]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
6be5b3837aecdc5e57a68e5890314aaa30d205fe
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "mifarecmd.h"
14 #include "apps.h"
15
16 //-----------------------------------------------------------------------------
17 // Select, Authenticate, Read a MIFARE tag.
18 // read block
19 //-----------------------------------------------------------------------------
20 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
21 {
22 // params
23 uint8_t blockNo = arg0;
24 uint8_t keyType = arg1;
25 uint64_t ui64Key = 0;
26 ui64Key = bytes_to_num(datain, 6);
27
28 // variables
29 byte_t isOK = 0;
30 byte_t dataoutbuf[16];
31 uint8_t uid[10];
32 uint32_t cuid;
33 struct Crypto1State mpcs = {0, 0};
34 struct Crypto1State *pcs;
35 pcs = &mpcs;
36
37 // clear trace
38 iso14a_clear_trace();
39 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
40
41 LED_A_ON();
42 LED_B_OFF();
43 LED_C_OFF();
44
45 while (true) {
46 if(!iso14443a_select_card(uid, NULL, &cuid)) {
47 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
48 break;
49 };
50
51 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
52 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
53 break;
54 };
55
56 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
57 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
58 break;
59 };
60
61 if(mifare_classic_halt(pcs, cuid)) {
62 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
63 break;
64 };
65
66 isOK = 1;
67 break;
68 }
69
70 // ----------------------------- crypto1 destroy
71 crypto1_destroy(pcs);
72
73 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
74
75 LED_B_ON();
76 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
77 LED_B_OFF();
78
79 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
80 LEDsoff();
81
82 }
83
84 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
85 {
86 // params
87 uint8_t blockNo = arg0;
88
89 // variables
90 byte_t isOK = 0;
91 byte_t dataoutbuf[16];
92 uint8_t uid[10];
93 uint32_t cuid;
94
95 // clear trace
96 iso14a_clear_trace();
97 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
98
99 LED_A_ON();
100 LED_B_OFF();
101 LED_C_OFF();
102
103 while (true) {
104 if(!iso14443a_select_card(uid, NULL, &cuid)) {
105 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
106 break;
107 };
108
109 if(mifare_ultra_readblock(cuid, blockNo, dataoutbuf)) {
110 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
111 break;
112 };
113
114 if(mifare_ultra_halt(cuid)) {
115 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
116 break;
117 };
118
119 isOK = 1;
120 break;
121 }
122
123 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
124
125 LED_B_ON();
126 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
127 LED_B_OFF();
128 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
129 LEDsoff();
130 }
131
132
133 //-----------------------------------------------------------------------------
134 // Select, Authenticate, Read a MIFARE tag.
135 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
136 //-----------------------------------------------------------------------------
137 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
138 {
139 // params
140 uint8_t sectorNo = arg0;
141 uint8_t keyType = arg1;
142 uint64_t ui64Key = 0;
143 ui64Key = bytes_to_num(datain, 6);
144
145 // variables
146 byte_t isOK = 0;
147 byte_t dataoutbuf[16 * 16];
148 uint8_t uid[10];
149 uint32_t cuid;
150 struct Crypto1State mpcs = {0, 0};
151 struct Crypto1State *pcs;
152 pcs = &mpcs;
153
154 // clear trace
155 iso14a_clear_trace();
156
157 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
158
159 LED_A_ON();
160 LED_B_OFF();
161 LED_C_OFF();
162
163 isOK = 1;
164 if(!iso14443a_select_card(uid, NULL, &cuid)) {
165 isOK = 0;
166 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
167 }
168
169
170 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
171 isOK = 0;
172 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
173 }
174
175 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
176 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
177 isOK = 0;
178 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
179 break;
180 }
181 }
182
183 if(mifare_classic_halt(pcs, cuid)) {
184 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
185 }
186
187 // ----------------------------- crypto1 destroy
188 crypto1_destroy(pcs);
189
190 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
191
192 LED_B_ON();
193 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
194 LED_B_OFF();
195
196 // Thats it...
197 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
198 LEDsoff();
199 }
200
201
202 void MifareUReadCard(uint8_t arg0, uint8_t *datain)
203 {
204 // params
205 uint8_t sectorNo = arg0;
206
207 // variables
208 byte_t isOK = 0;
209 byte_t dataoutbuf[16 * 4];
210 uint8_t uid[10];
211 uint32_t cuid;
212
213 // clear trace
214 iso14a_clear_trace();
215
216 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
217
218 LED_A_ON();
219 LED_B_OFF();
220 LED_C_OFF();
221
222 while (true) {
223 if(!iso14443a_select_card(uid, NULL, &cuid)) {
224 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
225 break;
226 };
227 for(int sec=0;sec<16;sec++){
228 if(mifare_ultra_readblock(cuid, sectorNo * 4 + sec, dataoutbuf + 4 * sec)) {
229 if (MF_DBGLEVEL >= 1) Dbprintf("Read block %d error",sec);
230 break;
231 };
232 }
233 if(mifare_ultra_halt(cuid)) {
234 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
235 break;
236 };
237
238 isOK = 1;
239 break;
240 }
241
242 if (MF_DBGLEVEL >= 2) DbpString("READ CARD FINISHED");
243
244 LED_B_ON();
245 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
246 LED_B_OFF();
247
248 // Thats it...
249 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
250 LEDsoff();
251
252 }
253
254
255 //-----------------------------------------------------------------------------
256 // Select, Authenticate, Write a MIFARE tag.
257 // read block
258 //-----------------------------------------------------------------------------
259 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
260 {
261 // params
262 uint8_t blockNo = arg0;
263 uint8_t keyType = arg1;
264 uint64_t ui64Key = 0;
265 byte_t blockdata[16];
266
267 ui64Key = bytes_to_num(datain, 6);
268 memcpy(blockdata, datain + 10, 16);
269
270 // variables
271 byte_t isOK = 0;
272 uint8_t uid[10];
273 uint32_t cuid;
274 struct Crypto1State mpcs = {0, 0};
275 struct Crypto1State *pcs;
276 pcs = &mpcs;
277
278 // clear trace
279 iso14a_clear_trace();
280
281 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
282
283 LED_A_ON();
284 LED_B_OFF();
285 LED_C_OFF();
286
287 while (true) {
288 if(!iso14443a_select_card(uid, NULL, &cuid)) {
289 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
290 break;
291 };
292
293 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
294 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
295 break;
296 };
297
298 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
299 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
300 break;
301 };
302
303 if(mifare_classic_halt(pcs, cuid)) {
304 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
305 break;
306 };
307
308 isOK = 1;
309 break;
310 }
311
312 // ----------------------------- crypto1 destroy
313 crypto1_destroy(pcs);
314
315 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
316
317 LED_B_ON();
318 cmd_send(CMD_ACK,isOK,0,0,0,0);
319 LED_B_OFF();
320
321
322 // Thats it...
323 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
324 LEDsoff();
325 }
326
327 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
328 {
329 // params
330 uint8_t blockNo = arg0;
331 byte_t blockdata[16];
332
333 memset(blockdata,'\0',16);
334 memcpy(blockdata, datain,16);
335
336 // variables
337 byte_t isOK = 0;
338 uint8_t uid[10];
339 uint32_t cuid;
340
341 // clear trace
342 iso14a_clear_trace();
343
344 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
345
346 LED_A_ON();
347 LED_B_OFF();
348 LED_C_OFF();
349
350 while (true) {
351 if(!iso14443a_select_card(uid, NULL, &cuid)) {
352 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
353 break;
354 };
355
356 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
357 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
358 break;
359 };
360
361 if(mifare_ultra_halt(cuid)) {
362 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
363 break;
364 };
365
366 isOK = 1;
367 break;
368 }
369
370 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
371
372 LED_B_ON();
373 cmd_send(CMD_ACK,isOK,0,0,0,0);
374 LED_B_OFF();
375
376
377 // Thats it...
378 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
379 LEDsoff();
380 // iso14a_set_tracing(TRUE);
381 }
382
383 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
384 {
385 // params
386 uint8_t blockNo = arg0;
387 byte_t blockdata[4];
388
389 memcpy(blockdata, datain,4);
390
391 // variables
392 byte_t isOK = 0;
393 uint8_t uid[10];
394 uint32_t cuid;
395
396 // clear trace
397 iso14a_clear_trace();
398
399 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
400
401 LED_A_ON();
402 LED_B_OFF();
403 LED_C_OFF();
404
405 while (true) {
406 if(!iso14443a_select_card(uid, NULL, &cuid)) {
407 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
408 break;
409 };
410
411 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
412 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
413 break;
414 };
415
416 if(mifare_ultra_halt(cuid)) {
417 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
418 break;
419 };
420
421 isOK = 1;
422 break;
423 }
424
425 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
426
427 LED_B_ON();
428 cmd_send(CMD_ACK,isOK,0,0,0,0);
429 LED_B_OFF();
430
431 // Thats it...
432 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
433 LEDsoff();
434 }
435
436 // Return 1 if the nonce is invalid else return 0
437 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
438 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
439 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
440 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
441 }
442
443
444 //-----------------------------------------------------------------------------
445 // MIFARE nested authentication.
446 //
447 //-----------------------------------------------------------------------------
448 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
449 {
450 // params
451 uint8_t blockNo = arg0 & 0xff;
452 uint8_t keyType = (arg0 >> 8) & 0xff;
453 uint8_t targetBlockNo = arg1 & 0xff;
454 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
455 uint64_t ui64Key = 0;
456
457 ui64Key = bytes_to_num(datain, 6);
458
459 // variables
460 uint16_t rtr, i, j, len;
461 uint16_t davg;
462 static uint16_t dmin, dmax;
463 uint8_t uid[10];
464 uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
465 uint32_t target_nt[2], target_ks[2];
466
467 uint8_t par_array[4];
468 uint16_t ncount = 0;
469 struct Crypto1State mpcs = {0, 0};
470 struct Crypto1State *pcs;
471 pcs = &mpcs;
472 uint8_t* receivedAnswer = mifare_get_bigbufptr();
473
474 uint32_t auth1_time, auth2_time;
475 static uint16_t delta_time;
476
477 // clear trace
478 iso14a_clear_trace();
479 iso14a_set_tracing(false);
480
481 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
482
483 LED_A_ON();
484 LED_C_OFF();
485
486
487 // statistics on nonce distance
488 if (calibrate) { // for first call only. Otherwise reuse previous calibration
489 LED_B_ON();
490
491 davg = dmax = 0;
492 dmin = 2000;
493 delta_time = 0;
494
495 for (rtr = 0; rtr < 17; rtr++) {
496
497 // prepare next select. No need to power down the card.
498 if(mifare_classic_halt(pcs, cuid)) {
499 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
500 rtr--;
501 continue;
502 }
503
504 if(!iso14443a_select_card(uid, NULL, &cuid)) {
505 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
506 rtr--;
507 continue;
508 };
509
510 auth1_time = 0;
511 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
512 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
513 rtr--;
514 continue;
515 };
516
517 if (delta_time) {
518 auth2_time = auth1_time + delta_time;
519 } else {
520 auth2_time = 0;
521 }
522 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
523 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
524 rtr--;
525 continue;
526 };
527
528 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
529 for (i = 101; i < 1200; i++) {
530 nttmp = prng_successor(nttmp, 1);
531 if (nttmp == nt2) break;
532 }
533
534 if (i != 1200) {
535 if (rtr != 0) {
536 davg += i;
537 dmin = MIN(dmin, i);
538 dmax = MAX(dmax, i);
539 }
540 else {
541 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
542 }
543 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
544 }
545 }
546
547 if (rtr <= 1) return;
548
549 davg = (davg + (rtr - 1)/2) / (rtr - 1);
550
551 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
552
553 dmin = davg - 2;
554 dmax = davg + 2;
555
556 LED_B_OFF();
557
558 }
559 // -------------------------------------------------------------------------------------------------
560
561 LED_C_ON();
562
563 // get crypted nonces for target sector
564 for(i=0; i < 2; i++) { // look for exactly two different nonces
565
566 target_nt[i] = 0;
567 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
568
569 // prepare next select. No need to power down the card.
570 if(mifare_classic_halt(pcs, cuid)) {
571 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
572 continue;
573 }
574
575 if(!iso14443a_select_card(uid, NULL, &cuid)) {
576 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
577 continue;
578 };
579
580 auth1_time = 0;
581 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
582 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
583 continue;
584 };
585
586 // nested authentication
587 auth2_time = auth1_time + delta_time;
588 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par, &auth2_time);
589 if (len != 4) {
590 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
591 continue;
592 };
593
594 nt2 = bytes_to_num(receivedAnswer, 4);
595 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par);
596
597 // Parity validity check
598 for (j = 0; j < 4; j++) {
599 par_array[j] = (oddparity(receivedAnswer[j]) != ((par & 0x08) >> 3));
600 par = par << 1;
601 }
602
603 ncount = 0;
604 nttest = prng_successor(nt1, dmin - 1);
605 for (j = dmin; j < dmax + 1; j++) {
606 nttest = prng_successor(nttest, 1);
607 ks1 = nt2 ^ nttest;
608
609 if (valid_nonce(nttest, nt2, ks1, par_array)){
610 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
611 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
612 target_nt[i] = 0;
613 break;
614 }
615 target_nt[i] = nttest;
616 target_ks[i] = ks1;
617 ncount++;
618 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
619 target_nt[i] = 0;
620 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
621 break;
622 }
623 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
624 }
625 }
626 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
627 }
628 }
629
630 LED_C_OFF();
631
632 // ----------------------------- crypto1 destroy
633 crypto1_destroy(pcs);
634
635 // add trace trailer
636 memset(uid, 0x44, 4);
637 LogTrace(uid, 4, 0, 0, TRUE);
638
639 byte_t buf[4 + 4 * 4];
640 memcpy(buf, &cuid, 4);
641 memcpy(buf+4, &target_nt[0], 4);
642 memcpy(buf+8, &target_ks[0], 4);
643 memcpy(buf+12, &target_nt[1], 4);
644 memcpy(buf+16, &target_ks[1], 4);
645
646 LED_B_ON();
647 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
648 LED_B_OFF();
649
650 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
651
652 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
653 LEDsoff();
654 iso14a_set_tracing(TRUE);
655 }
656
657 //-----------------------------------------------------------------------------
658 // MIFARE check keys. key count up to 85.
659 //
660 //-----------------------------------------------------------------------------
661 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
662 {
663 // params
664 uint8_t blockNo = arg0;
665 uint8_t keyType = arg1;
666 uint8_t keyCount = arg2;
667 uint64_t ui64Key = 0;
668
669 // variables
670 int i;
671 byte_t isOK = 0;
672 uint8_t uid[10];
673 uint32_t cuid;
674 struct Crypto1State mpcs = {0, 0};
675 struct Crypto1State *pcs;
676 pcs = &mpcs;
677
678 // clear debug level
679 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
680 MF_DBGLEVEL = MF_DBG_NONE;
681
682 // clear trace
683 iso14a_clear_trace();
684 iso14a_set_tracing(TRUE);
685
686 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
687
688 LED_A_ON();
689 LED_B_OFF();
690 LED_C_OFF();
691
692 for (i = 0; i < keyCount; i++) {
693 if(mifare_classic_halt(pcs, cuid)) {
694 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
695 }
696
697 if(!iso14443a_select_card(uid, NULL, &cuid)) {
698 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
699 break;
700 };
701
702 ui64Key = bytes_to_num(datain + i * 6, 6);
703 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
704 continue;
705 };
706
707 isOK = 1;
708 break;
709 }
710
711 // ----------------------------- crypto1 destroy
712 crypto1_destroy(pcs);
713
714 LED_B_ON();
715 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
716 LED_B_OFF();
717
718 // Thats it...
719 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
720 LEDsoff();
721
722 // restore debug level
723 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
724 }
725
726 //-----------------------------------------------------------------------------
727 // MIFARE commands set debug level
728 //
729 //-----------------------------------------------------------------------------
730 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
731 MF_DBGLEVEL = arg0;
732 Dbprintf("Debug level: %d", MF_DBGLEVEL);
733 }
734
735 //-----------------------------------------------------------------------------
736 // Work with emulator memory
737 //
738 //-----------------------------------------------------------------------------
739 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
740 emlClearMem();
741 }
742
743 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
744 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
745 }
746
747 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
748 byte_t buf[48];
749 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
750
751 LED_B_ON();
752 cmd_send(CMD_ACK,arg0,arg1,0,buf,48);
753 LED_B_OFF();
754 }
755
756 //-----------------------------------------------------------------------------
757 // Load a card into the emulator memory
758 //
759 //-----------------------------------------------------------------------------
760 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
761 uint8_t numSectors = arg0;
762 uint8_t keyType = arg1;
763 uint64_t ui64Key = 0;
764 uint32_t cuid;
765 struct Crypto1State mpcs = {0, 0};
766 struct Crypto1State *pcs;
767 pcs = &mpcs;
768
769 // variables
770 byte_t dataoutbuf[16];
771 byte_t dataoutbuf2[16];
772 uint8_t uid[10];
773
774 // clear trace
775 iso14a_clear_trace();
776 iso14a_set_tracing(false);
777
778 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
779
780 LED_A_ON();
781 LED_B_OFF();
782 LED_C_OFF();
783
784 bool isOK = true;
785
786 if(!iso14443a_select_card(uid, NULL, &cuid)) {
787 isOK = false;
788 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
789 }
790
791 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
792 ui64Key = emlGetKey(sectorNo, keyType);
793 if (sectorNo == 0){
794 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
795 isOK = false;
796 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
797 break;
798 }
799 } else {
800 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
801 isOK = false;
802 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
803 break;
804 }
805 }
806
807 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
808 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
809 isOK = false;
810 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
811 break;
812 };
813 if (isOK) {
814 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
815 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
816 } else { // sector trailer, keep the keys, set only the AC
817 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
818 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
819 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
820 }
821 }
822 }
823
824 }
825
826 if(mifare_classic_halt(pcs, cuid)) {
827 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
828 };
829
830 // ----------------------------- crypto1 destroy
831 crypto1_destroy(pcs);
832
833 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
834 LEDsoff();
835
836 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
837
838 }
839
840
841 //-----------------------------------------------------------------------------
842 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
843 //
844 //-----------------------------------------------------------------------------
845 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
846
847 // params
848 uint8_t needWipe = arg0;
849 // bit 0 - need get UID
850 // bit 1 - need wupC
851 // bit 2 - need HALT after sequence
852 // bit 3 - need init FPGA and field before sequence
853 // bit 4 - need reset FPGA and LED
854 uint8_t workFlags = arg1;
855 uint8_t blockNo = arg2;
856
857 // card commands
858 uint8_t wupC1[] = { 0x40 };
859 uint8_t wupC2[] = { 0x43 };
860 uint8_t wipeC[] = { 0x41 };
861
862 // variables
863 byte_t isOK = 0;
864 uint8_t uid[10];
865 uint8_t d_block[18];
866 uint32_t cuid;
867
868 memset(uid, 0x00, 10);
869 uint8_t* receivedAnswer = mifare_get_bigbufptr();
870
871 if (workFlags & 0x08) {
872 // clear trace
873 iso14a_clear_trace();
874 iso14a_set_tracing(TRUE);
875
876 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
877
878 LED_A_ON();
879 LED_B_OFF();
880 LED_C_OFF();
881
882 SpinDelay(300);
883 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
884 SpinDelay(100);
885 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
886 }
887
888 while (true) {
889 // get UID from chip
890 if (workFlags & 0x01) {
891 if(!iso14443a_select_card(uid, NULL, &cuid)) {
892 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
893 break;
894 };
895
896 if(mifare_classic_halt(NULL, cuid)) {
897 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
898 break;
899 };
900 };
901
902 // reset chip
903 if (needWipe){
904 ReaderTransmitBitsPar(wupC1,7,0, NULL);
905 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
906 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
907 break;
908 };
909
910 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
911 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
912 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
913 break;
914 };
915
916 if(mifare_classic_halt(NULL, cuid)) {
917 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
918 break;
919 };
920 };
921
922 // write block
923 if (workFlags & 0x02) {
924 ReaderTransmitBitsPar(wupC1,7,0, NULL);
925 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
926 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
927 break;
928 };
929
930 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
931 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
932 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
933 break;
934 };
935 }
936
937 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
938 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
939 break;
940 };
941
942 memcpy(d_block, datain, 16);
943 AppendCrc14443a(d_block, 16);
944
945 ReaderTransmit(d_block, sizeof(d_block), NULL);
946 if ((ReaderReceive(receivedAnswer) != 1) || (receivedAnswer[0] != 0x0a)) {
947 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
948 break;
949 };
950
951 if (workFlags & 0x04) {
952 if (mifare_classic_halt(NULL, cuid)) {
953 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
954 break;
955 };
956 }
957
958 isOK = 1;
959 break;
960 }
961
962 LED_B_ON();
963 cmd_send(CMD_ACK,isOK,0,0,uid,4);
964 LED_B_OFF();
965
966 if ((workFlags & 0x10) || (!isOK)) {
967 // Thats it...
968 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
969 LEDsoff();
970 }
971 }
972
973
974 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
975
976 // params
977 // bit 1 - need wupC
978 // bit 2 - need HALT after sequence
979 // bit 3 - need init FPGA and field before sequence
980 // bit 4 - need reset FPGA and LED
981 uint8_t workFlags = arg0;
982 uint8_t blockNo = arg2;
983
984 // card commands
985 uint8_t wupC1[] = { 0x40 };
986 uint8_t wupC2[] = { 0x43 };
987
988 // variables
989 byte_t isOK = 0;
990 uint8_t data[18];
991 uint32_t cuid = 0;
992
993 memset(data, 0x00, 18);
994 uint8_t* receivedAnswer = mifare_get_bigbufptr();
995
996 if (workFlags & 0x08) {
997 // clear trace
998 iso14a_clear_trace();
999 iso14a_set_tracing(TRUE);
1000
1001 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1002
1003 LED_A_ON();
1004 LED_B_OFF();
1005 LED_C_OFF();
1006
1007 SpinDelay(300);
1008 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1009 SpinDelay(100);
1010 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1011 }
1012
1013 while (true) {
1014 if (workFlags & 0x02) {
1015 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1016 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
1017 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1018 break;
1019 };
1020
1021 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1022 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
1023 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1024 break;
1025 };
1026 }
1027
1028 // read block
1029 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, NULL) != 18)) {
1030 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1031 break;
1032 };
1033 memcpy(data, receivedAnswer, 18);
1034
1035 if (workFlags & 0x04) {
1036 if (mifare_classic_halt(NULL, cuid)) {
1037 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1038 break;
1039 };
1040 }
1041
1042 isOK = 1;
1043 break;
1044 }
1045
1046 LED_B_ON();
1047 cmd_send(CMD_ACK,isOK,0,0,data,18);
1048 LED_B_OFF();
1049
1050 if ((workFlags & 0x10) || (!isOK)) {
1051 // Thats it...
1052 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1053 LEDsoff();
1054 }
1055 }
1056
Impressum, Datenschutz