git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // Routines to support ISO 14443 type A.
  11 //-----------------------------------------------------------------------------
  12
  13 #include "mifarecmd.h"
  14 #include "apps.h"
  15
  16 //-----------------------------------------------------------------------------
  17 // Select, Authenticate, Read a MIFARE tag.
  18 // read block
  19 //-----------------------------------------------------------------------------
  20 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  21 {
  22   // params
  23         uint8_t blockNo = arg0;
  24         uint8_t keyType = arg1;
  25         uint64_t ui64Key = 0;
  26         ui64Key = bytes_to_num(datain, 6);
  27
  28         // variables
  29         byte_t isOK = 0;
  30         byte_t dataoutbuf[16];
  31         uint8_t uid[10];
  32         uint32_t cuid;
  33         struct Crypto1State mpcs = {0, 0};
  34         struct Crypto1State *pcs;
  35         pcs = &mpcs;
  36
  37         // clear trace
  38         iso14a_clear_trace();
  39 //      iso14a_set_tracing(false);
  40
  41         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  42
  43         LED_A_ON();
  44         LED_B_OFF();
  45         LED_C_OFF();
  46
  47         while (true) {
  48                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  49                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  50                         break;
  51                 };
  52
  53                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  54                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  55                         break;
  56                 };
  57
  58                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  59                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  60                         break;
  61                 };
  62
  63                 if(mifare_classic_halt(pcs, cuid)) {
  64                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  65                         break;
  66                 };
  67
  68                 isOK = 1;
  69                 break;
  70         }
  71
  72         //  ----------------------------- crypto1 destroy
  73         crypto1_destroy(pcs);
  74
  75         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  76
  77         LED_B_ON();
  78         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  79         LED_B_OFF();
  80
  81         // Thats it...
  82         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  83         LEDsoff();
  84 //  iso14a_set_tracing(TRUE);
  85
  86 }
  87
  88 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
  89 {
  90     // params
  91         uint8_t blockNo = arg0;
  92
  93         // variables
  94         byte_t isOK = 0;
  95         byte_t dataoutbuf[16];
  96         uint8_t uid[10];
  97         uint32_t cuid;
  98
  99         // clear trace
 100         iso14a_clear_trace();
 101         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 102
 103         LED_A_ON();
 104         LED_B_OFF();
 105         LED_C_OFF();
 106
 107         while (true) {
 108                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 109             if (MF_DBGLEVEL >= 1)       Dbprintf("Can't select card");
 110                         break;
 111                 };
 112
 113                 if(mifare_ultra_readblock(cuid, blockNo, dataoutbuf)) {
 114             if (MF_DBGLEVEL >= 1)       Dbprintf("Read block error");
 115                         break;
 116                 };
 117
 118                 if(mifare_ultra_halt(cuid)) {
 119             if (MF_DBGLEVEL >= 1)       Dbprintf("Halt error");
 120                         break;
 121                 };
 122
 123                 isOK = 1;
 124                 break;
 125         }
 126
 127         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
 128
 129         // add trace trailer
 130         memset(uid, 0x44, 4);
 131         LogTrace(uid, 4, 0, 0, TRUE);
 132         LED_B_ON();
 133         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
 134         LED_B_OFF();
 135
 136
 137     // Thats it...
 138         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 139         LEDsoff();
 140 }
 141
 142
 143 //-----------------------------------------------------------------------------
 144 // Select, Authenticate, Read a MIFARE tag.
 145 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 146 //-----------------------------------------------------------------------------
 147 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 148 {
 149   // params
 150         uint8_t sectorNo = arg0;
 151         uint8_t keyType = arg1;
 152         uint64_t ui64Key = 0;
 153         ui64Key = bytes_to_num(datain, 6);
 154
 155         // variables
 156         byte_t isOK;
 157         byte_t dataoutbuf[16 * 16];
 158         uint8_t uid[10];
 159         uint32_t cuid;
 160         struct Crypto1State mpcs = {0, 0};
 161         struct Crypto1State *pcs;
 162         pcs = &mpcs;
 163
 164         // clear trace
 165         iso14a_clear_trace();
 166 //      iso14a_set_tracing(false);
 167
 168         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 169
 170         LED_A_ON();
 171         LED_B_OFF();
 172         LED_C_OFF();
 173
 174         isOK = 1;
 175         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 176                 isOK = 0;
 177                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 178         }
 179
 180
 181         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 182                 isOK = 0;
 183                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 184         }
 185
 186         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 187                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 188                         isOK = 0;
 189                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 190                         break;
 191                 }
 192         }
 193
 194         if(mifare_classic_halt(pcs, cuid)) {
 195                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 196         }
 197
 198
 199         //  ----------------------------- crypto1 destroy
 200         crypto1_destroy(pcs);
 201
 202         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 203
 204         LED_B_ON();
 205         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 206         LED_B_OFF();
 207
 208         // Thats it...
 209         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 210         LEDsoff();
 211 //  iso14a_set_tracing(TRUE);
 212 }
 213
 214
 215 void MifareUReadCard(uint8_t arg0, uint8_t *datain)
 216 {
 217   // params
 218         uint8_t sectorNo = arg0;
 219
 220         // variables
 221         byte_t isOK = 0;
 222         byte_t dataoutbuf[16 * 4];
 223         uint8_t uid[10];
 224         uint32_t cuid;
 225
 226         // clear trace
 227         iso14a_clear_trace();
 228 //      iso14a_set_tracing(false);
 229
 230                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 231
 232         LED_A_ON();
 233         LED_B_OFF();
 234         LED_C_OFF();
 235
 236         while (true) {
 237                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 238                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 239                         break;
 240                 };
 241                 for(int sec=0;sec<16;sec++){
 242                     if(mifare_ultra_readblock(cuid, sectorNo * 4 + sec, dataoutbuf + 4 * sec)) {
 243                     if (MF_DBGLEVEL >= 1)   Dbprintf("Read block %d error",sec);
 244                         break;
 245                     };
 246                 }
 247                 if(mifare_ultra_halt(cuid)) {
 248                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 249                         break;
 250                 };
 251
 252                 isOK = 1;
 253                 break;
 254         }
 255
 256         if (MF_DBGLEVEL >= 2) DbpString("READ CARD FINISHED");
 257
 258         LED_B_ON();
 259                 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
 260         LED_B_OFF();
 261
 262         // Thats it...
 263         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 264         LEDsoff();
 265
 266 }
 267
 268
 269 //-----------------------------------------------------------------------------
 270 // Select, Authenticate, Write a MIFARE tag.
 271 // read block
 272 //-----------------------------------------------------------------------------
 273 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 274 {
 275         // params
 276         uint8_t blockNo = arg0;
 277         uint8_t keyType = arg1;
 278         uint64_t ui64Key = 0;
 279         byte_t blockdata[16];
 280
 281         ui64Key = bytes_to_num(datain, 6);
 282         memcpy(blockdata, datain + 10, 16);
 283
 284         // variables
 285         byte_t isOK = 0;
 286         uint8_t uid[10];
 287         uint32_t cuid;
 288         struct Crypto1State mpcs = {0, 0};
 289         struct Crypto1State *pcs;
 290         pcs = &mpcs;
 291
 292         // clear trace
 293         iso14a_clear_trace();
 294 //  iso14a_set_tracing(false);
 295
 296         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 297
 298         LED_A_ON();
 299         LED_B_OFF();
 300         LED_C_OFF();
 301
 302         while (true) {
 303                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 304                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 305                         break;
 306                 };
 307
 308                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 309                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 310                         break;
 311                 };
 312
 313                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 314                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 315                         break;
 316                 };
 317
 318                 if(mifare_classic_halt(pcs, cuid)) {
 319                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 320                         break;
 321                 };
 322
 323                 isOK = 1;
 324                 break;
 325         }
 326
 327         //  ----------------------------- crypto1 destroy
 328         crypto1_destroy(pcs);
 329
 330         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 331
 332         LED_B_ON();
 333         cmd_send(CMD_ACK,isOK,0,0,0,0);
 334         LED_B_OFF();
 335
 336
 337         // Thats it...
 338         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 339         LEDsoff();
 340 //  iso14a_set_tracing(TRUE);
 341
 342 }
 343
 344
 345 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 346 {
 347         // params
 348         uint8_t blockNo = arg0;
 349         byte_t blockdata[16];
 350
 351         memset(blockdata,'\0',16);
 352         memcpy(blockdata, datain,16);
 353
 354         // variables
 355         byte_t isOK = 0;
 356         uint8_t uid[10];
 357         uint32_t cuid;
 358
 359         // clear trace
 360         iso14a_clear_trace();
 361         //  iso14a_set_tracing(false);
 362
 363                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 364
 365         LED_A_ON();
 366         LED_B_OFF();
 367         LED_C_OFF();
 368
 369         while (true) {
 370                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 371                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 372                         break;
 373                 };
 374
 375                 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
 376                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 377                         break;
 378                 };
 379
 380                 if(mifare_ultra_halt(cuid)) {
 381                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 382                         break;
 383                 };
 384
 385                 isOK = 1;
 386                 break;
 387         }
 388
 389         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 390
 391         LED_B_ON();
 392                 cmd_send(CMD_ACK,isOK,0,0,0,0);
 393         LED_B_OFF();
 394
 395
 396         // Thats it...
 397         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 398         LEDsoff();
 399 //  iso14a_set_tracing(TRUE);
 400 }
 401
 402
 403 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 404 {
 405         // params
 406         uint8_t blockNo = arg0;
 407         byte_t blockdata[4];
 408
 409         memcpy(blockdata, datain,4);
 410
 411         // variables
 412         byte_t isOK = 0;
 413         uint8_t uid[10];
 414         uint32_t cuid;
 415
 416         // clear trace
 417         iso14a_clear_trace();
 418         //  iso14a_set_tracing(false);
 419
 420         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 421
 422         LED_A_ON();
 423         LED_B_OFF();
 424         LED_C_OFF();
 425
 426         while (true) {
 427                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 428                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 429                         break;
 430                 };
 431
 432                 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
 433                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 434                         break;
 435                 };
 436
 437                 if(mifare_ultra_halt(cuid)) {
 438                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 439                         break;
 440                 };
 441
 442                 isOK = 1;
 443                 break;
 444         }
 445
 446         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 447
 448         LED_B_ON();
 449         cmd_send(CMD_ACK,isOK,0,0,0,0);
 450         LED_B_OFF();
 451
 452
 453         // Thats it...
 454         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 455         LEDsoff();
 456 //  iso14a_set_tracing(TRUE);
 457
 458 }
 459
 460
 461 // Return 1 if the nonce is invalid else return 0
 462 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
 463         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 464         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 465         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 466 }
 467
 468
 469 //-----------------------------------------------------------------------------
 470 // MIFARE nested authentication.
 471 //
 472 //-----------------------------------------------------------------------------
 473 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 474 {
 475         // params
 476         uint8_t blockNo = arg0 & 0xff;
 477         uint8_t keyType = (arg0 >> 8) & 0xff;
 478         uint8_t targetBlockNo = arg1 & 0xff;
 479         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 480         uint64_t ui64Key = 0;
 481
 482         ui64Key = bytes_to_num(datain, 6);
 483
 484         // variables
 485         uint16_t rtr, i, j, len;
 486         uint16_t davg;
 487         static uint16_t dmin, dmax;
 488         uint8_t uid[10];
 489         uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
 490         uint32_t target_nt[2], target_ks[2];
 491
 492         uint8_t par_array[4];
 493         uint16_t ncount = 0;
 494         struct Crypto1State mpcs = {0, 0};
 495         struct Crypto1State *pcs;
 496         pcs = &mpcs;
 497         uint8_t* receivedAnswer = mifare_get_bigbufptr();
 498
 499         uint32_t auth1_time, auth2_time;
 500         static uint16_t delta_time;
 501
 502         // clear trace
 503         iso14a_clear_trace();
 504         iso14a_set_tracing(false);
 505
 506         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 507
 508         LED_A_ON();
 509         LED_C_OFF();
 510
 511
 512         // statistics on nonce distance
 513         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 514                 LED_B_ON();
 515
 516                 davg = dmax = 0;
 517                 dmin = 2000;
 518                 delta_time = 0;
 519
 520                 for (rtr = 0; rtr < 17; rtr++) {
 521
 522                         // prepare next select. No need to power down the card.
 523                         if(mifare_classic_halt(pcs, cuid)) {
 524                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 525                                 rtr--;
 526                                 continue;
 527                         }
 528
 529                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 530                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 531                                 rtr--;
 532                                 continue;
 533                         };
 534
 535                         auth1_time = 0;
 536                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 537                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 538                                 rtr--;
 539                                 continue;
 540                         };
 541
 542                         if (delta_time) {
 543                                 auth2_time = auth1_time + delta_time;
 544                         } else {
 545                                 auth2_time = 0;
 546                         }
 547                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 548                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 549                                 rtr--;
 550                                 continue;
 551                         };
 552
 553                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 554                         for (i = 101; i < 1200; i++) {
 555                                 nttmp = prng_successor(nttmp, 1);
 556                                 if (nttmp == nt2) break;
 557                         }
 558
 559                         if (i != 1200) {
 560                                 if (rtr != 0) {
 561                                         davg += i;
 562                                         dmin = MIN(dmin, i);
 563                                         dmax = MAX(dmax, i);
 564                                 }
 565                                 else {
 566                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 567                                 }
 568                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 569                         }
 570                 }
 571
 572                 if (rtr <= 1)   return;
 573
 574                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 575
 576                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 577
 578                 dmin = davg - 2;
 579                 dmax = davg + 2;
 580
 581                 LED_B_OFF();
 582
 583         }
 584 //  -------------------------------------------------------------------------------------------------
 585
 586         LED_C_ON();
 587
 588         //  get crypted nonces for target sector
 589         for(i=0; i < 2; i++) { // look for exactly two different nonces
 590
 591                 target_nt[i] = 0;
 592                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 593
 594                         // prepare next select. No need to power down the card.
 595                         if(mifare_classic_halt(pcs, cuid)) {
 596                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 597                                 continue;
 598                         }
 599
 600                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 601                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 602                                 continue;
 603                         };
 604
 605                         auth1_time = 0;
 606                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 607                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 608                                 continue;
 609                         };
 610
 611                         // nested authentication
 612                         auth2_time = auth1_time + delta_time;
 613                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par, &auth2_time);
 614                         if (len != 4) {
 615                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 616                                 continue;
 617                         };
 618
 619                         nt2 = bytes_to_num(receivedAnswer, 4);
 620                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par);
 621
 622                         // Parity validity check
 623                         for (j = 0; j < 4; j++) {
 624                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par & 0x08) >> 3));
 625                                 par = par << 1;
 626                         }
 627
 628                         ncount = 0;
 629                         nttest = prng_successor(nt1, dmin - 1);
 630                         for (j = dmin; j < dmax + 1; j++) {
 631                                 nttest = prng_successor(nttest, 1);
 632                                 ks1 = nt2 ^ nttest;
 633
 634                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 635                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 636                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 637                                                 target_nt[i] = 0;
 638                                                 break;
 639                                         }
 640                                         target_nt[i] = nttest;
 641                                         target_ks[i] = ks1;
 642                                         ncount++;
 643                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 644                                                 target_nt[i] = 0;
 645                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 646                                                 break;
 647                                         }
 648                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 649                                 }
 650                         }
 651                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 652                 }
 653         }
 654
 655         LED_C_OFF();
 656
 657         //  ----------------------------- crypto1 destroy
 658         crypto1_destroy(pcs);
 659
 660         // add trace trailer
 661         memset(uid, 0x44, 4);
 662         LogTrace(uid, 4, 0, 0, TRUE);
 663
 664         byte_t buf[4 + 4 * 4];
 665         memcpy(buf, &cuid, 4);
 666         memcpy(buf+4, &target_nt[0], 4);
 667         memcpy(buf+8, &target_ks[0], 4);
 668         memcpy(buf+12, &target_nt[1], 4);
 669         memcpy(buf+16, &target_ks[1], 4);
 670
 671         LED_B_ON();
 672         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 673         LED_B_OFF();
 674
 675         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 676
 677         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 678         LEDsoff();
 679         iso14a_set_tracing(TRUE);
 680 }
 681
 682 //-----------------------------------------------------------------------------
 683 // MIFARE check keys. key count up to 85.
 684 //
 685 //-----------------------------------------------------------------------------
 686 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 687 {
 688   // params
 689         uint8_t blockNo = arg0;
 690         uint8_t keyType = arg1;
 691         uint8_t keyCount = arg2;
 692         uint64_t ui64Key = 0;
 693
 694         // variables
 695         int i;
 696         byte_t isOK = 0;
 697         uint8_t uid[10];
 698         uint32_t cuid;
 699         struct Crypto1State mpcs = {0, 0};
 700         struct Crypto1State *pcs;
 701         pcs = &mpcs;
 702
 703         // clear debug level
 704         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 705         MF_DBGLEVEL = MF_DBG_NONE;
 706
 707         // clear trace
 708         iso14a_clear_trace();
 709         iso14a_set_tracing(TRUE);
 710
 711         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 712
 713         LED_A_ON();
 714         LED_B_OFF();
 715         LED_C_OFF();
 716
 717         for (i = 0; i < keyCount; i++) {
 718                 if(mifare_classic_halt(pcs, cuid)) {
 719                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 720                 }
 721
 722                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 723                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 724                         break;
 725                 };
 726
 727                 ui64Key = bytes_to_num(datain + i * 6, 6);
 728                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 729                         continue;
 730                 };
 731
 732                 isOK = 1;
 733                 break;
 734         }
 735
 736         //  ----------------------------- crypto1 destroy
 737         crypto1_destroy(pcs);
 738
 739         LED_B_ON();
 740     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 741         LED_B_OFF();
 742
 743   // Thats it...
 744         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 745         LEDsoff();
 746
 747         // restore debug level
 748         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 749 }
 750
 751 //-----------------------------------------------------------------------------
 752 // MIFARE commands set debug level
 753 //
 754 //-----------------------------------------------------------------------------
 755 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 756         MF_DBGLEVEL = arg0;
 757         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 758 }
 759
 760
 761 //-----------------------------------------------------------------------------
 762 // Work with emulator memory
 763 //
 764 //-----------------------------------------------------------------------------
 765 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 766         emlClearMem();
 767 }
 768
 769
 770 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 771         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 772 }
 773
 774
 775 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 776
 777         byte_t buf[48];
 778         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 779
 780         LED_B_ON();
 781         cmd_send(CMD_ACK,arg0,arg1,0,buf,48);
 782         LED_B_OFF();
 783 }
 784
 785
 786 //-----------------------------------------------------------------------------
 787 // Load a card into the emulator memory
 788 //
 789 //-----------------------------------------------------------------------------
 790 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 791         uint8_t numSectors = arg0;
 792         uint8_t keyType = arg1;
 793         uint64_t ui64Key = 0;
 794         uint32_t cuid;
 795         struct Crypto1State mpcs = {0, 0};
 796         struct Crypto1State *pcs;
 797         pcs = &mpcs;
 798
 799         // variables
 800         byte_t dataoutbuf[16];
 801         byte_t dataoutbuf2[16];
 802         uint8_t uid[10];
 803
 804         // clear trace
 805         iso14a_clear_trace();
 806         iso14a_set_tracing(false);
 807
 808         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 809
 810         LED_A_ON();
 811         LED_B_OFF();
 812         LED_C_OFF();
 813
 814         bool isOK = true;
 815
 816         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 817                 isOK = false;
 818                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 819         }
 820
 821         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 822                 ui64Key = emlGetKey(sectorNo, keyType);
 823                 if (sectorNo == 0){
 824                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 825                                 isOK = false;
 826                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 827                                 break;
 828                         }
 829                 } else {
 830                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 831                                 isOK = false;
 832                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 833                                 break;
 834                         }
 835                 }
 836
 837                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 838                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 839                                 isOK = false;
 840                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 841                                 break;
 842                         };
 843                         if (isOK) {
 844                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 845                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 846                                 } else {        // sector trailer, keep the keys, set only the AC
 847                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 848                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 849                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 850                                 }
 851                         }
 852                 }
 853
 854         }
 855
 856         if(mifare_classic_halt(pcs, cuid)) {
 857                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 858         };
 859
 860         //  ----------------------------- crypto1 destroy
 861         crypto1_destroy(pcs);
 862
 863         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 864         LEDsoff();
 865
 866         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 867
 868 }
 869
 870
 871 //-----------------------------------------------------------------------------
 872 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 873 //
 874 //-----------------------------------------------------------------------------
 875 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 876
 877   // params
 878         uint8_t needWipe = arg0;
 879         // bit 0 - need get UID
 880         // bit 1 - need wupC
 881         // bit 2 - need HALT after sequence
 882         // bit 3 - need init FPGA and field before sequence
 883         // bit 4 - need reset FPGA and LED
 884         uint8_t workFlags = arg1;
 885         uint8_t blockNo = arg2;
 886
 887         // card commands
 888         uint8_t wupC1[]       = { 0x40 };
 889         uint8_t wupC2[]       = { 0x43 };
 890         uint8_t wipeC[]       = { 0x41 };
 891
 892         // variables
 893         byte_t isOK = 0;
 894         uint8_t uid[10];
 895         uint8_t d_block[18];
 896         uint32_t cuid;
 897
 898         memset(uid, 0x00, 10);
 899         uint8_t* receivedAnswer = mifare_get_bigbufptr();
 900
 901         if (workFlags & 0x08) {
 902                 // clear trace
 903                 iso14a_clear_trace();
 904                 iso14a_set_tracing(TRUE);
 905
 906                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 907
 908                 LED_A_ON();
 909                 LED_B_OFF();
 910                 LED_C_OFF();
 911
 912                 SpinDelay(300);
 913                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 914                 SpinDelay(100);
 915                 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
 916         }
 917
 918         while (true) {
 919                 // get UID from chip
 920                 if (workFlags & 0x01) {
 921                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 922                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 923                                 break;
 924                         };
 925
 926                         if(mifare_classic_halt(NULL, cuid)) {
 927                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 928                                 break;
 929                         };
 930                 };
 931
 932                 // reset chip
 933                 if (needWipe){
 934       ReaderTransmitBitsPar(wupC1,7,0, NULL);
 935                         if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
 936                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 937                                 break;
 938                         };
 939
 940                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
 941                         if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
 942                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
 943                                 break;
 944                         };
 945
 946                         if(mifare_classic_halt(NULL, cuid)) {
 947                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 948                                 break;
 949                         };
 950                 };
 951
 952                 // write block
 953                 if (workFlags & 0x02) {
 954       ReaderTransmitBitsPar(wupC1,7,0, NULL);
 955                         if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
 956                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 957                                 break;
 958                         };
 959
 960                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
 961                         if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
 962                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
 963                                 break;
 964                         };
 965                 }
 966
 967                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
 968                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
 969                         break;
 970                 };
 971
 972                 memcpy(d_block, datain, 16);
 973                 AppendCrc14443a(d_block, 16);
 974
 975                 ReaderTransmit(d_block, sizeof(d_block), NULL);
 976                 if ((ReaderReceive(receivedAnswer) != 1) || (receivedAnswer[0] != 0x0a)) {
 977                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
 978                         break;
 979                 };
 980
 981                 if (workFlags & 0x04) {
 982                         if (mifare_classic_halt(NULL, cuid)) {
 983                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 984                                 break;
 985                         };
 986                 }
 987
 988                 isOK = 1;
 989                 break;
 990         }
 991
 992         LED_B_ON();
 993         cmd_send(CMD_ACK,isOK,0,0,uid,4);
 994         LED_B_OFF();
 995
 996         if ((workFlags & 0x10) || (!isOK)) {
 997                 // Thats it...
 998                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 999                 LEDsoff();
1000         }
1001 }
1002
1003
1004 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1005
1006   // params
1007         // bit 1 - need wupC
1008         // bit 2 - need HALT after sequence
1009         // bit 3 - need init FPGA and field before sequence
1010         // bit 4 - need reset FPGA and LED
1011         uint8_t workFlags = arg0;
1012         uint8_t blockNo = arg2;
1013
1014         // card commands
1015         uint8_t wupC1[]       = { 0x40 };
1016         uint8_t wupC2[]       = { 0x43 };
1017
1018         // variables
1019         byte_t isOK = 0;
1020         uint8_t data[18];
1021         uint32_t cuid = 0;
1022
1023         memset(data, 0x00, 18);
1024         uint8_t* receivedAnswer = mifare_get_bigbufptr();
1025
1026         if (workFlags & 0x08) {
1027                 // clear trace
1028                 iso14a_clear_trace();
1029                 iso14a_set_tracing(TRUE);
1030
1031                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1032
1033                 LED_A_ON();
1034                 LED_B_OFF();
1035                 LED_C_OFF();
1036
1037                 SpinDelay(300);
1038                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1039                 SpinDelay(100);
1040                 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1041         }
1042
1043         while (true) {
1044                 if (workFlags & 0x02) {
1045                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1046                         if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
1047                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1048                                 break;
1049                         };
1050
1051                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1052                         if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
1053                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1054                                 break;
1055                         };
1056                 }
1057
1058                 // read block
1059                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, NULL) != 18)) {
1060                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1061                         break;
1062                 };
1063                 memcpy(data, receivedAnswer, 18);
1064
1065                 if (workFlags & 0x04) {
1066                         if (mifare_classic_halt(NULL, cuid)) {
1067                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1068                                 break;
1069                         };
1070                 }
1071
1072                 isOK = 1;
1073                 break;
1074         }
1075
1076         LED_B_ON();
1077         cmd_send(CMD_ACK,isOK,0,0,data,18);
1078         LED_B_OFF();
1079
1080         if ((workFlags & 0x10) || (!isOK)) {
1081                 // Thats it...
1082                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1083                 LEDsoff();
1084         }
1085 }
1086