git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // Routines to support ISO 14443 type A.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "mifarecmd.h"
  14 #include "apps.h"
  15
  16 //-----------------------------------------------------------------------------
  17 // Select, Authenticaate, Read an MIFARE tag.
  18 // read block
  19 //-----------------------------------------------------------------------------
  20 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  21 {
  22   // params
  23         uint8_t blockNo = arg0;
  24         uint8_t keyType = arg1;
  25         uint64_t ui64Key = 0;
  26         ui64Key = bytes_to_num(datain, 6);
  27
  28         // variables
  29         byte_t isOK = 0;
  30         byte_t dataoutbuf[16];
  31         uint8_t uid[8];
  32         uint32_t cuid;
  33         struct Crypto1State mpcs = {0, 0};
  34         struct Crypto1State *pcs;
  35         pcs = &mpcs;
  36
  37         // clear trace
  38         iso14a_clear_tracelen();
  39 //      iso14a_set_tracing(false);
  40
  41         iso14443a_setup();
  42
  43         LED_A_ON();
  44         LED_B_OFF();
  45         LED_C_OFF();
  46
  47         while (true) {
  48                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  49                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  50                         break;
  51                 };
  52
  53                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  54                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  55                         break;
  56                 };
  57
  58                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  59                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  60                         break;
  61                 };
  62
  63                 if(mifare_classic_halt(pcs, cuid)) {
  64                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  65                         break;
  66                 };
  67
  68                 isOK = 1;
  69                 break;
  70         }
  71
  72         //  ----------------------------- crypto1 destroy
  73         crypto1_destroy(pcs);
  74
  75         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  76
  77         // add trace trailer
  78         memset(uid, 0x44, 4);
  79         LogTrace(uid, 4, 0, 0, TRUE);
  80
  81         UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
  82         memcpy(ack.d.asBytes, dataoutbuf, 16);
  83
  84         LED_B_ON();
  85         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
  86         LED_B_OFF();
  87
  88
  89   // Thats it...
  90         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  91         LEDsoff();
  92 //  iso14a_set_tracing(TRUE);
  93
  94 }
  95
  96 //-----------------------------------------------------------------------------
  97 // Select, Authenticaate, Read an MIFARE tag.
  98 // read sector (data = 4 x 16 bytes = 64 bytes)
  99 //-----------------------------------------------------------------------------
 100 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 101 {
 102   // params
 103         uint8_t sectorNo = arg0;
 104         uint8_t keyType = arg1;
 105         uint64_t ui64Key = 0;
 106         ui64Key = bytes_to_num(datain, 6);
 107
 108         // variables
 109         byte_t isOK = 0;
 110         byte_t dataoutbuf[16 * 4];
 111         uint8_t uid[8];
 112         uint32_t cuid;
 113         struct Crypto1State mpcs = {0, 0};
 114         struct Crypto1State *pcs;
 115         pcs = &mpcs;
 116
 117         // clear trace
 118         iso14a_clear_tracelen();
 119 //      iso14a_set_tracing(false);
 120
 121         iso14443a_setup();
 122
 123         LED_A_ON();
 124         LED_B_OFF();
 125         LED_C_OFF();
 126
 127         while (true) {
 128                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 129                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 130                         break;
 131                 };
 132
 133                 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
 134                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 135                         break;
 136                 };
 137
 138                 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf + 16 * 0)) {
 139                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 0 error");
 140                         break;
 141                 };
 142                 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf + 16 * 1)) {
 143                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 1 error");
 144                         break;
 145                 };
 146                 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf + 16 * 2)) {
 147                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 2 error");
 148                         break;
 149                 };
 150                 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf + 16 * 3)) {
 151                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 3 error");
 152                         break;
 153                 };
 154
 155                 if(mifare_classic_halt(pcs, cuid)) {
 156                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 157                         break;
 158                 };
 159
 160                 isOK = 1;
 161                 break;
 162         }
 163
 164         //  ----------------------------- crypto1 destroy
 165         crypto1_destroy(pcs);
 166
 167         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 168
 169         // add trace trailer
 170         memset(uid, 0x44, 4);
 171         LogTrace(uid, 4, 0, 0, TRUE);
 172
 173         UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
 174         memcpy(ack.d.asBytes, dataoutbuf, 16 * 2);
 175
 176         LED_B_ON();
 177         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 178
 179         SpinDelay(100);
 180
 181         memcpy(ack.d.asBytes, dataoutbuf + 16 * 2, 16 * 2);
 182         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 183         LED_B_OFF();
 184
 185         // Thats it...
 186         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 187         LEDsoff();
 188 //  iso14a_set_tracing(TRUE);
 189
 190 }
 191
 192 //-----------------------------------------------------------------------------
 193 // Select, Authenticaate, Read an MIFARE tag.
 194 // read block
 195 //-----------------------------------------------------------------------------
 196 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 197 {
 198         // params
 199         uint8_t blockNo = arg0;
 200         uint8_t keyType = arg1;
 201         uint64_t ui64Key = 0;
 202         byte_t blockdata[16];
 203
 204         ui64Key = bytes_to_num(datain, 6);
 205         memcpy(blockdata, datain + 10, 16);
 206
 207         // variables
 208         byte_t isOK = 0;
 209         uint8_t uid[8];
 210         uint32_t cuid;
 211         struct Crypto1State mpcs = {0, 0};
 212         struct Crypto1State *pcs;
 213         pcs = &mpcs;
 214
 215         // clear trace
 216         iso14a_clear_tracelen();
 217 //  iso14a_set_tracing(false);
 218
 219         iso14443a_setup();
 220
 221         LED_A_ON();
 222         LED_B_OFF();
 223         LED_C_OFF();
 224
 225         while (true) {
 226                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 227                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 228                         break;
 229                 };
 230
 231                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 232                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 233                         break;
 234                 };
 235
 236                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 237                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 238                         break;
 239                 };
 240
 241                 if(mifare_classic_halt(pcs, cuid)) {
 242                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 243                         break;
 244                 };
 245
 246                 isOK = 1;
 247                 break;
 248         }
 249
 250         //  ----------------------------- crypto1 destroy
 251         crypto1_destroy(pcs);
 252
 253         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 254
 255         // add trace trailer
 256         memset(uid, 0x44, 4);
 257         LogTrace(uid, 4, 0, 0, TRUE);
 258
 259         UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
 260
 261         LED_B_ON();
 262         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 263         LED_B_OFF();
 264
 265
 266         // Thats it...
 267         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 268         LEDsoff();
 269 //  iso14a_set_tracing(TRUE);
 270
 271 }
 272
 273 // Return 1 if the nonce is invalid else return 0
 274 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
 275         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 276         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 277         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 278 }
 279
 280 //-----------------------------------------------------------------------------
 281 // MIFARE nested authentication.
 282 //
 283 //-----------------------------------------------------------------------------
 284 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
 285 {
 286         // params
 287         uint8_t blockNo = arg0;
 288         uint8_t keyType = arg1;
 289         uint8_t targetBlockNo = arg2 & 0xff;
 290         uint8_t targetKeyType = (arg2 >> 8) & 0xff;
 291         uint64_t ui64Key = 0;
 292
 293         ui64Key = bytes_to_num(datain, 6);
 294
 295         // variables
 296         int rtr, i, j, m, len;
 297         int davg, dmin, dmax;
 298         uint8_t uid[8];
 299         uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
 300         uint8_t par_array[4];
 301         nestedVector nvector[NES_MAX_INFO + 1][11];
 302         int nvectorcount[NES_MAX_INFO + 1];
 303         int ncount = 0;
 304         UsbCommand ack = {CMD_ACK, {0, 0, 0}};
 305         struct Crypto1State mpcs = {0, 0};
 306         struct Crypto1State *pcs;
 307         pcs = &mpcs;
 308         uint8_t* receivedAnswer = mifare_get_bigbufptr();
 309
 310         //init
 311         for (i = 0; i < NES_MAX_INFO + 1; i++) nvectorcount[i] = 11;  //  11 - empty block;
 312
 313         // clear trace
 314         iso14a_clear_tracelen();
 315   iso14a_set_tracing(false);
 316
 317         iso14443a_setup();
 318
 319         LED_A_ON();
 320         LED_B_ON();
 321         LED_C_OFF();
 322
 323   FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 324   SpinDelay(200);
 325
 326         davg = dmax = 0;
 327         dmin = 2000;
 328
 329         // test nonce distance
 330         for (rtr = 0; rtr < 10; rtr++) {
 331     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 332     SpinDelay(100);
 333     FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 334
 335     // Test if the action was cancelled
 336     if(BUTTON_PRESS()) {
 337       break;
 338     }
 339
 340                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 341                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 342                         break;
 343                 };
 344
 345                 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
 346                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth1 error");
 347                         break;
 348                 };
 349
 350                 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2)) {
 351                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth2 error");
 352                         break;
 353                 };
 354
 355                 nttmp = prng_successor(nt1, 500);
 356                 for (i = 501; i < 2000; i++) {
 357                         nttmp = prng_successor(nttmp, 1);
 358                         if (nttmp == nt2) break;
 359                 }
 360
 361                 if (i != 2000) {
 362                         davg += i;
 363                         if (dmin > i) dmin = i;
 364                         if (dmax < i) dmax = i;
 365                         if (MF_DBGLEVEL >= 4)   Dbprintf("r=%d nt1=%08x nt2=%08x distance=%d", rtr, nt1, nt2, i);
 366                 }
 367         }
 368
 369         if (rtr == 0)   return;
 370
 371         davg = davg / rtr;
 372         if (MF_DBGLEVEL >= 3)   Dbprintf("distance: min=%d max=%d avg=%d", dmin, dmax, davg);
 373
 374         LED_B_OFF();
 375
 376 //  -------------------------------------------------------------------------------------------------
 377
 378         LED_C_ON();
 379
 380         //  get crypted nonces for target sector
 381         for (rtr = 0; rtr < NS_RETRIES_GETNONCE; rtr++) {
 382         if (MF_DBGLEVEL >= 4)                   Dbprintf("------------------------------");
 383
 384                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 385     SpinDelay(100);
 386     FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 387
 388     // Test if the action was cancelled
 389     if(BUTTON_PRESS()) {
 390       break;
 391     }
 392
 393                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 394                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 395                         break;
 396                 };
 397
 398                 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
 399                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth1 error");
 400                         break;
 401                 };
 402
 403                 // nested authentication
 404                 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par);
 405                 if (len != 4) {
 406                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth2 error len=%d", len);
 407                         break;
 408                 };
 409
 410                 nt2 = bytes_to_num(receivedAnswer, 4);
 411                 if (MF_DBGLEVEL >= 4)   Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
 412
 413                 // Parity validity check
 414                 for (i = 0; i < 4; i++) {
 415                         par_array[i] = (oddparity(receivedAnswer[i]) != ((par & 0x08) >> 3));
 416                         par = par << 1;
 417                 }
 418
 419                 ncount = 0;
 420                 for (m = dmin - NS_TOLERANCE; m < dmax + NS_TOLERANCE; m++) {
 421                         nttest = prng_successor(nt1, m);
 422                         ks1 = nt2 ^ nttest;
 423
 424                         if (valid_nonce(nttest, nt2, ks1, par_array) && (ncount < 11)){
 425
 426                                 nvector[NES_MAX_INFO][ncount].nt = nttest;
 427                                 nvector[NES_MAX_INFO][ncount].ks1 = ks1;
 428                                 ncount++;
 429                                 nvectorcount[NES_MAX_INFO] = ncount;
 430                                 if (MF_DBGLEVEL >= 4)   Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
 431                         }
 432
 433                 }
 434
 435                 // select vector with length less than got
 436                 if (nvectorcount[NES_MAX_INFO] != 0) {
 437                         m = NES_MAX_INFO;
 438
 439                         for (i = 0; i < NES_MAX_INFO; i++)
 440                                 if (nvectorcount[i] > 10) {
 441                                         m = i;
 442                                         break;
 443                                 }
 444
 445                         if (m == NES_MAX_INFO)
 446                                 for (i = 0; i < NES_MAX_INFO; i++)
 447                                         if (nvectorcount[NES_MAX_INFO] < nvectorcount[i]) {
 448                                                 m = i;
 449                                                 break;
 450                                         }
 451
 452                         if (m != NES_MAX_INFO) {
 453                                 for (i = 0; i < nvectorcount[m]; i++) {
 454                                         nvector[m][i] = nvector[NES_MAX_INFO][i];
 455                                 }
 456                                 nvectorcount[m] = nvectorcount[NES_MAX_INFO];
 457                         }
 458                 }
 459         }
 460
 461         LED_C_OFF();
 462
 463         //  ----------------------------- crypto1 destroy
 464         crypto1_destroy(pcs);
 465
 466         // add trace trailer
 467         memset(uid, 0x44, 4);
 468         LogTrace(uid, 4, 0, 0, TRUE);
 469
 470         for (i = 0; i < NES_MAX_INFO; i++) {
 471                 if (nvectorcount[i] > 10) continue;
 472
 473                 for (j = 0; j < nvectorcount[i]; j += 5) {
 474                         ncount = nvectorcount[i] - j;
 475                         if (ncount > 5) ncount = 5;
 476
 477                         ack.arg[0] = 0; // isEOF = 0
 478                         ack.arg[1] = ncount;
 479                         ack.arg[2] = targetBlockNo + (targetKeyType * 0x100);
 480                         memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
 481
 482                         memcpy(ack.d.asBytes, &cuid, 4);
 483                         for (m = 0; m < ncount; m++) {
 484                                 memcpy(ack.d.asBytes + 8 + m * 8 + 0, &nvector[i][m + j].nt, 4);
 485                                 memcpy(ack.d.asBytes + 8 + m * 8 + 4, &nvector[i][m + j].ks1, 4);
 486                         }
 487
 488                         LED_B_ON();
 489                         SpinDelay(100);
 490                         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 491                         LED_B_OFF();
 492                 }
 493         }
 494
 495         // finalize list
 496         ack.arg[0] = 1; // isEOF = 1
 497         ack.arg[1] = 0;
 498         ack.arg[2] = 0;
 499         memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
 500
 501         LED_B_ON();
 502         SpinDelay(300);
 503         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 504         LED_B_OFF();
 505
 506         if (MF_DBGLEVEL >= 4)   DbpString("NESTED FINISHED");
 507
 508         // Thats it...
 509         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 510         LEDsoff();
 511
 512   iso14a_set_tracing(TRUE);
 513 }
 514
 515 //-----------------------------------------------------------------------------
 516 // MIFARE check keys. key count up to 8.
 517 //
 518 //-----------------------------------------------------------------------------
 519 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 520 {
 521   // params
 522         uint8_t blockNo = arg0;
 523         uint8_t keyType = arg1;
 524         uint8_t keyCount = arg2;
 525         uint64_t ui64Key = 0;
 526
 527         // variables
 528         int i;
 529         byte_t isOK = 0;
 530         uint8_t uid[8];
 531         uint32_t cuid;
 532         struct Crypto1State mpcs = {0, 0};
 533         struct Crypto1State *pcs;
 534         pcs = &mpcs;
 535
 536         // clear debug level
 537         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 538         MF_DBGLEVEL = MF_DBG_NONE;
 539
 540         // clear trace
 541         iso14a_clear_tracelen();
 542   iso14a_set_tracing(TRUE);
 543
 544         iso14443a_setup();
 545
 546         LED_A_ON();
 547         LED_B_OFF();
 548         LED_C_OFF();
 549
 550         SpinDelay(300);
 551         for (i = 0; i < keyCount; i++) {
 552                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 553     SpinDelay(100);
 554     FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 555
 556                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 557                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("Can't select card");
 558                         break;
 559                 };
 560
 561                 ui64Key = bytes_to_num(datain + i * 6, 6);
 562                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 563                         continue;
 564                 };
 565
 566                 isOK = 1;
 567                 break;
 568         }
 569
 570         //  ----------------------------- crypto1 destroy
 571         crypto1_destroy(pcs);
 572
 573         // add trace trailer
 574         memset(uid, 0x44, 4);
 575         LogTrace(uid, 4, 0, 0, TRUE);
 576
 577         UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
 578         if (isOK) memcpy(ack.d.asBytes, datain + i * 6, 6);
 579
 580         LED_B_ON();
 581         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 582         LED_B_OFF();
 583
 584   // Thats it...
 585         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 586         LEDsoff();
 587
 588         // restore debug level
 589         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 590 }
 591
 592 //-----------------------------------------------------------------------------
 593 // MIFARE commands set debug level
 594 //
 595 //-----------------------------------------------------------------------------
 596 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 597         MF_DBGLEVEL = arg0;
 598         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 599 }
 600
 601 //-----------------------------------------------------------------------------
 602 // Work with emulator memory
 603 //
 604 //-----------------------------------------------------------------------------
 605 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 606         emlClearMem();
 607 }
 608
 609 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 610         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 611 }
 612
 613 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 614         UsbCommand ack = {CMD_ACK, {arg0, arg1, 0}};
 615
 616         emlGetMem(ack.d.asBytes, arg0, arg1); // data, block num, blocks count
 617
 618         LED_B_ON();
 619         UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 620         LED_B_OFF();
 621 }
 622
 623 //-----------------------------------------------------------------------------
 624 // Load a card into the emulator memory
 625 //
 626 //-----------------------------------------------------------------------------
 627 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 628         int i;
 629         uint8_t sectorNo = 0;
 630         uint8_t keyType = arg1;
 631         uint64_t ui64Key = 0;
 632         uint32_t cuid;
 633         struct Crypto1State mpcs = {0, 0};
 634         struct Crypto1State *pcs;
 635         pcs = &mpcs;
 636
 637         // variables
 638         byte_t dataoutbuf[16];
 639         byte_t dataoutbuf2[16];
 640         uint8_t uid[8];
 641
 642         // clear trace
 643         iso14a_clear_tracelen();
 644         iso14a_set_tracing(false);
 645
 646         iso14443a_setup();
 647
 648         LED_A_ON();
 649         LED_B_OFF();
 650         LED_C_OFF();
 651
 652         while (true) {
 653                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 654                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 655                         break;
 656                 };
 657
 658                 for (i = 0; i < 16; i++) {
 659                         sectorNo = i;
 660                         ui64Key = emlGetKey(sectorNo, keyType);
 661
 662                         if (!i){
 663                                 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
 664                                         if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%d]. Auth error", i);
 665                                         break;
 666                                 }
 667                         } else {
 668                                 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_NESTED)) {
 669                                         if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%d]. Auth nested error", i);
 670                                         break;
 671                                 }
 672                         }
 673
 674                         if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf)) {
 675                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 0 error");
 676                                 break;
 677                         };
 678                         emlSetMem(dataoutbuf, sectorNo * 4 + 0, 1);
 679
 680                         if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf)) {
 681                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 1 error");
 682                                 break;
 683                         };
 684                         emlSetMem(dataoutbuf, sectorNo * 4 + 1, 1);
 685
 686                         if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf)) {
 687                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 2 error");
 688                                 break;
 689                         };
 690                         emlSetMem(dataoutbuf, sectorNo * 4 + 2, 1);
 691
 692                         // get block 3 bytes 6-9
 693                         if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf)) {
 694                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Read block 3 error");
 695                                 break;
 696                         };
 697                         emlGetMem(dataoutbuf2, sectorNo * 4 + 3, 1);
 698                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 699                         emlSetMem(dataoutbuf2,  sectorNo * 4 + 3, 1);
 700                 }
 701
 702                 if(mifare_classic_halt(pcs, cuid)) {
 703                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 704                         break;
 705                 };
 706
 707                 break;
 708         }
 709
 710         //  ----------------------------- crypto1 destroy
 711         crypto1_destroy(pcs);
 712
 713         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 714         LEDsoff();
 715
 716         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 717
 718         // add trace trailer
 719         memset(uid, 0x44, 4);
 720         LogTrace(uid, 4, 0, 0, TRUE);
 721 }
 722
 723 //-----------------------------------------------------------------------------
 724 // MIFARE 1k emulator
 725 //
 726 //-----------------------------------------------------------------------------
 727