git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "desfire.h"
  20 #include "../common/crc.h"
  21
  22 //-----------------------------------------------------------------------------
  23 // Select, Authenticate, Read a MIFARE tag.
  24 // read block
  25 //-----------------------------------------------------------------------------
  26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  27 {
  28   // params
  29         uint8_t blockNo = arg0;
  30         uint8_t keyType = arg1;
  31         uint64_t ui64Key = 0;
  32         ui64Key = bytes_to_num(datain, 6);
  33
  34         // variables
  35         byte_t isOK = 0;
  36         byte_t dataoutbuf[16];
  37         uint8_t uid[10];
  38         uint32_t cuid;
  39         struct Crypto1State mpcs = {0, 0};
  40         struct Crypto1State *pcs;
  41         pcs = &mpcs;
  42
  43         // clear trace
  44         iso14a_clear_trace();
  45         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  46
  47         LED_A_ON();
  48         LED_B_OFF();
  49         LED_C_OFF();
  50
  51         while (true) {
  52                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  53                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  54                         break;
  55                 };
  56
  57                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  58                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  59                         break;
  60                 };
  61
  62                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  63                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  64                         break;
  65                 };
  66
  67                 if(mifare_classic_halt(pcs, cuid)) {
  68                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  69                         break;
  70                 };
  71
  72                 isOK = 1;
  73                 break;
  74         }
  75
  76         //  ----------------------------- crypto1 destroy
  77         crypto1_destroy(pcs);
  78
  79         if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
  80
  81         LED_B_ON();
  82         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  83         LED_B_OFF();
  84
  85         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  86         LEDsoff();
  87 }
  88
  89
  90 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  91         // variables
  92         byte_t isOK = 0;
  93         byte_t dataoutbuf[16] = {0x00};
  94         uint8_t uid[10] = {0x00};
  95         uint32_t cuid;
  96
  97         // clear trace
  98         iso14a_clear_trace();
  99         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 100
 101         LED_A_ON();
 102         LED_B_OFF();
 103         LED_C_OFF();
 104
 105
 106         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 107           if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card, something went wrong before auth");
 108         };
 109
 110         if(mifare_ultra_auth1(cuid, dataoutbuf)){
 111           if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part1: Fail.");
 112         }
 113
 114         isOK=1;
 115         if (MF_DBGLEVEL >= 2)   DbpString("AUTH 1 FINISHED");
 116
 117         LED_B_ON();
 118     cmd_send(CMD_ACK,isOK,cuid,0,dataoutbuf,11);
 119
 120         LEDsoff();
 121 }
 122 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 123
 124         uint32_t cuid = arg0;
 125         uint8_t key[16] = {0x00};
 126         byte_t isOK = 0;
 127         byte_t dataoutbuf[16] = {0x00};
 128
 129         memcpy(key, datain, 16);
 130
 131         LED_A_ON();
 132         LED_B_OFF();
 133         LED_C_OFF();
 134
 135         if(mifare_ultra_auth2(cuid, key, dataoutbuf)){
 136             if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part2: Fail...");
 137         }
 138         isOK = 1;
 139         if (MF_DBGLEVEL >= 2)   DbpString("AUTH 2 FINISHED");
 140
 141         LED_B_ON();
 142         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);
 143         LED_B_OFF();
 144
 145         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 146         LEDsoff();
 147 }
 148
 149 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
 150 {
 151         uint8_t blockNo = arg0;
 152         byte_t dataout[16] = {0x00};
 153         uint8_t uid[10] = {0x00};
 154         uint32_t cuid;
 155
 156         LED_A_ON();
 157         LED_B_OFF();
 158         LED_C_OFF();
 159
 160         iso14a_clear_trace();
 161         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 162
 163         int len = iso14443a_select_card(uid, NULL, &cuid);
 164         if(!len) {
 165                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Can't select card");
 166                 OnError(1);
 167                 return;
 168         };
 169
 170         len = mifare_ultra_readblock(cuid, blockNo, dataout);
 171         if(len) {
 172                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Read block error");
 173                 OnError(2);
 174                 return;
 175         };
 176
 177         len = mifare_ultra_halt(cuid);
 178         if(len) {
 179                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Halt error");
 180                 OnError(3);
 181                 return;
 182         };
 183
 184     cmd_send(CMD_ACK,1,0,0,dataout,16);
 185         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 186         LEDsoff();
 187 }
 188
 189 //-----------------------------------------------------------------------------
 190 // Select, Authenticate, Read a MIFARE tag.
 191 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 192 //-----------------------------------------------------------------------------
 193 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 194 {
 195   // params
 196         uint8_t sectorNo = arg0;
 197         uint8_t keyType = arg1;
 198         uint64_t ui64Key = 0;
 199         ui64Key = bytes_to_num(datain, 6);
 200
 201         // variables
 202         byte_t isOK = 0;
 203         byte_t dataoutbuf[16 * 16];
 204         uint8_t uid[10];
 205         uint32_t cuid;
 206         struct Crypto1State mpcs = {0, 0};
 207         struct Crypto1State *pcs;
 208         pcs = &mpcs;
 209
 210         // clear trace
 211         iso14a_clear_trace();
 212
 213         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 214
 215         LED_A_ON();
 216         LED_B_OFF();
 217         LED_C_OFF();
 218
 219         isOK = 1;
 220         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 221                 isOK = 0;
 222                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 223         }
 224
 225
 226         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 227                 isOK = 0;
 228                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 229         }
 230
 231         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 232                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 233                         isOK = 0;
 234                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 235                         break;
 236                 }
 237         }
 238
 239         if(mifare_classic_halt(pcs, cuid)) {
 240                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 241         }
 242
 243         //  ----------------------------- crypto1 destroy
 244         crypto1_destroy(pcs);
 245
 246         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 247
 248         LED_B_ON();
 249         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 250         LED_B_OFF();
 251
 252         // Thats it...
 253         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 254         LEDsoff();
 255 }
 256
 257 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 258 {
 259         // params
 260         uint8_t sectorNo = arg0;
 261         int Pages = arg1;
 262         int count_Pages = 0;
 263         byte_t dataout[176] = {0x00};;
 264         uint8_t uid[10] = {0x00};
 265         uint32_t cuid;
 266
 267         LED_A_ON();
 268         LED_B_OFF();
 269         LED_C_OFF();
 270
 271         if (MF_DBGLEVEL >= MF_DBG_ALL)
 272                 Dbprintf("Pages %d",Pages);
 273
 274         iso14a_clear_trace();
 275         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 276
 277         int len = iso14443a_select_card(uid, NULL, &cuid);
 278
 279         if (!len) {
 280                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 281                         Dbprintf("Can't select card");
 282                 OnError(1);
 283                 return;
 284         }
 285
 286         for (int i = 0; i < Pages; i++){
 287
 288                 len = mifare_ultra_readblock(cuid, sectorNo * 4 + i, dataout + 4 * i);
 289
 290                 if (len) {
 291                         if (MF_DBGLEVEL >= MF_DBG_ERROR)
 292                                 Dbprintf("Read block %d error",i);
 293                         OnError(2);
 294                         return;
 295                 } else {
 296                         count_Pages++;
 297                 }
 298         }
 299
 300         len = mifare_ultra_halt(cuid);
 301         if (len) {
 302                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 303                         Dbprintf("Halt error");
 304                 OnError(3);
 305                 return;
 306         }
 307
 308         if (MF_DBGLEVEL >= MF_DBG_ALL) {
 309                 Dbprintf("Pages read %d", count_Pages);
 310         }
 311
 312         len = 16*4; //64 bytes
 313
 314         // Read a UL-C
 315         if (Pages == 44 && count_Pages > 16)
 316                 len = 176;
 317
 318         cmd_send(CMD_ACK, 1, 0, 0, dataout, len);
 319         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 320         LEDsoff();
 321 }
 322
 323
 324 //-----------------------------------------------------------------------------
 325 // Select, Authenticate, Write a MIFARE tag.
 326 // read block
 327 //-----------------------------------------------------------------------------
 328 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 329 {
 330         // params
 331         uint8_t blockNo = arg0;
 332         uint8_t keyType = arg1;
 333         uint64_t ui64Key = 0;
 334         byte_t blockdata[16];
 335
 336         ui64Key = bytes_to_num(datain, 6);
 337         memcpy(blockdata, datain + 10, 16);
 338
 339         // variables
 340         byte_t isOK = 0;
 341         uint8_t uid[10];
 342         uint32_t cuid;
 343         struct Crypto1State mpcs = {0, 0};
 344         struct Crypto1State *pcs;
 345         pcs = &mpcs;
 346
 347         // clear trace
 348         iso14a_clear_trace();
 349
 350         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 351
 352         LED_A_ON();
 353         LED_B_OFF();
 354         LED_C_OFF();
 355
 356         while (true) {
 357                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 358                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 359                         break;
 360                 };
 361
 362                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 363                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 364                         break;
 365                 };
 366
 367                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 368                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 369                         break;
 370                 };
 371
 372                 if(mifare_classic_halt(pcs, cuid)) {
 373                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 374                         break;
 375                 };
 376
 377                 isOK = 1;
 378                 break;
 379         }
 380
 381         //  ----------------------------- crypto1 destroy
 382         crypto1_destroy(pcs);
 383
 384         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 385
 386         LED_B_ON();
 387         cmd_send(CMD_ACK,isOK,0,0,0,0);
 388         LED_B_OFF();
 389
 390
 391         // Thats it...
 392         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 393         LEDsoff();
 394 }
 395
 396 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 397 {
 398         // params
 399         uint8_t blockNo = arg0;
 400         byte_t blockdata[16] = {0x00};
 401
 402         memcpy(blockdata, datain, 16);
 403
 404         // variables
 405         byte_t isOK = 0;
 406         uint8_t uid[10] = {0x00};
 407         uint32_t cuid;
 408
 409         iso14a_clear_trace();
 410         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 411
 412         LED_A_ON();
 413         LED_B_OFF();
 414         LED_C_OFF();
 415
 416         while (true) {
 417                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 418                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 419                                 break;
 420                 };
 421
 422                 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
 423                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 424                                 break;
 425                 };
 426
 427                 if(mifare_ultra_halt(cuid)) {
 428                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 429                                 break;
 430                 };
 431
 432                 isOK = 1;
 433                 break;
 434         }
 435
 436         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 437
 438         cmd_send(CMD_ACK,isOK,0,0,0,0);
 439         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 440         LEDsoff();
 441 }
 442
 443 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 444 {
 445         // params
 446         uint8_t blockNo = arg0;
 447         byte_t blockdata[4] = {0x00};
 448
 449         memcpy(blockdata, datain,4);
 450
 451         // variables
 452         byte_t isOK = 0;
 453         uint8_t uid[10] = {0x00};
 454         uint32_t cuid;
 455
 456         iso14a_clear_trace();
 457         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 458
 459         LED_A_ON();
 460         LED_B_OFF();
 461         LED_C_OFF();
 462
 463         while (true) {
 464                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 465                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 466                         break;
 467                 };
 468
 469                 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
 470                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 471                         break;
 472                 };
 473
 474                 if(mifare_ultra_halt(cuid)) {
 475                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 476                         break;
 477                 };
 478
 479                 isOK = 1;
 480                 break;
 481         }
 482
 483         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 484
 485         cmd_send(CMD_ACK,isOK,0,0,0,0);
 486         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 487         LEDsoff();
 488 }
 489
 490 // Return 1 if the nonce is invalid else return 0
 491 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t * parity) {
 492         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 493         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 494         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 495 }
 496
 497
 498 //-----------------------------------------------------------------------------
 499 // MIFARE nested authentication.
 500 //
 501 //-----------------------------------------------------------------------------
 502 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 503 {
 504         // params
 505         uint8_t blockNo = arg0 & 0xff;
 506         uint8_t keyType = (arg0 >> 8) & 0xff;
 507         uint8_t targetBlockNo = arg1 & 0xff;
 508         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 509         uint64_t ui64Key = 0;
 510
 511         ui64Key = bytes_to_num(datain, 6);
 512
 513         // variables
 514         uint16_t rtr, i, j, len;
 515         uint16_t davg;
 516         static uint16_t dmin, dmax;
 517         uint8_t uid[10];
 518         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 519         uint8_t par[1];
 520         uint32_t target_nt[2], target_ks[2];
 521
 522         uint8_t par_array[4];
 523         uint16_t ncount = 0;
 524         struct Crypto1State mpcs = {0, 0};
 525         struct Crypto1State *pcs;
 526         pcs = &mpcs;
 527         uint8_t* receivedAnswer =  get_bigbufptr_recvrespbuf();
 528
 529         uint32_t auth1_time, auth2_time;
 530         static uint16_t delta_time;
 531
 532         // clear trace
 533         iso14a_clear_trace();
 534         iso14a_set_tracing(false);
 535
 536         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 537
 538         LED_A_ON();
 539         LED_C_OFF();
 540
 541
 542         // statistics on nonce distance
 543         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 544                 LED_B_ON();
 545                 WDT_HIT();
 546
 547                 davg = dmax = 0;
 548                 dmin = 2000;
 549                 delta_time = 0;
 550
 551                 for (rtr = 0; rtr < 17; rtr++) {
 552
 553                         // prepare next select. No need to power down the card.
 554                         if(mifare_classic_halt(pcs, cuid)) {
 555                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 556                                 rtr--;
 557                                 continue;
 558                         }
 559
 560                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 561                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 562                                 rtr--;
 563                                 continue;
 564                         };
 565
 566                         auth1_time = 0;
 567                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 568                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 569                                 rtr--;
 570                                 continue;
 571                         };
 572
 573                         if (delta_time) {
 574                                 auth2_time = auth1_time + delta_time;
 575                         } else {
 576                                 auth2_time = 0;
 577                         }
 578                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 579                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 580                                 rtr--;
 581                                 continue;
 582                         };
 583
 584                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 585                         for (i = 141; i < 1200; i++) {
 586                                 nttmp = prng_successor(nttmp, 1);
 587                                 if (nttmp == nt2) break;
 588                         }
 589
 590                         if (i != 1200) {
 591                                 if (rtr != 0) {
 592                                         davg += i;
 593                                         dmin = MIN(dmin, i);
 594                                         dmax = MAX(dmax, i);
 595                                 }
 596                                 else {
 597                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 598                                 }
 599                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 600                         }
 601                 }
 602
 603                 if (rtr <= 1) return;
 604
 605                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 606
 607                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 608
 609                 dmin = davg - 2;
 610                 dmax = davg + 2;
 611
 612                 LED_B_OFF();
 613
 614         }
 615 //  -------------------------------------------------------------------------------------------------
 616
 617         LED_C_ON();
 618
 619         //  get crypted nonces for target sector
 620         for(i=0; i < 2; i++) { // look for exactly two different nonces
 621
 622                 WDT_HIT();
 623             if(BUTTON_PRESS()) {
 624                         DbpString("Nested: cancelled");
 625                         crypto1_destroy(pcs);
 626                         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 627                         LEDsoff();
 628                         return;
 629                 }
 630
 631                 target_nt[i] = 0;
 632                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 633
 634                         // prepare next select. No need to power down the card.
 635                         if(mifare_classic_halt(pcs, cuid)) {
 636                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 637                                 continue;
 638                         }
 639
 640                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 641                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 642                                 continue;
 643                         };
 644
 645                         auth1_time = 0;
 646                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 647                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 648                                 continue;
 649                         };
 650
 651                         // nested authentication
 652                         auth2_time = auth1_time + delta_time;
 653                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 654                         if (len != 4) {
 655                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 656                                 continue;
 657                         };
 658
 659                         nt2 = bytes_to_num(receivedAnswer, 4);
 660                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 661
 662                         // Parity validity check
 663                         for (j = 0; j < 4; j++) {
 664                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 665                         }
 666
 667                         ncount = 0;
 668                         nttest = prng_successor(nt1, dmin - 1);
 669                         for (j = dmin; j < dmax + 1; j++) {
 670                                 nttest = prng_successor(nttest, 1);
 671                                 ks1 = nt2 ^ nttest;
 672
 673                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 674                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 675                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 676                                                 target_nt[i] = 0;
 677                                                 break;
 678                                         }
 679                                         target_nt[i] = nttest;
 680                                         target_ks[i] = ks1;
 681                                         ncount++;
 682                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 683                                                 target_nt[i] = 0;
 684                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 685                                                 break;
 686                                         }
 687                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 688                                 }
 689                         }
 690                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 691                 }
 692         }
 693
 694         LED_C_OFF();
 695
 696         //  ----------------------------- crypto1 destroy
 697         crypto1_destroy(pcs);
 698
 699         byte_t buf[4 + 4 * 4];
 700         memcpy(buf, &cuid, 4);
 701         memcpy(buf+4, &target_nt[0], 4);
 702         memcpy(buf+8, &target_ks[0], 4);
 703         memcpy(buf+12, &target_nt[1], 4);
 704         memcpy(buf+16, &target_ks[1], 4);
 705
 706         LED_B_ON();
 707         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 708         LED_B_OFF();
 709
 710         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 711
 712         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 713         LEDsoff();
 714         iso14a_set_tracing(TRUE);
 715 }
 716
 717 //-----------------------------------------------------------------------------
 718 // MIFARE check keys. key count up to 85.
 719 //
 720 //-----------------------------------------------------------------------------
 721 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 722 {
 723   // params
 724         uint8_t blockNo = arg0;
 725         uint8_t keyType = arg1;
 726         uint8_t keyCount = arg2;
 727         uint64_t ui64Key = 0;
 728
 729         // variables
 730         int i;
 731         byte_t isOK = 0;
 732         uint8_t uid[10];
 733         uint32_t cuid;
 734         struct Crypto1State mpcs = {0, 0};
 735         struct Crypto1State *pcs;
 736         pcs = &mpcs;
 737
 738         // clear debug level
 739         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 740         MF_DBGLEVEL = MF_DBG_NONE;
 741
 742         // clear trace
 743         iso14a_clear_trace();
 744         iso14a_set_tracing(TRUE);
 745
 746         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 747
 748         LED_A_ON();
 749         LED_B_OFF();
 750         LED_C_OFF();
 751
 752         for (i = 0; i < keyCount; i++) {
 753                 if(mifare_classic_halt(pcs, cuid)) {
 754                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 755                 }
 756
 757                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 758                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 759                         break;
 760                 };
 761
 762                 ui64Key = bytes_to_num(datain + i * 6, 6);
 763                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 764                         continue;
 765                 };
 766
 767                 isOK = 1;
 768                 break;
 769         }
 770
 771         //  ----------------------------- crypto1 destroy
 772         crypto1_destroy(pcs);
 773
 774         LED_B_ON();
 775     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 776         LED_B_OFF();
 777
 778         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 779         LEDsoff();
 780
 781         // restore debug level
 782         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 783 }
 784
 785 //-----------------------------------------------------------------------------
 786 // MIFARE commands set debug level
 787 //
 788 //-----------------------------------------------------------------------------
 789 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 790         MF_DBGLEVEL = arg0;
 791         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 792 }
 793
 794 //-----------------------------------------------------------------------------
 795 // Work with emulator memory
 796 //
 797 //-----------------------------------------------------------------------------
 798 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 799         emlClearMem();
 800 }
 801
 802 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 803         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 804 }
 805
 806 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 807         byte_t buf[USB_CMD_DATA_SIZE];
 808         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 809
 810         LED_B_ON();
 811         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 812         LED_B_OFF();
 813 }
 814
 815 //-----------------------------------------------------------------------------
 816 // Load a card into the emulator memory
 817 //
 818 //-----------------------------------------------------------------------------
 819 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 820         uint8_t numSectors = arg0;
 821         uint8_t keyType = arg1;
 822         uint64_t ui64Key = 0;
 823         uint32_t cuid;
 824         struct Crypto1State mpcs = {0, 0};
 825         struct Crypto1State *pcs;
 826         pcs = &mpcs;
 827
 828         // variables
 829         byte_t dataoutbuf[16];
 830         byte_t dataoutbuf2[16];
 831         uint8_t uid[10];
 832
 833         // clear trace
 834         iso14a_clear_trace();
 835         iso14a_set_tracing(false);
 836
 837         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 838
 839         LED_A_ON();
 840         LED_B_OFF();
 841         LED_C_OFF();
 842
 843         bool isOK = true;
 844
 845         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 846                 isOK = false;
 847                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 848         }
 849
 850         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 851                 ui64Key = emlGetKey(sectorNo, keyType);
 852                 if (sectorNo == 0){
 853                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 854                                 isOK = false;
 855                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 856                                 break;
 857                         }
 858                 } else {
 859                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 860                                 isOK = false;
 861                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 862                                 break;
 863                         }
 864                 }
 865
 866                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 867                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 868                                 isOK = false;
 869                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 870                                 break;
 871                         };
 872                         if (isOK) {
 873                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 874                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 875                                 } else {        // sector trailer, keep the keys, set only the AC
 876                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 877                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 878                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 879                                 }
 880                         }
 881                 }
 882
 883         }
 884
 885         if(mifare_classic_halt(pcs, cuid)) {
 886                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 887         };
 888
 889         //  ----------------------------- crypto1 destroy
 890         crypto1_destroy(pcs);
 891
 892         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 893         LEDsoff();
 894
 895         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 896
 897 }
 898
 899
 900 //-----------------------------------------------------------------------------
 901 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 902 //
 903 //-----------------------------------------------------------------------------
 904 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 905
 906   // params
 907         uint8_t needWipe = arg0;
 908         // bit 0 - need get UID
 909         // bit 1 - need wupC
 910         // bit 2 - need HALT after sequence
 911         // bit 3 - need init FPGA and field before sequence
 912         // bit 4 - need reset FPGA and LED
 913         uint8_t workFlags = arg1;
 914         uint8_t blockNo = arg2;
 915
 916         // card commands
 917         uint8_t wupC1[]       = { 0x40 };
 918         uint8_t wupC2[]       = { 0x43 };
 919         uint8_t wipeC[]       = { 0x41 };
 920
 921         // variables
 922         byte_t isOK = 0;
 923         uint8_t uid[10] = {0x00};
 924         uint8_t d_block[18] = {0x00};
 925         uint32_t cuid;
 926
 927         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
 928         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
 929
 930         // reset FPGA and LED
 931         if (workFlags & 0x08) {
 932                 LED_A_ON();
 933                 LED_B_OFF();
 934                 LED_C_OFF();
 935
 936                 iso14a_clear_trace();
 937                 iso14a_set_tracing(TRUE);
 938                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 939         }
 940
 941         while (true) {
 942
 943                 // get UID from chip
 944                 if (workFlags & 0x01) {
 945                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 946                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 947                                 break;
 948                         };
 949
 950                         if(mifare_classic_halt(NULL, cuid)) {
 951                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 952                                 break;
 953                         };
 954                 };
 955
 956                 // reset chip
 957                 if (needWipe){
 958                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 959                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 960                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 961                                 break;
 962                         };
 963
 964                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
 965                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 966                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
 967                                 break;
 968                         };
 969
 970                         if(mifare_classic_halt(NULL, cuid)) {
 971                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 972                                 break;
 973                         };
 974                 };
 975
 976                 // write block
 977                 if (workFlags & 0x02) {
 978                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 979                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 980                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 981                                 break;
 982                         };
 983
 984                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
 985                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 986                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
 987                                 break;
 988                         };
 989                 }
 990
 991                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
 992                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
 993                         break;
 994                 };
 995
 996                 memcpy(d_block, datain, 16);
 997                 AppendCrc14443a(d_block, 16);
 998
 999                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1000                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1001                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1002                         break;
1003                 };
1004
1005                 if (workFlags & 0x04) {
1006                         if (mifare_classic_halt(NULL, cuid)) {
1007                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1008                                 break;
1009                         };
1010                 }
1011
1012                 isOK = 1;
1013                 break;
1014         }
1015
1016         LED_B_ON();
1017         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1018         LED_B_OFF();
1019
1020         if ((workFlags & 0x10) || (!isOK)) {
1021                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1022                 LEDsoff();
1023         }
1024 }
1025
1026
1027 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1028
1029   // params
1030         // bit 1 - need wupC
1031         // bit 2 - need HALT after sequence
1032         // bit 3 - need init FPGA and field before sequence
1033         // bit 4 - need reset FPGA and LED
1034         uint8_t workFlags = arg0;
1035         uint8_t blockNo = arg2;
1036
1037         // card commands
1038         uint8_t wupC1[]       = { 0x40 };
1039         uint8_t wupC2[]       = { 0x43 };
1040
1041         // variables
1042         byte_t isOK = 0;
1043         uint8_t data[18] = {0x00};
1044         uint32_t cuid = 0;
1045
1046         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1047         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1048
1049         if (workFlags & 0x08) {
1050                 LED_A_ON();
1051                 LED_B_OFF();
1052                 LED_C_OFF();
1053
1054                 iso14a_clear_trace();
1055                 iso14a_set_tracing(TRUE);
1056                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1057         }
1058
1059         while (true) {
1060                 if (workFlags & 0x02) {
1061                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1062                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1063                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1064                                 break;
1065                         };
1066
1067                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1068                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1069                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1070                                 break;
1071                         };
1072                 }
1073
1074                 // read block
1075                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1076                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1077                         break;
1078                 };
1079                 memcpy(data, receivedAnswer, 18);
1080
1081                 if (workFlags & 0x04) {
1082                         if (mifare_classic_halt(NULL, cuid)) {
1083                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1084                                 break;
1085                         };
1086                 }
1087
1088                 isOK = 1;
1089                 break;
1090         }
1091
1092         LED_B_ON();
1093         cmd_send(CMD_ACK,isOK,0,0,data,18);
1094         LED_B_OFF();
1095
1096         if ((workFlags & 0x10) || (!isOK)) {
1097                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1098                 LEDsoff();
1099         }
1100 }
1101
1102 void MifareCIdent(){
1103
1104         // card commands
1105         uint8_t wupC1[]       = { 0x40 };
1106         uint8_t wupC2[]       = { 0x43 };
1107
1108         // variables
1109         byte_t isOK = 1;
1110
1111         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1112         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1113
1114         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1115         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1116                 isOK = 0;
1117         };
1118
1119         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1120         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1121                 isOK = 0;
1122         };
1123
1124         if (mifare_classic_halt(NULL, 0)) {
1125                 isOK = 0;
1126         };
1127
1128         cmd_send(CMD_ACK,isOK,0,0,0,0);
1129 }
1130
1131 //
1132 // DESFIRE
1133 //
1134
1135 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1136
1137         byte_t dataout[11] = {0x00};
1138         uint8_t uid[10] = {0x00};
1139         uint32_t cuid;
1140
1141         iso14a_clear_trace();
1142         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1143
1144         int len = iso14443a_select_card(uid, NULL, &cuid);
1145         if(!len) {
1146                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1147                         Dbprintf("Can't select card");
1148                 OnError(1);
1149                 return;
1150         };
1151
1152         if(mifare_desfire_des_auth1(cuid, dataout)){
1153                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1154                         Dbprintf("Authentication part1: Fail.");
1155                 OnError(4);
1156                 return;
1157         }
1158
1159         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1160
1161     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1162 }
1163
1164 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1165
1166         uint32_t cuid = arg0;
1167         uint8_t key[16] = {0x00};
1168         byte_t isOK = 0;
1169         byte_t dataout[12] = {0x00};
1170
1171         memcpy(key, datain, 16);
1172
1173         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1174
1175         if( isOK) {
1176             if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1177                         Dbprintf("Authentication part2: Failed");
1178                 OnError(4);
1179                 return;
1180         }
1181
1182         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1183                 DbpString("AUTH 2 FINISHED");
1184
1185         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1186         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1187         LEDsoff();
1188 }