)) {
 586                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 587                 OnError(47);
 588                 return;
 589         };
 590
 591         if(mifare_ultra_halt()) {
 592                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 593                 OnError(0);
 594                 return;
 595         };
 596
 597         cmd_send(CMD_ACK,1,0,0,0,0);
 598         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 599         LEDsoff();
 600 }
 601
 602 // Return 1 if the nonce is invalid else return 0
 603 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 604         return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 605         (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 606         (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 607 }
 608
 609
 610 //-----------------------------------------------------------------------------
 611 // acquire encrypted nonces in order to perform the attack described in
 612 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
 613 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
 614 // Computer and Communications Security, 2015
 615 //-----------------------------------------------------------------------------
 616 #define AUTHENTICATION_TIMEOUT 848                      // card times out 1ms after wrong authentication (according to NXP documentation)
 617 #define PRE_AUTHENTICATION_LEADTIME 400         // some (non standard) cards need a pause after select before they are ready for first authentication
 618
 619 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
 620 {
 621         uint64_t ui64Key = 0;
 622         uint8_t uid[10] = {0x00};
 623         uint32_t cuid = 0;
 624         uint8_t cascade_levels = 0;
 625         struct Crypto1State mpcs = {0, 0};
 626         struct Crypto1State *pcs;
 627         pcs = &mpcs;
 628         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
 629         int16_t isOK = 0;
 630         uint8_t par_enc[1] = {0x00};
 631         uint8_t nt_par_enc = 0;
 632         uint8_t buf[USB_CMD_DATA_SIZE] = {0x00};
 633         uint32_t timeout = 0;
 634
 635         uint8_t blockNo = arg0 & 0xff;
 636         uint8_t keyType = (arg0 >> 8) & 0xff;
 637         uint8_t targetBlockNo = arg1 & 0xff;
 638         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 639         ui64Key = bytes_to_num(datain, 6);
 640         bool initialize = flags & 0x0001;
 641         bool slow = flags & 0x0002;
 642         bool field_off = flags & 0x0004;
 643
 644         LED_A_ON();
 645         LED_C_OFF();
 646
 647         if (initialize) {
 648                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 649                 clear_trace();
 650                 set_tracing(true);
 651         }
 652
 653         LED_C_ON();
 654
 655         uint16_t num_nonces = 0;
 656         bool have_uid = false;
 657         for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
 658
 659                 // Test if the action was cancelled
 660                 if(BUTTON_PRESS()) {
 661                         isOK = 2;
 662                         field_off = true;
 663                         break;
 664                 }
 665
 666                 if (!have_uid) { // need a full select cycle to get the uid first
 667                         iso14a_card_select_t card_info;
 668                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
 669                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (ALL)");
 670                                 continue;
 671                         }
 672                         switch (card_info.uidlen) {
 673                                 case 4 : cascade_levels = 1; break;
 674                                 case 7 : cascade_levels = 2; break;
 675                                 case 10: cascade_levels = 3; break;
 676                                 default: break;
 677                         }
 678                         have_uid = true;
 679                 } else { // no need for anticollision. We can directly select the card
 680                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
 681                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (UID)");
 682                                 continue;
 683                         }
 684                 }
 685
 686                 if (slow) {
 687                         timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
 688                         while(GetCountSspClk() < timeout);
 689                 }
 690
 691                 uint32_t nt1;
 692                 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
 693                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth1 error");
 694                         continue;
 695                 }
 696
 697                 // nested authentication
 698                 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
 699                 if (len != 4) {
 700                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth2 error len=%d", len);
 701                         continue;
 702                 }
 703
 704                 // send a dummy byte as reader response in order to trigger the cards authentication timeout
 705                 uint8_t dummy_answer = 0;
 706                 ReaderTransmit(&dummy_answer, 1, NULL);
 707                 timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
 708
 709                 num_nonces++;
 710                 if (num_nonces % 2) {
 711                         memcpy(buf+i, receivedAnswer, 4);
 712                         nt_par_enc = par_enc[0] & 0xf0;
 713                 } else {
 714                         nt_par_enc |= par_enc[0] >> 4;
 715                         memcpy(buf+i+4, receivedAnswer, 4);
 716                         memcpy(buf+i+8, &nt_par_enc, 1);
 717                         i += 9;
 718                 }
 719
 720                 // wait for the card to become ready again
 721                 while(GetCountSspClk() < timeout);
 722
 723         }
 724
 725         LED_C_OFF();
 726
 727         crypto1_destroy(pcs);
 728
 729         LED_B_ON();
 730         cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
 731         LED_B_OFF();
 732
 733         if (MF_DBGLEVEL >= 3)   DbpString("AcquireEncryptedNonces finished");
 734
 735         if (field_off) {
 736                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 737                 LEDsoff();
 738         }
 739 }
 740
 741
 742 //-----------------------------------------------------------------------------
 743 // MIFARE nested authentication.
 744 //
 745 //-----------------------------------------------------------------------------
 746 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 747 {
 748         // params
 749         uint8_t blockNo = arg0 & 0xff;
 750         uint8_t keyType = (arg0 >> 8) & 0xff;
 751         uint8_t targetBlockNo = arg1 & 0xff;
 752         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 753         uint64_t ui64Key = 0;
 754
 755         ui64Key = bytes_to_num(datain, 6);
 756
 757         // variables
 758         uint16_t rtr, i, j, len;
 759         uint16_t davg = 0;
 760         static uint16_t dmin, dmax;
 761         uint8_t uid[10] = {0x00};
 762         uint32_t cuid = 0, nt1, nt2, nttmp, nttest, ks1;
 763         uint8_t par[1] = {0x00};
 764         uint32_t target_nt[2] = {0x00}, target_ks[2] = {0x00};
 765
 766         uint8_t par_array[4] = {0x00};
 767         uint16_t ncount = 0;
 768         struct Crypto1State mpcs = {0, 0};
 769         struct Crypto1State *pcs;
 770         pcs = &mpcs;
 771         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
 772
 773         uint32_t auth1_time, auth2_time;
 774         static uint16_t delta_time = 0;
 775
 776         LED_A_ON();
 777         LED_C_OFF();
 778         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 779
 780         // free eventually allocated BigBuf memory
 781         BigBuf_free(); BigBuf_Clear_ext(false);
 782
 783         if (calibrate) clear_trace();
 784         set_tracing(true);
 785
 786         // statistics on nonce distance
 787         int16_t isOK = 0;
 788         #define NESTED_MAX_TRIES 12
 789         uint16_t unsuccessfull_tries = 0;
 790         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 791                 LED_B_ON();
 792                 WDT_HIT();
 793
 794                 davg = dmax = 0;
 795                 dmin = 2000;
 796                 delta_time = 0;
 797
 798                 for (rtr = 0; rtr < 17; rtr++) {
 799
 800                         // Test if the action was cancelled
 801                         if(BUTTON_PRESS()) {
 802                                 isOK = -2;
 803                                 break;
 804                         }
 805
 806                         // prepare next select. No need to power down the card.
 807                         if(mifare_classic_halt(pcs, cuid)) {
 808                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 809                                 rtr--;
 810                                 continue;
 811                         }
 812
 813                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 814                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 815                                 rtr--;
 816                                 continue;
 817                         };
 818
 819                         auth1_time = 0;
 820                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 821                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 822                                 rtr--;
 823                                 continue;
 824                         };
 825                         auth2_time = (delta_time) ? auth1_time + delta_time : 0;
 826
 827                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 828                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 829                                 rtr--;
 830                                 continue;
 831                         };
 832
 833                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 834                         for (i = 101; i < 1200; i++) {
 835                                 nttmp = prng_successor(nttmp, 1);
 836                                 if (nttmp == nt2) break;
 837                         }
 838
 839                         if (i != 1200) {
 840                                 if (rtr != 0) {
 841                                         davg += i;
 842                                         dmin = MIN(dmin, i);
 843                                         dmax = MAX(dmax, i);
 844                                 }
 845                                 else {
 846                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 847                                 }
 848                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 849                         } else {
 850                                 unsuccessfull_tries++;
 851                                 if (unsuccessfull_tries > NESTED_MAX_TRIES) {   // card isn't vulnerable to nested attack (random numbers are not predictable)
 852                                         isOK = -3;
 853                                 }
 854                         }
 855                 }
 856
 857                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 858
 859                 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
 860
 861                 dmin = davg - 2;
 862                 dmax = davg + 2;
 863
 864                 LED_B_OFF();
 865         }
 866 //  -------------------------------------------------------------------------------------------------
 867
 868         LED_C_ON();
 869
 870         //  get crypted nonces for target sector
 871         for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
 872
 873                 target_nt[i] = 0;
 874                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 875
 876                         // prepare next select. No need to power down the card.
 877                         if(mifare_classic_halt(pcs, cuid)) {
 878                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 879                                 continue;
 880                         }
 881
 882                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 883                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 884                                 continue;
 885                         };
 886
 887                         auth1_time = 0;
 888                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 889                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 890                                 continue;
 891                         };
 892
 893                         // nested authentication
 894                         auth2_time = auth1_time + delta_time;
 895
 896                         len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 897                         if (len != 4) {
 898                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 899                                 continue;
 900                         };
 901
 902                         nt2 = bytes_to_num(receivedAnswer, 4);
 903                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 904
 905                         // Parity validity check
 906 //                      for (j = 0; j < 4; j++) {
 907 //                              par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 908 //                      }
 909                         par_array[0] = (oddparity8(receivedAnswer[0]) != ((par[0] >> (7-0)) & 0x01));
 910                         par_array[1] = (oddparity8(receivedAnswer[1]) != ((par[0] >> (7-1)) & 0x01));
 911                         par_array[2] = (oddparity8(receivedAnswer[2]) != ((par[0] >> (7-2)) & 0x01));
 912                         par_array[3] = (oddparity8(receivedAnswer[3]) != ((par[0] >> (7-3)) & 0x01));
 913
 914                         ncount = 0;
 915                         nttest = prng_successor(nt1, dmin - 1);
 916                         for (j = dmin; j < dmax + 1; j++) {
 917                                 nttest = prng_successor(nttest, 1);
 918                                 ks1 = nt2 ^ nttest;
 919
 920                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 921                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 922                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 923                                                 target_nt[i] = 0;
 924                                                 break;
 925                                         }
 926                                         target_nt[i] = nttest;
 927                                         target_ks[i] = ks1;
 928                                         ncount++;
 929                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 930                                                 target_nt[i] = 0;
 931                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 932                                                 break;
 933                                         }
 934                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 935                                 }
 936                         }
 937                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 938                 }
 939         }
 940
 941         LED_C_OFF();
 942
 943         //  ----------------------------- crypto1 destroy
 944         crypto1_destroy(pcs);
 945
 946         byte_t buf[4 + 4 * 4] = {0};
 947         memcpy(buf, &cuid, 4);
 948         memcpy(buf+4, &target_nt[0], 4);
 949         memcpy(buf+8, &target_ks[0], 4);
 950         memcpy(buf+12, &target_nt[1], 4);
 951         memcpy(buf+16, &target_ks[1], 4);
 952
 953         LED_B_ON();
 954         cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 955         LED_B_OFF();
 956
 957         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 958
 959         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 960         LEDsoff();
 961         set_tracing(FALSE);
 962 }
 963
 964 //-----------------------------------------------------------------------------
 965 // MIFARE check keys. key count up to 85.
 966 //
 967 //-----------------------------------------------------------------------------
 968 void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) {
 969         uint8_t blockNo = arg0 & 0xff;
 970         uint8_t keyType = (arg0 >> 8) & 0xff;
 971         bool clearTrace = arg1;
 972         uint8_t keyCount = arg2;
 973         uint64_t ui64Key = 0;
 974
 975         bool have_uid = FALSE;
 976         uint8_t cascade_levels = 0;
 977         uint32_t timeout = 0;
 978
 979         int i;
 980         byte_t isOK = 0;
 981         uint8_t uid[10] = {0x00};
 982         uint32_t cuid = 0;
 983         struct Crypto1State mpcs = {0, 0};
 984         struct Crypto1State *pcs;
 985         pcs = &mpcs;
 986
 987         // save old debuglevel, and tempory turn off dbg printing. speedissues.
 988         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 989         MF_DBGLEVEL = MF_DBG_NONE;
 990
 991         LEDsoff();
 992         LED_A_ON();
 993
 994         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 995
 996         if (clearTrace)
 997                 clear_trace();
 998
 999         set_tracing(TRUE);
1000
1001         for (i = 0; i < keyCount; ++i) {
1002
1003                 //mifare_classic_halt(pcs, cuid);
1004
1005                 // this part is from Piwi's faster nonce collecting part in Hardnested.
1006                 if (!have_uid) { // need a full select cycle to get the uid first
1007                         iso14a_card_select_t card_info;
1008                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
1009                                 if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Can't select card (ALL)");
1010                                 break;
1011                         }
1012                         switch (card_info.uidlen) {
1013                                 case 4 : cascade_levels = 1; break;
1014                                 case 7 : cascade_levels = 2; break;
1015                                 case 10: cascade_levels = 3; break;
1016                                 default: break;
1017                         }
1018                         have_uid = TRUE;
1019                 } else { // no need for anticollision. We can directly select the card
1020                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
1021                                 if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Can't select card (UID)");
1022                                 continue;
1023                         }
1024                 }
1025
1026                 ui64Key = bytes_to_num(datain + i * 6, 6);
1027
1028                 if (mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
1029
1030                         uint8_t dummy_answer = 0;
1031                         ReaderTransmit(&dummy_answer, 1, NULL);
1032                         timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
1033
1034                         // wait for the card to become ready again
1035                         while(GetCountSspClk() < timeout);
1036
1037                         continue;
1038                 }
1039                 isOK = 1;
1040                 break;
1041         }
1042
1043         LED_B_ON();
1044     cmd_send(CMD_ACK, isOK, 0, 0, datain + i * 6, 6);
1045
1046         // restore debug level
1047         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1048
1049         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1050         LEDsoff();
1051         set_tracing(FALSE);
1052         crypto1_destroy(pcs);
1053 }
1054
1055 //-----------------------------------------------------------------------------
1056 // MIFARE commands set debug level
1057 //
1058 //-----------------------------------------------------------------------------
1059 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1060         MF_DBGLEVEL = arg0;
1061         Dbprintf("Debug level: %d", MF_DBGLEVEL);
1062 }
1063
1064 //-----------------------------------------------------------------------------
1065 // Work with emulator memory
1066 //
1067 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1068 // involved in dealing with emulator memory. But if it is called later, it might
1069 // destroy the Emulator Memory.
1070 //-----------------------------------------------------------------------------
1071
1072 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1073         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1074         emlClearMem();
1075 }
1076
1077 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1078         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1079         if (arg2==0) arg2 = 16; // backwards compat... default bytewidth
1080         emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width
1081 }
1082
1083 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1084         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1085         byte_t buf[USB_CMD_DATA_SIZE] = {0x00};
1086         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1087
1088         LED_B_ON();
1089         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1090         LED_B_OFF();
1091 }
1092
1093 //-----------------------------------------------------------------------------
1094 // Load a card into the emulator memory
1095 //
1096 //-----------------------------------------------------------------------------
1097 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1098         uint8_t numSectors = arg0;
1099         uint8_t keyType = arg1;
1100         uint64_t ui64Key = 0;
1101         uint32_t cuid = 0;
1102         struct Crypto1State mpcs = {0, 0};
1103         struct Crypto1State *pcs;
1104         pcs = &mpcs;
1105
1106         // variables
1107         byte_t dataoutbuf[16] = {0x00};
1108         byte_t dataoutbuf2[16] = {0x00};
1109         uint8_t uid[10] = {0x00};
1110
1111         LED_A_ON();
1112         LED_B_OFF();
1113         LED_C_OFF();
1114         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1115
1116         clear_trace();
1117         set_tracing(TRUE);
1118
1119         bool isOK = true;
1120
1121         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1122                 isOK = false;
1123                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1124         }
1125
1126         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1127                 ui64Key = emlGetKey(sectorNo, keyType);
1128                 if (sectorNo == 0){
1129                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1130                                 isOK = false;
1131                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
1132                                 break;
1133                         }
1134                 } else {
1135                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1136                                 isOK = false;
1137                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1138                                 break;
1139                         }
1140                 }
1141
1142                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1143                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1144                                 isOK = false;
1145                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1146                                 break;
1147                         }
1148                         if (isOK) {
1149                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1150                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1151                                 } else {        // sector trailer, keep the keys, set only the AC
1152                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1153                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1154                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
1155                                 }
1156                         }
1157                 }
1158
1159         }
1160
1161         if(mifare_classic_halt(pcs, cuid))
1162                 if (MF_DBGLEVEL >= 1)
1163                         Dbprintf("Halt error");
1164
1165         //  ----------------------------- crypto1 destroy
1166         crypto1_destroy(pcs);
1167
1168         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1169         LEDsoff();
1170
1171         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1172
1173         set_tracing(FALSE);
1174 }
1175
1176
1177 //-----------------------------------------------------------------------------
1178 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1179 //
1180 // PARAMS - workFlags
1181 // bit 0 - need get UID
1182 // bit 1 - need wupC
1183 // bit 2 - need HALT after sequence
1184 // bit 3 - need turn on FPGA before sequence
1185 // bit 4 - need turn off FPGA
1186 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1187 // bit 6 - wipe tag.
1188 //-----------------------------------------------------------------------------
1189 // magic uid card generation 1 commands
1190 uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
1191 uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
1192 uint8_t wipeC[] = { MIFARE_MAGICWIPEC };
1193
1194 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1195
1196         // params
1197         uint8_t workFlags = arg0;
1198         uint8_t blockNo = arg1;
1199
1200         // variables
1201         bool isOK = false; //assume we will get an error
1202         uint8_t errormsg = 0x00;
1203         uint8_t uid[10] = {0x00};
1204         uint8_t data[18] = {0x00};
1205         uint32_t cuid = 0;
1206
1207         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
1208         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
1209
1210         if (workFlags & MAGIC_INIT) {
1211                 LED_A_ON();
1212                 LED_B_OFF();
1213                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1214                 clear_trace();
1215                 set_tracing(TRUE);
1216         }
1217
1218         //loop doesn't loop just breaks out if error
1219         while (true) {
1220                 // read UID and return to client with write
1221                 if (workFlags & MAGIC_UID) {
1222                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1223                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Can't select card");
1224                                 errormsg = MAGIC_UID;
1225                                 // break;
1226                         }
1227
1228                         if ( mifare_classic_halt_ex(NULL) ) break;
1229                 }
1230
1231                 // wipe tag, fill it with zeros
1232                 if (workFlags & MAGIC_WIPE){
1233                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1234                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1235                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1236                                 errormsg = MAGIC_WIPE;
1237                                 break;
1238                         }
1239
1240                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1241                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1242                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wipeC error");
1243                                 errormsg = MAGIC_WIPE;
1244                                 break;
1245                         }
1246
1247                         if ( mifare_classic_halt_ex(NULL) ) break;
1248                 }
1249
1250                 // write block
1251                 if (workFlags & MAGIC_WUPC) {
1252                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1253                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1254                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1255                                 errormsg = MAGIC_WUPC;
1256                                 break;
1257                         }
1258
1259                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1260                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1261                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC2 error");
1262                                 errormsg = MAGIC_WUPC;
1263                                 break;
1264                         }
1265                 }
1266
1267                 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1268                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send command error");
1269                         errormsg = 4;
1270                         break;
1271                 }
1272
1273                 memcpy(data, datain, 16);
1274                 AppendCrc14443a(data, 16);
1275
1276                 ReaderTransmit(data, sizeof(data), NULL);
1277                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1278                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send data error");
1279                         errormsg = 0;
1280                         break;
1281                 }
1282
1283                 if (workFlags & MAGIC_OFF)
1284                         if ( mifare_classic_halt_ex(NULL) ) break;
1285
1286                 isOK = true;
1287                 break;
1288
1289         } // end while
1290
1291         if (isOK )
1292                 cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));
1293         else
1294                 OnErrorMagic(errormsg);
1295
1296         if (workFlags & MAGIC_OFF)
1297                 OnSuccessMagic();
1298 }
1299
1300 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1301
1302         uint8_t workFlags = arg0;
1303         uint8_t blockNo = arg1;
1304         uint8_t errormsg = 0x00;
1305         bool isOK = false; //assume we will get an error
1306
1307         // variables
1308         uint8_t data[MAX_MIFARE_FRAME_SIZE];
1309         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
1310         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
1311
1312         memset(data, 0x00, sizeof(data));
1313
1314         if (workFlags & MAGIC_INIT) {
1315                 LED_A_ON();
1316                 LED_B_OFF();
1317                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1318                 clear_trace();
1319                 set_tracing(TRUE);
1320         }
1321
1322         //loop doesn't loop just breaks out if error or done
1323         while (true) {
1324                 if (workFlags & MAGIC_WUPC) {
1325                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1326                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1327                                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1328                                 errormsg = MAGIC_WUPC;
1329                                 break;
1330                         }
1331
1332                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1333                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1334                                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1335                                 errormsg = MAGIC_WUPC;
1336                                 break;
1337                         }
1338                 }
1339
1340                 // read block
1341                 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1342                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");
1343                         errormsg = 0;
1344                         break;
1345                 }
1346
1347                 memcpy(data, receivedAnswer, sizeof(data));
1348
1349                 // send HALT
1350                 if (workFlags & MAGIC_HALT)
1351                         mifare_classic_halt_ex(NULL);
1352
1353                 isOK = true;
1354                 break;
1355         }
1356         // if MAGIC_DATAIN, the data stays on device side.
1357         if (workFlags & MAGIC_DATAIN) {
1358                 if (isOK)
1359                         memcpy(datain, data, sizeof(data));
1360         } else {
1361                 if (isOK)
1362                         cmd_send(CMD_ACK,1,0,0,data,sizeof(data));
1363                 else
1364                         OnErrorMagic(errormsg);
1365         }
1366
1367         if (workFlags & MAGIC_OFF)
1368                 OnSuccessMagic();
1369 }
1370
1371 void MifareCIdent(){
1372
1373         // variables
1374         bool isOK = true;
1375         uint8_t receivedAnswer[1] = {0x00};
1376         uint8_t receivedAnswerPar[1] = {0x00};
1377
1378         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1379         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1380                 isOK = false;
1381         }
1382
1383         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1384         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1385                 isOK = false;
1386         }
1387
1388         // removed the if,  since some magic tags misbehavies and send an answer to it.
1389         mifare_classic_halt(NULL, 0);
1390         cmd_send(CMD_ACK,isOK,0,0,0,0);
1391 }
1392
1393 void OnSuccessMagic(){
1394         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1395         LEDsoff();
1396         set_tracing(FALSE);
1397 }
1398 void OnErrorMagic(uint8_t reason){
1399         //          ACK, ISOK, reason,0,0,0
1400         cmd_send(CMD_ACK,0,reason,0,0,0);
1401         OnSuccessMagic();
1402 }
1403
1404 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1405 }
1406
1407 //
1408 // DESFIRE
1409 //
1410
1411 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1412
1413         byte_t dataout[12] = {0x00};
1414         uint8_t uid[10] = {0x00};
1415         uint32_t cuid = 0;
1416
1417         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1418         clear_trace();
1419         set_tracing(true);
1420
1421         int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);
1422         if(!len) {
1423                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1424                 OnError(1);
1425                 return;
1426         };
1427
1428         if(mifare_desfire_des_auth1(cuid, dataout)){
1429                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1430                 OnError(4);
1431                 return;
1432         }
1433
1434         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1435     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1436 }
1437
1438 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1439
1440         uint32_t cuid = arg0;
1441         uint8_t key[16] = {0x00};
1442         byte_t dataout[12] = {0x00};
1443         byte_t isOK = 0;
1444
1445         memcpy(key, datain, 16);
1446
1447         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1448
1449         if( isOK) {
1450             if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1451                 OnError(4);
1452                 return;
1453         }
1454
1455         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1456
1457         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1458         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1459         LEDsoff();
1460 }