]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
projects / proxmark3-svn / blob
? search:


89afe06a42f8a626df3b564d21e16d13826eb2f1
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17
18 #include <stdint.h>
19
20 #include "proxmark3.h"
21 #include "cmd.h"
22 #include "crapto1/crapto1.h"
23 #include "iso14443a.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "apps.h"
27 #include "protocols.h"
28 #include "util.h"
29 #include "parity.h"
30 #include "crc.h"
31 #include "fpgaloader.h"
32
33 #define HARDNESTED_AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)
34 #define HARDNESTED_PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication
35
36 /*
37 // the block number for the ISO14443-4 PCB
38 static uint8_t pcb_blocknum = 0;
39 // Deselect card by sending a s-block. the crc is precalced for speed
40 static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
41
42 static void OnSuccess(){
43 pcb_blocknum = 0;
44 ReaderTransmit(deselect_cmd, 3 , NULL);
45 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
46 LEDsoff();
47 }
48 */
49
50 static void OnError(uint8_t reason){
51 // pcb_blocknum = 0;
52 // ReaderTransmit(deselect_cmd, 3 , NULL);
53 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
54 LED_D_OFF();
55 cmd_send(CMD_ACK,0,reason,0,0,0);
56 LED_A_OFF();
57 }
58
59 //-----------------------------------------------------------------------------
60 // Select, Authenticate, Read a MIFARE tag.
61 // read block
62 //-----------------------------------------------------------------------------
63 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
64 {
65 LED_A_ON();
66
67 uint8_t blockNo = arg0;
68 uint8_t keyType = arg1;
69 uint64_t ui64Key = 0;
70 ui64Key = bytes_to_num(datain, 6);
71
72 byte_t isOK = 0;
73 byte_t dataoutbuf[16];
74 uint8_t uid[10];
75 uint32_t cuid;
76 struct Crypto1State mpcs = {0, 0};
77 struct Crypto1State *pcs;
78 pcs = &mpcs;
79
80 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
81
82 clear_trace();
83
84 while (true) {
85 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
86 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
87 break;
88 };
89
90 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
91 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
92 break;
93 };
94
95 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
96 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
97 break;
98 };
99
100 if(mifare_classic_halt(pcs, cuid)) {
101 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
102 break;
103 };
104
105 isOK = 1;
106 break;
107 }
108
109 // ----------------------------- crypto1 destroy
110 crypto1_destroy(pcs);
111
112 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
113
114 LED_B_ON();
115 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
116 LED_B_OFF();
117
118 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
119 LEDsoff();
120 }
121
122 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
123
124 LED_A_ON();
125 bool turnOffField = (arg0 == 1);
126
127 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
128
129 if (!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
130 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
131 OnError(0);
132 return;
133 };
134
135 if (!mifare_ultra_auth(keybytes)){
136 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
137 OnError(1);
138 return;
139 }
140
141 if (turnOffField) {
142 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
143 LED_D_OFF();
144 }
145
146 cmd_send(CMD_ACK,1,0,0,0,0);
147 LED_A_OFF();
148 }
149
150 // Arg0 = BlockNo,
151 // Arg1 = UsePwd bool
152 // datain = PWD bytes,
153 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
154 {
155 LED_A_ON();
156
157 uint8_t blockNo = arg0;
158 byte_t dataout[16] = {0x00};
159 bool useKey = (arg1 == 1); //UL_C
160 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
161
162 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
163
164 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
165 if(!len) {
166 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
167 OnError(1);
168 return;
169 }
170
171 // UL-C authentication
172 if (useKey) {
173 uint8_t key[16] = {0x00};
174 memcpy(key, datain, sizeof(key) );
175
176 if ( !mifare_ultra_auth(key) ) {
177 OnError(1);
178 return;
179 }
180 }
181
182 // UL-EV1 / NTAG authentication
183 if (usePwd) {
184 uint8_t pwd[4] = {0x00};
185 memcpy(pwd, datain, 4);
186 uint8_t pack[4] = {0,0,0,0};
187 if (!mifare_ul_ev1_auth(pwd, pack)) {
188 OnError(1);
189 return;
190 }
191 }
192
193 if (mifare_ultra_readblock(blockNo, dataout)) {
194 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
195 OnError(2);
196 return;
197 }
198
199 if (mifare_ultra_halt()) {
200 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
201 OnError(3);
202 return;
203 }
204
205 cmd_send(CMD_ACK,1,0,0,dataout,16);
206 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
207 LED_D_OFF();
208 LED_A_OFF();
209 }
210
211 //-----------------------------------------------------------------------------
212 // Select, Authenticate, Read a MIFARE tag.
213 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
214 //-----------------------------------------------------------------------------
215 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
216 {
217 // params
218 uint8_t sectorNo = arg0;
219 uint8_t keyType = arg1;
220 uint64_t ui64Key = 0;
221 ui64Key = bytes_to_num(datain, 6);
222
223 // variables
224 byte_t isOK = 0;
225 byte_t dataoutbuf[16 * 16];
226 uint8_t uid[10];
227 uint32_t cuid;
228 struct Crypto1State mpcs = {0, 0};
229 struct Crypto1State *pcs;
230 pcs = &mpcs;
231
232 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
233
234 clear_trace();
235
236 LED_A_ON();
237 LED_B_OFF();
238 LED_C_OFF();
239
240 isOK = 1;
241 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
242 isOK = 0;
243 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
244 }
245
246
247 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
248 isOK = 0;
249 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
250 }
251
252 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
253 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
254 isOK = 0;
255 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
256 break;
257 }
258 }
259
260 if(mifare_classic_halt(pcs, cuid)) {
261 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
262 }
263
264 // ----------------------------- crypto1 destroy
265 crypto1_destroy(pcs);
266
267 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
268
269 LED_B_ON();
270 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
271 LED_B_OFF();
272
273 // Thats it...
274 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
275 LEDsoff();
276 }
277
278 // arg0 = blockNo (start)
279 // arg1 = Pages (number of blocks)
280 // arg2 = useKey
281 // datain = KEY bytes
282 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
283 {
284 LED_A_ON();
285 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
286
287 // free eventually allocated BigBuf memory
288 BigBuf_free();
289
290 // params
291 uint8_t blockNo = arg0;
292 uint16_t blocks = arg1;
293 bool useKey = (arg2 == 1); //UL_C
294 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
295 uint32_t countblocks = 0;
296 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
297 if (dataout == NULL){
298 Dbprintf("out of memory");
299 OnError(1);
300 return;
301 }
302
303 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
304 if (!len) {
305 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
306 OnError(1);
307 return;
308 }
309
310 // UL-C authentication
311 if (useKey) {
312 uint8_t key[16] = {0x00};
313 memcpy(key, datain, sizeof(key) );
314
315 if ( !mifare_ultra_auth(key) ) {
316 OnError(1);
317 return;
318 }
319 }
320
321 // UL-EV1 / NTAG authentication
322 if (usePwd) {
323 uint8_t pwd[4] = {0x00};
324 memcpy(pwd, datain, sizeof(pwd));
325 uint8_t pack[4] = {0,0,0,0};
326
327 if (!mifare_ul_ev1_auth(pwd, pack)){
328 OnError(1);
329 return;
330 }
331 }
332
333 for (int i = 0; i < blocks; i++){
334 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
335 Dbprintf("Data exceeds buffer!!");
336 break;
337 }
338
339 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
340
341 if (len) {
342 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
343 // if no blocks read - error out
344 if (i==0){
345 OnError(2);
346 return;
347 } else {
348 //stop at last successful read block and return what we got
349 break;
350 }
351 } else {
352 countblocks++;
353 }
354 }
355
356 len = mifare_ultra_halt();
357 if (len) {
358 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
359 OnError(3);
360 return;
361 }
362
363 if (MF_DBGLEVEL >= MF_DBG_DEBUG) Dbprintf("Blocks read %d", countblocks);
364
365 cmd_send(CMD_ACK, 1, countblocks*4, BigBuf_max_traceLen(), 0, 0);
366
367 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
368 LED_D_OFF();
369 BigBuf_free();
370 LED_A_OFF();
371 }
372
373 //-----------------------------------------------------------------------------
374 // Select, Authenticate, Write a MIFARE tag.
375 // read block
376 //-----------------------------------------------------------------------------
377 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
378 {
379 // params
380 uint8_t blockNo = arg0;
381 uint8_t keyType = arg1;
382 uint64_t ui64Key = 0;
383 byte_t blockdata[16];
384
385 ui64Key = bytes_to_num(datain, 6);
386 memcpy(blockdata, datain + 10, 16);
387
388 // variables
389 byte_t isOK = 0;
390 uint8_t uid[10];
391 uint32_t cuid;
392 struct Crypto1State mpcs = {0, 0};
393 struct Crypto1State *pcs;
394 pcs = &mpcs;
395
396 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
397
398 clear_trace();
399
400 LED_A_ON();
401 LED_B_OFF();
402 LED_C_OFF();
403
404 while (true) {
405 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
406 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
407 break;
408 };
409
410 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
411 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
412 break;
413 };
414
415 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
416 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
417 break;
418 };
419
420 if(mifare_classic_halt(pcs, cuid)) {
421 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
422 break;
423 };
424
425 isOK = 1;
426 break;
427 }
428
429 // ----------------------------- crypto1 destroy
430 crypto1_destroy(pcs);
431
432 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
433
434 LED_B_ON();
435 cmd_send(CMD_ACK,isOK,0,0,0,0);
436 LED_B_OFF();
437
438
439 // Thats it...
440 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
441 LEDsoff();
442 }
443
444 /* // Command not needed but left for future testing
445 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
446 {
447 uint8_t blockNo = arg0;
448 byte_t blockdata[16] = {0x00};
449
450 memcpy(blockdata, datain, 16);
451
452 uint8_t uid[10] = {0x00};
453
454 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
455
456 clear_trace();
457 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
458
459 if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
460 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
461 OnError(0);
462 return;
463 };
464
465 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
466 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
467 OnError(0);
468 return; };
469
470 if(mifare_ultra_halt()) {
471 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
472 OnError(0);
473 return;
474 };
475
476 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
477
478 cmd_send(CMD_ACK,1,0,0,0,0);
479 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
480 LEDsoff();
481 }
482 */
483
484 // Arg0 : Block to write to.
485 // Arg1 : 0 = use no authentication.
486 // 1 = use 0x1A authentication.
487 // 2 = use 0x1B authentication.
488 // datain : 4 first bytes is data to be written.
489 // : 4/16 next bytes is authentication key.
490 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
491 {
492 uint8_t blockNo = arg0;
493 bool useKey = (arg1 == 1); //UL_C
494 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
495 byte_t blockdata[4] = {0x00};
496
497 memcpy(blockdata, datain,4);
498
499 LEDsoff();
500 LED_A_ON();
501 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
502
503 clear_trace();
504
505 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
506 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
507 OnError(0);
508 return;
509 };
510
511 // UL-C authentication
512 if ( useKey ) {
513 uint8_t key[16] = {0x00};
514 memcpy(key, datain+4, sizeof(key) );
515
516 if ( !mifare_ultra_auth(key) ) {
517 OnError(1);
518 return;
519 }
520 }
521
522 // UL-EV1 / NTAG authentication
523 if (usePwd) {
524 uint8_t pwd[4] = {0x00};
525 memcpy(pwd, datain+4, 4);
526 uint8_t pack[4] = {0,0,0,0};
527 if (!mifare_ul_ev1_auth(pwd, pack)) {
528 OnError(1);
529 return;
530 }
531 }
532
533 if(mifare_ultra_writeblock(blockNo, blockdata)) {
534 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
535 OnError(0);
536 return;
537 };
538
539 if(mifare_ultra_halt()) {
540 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
541 OnError(0);
542 return;
543 };
544
545 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
546
547 cmd_send(CMD_ACK,1,0,0,0,0);
548 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
549 LEDsoff();
550 }
551
552 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
553
554 uint8_t pwd[16] = {0x00};
555 byte_t blockdata[4] = {0x00};
556
557 memcpy(pwd, datain, 16);
558
559 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
560 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
561
562 clear_trace();
563
564 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
565 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
566 OnError(0);
567 return;
568 };
569
570 blockdata[0] = pwd[7];
571 blockdata[1] = pwd[6];
572 blockdata[2] = pwd[5];
573 blockdata[3] = pwd[4];
574 if(mifare_ultra_writeblock( 44, blockdata)) {
575 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
576 OnError(44);
577 return;
578 };
579
580 blockdata[0] = pwd[3];
581 blockdata[1] = pwd[2];
582 blockdata[2] = pwd[1];
583 blockdata[3] = pwd[0];
584 if(mifare_ultra_writeblock( 45, blockdata)) {
585 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
586 OnError(45);
587 return;
588 };
589
590 blockdata[0] = pwd[15];
591 blockdata[1] = pwd[14];
592 blockdata[2] = pwd[13];
593 blockdata[3] = pwd[12];
594 if(mifare_ultra_writeblock( 46, blockdata)) {
595 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
596 OnError(46);
597 return;
598 };
599
600 blockdata[0] = pwd[11];
601 blockdata[1] = pwd[10];
602 blockdata[2] = pwd[9];
603 blockdata[3] = pwd[8];
604 if(mifare_ultra_writeblock( 47, blockdata)) {
605 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
606 OnError(47);
607 return;
608 };
609
610 if(mifare_ultra_halt()) {
611 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
612 OnError(0);
613 return;
614 };
615
616 cmd_send(CMD_ACK,1,0,0,0,0);
617 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
618 LEDsoff();
619 }
620
621 // Return 1 if the nonce is invalid else return 0
622 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
623 return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
624 (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
625 (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
626 }
627
628
629 //-----------------------------------------------------------------------------
630 // acquire encrypted nonces in order to perform the attack described in
631 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
632 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
633 // Computer and Communications Security, 2015
634 //-----------------------------------------------------------------------------
635 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
636 {
637 uint64_t ui64Key = 0;
638 uint8_t uid[10];
639 uint32_t cuid;
640 uint8_t cascade_levels = 0;
641 struct Crypto1State mpcs = {0, 0};
642 struct Crypto1State *pcs;
643 pcs = &mpcs;
644 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
645 int16_t isOK = 0;
646 uint8_t par_enc[1];
647 uint8_t nt_par_enc = 0;
648 uint8_t buf[USB_CMD_DATA_SIZE];
649 uint32_t timeout;
650
651 uint8_t blockNo = arg0 & 0xff;
652 uint8_t keyType = (arg0 >> 8) & 0xff;
653 uint8_t targetBlockNo = arg1 & 0xff;
654 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
655 ui64Key = bytes_to_num(datain, 6);
656 bool initialize = flags & 0x0001;
657 bool slow = flags & 0x0002;
658 bool field_off = flags & 0x0004;
659
660 LED_A_ON();
661 LED_C_OFF();
662
663 if (initialize) {
664 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
665 clear_trace();
666 set_tracing(true);
667 }
668
669 LED_C_ON();
670
671 uint16_t num_nonces = 0;
672 bool have_uid = false;
673 for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
674
675 // Test if the action was cancelled
676 if(BUTTON_PRESS()) {
677 isOK = 2;
678 field_off = true;
679 break;
680 }
681
682 if (!have_uid) { // need a full select cycle to get the uid first
683 iso14a_card_select_t card_info;
684 if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
685 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");
686 continue;
687 }
688 switch (card_info.uidlen) {
689 case 4 : cascade_levels = 1; break;
690 case 7 : cascade_levels = 2; break;
691 case 10: cascade_levels = 3; break;
692 default: break;
693 }
694 have_uid = true;
695 } else { // no need for anticollision. We can directly select the card
696 if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
697 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");
698 continue;
699 }
700 }
701
702 if (slow) {
703 timeout = GetCountSspClk() + HARDNESTED_PRE_AUTHENTICATION_LEADTIME;
704 while(GetCountSspClk() < timeout);
705 }
706
707 uint32_t nt1;
708 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
709 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
710 continue;
711 }
712
713 // nested authentication
714 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
715 if (len != 4) {
716 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
717 continue;
718 }
719
720 // send an incomplete dummy response in order to trigger the card's authentication failure timeout
721 uint8_t dummy_answer[1] = {0};
722 ReaderTransmit(dummy_answer, 1, NULL);
723
724 timeout = GetCountSspClk() + HARDNESTED_AUTHENTICATION_TIMEOUT;
725
726 num_nonces++;
727 if (num_nonces % 2) {
728 memcpy(buf+i, receivedAnswer, 4);
729 nt_par_enc = par_enc[0] & 0xf0;
730 } else {
731 nt_par_enc |= par_enc[0] >> 4;
732 memcpy(buf+i+4, receivedAnswer, 4);
733 memcpy(buf+i+8, &nt_par_enc, 1);
734 i += 9;
735 }
736
737 // wait for the card to become ready again
738 while(GetCountSspClk() < timeout);
739
740 }
741
742 LED_C_OFF();
743
744 crypto1_destroy(pcs);
745
746 LED_B_ON();
747 cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
748 LED_B_OFF();
749
750 if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
751
752 if (field_off) {
753 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
754 LEDsoff();
755 }
756 }
757
758
759 //-----------------------------------------------------------------------------
760 // MIFARE nested authentication.
761 //
762 //-----------------------------------------------------------------------------
763 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
764 {
765 // params
766 uint8_t blockNo = arg0 & 0xff;
767 uint8_t keyType = (arg0 >> 8) & 0xff;
768 uint8_t targetBlockNo = arg1 & 0xff;
769 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
770 uint64_t ui64Key = 0;
771
772 ui64Key = bytes_to_num(datain, 6);
773
774 // variables
775 uint16_t rtr, i, j, len;
776 uint16_t davg;
777 static uint16_t dmin, dmax;
778 uint8_t uid[10];
779 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
780 uint8_t par[1];
781 uint32_t target_nt[2], target_ks[2];
782 uint8_t target_nt_duplicate_count = 0;
783
784 uint8_t par_array[4];
785 uint16_t ncount = 0;
786 struct Crypto1State mpcs = {0, 0};
787 struct Crypto1State *pcs;
788 pcs = &mpcs;
789 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
790
791 uint32_t auth1_time, auth2_time;
792 static uint16_t delta_time;
793
794 LED_A_ON();
795 LED_C_OFF();
796 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
797
798 // free eventually allocated BigBuf memory
799 BigBuf_free();
800
801 if (calibrate) clear_trace();
802 set_tracing(true);
803
804 // statistics on nonce distance
805 int16_t isOK = 0;
806 #define NESTED_MAX_TRIES 12
807 uint16_t unsuccessfull_tries = 0;
808 if (calibrate) { // for first call only. Otherwise reuse previous calibration
809 LED_B_ON();
810 WDT_HIT();
811
812 davg = dmax = 0;
813 dmin = 2000;
814 delta_time = 0;
815
816 for (rtr = 0; rtr < 17; rtr++) {
817
818 // prepare next select. No need to power down the card.
819 if(mifare_classic_halt(pcs, cuid)) {
820 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
821 rtr--;
822 continue;
823 }
824
825 // Test if the action was cancelled
826 if(BUTTON_PRESS()) {
827 isOK = -2;
828 break;
829 }
830
831 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
832 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
833 rtr--;
834 continue;
835 };
836
837 auth1_time = 0;
838 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
839 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
840 rtr--;
841 continue;
842 };
843
844 if (delta_time) {
845 auth2_time = auth1_time + delta_time;
846 } else {
847 auth2_time = 0;
848 }
849 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
850 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
851 rtr--;
852 continue;
853 };
854
855 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
856 for (i = 101; i < 1200; i++) {
857 nttmp = prng_successor(nttmp, 1);
858 if (nttmp == nt2) break;
859 }
860
861 if (i != 1200) {
862 if (rtr != 0) {
863 davg += i;
864 dmin = MIN(dmin, i);
865 dmax = MAX(dmax, i);
866 }
867 else {
868 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
869 }
870 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
871 } else {
872 unsuccessfull_tries++;
873 if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)
874 isOK = -3;
875 }
876 }
877 }
878
879 davg = (davg + (rtr - 1)/2) / (rtr - 1);
880
881 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
882
883 dmin = davg - 2;
884 dmax = davg + 2;
885
886 LED_B_OFF();
887
888 }
889 // -------------------------------------------------------------------------------------------------
890
891 LED_C_ON();
892
893 // get crypted nonces for target sector
894 for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
895
896 target_nt[i] = 0;
897 while(target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
898
899 // prepare next select. No need to power down the card.
900 if(mifare_classic_halt(pcs, cuid)) {
901 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
902 continue;
903 }
904
905 // break out of the loop on button press
906 if(BUTTON_PRESS()) {
907 isOK = -2;
908 break;
909 }
910
911 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
912 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
913 continue;
914 }
915
916 auth1_time = 0;
917 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
918 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
919 continue;
920 }
921
922 // nested authentication
923 auth2_time = auth1_time + delta_time;
924 len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
925 if (len != 4) {
926 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
927 continue;
928 }
929
930 nt2 = bytes_to_num(receivedAnswer, 4);
931 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
932
933 // Parity validity check
934 for (j = 0; j < 4; j++) {
935 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
936 }
937
938 ncount = 0;
939 nttest = prng_successor(nt1, dmin - 1);
940 for (j = dmin; j < dmax + 1; j++) {
941 nttest = prng_successor(nttest, 1);
942 ks1 = nt2 ^ nttest;
943
944 if (valid_nonce(nttest, nt2, ks1, par_array)){
945 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
946 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
947 target_nt[i] = 0;
948 break;
949 }
950 target_nt[i] = nttest;
951 target_ks[i] = ks1;
952 ncount++;
953 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
954 if( ++target_nt_duplicate_count >= NESTED_MAX_TRIES ) { // unable to get a 2nd nonce after NESTED_MAX_TRIES tries, probably a fixed nonce
955 if (MF_DBGLEVEL >= 2) Dbprintf("Nonce#2: cannot get nonce that != nonce#1, continuing anyway with single nonce! ntdist=%d", j);
956 break;
957 }
958
959 target_nt[1] = 0;
960 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
961 break;
962 }
963 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
964 }
965 }
966 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
967 }
968 }
969
970 LED_C_OFF();
971
972 // ----------------------------- crypto1 destroy
973 crypto1_destroy(pcs);
974
975 byte_t buf[4 + 4 * 4];
976 memcpy(buf, &cuid, 4);
977 memcpy(buf+4, &target_nt[0], 4);
978 memcpy(buf+8, &target_ks[0], 4);
979 memcpy(buf+12, &target_nt[1], 4);
980 memcpy(buf+16, &target_ks[1], 4);
981
982 LED_B_ON();
983 cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
984 LED_B_OFF();
985
986 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
987
988 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
989 LEDsoff();
990 }
991
992 //-----------------------------------------------------------------------------
993 // MIFARE check keys. key count up to 85.
994 //
995 //-----------------------------------------------------------------------------
996 void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
997 {
998 uint8_t blockNo = arg0 & 0xff;
999 uint8_t keyType = (arg0 >> 8) & 0xff;
1000 bool clearTrace = arg1 & 0x01;
1001 bool multisectorCheck = arg1 & 0x02;
1002 uint8_t set14aTimeout = (arg1 >> 8) & 0xff;
1003 uint8_t keyCount = arg2;
1004
1005 LED_A_ON();
1006
1007 // clear debug level
1008 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
1009 MF_DBGLEVEL = MF_DBG_NONE;
1010
1011 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1012
1013 if (clearTrace) {
1014 clear_trace();
1015 }
1016 set_tracing(true);
1017
1018 if (set14aTimeout){
1019 iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe
1020 }
1021
1022 if (multisectorCheck) {
1023 TKeyIndex keyIndex = {{0}};
1024 uint8_t sectorCnt = blockNo;
1025 int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex);
1026
1027 if (res >= 0) {
1028 cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);
1029 } else {
1030 cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
1031 }
1032 } else {
1033 int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL);
1034
1035 if (res > 0) {
1036 cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
1037 } else {
1038 cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
1039 }
1040 }
1041
1042 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1043 LED_D_OFF();
1044
1045 // restore debug level
1046 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1047
1048 LED_A_OFF();
1049 }
1050
1051
1052 //-----------------------------------------------------------------------------
1053 // MIFARE Personalize UID. Only for Mifare Classic EV1 7Byte UID
1054 //-----------------------------------------------------------------------------
1055 void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data) {
1056
1057 uint8_t uid[10];
1058 uint32_t cuid;
1059 struct Crypto1State mpcs = {0, 0};
1060 struct Crypto1State *pcs;
1061 pcs = &mpcs;
1062
1063 LED_A_ON();
1064 clear_trace();
1065
1066 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1067
1068 bool isOK = false;
1069 while (true) {
1070 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1071 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1072 break;
1073 }
1074
1075 uint8_t block_number = 0;
1076 uint64_t key = bytes_to_num(data, 6);
1077 if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) {
1078 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
1079 break;
1080 }
1081
1082 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1083 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1084 int len = mifare_sendcmd_short(pcs, true, MIFARE_EV1_PERSONAL_UID, perso_option, receivedAnswer, receivedAnswerPar, NULL);
1085 if (len != 1 || receivedAnswer[0] != CARD_ACK) {
1086 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
1087 break;;
1088 }
1089 isOK = true;
1090 break;
1091 }
1092
1093 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1094 LED_D_OFF();
1095
1096 crypto1_destroy(pcs);
1097
1098 if (MF_DBGLEVEL >= 2) DbpString("PERSONALIZE UID FINISHED");
1099
1100 cmd_send(CMD_ACK, isOK, 0, 0, NULL, 0);
1101
1102 LED_A_OFF();
1103 }
1104
1105 //-----------------------------------------------------------------------------
1106 // MIFARE commands set debug level
1107 //
1108 //-----------------------------------------------------------------------------
1109 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1110 MF_DBGLEVEL = arg0;
1111 Dbprintf("Debug level: %d", MF_DBGLEVEL);
1112 }
1113
1114 //-----------------------------------------------------------------------------
1115 // Work with emulator memory
1116 //
1117 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1118 // involved in dealing with emulator memory. But if it is called later, it might
1119 // destroy the Emulator Memory.
1120 //-----------------------------------------------------------------------------
1121
1122 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1123 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1124 emlClearMem();
1125 }
1126
1127 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1128 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1129 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
1130 }
1131
1132 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1133 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1134 byte_t buf[USB_CMD_DATA_SIZE];
1135 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1136
1137 LED_B_ON();
1138 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1139 LED_B_OFF();
1140 }
1141
1142 //-----------------------------------------------------------------------------
1143 // Load a card into the emulator memory
1144 //
1145 //-----------------------------------------------------------------------------
1146 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1147 uint8_t numSectors = arg0;
1148 uint8_t keyType = arg1;
1149 uint64_t ui64Key = 0;
1150 uint32_t cuid;
1151 struct Crypto1State mpcs = {0, 0};
1152 struct Crypto1State *pcs;
1153 pcs = &mpcs;
1154
1155 // variables
1156 byte_t dataoutbuf[16];
1157 byte_t dataoutbuf2[16];
1158 uint8_t uid[10];
1159
1160 LED_A_ON();
1161 LED_B_OFF();
1162 LED_C_OFF();
1163 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1164
1165 clear_trace();
1166 set_tracing(false);
1167
1168 bool isOK = true;
1169
1170 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1171 isOK = false;
1172 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1173 }
1174
1175 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1176 ui64Key = emlGetKey(sectorNo, keyType);
1177 if (sectorNo == 0){
1178 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1179 isOK = false;
1180 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1181 break;
1182 }
1183 } else {
1184 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1185 isOK = false;
1186 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1187 break;
1188 }
1189 }
1190
1191 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1192 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1193 isOK = false;
1194 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1195 break;
1196 };
1197 if (isOK) {
1198 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1199 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1200 } else { // sector trailer, keep the keys, set only the AC
1201 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1202 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1203 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1204 }
1205 }
1206 }
1207
1208 }
1209
1210 if(mifare_classic_halt(pcs, cuid)) {
1211 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1212 };
1213
1214 // ----------------------------- crypto1 destroy
1215 crypto1_destroy(pcs);
1216
1217 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1218 LEDsoff();
1219
1220 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1221
1222 }
1223
1224
1225 //-----------------------------------------------------------------------------
1226 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1227 //
1228 //-----------------------------------------------------------------------------
1229
1230 static bool isBlockTrailer(int blockN) {
1231 if (blockN >= 0 && blockN < 128) {
1232 return ((blockN & 0x03) == 0x03);
1233 }
1234 if (blockN >= 128 && blockN <= 256) {
1235 return ((blockN & 0x0F) == 0x0F);
1236 }
1237 return false;
1238 }
1239
1240 void MifareCWipe(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1241 // var
1242 byte_t isOK = 0;
1243 uint32_t numBlocks = arg0;
1244 // cmdParams:
1245 // bit 0 - wipe gen1a
1246 // bit 1 - fill card with default data
1247 // bit 2 - gen1a = 0, gen1b = 1
1248 uint8_t cmdParams = arg1;
1249 bool needWipe = cmdParams & 0x01;
1250 bool needFill = cmdParams & 0x02;
1251 bool gen1b = cmdParams & 0x04;
1252
1253 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1254 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1255
1256 uint8_t block0[16] = {0x01, 0x02, 0x03, 0x04, 0x04, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0xAF};
1257 uint8_t block1[16] = {0x00};
1258 uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
1259 uint8_t d_block[18] = {0x00};
1260
1261 // card commands
1262 uint8_t wupC1[] = { 0x40 };
1263 uint8_t wupC2[] = { 0x43 };
1264 uint8_t wipeC[] = { 0x41 };
1265
1266 // iso14443 setup
1267 LED_A_ON();
1268 LED_B_OFF();
1269 LED_C_OFF();
1270 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1271
1272 // tracing
1273 clear_trace();
1274 set_tracing(true);
1275
1276 while (true){
1277 // wipe
1278 if (needWipe){
1279 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1280 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1281 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1282 break;
1283 };
1284
1285 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1286 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1287 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1288 break;
1289 };
1290
1291 if(mifare_classic_halt(NULL, 0)) {
1292 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1293 };
1294 };
1295
1296 // put default data
1297 if (needFill){
1298 // select commands
1299 ReaderTransmitBitsPar(wupC1, 7, 0, NULL);
1300
1301 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1302 if (!gen1b) {
1303
1304 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1305 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1306 break;
1307 };
1308
1309 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1310 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1311 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1312 break;
1313 };
1314 }
1315
1316 // send blocks command
1317 for (int blockNo = 0; blockNo < numBlocks; blockNo++) {
1318 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1319 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1320 break;
1321 };
1322
1323 // check type of block and add crc
1324 if (!isBlockTrailer(blockNo)){
1325 memcpy(d_block, block1, 16);
1326 } else {
1327 memcpy(d_block, blockK, 16);
1328 }
1329 if (blockNo == 0) {
1330 memcpy(d_block, block0, 16);
1331 }
1332 AppendCrc14443a(d_block, 16);
1333
1334 // send write command
1335 ReaderTransmit(d_block, sizeof(d_block), NULL);
1336 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1337 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1338 break;
1339 };
1340 }
1341
1342 // halt
1343 // do no issue halt command for gen1b
1344 if (!gen1b) {
1345 if (mifare_classic_halt(NULL, 0)) {
1346 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1347 break;
1348 }
1349 }
1350 }
1351 break;
1352 }
1353
1354 // send USB response
1355 LED_B_ON();
1356 cmd_send(CMD_ACK,isOK,0,0,NULL,0);
1357 LED_B_OFF();
1358
1359 // reset fpga
1360 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1361 LEDsoff();
1362
1363 return;
1364 }
1365
1366 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1367
1368 // params
1369 uint8_t needWipe = arg0;
1370 // bit 0 - need get UID
1371 // bit 1 - need wupC
1372 // bit 2 - need HALT after sequence
1373 // bit 3 - need init FPGA and field before sequence
1374 // bit 4 - need reset FPGA and LED
1375 // bit 6 - gen1b backdoor type
1376 uint8_t workFlags = arg1;
1377 uint8_t blockNo = arg2;
1378
1379 // card commands
1380 uint8_t wupC1[] = { 0x40 };
1381 uint8_t wupC2[] = { 0x43 };
1382 uint8_t wipeC[] = { 0x41 };
1383
1384 // variables
1385 byte_t isOK = 0;
1386 uint8_t uid[10] = {0x00};
1387 uint8_t d_block[18] = {0x00};
1388 uint32_t cuid;
1389
1390 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1391 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1392
1393 // reset FPGA and LED
1394 if (workFlags & 0x08) {
1395 LED_A_ON();
1396 LED_B_OFF();
1397 LED_C_OFF();
1398 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1399
1400 clear_trace();
1401 set_tracing(true);
1402 }
1403
1404 while (true) {
1405
1406 // get UID from chip
1407 if (workFlags & 0x01) {
1408 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1409 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1410 // Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work.
1411 //break;
1412 };
1413
1414 if(mifare_classic_halt(NULL, cuid)) {
1415 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1416 // Continue, some magic tags misbehavies and send an answer to it.
1417 // break;
1418 };
1419 };
1420
1421 // reset chip
1422 // Wipe command don't work with gen1b
1423 if (needWipe && !(workFlags & 0x40)){
1424 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1425 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1426 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1427 break;
1428 };
1429
1430 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1431 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1432 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1433 break;
1434 };
1435
1436 if(mifare_classic_halt(NULL, 0)) {
1437 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1438 // Continue, some magic tags misbehavies and send an answer to it.
1439 // break;
1440 };
1441 };
1442
1443 // write block
1444 if (workFlags & 0x02) {
1445 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1446
1447 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1448 if (!(workFlags & 0x40)) {
1449
1450 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1451 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1452 break;
1453 };
1454
1455 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1456 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1457 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1458 break;
1459 };
1460 }
1461 }
1462
1463 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1464 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1465 break;
1466 };
1467
1468 memcpy(d_block, datain, 16);
1469 AppendCrc14443a(d_block, 16);
1470
1471 ReaderTransmit(d_block, sizeof(d_block), NULL);
1472 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1473 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1474 break;
1475 };
1476
1477 if (workFlags & 0x04) {
1478 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1479 if (!(workFlags & 0x40)) {
1480 if (mifare_classic_halt(NULL, 0)) {
1481 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1482 // Continue, some magic tags misbehavies and send an answer to it.
1483 // break;
1484 }
1485 }
1486 }
1487
1488 isOK = 1;
1489 break;
1490 }
1491
1492 LED_B_ON();
1493 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1494 LED_B_OFF();
1495
1496 if ((workFlags & 0x10) || (!isOK)) {
1497 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1498 LEDsoff();
1499 }
1500 }
1501
1502
1503 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1504
1505 // params
1506 // bit 1 - need wupC
1507 // bit 2 - need HALT after sequence
1508 // bit 3 - need init FPGA and field before sequence
1509 // bit 4 - need reset FPGA and LED
1510 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1511 // bit 6 - gen1b backdoor type
1512 uint8_t workFlags = arg0;
1513 uint8_t blockNo = arg2;
1514
1515 // card commands
1516 uint8_t wupC1[] = { 0x40 };
1517 uint8_t wupC2[] = { 0x43 };
1518
1519 // variables
1520 byte_t isOK = 0;
1521 uint8_t data[18] = {0x00};
1522 uint32_t cuid = 0;
1523
1524 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1525 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1526
1527 if (workFlags & 0x08) {
1528 LED_A_ON();
1529 LED_B_OFF();
1530 LED_C_OFF();
1531 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1532
1533 clear_trace();
1534 set_tracing(true);
1535 }
1536
1537 while (true) {
1538 if (workFlags & 0x02) {
1539 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1540 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1541 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1542 break;
1543 };
1544 // do no issue for gen1b magic tag
1545 if (!(workFlags & 0x40)) {
1546 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1547 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1548 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1549 break;
1550 };
1551 }
1552 }
1553
1554 // read block
1555 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1556 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1557 break;
1558 };
1559 memcpy(data, receivedAnswer, 18);
1560
1561 if (workFlags & 0x04) {
1562 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1563 if (!(workFlags & 0x40)) {
1564 if (mifare_classic_halt(NULL, cuid)) {
1565 if (MF_DBGLEVEL > 1) Dbprintf("Halt error");
1566 // Continue, some magic tags misbehavies and send an answer to it.
1567 // break;
1568 }
1569 }
1570 }
1571
1572 isOK = 1;
1573 break;
1574 }
1575
1576 LED_B_ON();
1577 if (workFlags & 0x20) {
1578 if (isOK)
1579 memcpy(datain, data, 18);
1580 }
1581 else
1582 cmd_send(CMD_ACK,isOK,0,0,data,18);
1583 LED_B_OFF();
1584
1585 if ((workFlags & 0x10) || (!isOK)) {
1586 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1587 LEDsoff();
1588 }
1589 }
1590
1591 void MifareCIdent(){
1592
1593 // card commands
1594 uint8_t wupC1[] = { 0x40 };
1595 uint8_t wupC2[] = { 0x43 };
1596
1597 // variables
1598 byte_t isOK = 0;
1599
1600 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1601 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1602
1603 LED_A_ON();
1604 LED_B_OFF();
1605 LED_C_OFF();
1606 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1607
1608 clear_trace();
1609 set_tracing(true);
1610
1611 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1612 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1613 isOK = 2;
1614
1615 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1616 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1617 isOK = 1;
1618 };
1619 };
1620
1621 // From iceman1001: removed the if, since some magic tags misbehavies and send an answer to it.
1622 mifare_classic_halt(NULL, 0);
1623
1624 LED_B_ON();
1625 cmd_send(CMD_ACK,isOK,0,0,0,0);
1626 LED_B_OFF();
1627
1628 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1629 LEDsoff();
1630 }
1631
1632 //
1633 // DESFIRE
1634 //
1635
1636 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1637
1638 byte_t dataout[11] = {0x00};
1639 uint8_t uid[10] = {0x00};
1640 uint32_t cuid;
1641
1642 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1643 clear_trace();
1644
1645 int len = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
1646 if(!len) {
1647 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1648 OnError(1);
1649 return;
1650 };
1651
1652 if(mifare_desfire_des_auth1(cuid, dataout)){
1653 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1654 OnError(4);
1655 return;
1656 }
1657
1658 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1659 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1660 }
1661
1662 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1663
1664 uint32_t cuid = arg0;
1665 uint8_t key[16] = {0x00};
1666 byte_t isOK = 0;
1667 byte_t dataout[12] = {0x00};
1668
1669 memcpy(key, datain, 16);
1670
1671 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1672
1673 if( isOK) {
1674 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1675 OnError(4);
1676 return;
1677 }
1678
1679 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1680
1681 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1682 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1683 LEDsoff();
1684 }
1685
Proxmark3 GIT tracking
Impressum, Datenschutz