1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
16 #include "mifarecmd.h"
21 // the block number for the ISO14443-4 PCB
22 uint8_t pcb_blocknum
= 0;
23 // Deselect card by sending a s-block. the crc is precalced for speed
24 static uint8_t deselect_cmd
[] = {0xc2,0xe0,0xb4};
26 //-----------------------------------------------------------------------------
27 // Select, Authenticate, Read a MIFARE tag.
29 //-----------------------------------------------------------------------------
30 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
33 uint8_t blockNo
= arg0
;
34 uint8_t keyType
= arg1
;
36 ui64Key
= bytes_to_num(datain
, 6);
40 byte_t dataoutbuf
[16];
43 struct Crypto1State mpcs
= {0, 0};
44 struct Crypto1State
*pcs
;
49 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
56 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
57 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
61 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
62 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
66 if(mifare_classic_readblock(pcs
, cuid
, blockNo
, dataoutbuf
)) {
67 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block error");
71 if(mifare_classic_halt(pcs
, cuid
)) {
72 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
80 // ----------------------------- crypto1 destroy
83 if (MF_DBGLEVEL
>= 2) DbpString("READ BLOCK FINISHED");
86 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16);
89 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
93 void MifareUC_Auth(uint8_t arg0
, uint8_t *keybytes
){
95 bool turnOffField
= (arg0
== 1);
97 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
99 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
101 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
102 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card");
107 if(!mifare_ultra_auth(keybytes
)){
108 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Authentication failed");
114 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
117 cmd_send(CMD_ACK
,1,0,0,0,0);
121 // Arg1 = UsePwd bool
122 // datain = PWD bytes,
123 void MifareUReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
)
125 uint8_t blockNo
= arg0
;
126 byte_t dataout
[16] = {0x00};
127 bool useKey
= (arg1
== 1); //UL_C
128 bool usePwd
= (arg1
== 2); //UL_EV1/NTAG
133 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
135 int len
= iso14443a_select_card(NULL
, NULL
, NULL
);
137 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card (RC:%02X)",len
);
142 // UL-C authentication
144 uint8_t key
[16] = {0x00};
145 memcpy(key
, datain
, sizeof(key
) );
147 if ( !mifare_ultra_auth(key
) ) {
153 // UL-EV1 / NTAG authentication
155 uint8_t pwd
[4] = {0x00};
156 memcpy(pwd
, datain
, 4);
157 uint8_t pack
[4] = {0,0,0,0};
158 if (!mifare_ul_ev1_auth(pwd
, pack
)) {
164 if( mifare_ultra_readblock(blockNo
, dataout
) ) {
165 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Read block error");
170 if( mifare_ultra_halt() ) {
171 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Halt error");
176 cmd_send(CMD_ACK
,1,0,0,dataout
,16);
177 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
181 //-----------------------------------------------------------------------------
182 // Select, Authenticate, Read a MIFARE tag.
183 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
184 //-----------------------------------------------------------------------------
185 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
188 uint8_t sectorNo
= arg0
;
189 uint8_t keyType
= arg1
;
190 uint64_t ui64Key
= 0;
191 ui64Key
= bytes_to_num(datain
, 6);
195 byte_t dataoutbuf
[16 * 16];
198 struct Crypto1State mpcs
= {0, 0};
199 struct Crypto1State
*pcs
;
205 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
212 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
214 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
218 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
220 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
223 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
224 if(mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
+ 16 * blockNo
)) {
226 if (MF_DBGLEVEL
>= 1) Dbprintf("Read sector %2d block %2d error", sectorNo
, blockNo
);
231 if(mifare_classic_halt(pcs
, cuid
)) {
232 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
235 // ----------------------------- crypto1 destroy
236 crypto1_destroy(pcs
);
238 if (MF_DBGLEVEL
>= 2) DbpString("READ SECTOR FINISHED");
241 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16*NumBlocksPerSector(sectorNo
));
245 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
249 // arg0 = blockNo (start)
250 // arg1 = Pages (number of blocks)
252 // datain = KEY bytes
253 void MifareUReadCard(uint8_t arg0
, uint16_t arg1
, uint8_t arg2
, uint8_t *datain
)
255 // free eventually allocated BigBuf memory
261 uint8_t blockNo
= arg0
;
262 uint16_t blocks
= arg1
;
263 bool useKey
= (arg2
== 1); //UL_C
264 bool usePwd
= (arg2
== 2); //UL_EV1/NTAG
265 uint32_t countblocks
= 0;
266 uint8_t *dataout
= BigBuf_malloc(CARD_MEMORY_SIZE
);
267 if (dataout
== NULL
){
268 Dbprintf("out of memory");
275 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
277 int len
= iso14443a_select_card(NULL
, NULL
, NULL
);
279 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card (RC:%d)",len
);
284 // UL-C authentication
286 uint8_t key
[16] = {0x00};
287 memcpy(key
, datain
, sizeof(key
) );
289 if ( !mifare_ultra_auth(key
) ) {
295 // UL-EV1 / NTAG authentication
297 uint8_t pwd
[4] = {0x00};
298 memcpy(pwd
, datain
, sizeof(pwd
));
299 uint8_t pack
[4] = {0,0,0,0};
301 if (!mifare_ul_ev1_auth(pwd
, pack
)){
307 for (int i
= 0; i
< blocks
; i
++){
308 if ((i
*4) + 4 > CARD_MEMORY_SIZE
) {
309 Dbprintf("Data exceeds buffer!!");
313 len
= mifare_ultra_readblock(blockNo
+ i
, dataout
+ 4 * i
);
316 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Read block %d error",i
);
317 // if no blocks read - error out
322 //stop at last successful read block and return what we got
330 len
= mifare_ultra_halt();
332 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Halt error");
337 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) Dbprintf("Blocks read %d", countblocks
);
342 for(size_t i=0; i < countblocks; i += USB_CMD_DATA_SIZE) {
343 size_t len = MIN((countblocks - i),USB_CMD_DATA_SIZE);
344 cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,countblocks,dataout+i,len);
347 cmd_send(CMD_ACK
, 1, countblocks
, BigBuf_max_traceLen(), 0, 0);
348 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
352 //-----------------------------------------------------------------------------
353 // Select, Authenticate, Write a MIFARE tag.
355 //-----------------------------------------------------------------------------
356 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
359 uint8_t blockNo
= arg0
;
360 uint8_t keyType
= arg1
;
361 uint64_t ui64Key
= 0;
362 byte_t blockdata
[16];
364 ui64Key
= bytes_to_num(datain
, 6);
365 memcpy(blockdata
, datain
+ 10, 16);
371 struct Crypto1State mpcs
= {0, 0};
372 struct Crypto1State
*pcs
;
378 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
385 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
386 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
390 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
391 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
395 if(mifare_classic_writeblock(pcs
, cuid
, blockNo
, blockdata
)) {
396 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
400 if(mifare_classic_halt(pcs
, cuid
)) {
401 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
409 // ----------------------------- crypto1 destroy
410 crypto1_destroy(pcs
);
412 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
415 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
420 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
424 void MifareUWriteBlock(uint8_t arg0
, uint8_t *datain
)
426 uint8_t blockNo
= arg0
;
427 byte_t blockdata
[16] = {0x00};
429 memcpy(blockdata
, datain
, 16);
431 uint8_t uid
[10] = {0x00};
433 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
436 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
438 if(!iso14443a_select_card(uid
, NULL
, NULL
)) {
439 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
444 if(mifare_ultra_writeblock(blockNo
, blockdata
)) {
445 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
449 if(mifare_ultra_halt()) {
450 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
455 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
457 cmd_send(CMD_ACK
,1,0,0,0,0);
458 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
462 // Arg0 : Block to write to.
463 // Arg1 : 0 = use no authentication.
464 // 1 = use 0x1A authentication.
465 // 2 = use 0x1B authentication.
466 // datain : 4 first bytes is data to be written.
467 // : 4/16 next bytes is authentication key.
468 void MifareUWriteBlock_Special(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
)
470 uint8_t blockNo
= arg0
;
471 bool useKey
= (arg1
== 1); //UL_C
472 bool usePwd
= (arg1
== 2); //UL_EV1/NTAG
473 byte_t blockdata
[4] = {0x00};
475 memcpy(blockdata
, datain
,4);
480 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
482 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
483 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
488 // UL-C authentication
490 uint8_t key
[16] = {0x00};
491 memcpy(key
, datain
+4, sizeof(key
) );
493 if ( !mifare_ultra_auth(key
) ) {
499 // UL-EV1 / NTAG authentication
501 uint8_t pwd
[4] = {0x00};
502 memcpy(pwd
, datain
+4, 4);
503 uint8_t pack
[4] = {0,0,0,0};
504 if (!mifare_ul_ev1_auth(pwd
, pack
)) {
510 if(mifare_ultra_special_writeblock(blockNo
, blockdata
)) {
511 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
516 if(mifare_ultra_halt()) {
517 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
522 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
524 cmd_send(CMD_ACK
,1,0,0,0,0);
525 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
529 void MifareUSetPwd(uint8_t arg0
, uint8_t *datain
){
531 uint8_t pwd
[16] = {0x00};
532 byte_t blockdata
[4] = {0x00};
534 memcpy(pwd
, datain
, 16);
536 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
538 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
540 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
541 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
546 blockdata
[0] = pwd
[7];
547 blockdata
[1] = pwd
[6];
548 blockdata
[2] = pwd
[5];
549 blockdata
[3] = pwd
[4];
550 if(mifare_ultra_special_writeblock( 44, blockdata
)) {
551 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
556 blockdata
[0] = pwd
[3];
557 blockdata
[1] = pwd
[2];
558 blockdata
[2] = pwd
[1];
559 blockdata
[3] = pwd
[0];
560 if(mifare_ultra_special_writeblock( 45, blockdata
)) {
561 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
566 blockdata
[0] = pwd
[15];
567 blockdata
[1] = pwd
[14];
568 blockdata
[2] = pwd
[13];
569 blockdata
[3] = pwd
[12];
570 if(mifare_ultra_special_writeblock( 46, blockdata
)) {
571 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
576 blockdata
[0] = pwd
[11];
577 blockdata
[1] = pwd
[10];
578 blockdata
[2] = pwd
[9];
579 blockdata
[3] = pwd
[8];
580 if(mifare_ultra_special_writeblock( 47, blockdata
)) {
581 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
586 if(mifare_ultra_halt()) {
587 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
592 cmd_send(CMD_ACK
,1,0,0,0,0);
593 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
597 // Return 1 if the nonce is invalid else return 0
598 int valid_nonce(uint32_t Nt
, uint32_t NtEnc
, uint32_t Ks1
, uint8_t *parity
) {
599 return ((oddparity((Nt
>> 24) & 0xFF) == ((parity
[0]) ^ oddparity((NtEnc
>> 24) & 0xFF) ^ BIT(Ks1
,16))) & \
600 (oddparity((Nt
>> 16) & 0xFF) == ((parity
[1]) ^ oddparity((NtEnc
>> 16) & 0xFF) ^ BIT(Ks1
,8))) & \
601 (oddparity((Nt
>> 8) & 0xFF) == ((parity
[2]) ^ oddparity((NtEnc
>> 8) & 0xFF) ^ BIT(Ks1
,0)))) ? 1 : 0;
605 //-----------------------------------------------------------------------------
606 // MIFARE nested authentication.
608 //-----------------------------------------------------------------------------
609 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t calibrate
, uint8_t *datain
)
612 uint8_t blockNo
= arg0
& 0xff;
613 uint8_t keyType
= (arg0
>> 8) & 0xff;
614 uint8_t targetBlockNo
= arg1
& 0xff;
615 uint8_t targetKeyType
= (arg1
>> 8) & 0xff;
616 uint64_t ui64Key
= 0;
618 ui64Key
= bytes_to_num(datain
, 6);
621 uint16_t rtr
, i
, j
, len
;
623 static uint16_t dmin
, dmax
;
625 uint32_t cuid
, nt1
, nt2
, nttmp
, nttest
, ks1
;
627 uint32_t target_nt
[2], target_ks
[2];
629 uint8_t par_array
[4];
631 struct Crypto1State mpcs
= {0, 0};
632 struct Crypto1State
*pcs
;
634 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
636 uint32_t auth1_time
, auth2_time
;
637 static uint16_t delta_time
;
639 // free eventually allocated BigBuf memory
645 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
651 // statistics on nonce distance
652 if (calibrate
) { // for first call only. Otherwise reuse previous calibration
660 for (rtr
= 0; rtr
< 17; rtr
++) {
662 // prepare next select. No need to power down the card.
663 if(mifare_classic_halt(pcs
, cuid
)) {
664 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
669 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
670 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
676 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
677 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
683 auth2_time
= auth1_time
+ delta_time
;
687 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_NESTED
, &nt2
, &auth2_time
)) {
688 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error");
693 nttmp
= prng_successor(nt1
, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
694 for (i
= 101; i
< 1200; i
++) {
695 nttmp
= prng_successor(nttmp
, 1);
696 if (nttmp
== nt2
) break;
706 delta_time
= auth2_time
- auth1_time
+ 32; // allow some slack for proper timing
708 if (MF_DBGLEVEL
>= 3) Dbprintf("Nested: calibrating... ntdist=%d", i
);
712 if (rtr
<= 1) return;
714 davg
= (davg
+ (rtr
- 1)/2) / (rtr
- 1);
716 if (MF_DBGLEVEL
>= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin
, dmax
, davg
, delta_time
);
724 // -------------------------------------------------------------------------------------------------
728 // get crypted nonces for target sector
729 for(i
=0; i
< 2; i
++) { // look for exactly two different nonces
732 while(target_nt
[i
] == 0) { // continue until we have an unambiguous nonce
734 // prepare next select. No need to power down the card.
735 if(mifare_classic_halt(pcs
, cuid
)) {
736 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
740 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
741 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
746 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
747 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
751 // nested authentication
752 auth2_time
= auth1_time
+ delta_time
;
753 len
= mifare_sendcmd_shortex(pcs
, AUTH_NESTED
, 0x60 + (targetKeyType
& 0x01), targetBlockNo
, receivedAnswer
, par
, &auth2_time
);
755 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error len=%d", len
);
759 nt2
= bytes_to_num(receivedAnswer
, 4);
760 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i
+1, nt1
, nt2
, par
[0]);
762 // Parity validity check
763 for (j
= 0; j
< 4; j
++) {
764 par_array
[j
] = (oddparity(receivedAnswer
[j
]) != ((par
[0] >> (7-j
)) & 0x01));
768 nttest
= prng_successor(nt1
, dmin
- 1);
769 for (j
= dmin
; j
< dmax
+ 1; j
++) {
770 nttest
= prng_successor(nttest
, 1);
773 if (valid_nonce(nttest
, nt2
, ks1
, par_array
)){
774 if (ncount
> 0) { // we are only interested in disambiguous nonces, try again
775 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i
+1, j
);
779 target_nt
[i
] = nttest
;
782 if (i
== 1 && target_nt
[1] == target_nt
[0]) { // we need two different nonces
784 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j
);
787 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i
+1, j
);
790 if (target_nt
[i
] == 0 && j
== dmax
+1 && MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i
+1);
796 // ----------------------------- crypto1 destroy
797 crypto1_destroy(pcs
);
799 byte_t buf
[4 + 4 * 4];
800 memcpy(buf
, &cuid
, 4);
801 memcpy(buf
+4, &target_nt
[0], 4);
802 memcpy(buf
+8, &target_ks
[0], 4);
803 memcpy(buf
+12, &target_nt
[1], 4);
804 memcpy(buf
+16, &target_ks
[1], 4);
807 cmd_send(CMD_ACK
, 0, 2, targetBlockNo
+ (targetKeyType
* 0x100), buf
, sizeof(buf
));
810 if (MF_DBGLEVEL
>= 3) DbpString("NESTED FINISHED");
812 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
817 //-----------------------------------------------------------------------------
818 // MIFARE check keys. key count up to 85.
820 //-----------------------------------------------------------------------------
821 void MifareChkKeys(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
824 uint8_t blockNo
= arg0
;
825 uint8_t keyType
= arg1
;
826 uint8_t keyCount
= arg2
;
827 uint64_t ui64Key
= 0;
834 struct Crypto1State mpcs
= {0, 0};
835 struct Crypto1State
*pcs
;
839 int OLD_MF_DBGLEVEL
= MF_DBGLEVEL
;
840 MF_DBGLEVEL
= MF_DBG_NONE
;
846 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
852 for (i
= 0; i
< keyCount
; i
++) {
853 if(mifare_classic_halt(pcs
, cuid
)) {
854 if (MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Halt error");
857 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
858 if (OLD_MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Can't select card");
862 ui64Key
= bytes_to_num(datain
+ i
* 6, 6);
863 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
871 // ----------------------------- crypto1 destroy
872 crypto1_destroy(pcs
);
875 cmd_send(CMD_ACK
,isOK
,0,0,datain
+ i
* 6,6);
878 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
881 // restore debug level
882 MF_DBGLEVEL
= OLD_MF_DBGLEVEL
;
885 //-----------------------------------------------------------------------------
886 // MIFARE commands set debug level
888 //-----------------------------------------------------------------------------
889 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
891 Dbprintf("Debug level: %d", MF_DBGLEVEL
);
894 //-----------------------------------------------------------------------------
895 // Work with emulator memory
897 //-----------------------------------------------------------------------------
898 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
902 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
903 emlSetMem(datain
, arg0
, arg1
); // data, block num, blocks count
906 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
907 byte_t buf
[USB_CMD_DATA_SIZE
];
908 emlGetMem(buf
, arg0
, arg1
); // data, block num, blocks count (max 4)
911 cmd_send(CMD_ACK
,arg0
,arg1
,0,buf
,USB_CMD_DATA_SIZE
);
915 //-----------------------------------------------------------------------------
916 // Load a card into the emulator memory
918 //-----------------------------------------------------------------------------
919 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
920 uint8_t numSectors
= arg0
;
921 uint8_t keyType
= arg1
;
922 uint64_t ui64Key
= 0;
924 struct Crypto1State mpcs
= {0, 0};
925 struct Crypto1State
*pcs
;
929 byte_t dataoutbuf
[16];
930 byte_t dataoutbuf2
[16];
937 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
945 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
947 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
950 for (uint8_t sectorNo
= 0; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
951 ui64Key
= emlGetKey(sectorNo
, keyType
);
953 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
955 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo
);
959 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_NESTED
)) {
961 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo
);
966 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
967 if(isOK
&& mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
)) {
969 if (MF_DBGLEVEL
>= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo
, blockNo
);
973 if (blockNo
< NumBlocksPerSector(sectorNo
) - 1) {
974 emlSetMem(dataoutbuf
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
975 } else { // sector trailer, keep the keys, set only the AC
976 emlGetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
977 memcpy(&dataoutbuf2
[6], &dataoutbuf
[6], 4);
978 emlSetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
985 if(mifare_classic_halt(pcs
, cuid
)) {
986 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
989 // ----------------------------- crypto1 destroy
990 crypto1_destroy(pcs
);
992 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
995 if (MF_DBGLEVEL
>= 2) DbpString("EMUL FILL SECTORS FINISHED");
1000 //-----------------------------------------------------------------------------
1001 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1003 //-----------------------------------------------------------------------------
1004 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
1007 uint8_t needWipe
= arg0
;
1008 // bit 0 - need get UID
1009 // bit 1 - need wupC
1010 // bit 2 - need HALT after sequence
1011 // bit 3 - need init FPGA and field before sequence
1012 // bit 4 - need reset FPGA and LED
1013 uint8_t workFlags
= arg1
;
1014 uint8_t blockNo
= arg2
;
1017 uint8_t wupC1
[] = { 0x40 };
1018 uint8_t wupC2
[] = { 0x43 };
1019 uint8_t wipeC
[] = { 0x41 };
1023 uint8_t uid
[10] = {0x00};
1024 uint8_t d_block
[18] = {0x00};
1027 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1028 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1030 // reset FPGA and LED
1031 if (workFlags
& 0x08) {
1038 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1043 // get UID from chip
1044 if (workFlags
& 0x01) {
1045 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
1046 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
1050 if(mifare_classic_halt(NULL
, cuid
)) {
1051 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1058 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1059 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1060 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1064 ReaderTransmit(wipeC
, sizeof(wipeC
), NULL
);
1065 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1066 if (MF_DBGLEVEL
>= 1) Dbprintf("wipeC error");
1070 if(mifare_classic_halt(NULL
, cuid
)) {
1071 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1077 if (workFlags
& 0x02) {
1078 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1079 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1080 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1084 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1085 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1086 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1091 if ((mifare_sendcmd_short(NULL
, 0, 0xA0, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1092 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send command error");
1096 memcpy(d_block
, datain
, 16);
1097 AppendCrc14443a(d_block
, 16);
1099 ReaderTransmit(d_block
, sizeof(d_block
), NULL
);
1100 if ((ReaderReceive(receivedAnswer
, receivedAnswerPar
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1101 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send data error");
1105 if (workFlags
& 0x04) {
1106 if (mifare_classic_halt(NULL
, cuid
)) {
1107 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1117 cmd_send(CMD_ACK
,isOK
,0,0,uid
,4);
1120 if ((workFlags
& 0x10) || (!isOK
)) {
1121 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1127 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
1130 // bit 1 - need wupC
1131 // bit 2 - need HALT after sequence
1132 // bit 3 - need init FPGA and field before sequence
1133 // bit 4 - need reset FPGA and LED
1134 uint8_t workFlags
= arg0
;
1135 uint8_t blockNo
= arg2
;
1138 uint8_t wupC1
[] = { 0x40 };
1139 uint8_t wupC2
[] = { 0x43 };
1143 uint8_t data
[18] = {0x00};
1146 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1147 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1149 if (workFlags
& 0x08) {
1156 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1160 if (workFlags
& 0x02) {
1161 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1162 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1163 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1167 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1168 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1169 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1175 if ((mifare_sendcmd_short(NULL
, 0, 0x30, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 18)) {
1176 if (MF_DBGLEVEL
>= 1) Dbprintf("read block send command error");
1179 memcpy(data
, receivedAnswer
, 18);
1181 if (workFlags
& 0x04) {
1182 if (mifare_classic_halt(NULL
, cuid
)) {
1183 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1193 cmd_send(CMD_ACK
,isOK
,0,0,data
,18);
1196 if ((workFlags
& 0x10) || (!isOK
)) {
1197 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1202 void MifareCIdent(){
1205 uint8_t wupC1
[] = { 0x40 };
1206 uint8_t wupC2
[] = { 0x43 };
1211 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1212 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1214 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1215 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1219 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1220 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1224 if (mifare_classic_halt(NULL
, 0)) {
1228 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
1235 void Mifare_DES_Auth1(uint8_t arg0
, uint8_t *datain
){
1237 byte_t dataout
[11] = {0x00};
1238 uint8_t uid
[10] = {0x00};
1242 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1244 int len
= iso14443a_select_card(uid
, NULL
, &cuid
);
1246 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card");
1251 if(mifare_desfire_des_auth1(cuid
, dataout
)){
1252 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Authentication part1: Fail.");
1257 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) DbpString("AUTH 1 FINISHED");
1258 cmd_send(CMD_ACK
,1,cuid
,0,dataout
, sizeof(dataout
));
1261 void Mifare_DES_Auth2(uint32_t arg0
, uint8_t *datain
){
1263 uint32_t cuid
= arg0
;
1264 uint8_t key
[16] = {0x00};
1266 byte_t dataout
[12] = {0x00};
1268 memcpy(key
, datain
, 16);
1270 isOK
= mifare_desfire_des_auth2(cuid
, key
, dataout
);
1273 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
)
1274 Dbprintf("Authentication part2: Failed");
1279 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
)
1280 DbpString("AUTH 2 FINISHED");
1282 cmd_send(CMD_ACK
, isOK
, 0, 0, dataout
, sizeof(dataout
));
1283 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1289 ReaderTransmit(deselect_cmd
, 3 , NULL
);
1290 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1294 void OnError(uint8_t reason
){
1296 ReaderTransmit(deselect_cmd
, 3 , NULL
);
1297 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1298 cmd_send(CMD_ACK
,0,reason
,0,0,0);