git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014,2015,2016
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "crc.h"
  20 #include "protocols.h"
  21 #include "parity.h"
  22
  23 //-----------------------------------------------------------------------------
  24 // Select, Authenticate, Read a MIFARE tag.
  25 // read block
  26 //-----------------------------------------------------------------------------
  27 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  28 {
  29   // params
  30         uint8_t blockNo = arg0;
  31         uint8_t keyType = arg1;
  32         uint64_t ui64Key = 0;
  33         ui64Key = bytes_to_num(datain, 6);
  34
  35         // variables
  36         byte_t isOK = 0;
  37         byte_t dataoutbuf[16] = {0x00};
  38         uint8_t uid[10] = {0x00};
  39         uint32_t cuid = 0;
  40         struct Crypto1State mpcs = {0, 0};
  41         struct Crypto1State *pcs;
  42         pcs = &mpcs;
  43
  44         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  45
  46         clear_trace();
  47         set_tracing(true);
  48
  49         LED_A_ON();
  50         LED_B_OFF();
  51         LED_C_OFF();
  52
  53         while (true) {
  54                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
  55                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  56                         break;
  57                 };
  58
  59                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  60                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  61                         break;
  62                 };
  63
  64                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  65                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  66                         break;
  67                 };
  68
  69                 if(mifare_classic_halt(pcs, cuid)) {
  70                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  71                         break;
  72                 };
  73
  74                 isOK = 1;
  75                 break;
  76         }
  77
  78         crypto1_destroy(pcs);
  79
  80         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  81
  82         LED_B_ON();
  83         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  84         LED_B_OFF();
  85
  86         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  87         LEDsoff();
  88 }
  89
  90 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
  91
  92         bool turnOffField = (arg0 == 1);
  93
  94         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
  95
  96         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  97
  98         clear_trace();
  99         set_tracing(true);
 100
 101         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 102                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 103                 OnError(0);
 104                 return;
 105         };
 106
 107         if(!mifare_ultra_auth(keybytes)){
 108                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
 109                 OnError(1);
 110                 return;
 111         }
 112
 113         if (turnOffField) {
 114                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 115                 LEDsoff();
 116         }
 117         cmd_send(CMD_ACK,1,0,0,0,0);
 118 }
 119
 120 // Arg0 = BlockNo,
 121 // Arg1 = UsePwd bool
 122 // datain = PWD bytes,
 123 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 124 {
 125         uint8_t blockNo = arg0;
 126         byte_t dataout[16] = {0x00};
 127         bool useKey = (arg1 == 1); //UL_C
 128         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 129
 130         LEDsoff();
 131         LED_A_ON();
 132         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 133
 134         clear_trace();
 135         set_tracing(true);
 136
 137         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 138         if(!len) {
 139                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 140                 OnError(1);
 141                 return;
 142         }
 143
 144         // UL-C authentication
 145         if ( useKey ) {
 146                 uint8_t key[16] = {0x00};
 147                 memcpy(key, datain, sizeof(key) );
 148
 149                 if ( !mifare_ultra_auth(key) ) {
 150                         OnError(1);
 151                         return;
 152                 }
 153         }
 154
 155         // UL-EV1 / NTAG authentication
 156         if ( usePwd ) {
 157                 uint8_t pwd[4] = {0x00};
 158                 memcpy(pwd, datain, 4);
 159                 uint8_t pack[4] = {0,0,0,0};
 160                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 161                         OnError(1);
 162                         return;
 163                 }
 164         }
 165
 166         if( mifare_ultra_readblock(blockNo, dataout) ) {
 167                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 168                 OnError(2);
 169                 return;
 170         }
 171
 172         if( mifare_ultra_halt() ) {
 173                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 174                 OnError(3);
 175                 return;
 176         }
 177
 178     cmd_send(CMD_ACK,1,0,0,dataout,16);
 179         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 180         LEDsoff();
 181 }
 182
 183 //-----------------------------------------------------------------------------
 184 // Select, Authenticate, Read a MIFARE tag.
 185 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 186 //-----------------------------------------------------------------------------
 187 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 188 {
 189   // params
 190         uint8_t sectorNo = arg0;
 191         uint8_t keyType = arg1;
 192         uint64_t ui64Key = 0;
 193         ui64Key = bytes_to_num(datain, 6);
 194
 195         // variables
 196         byte_t isOK = 0;
 197         byte_t dataoutbuf[16 * 16];
 198         uint8_t uid[10] = {0x00};
 199         uint32_t cuid = 0;
 200         struct Crypto1State mpcs = {0, 0};
 201         struct Crypto1State *pcs;
 202         pcs = &mpcs;
 203
 204         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 205
 206         clear_trace();
 207         set_tracing(true);
 208
 209         LED_A_ON();
 210         LED_B_OFF();
 211         LED_C_OFF();
 212
 213         isOK = 1;
 214         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 215                 isOK = 0;
 216                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 217         }
 218
 219
 220         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 221                 isOK = 0;
 222                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 223         }
 224
 225         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 226                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 227                         isOK = 0;
 228                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 229                         break;
 230                 }
 231         }
 232
 233         if(mifare_classic_halt(pcs, cuid)) {
 234                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 235         }
 236
 237         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 238
 239         crypto1_destroy(pcs);
 240
 241         LED_B_ON();
 242         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 243         LED_B_OFF();
 244
 245         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 246         LEDsoff();
 247         set_tracing(FALSE);
 248 }
 249
 250 // arg0 = blockNo (start)
 251 // arg1 = Pages (number of blocks)
 252 // arg2 = useKey
 253 // datain = KEY bytes
 254 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 255 {
 256         LEDsoff();
 257         LED_A_ON();
 258         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 259
 260         // free eventually allocated BigBuf memory
 261         BigBuf_free(); BigBuf_Clear_ext(false);
 262         clear_trace();
 263         set_tracing(true);
 264
 265         // params
 266         uint8_t blockNo = arg0;
 267         uint16_t blocks = arg1;
 268         bool useKey = (arg2 == 1); //UL_C
 269         bool usePwd = (arg2 == 2); //UL_EV1/NTAG
 270         uint32_t countblocks = 0;
 271         uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
 272         if (dataout == NULL){
 273                 Dbprintf("out of memory");
 274                 OnError(1);
 275                 return;
 276         }
 277
 278         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 279         if (!len) {
 280                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 281                 OnError(1);
 282                 return;
 283         }
 284
 285         // UL-C authentication
 286         if ( useKey ) {
 287                 uint8_t key[16] = {0x00};
 288                 memcpy(key, datain, sizeof(key) );
 289
 290                 if ( !mifare_ultra_auth(key) ) {
 291                         OnError(1);
 292                         return;
 293                 }
 294         }
 295
 296         // UL-EV1 / NTAG authentication
 297         if (usePwd) {
 298                 uint8_t pwd[4] = {0x00};
 299                 memcpy(pwd, datain, sizeof(pwd));
 300                 uint8_t pack[4] = {0,0,0,0};
 301
 302                 if (!mifare_ul_ev1_auth(pwd, pack)){
 303                         OnError(1);
 304                         return;
 305                 }
 306         }
 307
 308         for (int i = 0; i < blocks; i++){
 309                 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
 310                         Dbprintf("Data exceeds buffer!!");
 311                         break;
 312                 }
 313
 314                 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
 315
 316                 if (len) {
 317                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 318                         // if no blocks read - error out
 319                         if (i==0){
 320                                 OnError(2);
 321                         return;
 322                         } else {
 323                                 //stop at last successful read block and return what we got
 324                                 break;
 325                         }
 326                 } else {
 327                         countblocks++;
 328                 }
 329         }
 330
 331         len = mifare_ultra_halt();
 332         if (len) {
 333                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 334                 OnError(3);
 335                 return;
 336         }
 337
 338         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 339
 340         countblocks *= 4;
 341
 342         cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
 343         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 344         LEDsoff();
 345         BigBuf_free();
 346         set_tracing(FALSE);
 347 }
 348
 349 //-----------------------------------------------------------------------------
 350 // Select, Authenticate, Write a MIFARE tag.
 351 // read block
 352 //-----------------------------------------------------------------------------
 353 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 354 {
 355         // params
 356         uint8_t blockNo = arg0;
 357         uint8_t keyType = arg1;
 358         uint64_t ui64Key = 0;
 359         byte_t blockdata[16] = {0x00};
 360
 361         ui64Key = bytes_to_num(datain, 6);
 362         memcpy(blockdata, datain + 10, 16);
 363
 364         // variables
 365         byte_t isOK = 0;
 366         uint8_t uid[10] = {0x00};
 367         uint32_t cuid = 0;
 368         struct Crypto1State mpcs = {0, 0};
 369         struct Crypto1State *pcs;
 370         pcs = &mpcs;
 371
 372         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 373
 374         clear_trace();
 375         set_tracing(true);
 376
 377         LED_A_ON();
 378         LED_B_OFF();
 379         LED_C_OFF();
 380
 381         while (true) {
 382                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 383                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 384                         break;
 385                 };
 386
 387                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 388                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 389                         break;
 390                 };
 391
 392                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 393                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 394                         break;
 395                 };
 396
 397                 if(mifare_classic_halt(pcs, cuid)) {
 398                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 399                         break;
 400                 };
 401
 402                 isOK = 1;
 403                 break;
 404         }
 405
 406         //  ----------------------------- crypto1 destroy
 407         crypto1_destroy(pcs);
 408
 409         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 410
 411         LED_B_ON();
 412         cmd_send(CMD_ACK,isOK,0,0,0,0);
 413         LED_B_OFF();
 414
 415         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 416         LEDsoff();
 417         set_tracing(FALSE);
 418 }
 419
 420 /* // Command not needed but left for future testing
 421 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
 422 {
 423         uint8_t blockNo = arg0;
 424         byte_t blockdata[16] = {0x00};
 425
 426         memcpy(blockdata, datain, 16);
 427
 428         uint8_t uid[10] = {0x00};
 429
 430         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 431
 432         clear_trace();
 433         set_tracing(true);
 434         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 435
 436         if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
 437                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 438                 OnError(0);
 439                 return;
 440         };
 441
 442         if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
 443                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 444                 OnError(0);
 445                 return; };
 446
 447         if(mifare_ultra_halt()) {
 448                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 449                 OnError(0);
 450                 return;
 451         };
 452
 453         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 454
 455         cmd_send(CMD_ACK,1,0,0,0,0);
 456         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 457         LEDsoff();
 458 }
 459 */
 460
 461 // Arg0   : Block to write to.
 462 // Arg1   : 0 = use no authentication.
 463 //          1 = use 0x1A authentication.
 464 //          2 = use 0x1B authentication.
 465 // datain : 4 first bytes is data to be written.
 466 //        : 4/16 next bytes is authentication key.
 467 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 468 {
 469         uint8_t blockNo = arg0;
 470         bool useKey = (arg1 == 1); //UL_C
 471         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 472         byte_t blockdata[4] = {0x00};
 473
 474         memcpy(blockdata, datain,4);
 475
 476         LEDsoff();
 477         LED_A_ON();
 478         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 479
 480         clear_trace();
 481         set_tracing(true);
 482
 483         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 484                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 485                 OnError(0);
 486                 return;
 487         };
 488
 489         // UL-C authentication
 490         if ( useKey ) {
 491                 uint8_t key[16] = {0x00};
 492                 memcpy(key, datain+4, sizeof(key) );
 493
 494                 if ( !mifare_ultra_auth(key) ) {
 495                         OnError(1);
 496                         return;
 497                 }
 498         }
 499
 500         // UL-EV1 / NTAG authentication
 501         if (usePwd) {
 502                 uint8_t pwd[4] = {0x00};
 503                 memcpy(pwd, datain+4, 4);
 504                 uint8_t pack[4] = {0,0,0,0};
 505                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 506                         OnError(1);
 507                         return;
 508                 }
 509         }
 510
 511         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 512                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 513                 OnError(0);
 514                 return;
 515         };
 516
 517         if(mifare_ultra_halt()) {
 518                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 519                 OnError(0);
 520                 return;
 521         };
 522
 523         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 524
 525         cmd_send(CMD_ACK,1,0,0,0,0);
 526         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 527         LEDsoff();
 528         set_tracing(FALSE);
 529 }
 530
 531 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 532
 533         uint8_t pwd[16] = {0x00};
 534         byte_t blockdata[4] = {0x00};
 535
 536         memcpy(pwd, datain, 16);
 537
 538         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 539         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 540
 541         clear_trace();
 542         set_tracing(true);
 543
 544         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 545                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 546                 OnError(0);
 547                 return;
 548         };
 549
 550         blockdata[0] = pwd[7];
 551         blockdata[1] = pwd[6];
 552         blockdata[2] = pwd[5];
 553         blockdata[3] = pwd[4];
 554         if(mifare_ultra_writeblock( 44, blockdata)) {
 555                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 556                 OnError(44);
 557                 return;
 558         };
 559
 560         blockdata[0] = pwd[3];
 561         blockdata[1] = pwd[2];
 562         blockdata[2] = pwd[1];
 563         blockdata[3] = pwd[0];
 564         if(mifare_ultra_writeblock( 45, blockdata)) {
 565                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 566                 OnError(45);
 567                 return;
 568         };
 569
 570         blockdata[0] = pwd[15];
 571         blockdata[1] = pwd[14];
 572         blockdata[2] = pwd[13];
 573         blockdata[3] = pwd[12];
 574         if(mifare_ultra_writeblock( 46, blockdata)) {
 575                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 576                 OnError(46);
 577                 return;
 578         };
 579
 580         blockdata[0] = pwd[11];
 581         blockdata[1] = pwd[10];
 582         blockdata[2] = pwd[9];
 583         blockdata[3] = pwd[8];
 584         if(mifare_ultra_writeblock( 47, blockdata)) {
 585                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 586                 OnError(47);
 587                 return;
 588         };
 589
 590         if(mifare_ultra_halt()) {
 591                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 592                 OnError(0);
 593                 return;
 594         };
 595
 596         cmd_send(CMD_ACK,1,0,0,0,0);
 597         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 598         LEDsoff();
 599         set_tracing(FALSE);
 600 }
 601
 602 // Return 1 if the nonce is invalid else return 0
 603 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 604         return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 605         (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 606         (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 607 }
 608
 609
 610 //-----------------------------------------------------------------------------
 611 // acquire encrypted nonces in order to perform the attack described in
 612 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
 613 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
 614 // Computer and Communications Security, 2015
 615 //-----------------------------------------------------------------------------
 616 #define AUTHENTICATION_TIMEOUT 848                      // card times out 1ms after wrong authentication (according to NXP documentation)
 617 #define PRE_AUTHENTICATION_LEADTIME 400         // some (non standard) cards need a pause after select before they are ready for first authentication
 618
 619 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
 620 {
 621         uint64_t ui64Key = 0;
 622         uint8_t uid[10] = {0x00};
 623         uint32_t cuid = 0;
 624         uint8_t cascade_levels = 0;
 625         struct Crypto1State mpcs = {0, 0};
 626         struct Crypto1State *pcs;
 627         pcs = &mpcs;
 628         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
 629         int16_t isOK = 0;
 630         uint8_t par_enc[1] = {0x00};
 631         uint8_t nt_par_enc = 0;
 632         uint8_t buf[USB_CMD_DATA_SIZE] = {0x00};
 633         uint32_t timeout = 0;
 634
 635         uint8_t blockNo = arg0 & 0xff;
 636         uint8_t keyType = (arg0 >> 8) & 0xff;
 637         uint8_t targetBlockNo = arg1 & 0xff;
 638         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 639         ui64Key = bytes_to_num(datain, 6);
 640         bool initialize = flags & 0x0001;
 641         bool slow = flags & 0x0002;
 642         bool field_off = flags & 0x0004;
 643
 644         LED_A_ON();
 645         LED_C_OFF();
 646
 647         if (initialize) {
 648                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 649                 clear_trace();
 650                 set_tracing(true);
 651         }
 652
 653         LED_C_ON();
 654
 655         uint16_t num_nonces = 0;
 656         bool have_uid = false;
 657         for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
 658
 659                 // Test if the action was cancelled
 660                 if(BUTTON_PRESS()) {
 661                         isOK = 2;
 662                         field_off = true;
 663                         break;
 664                 }
 665
 666                 if (!have_uid) { // need a full select cycle to get the uid first
 667                         iso14a_card_select_t card_info;
 668                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
 669                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (ALL)");
 670                                 continue;
 671                         }
 672                         switch (card_info.uidlen) {
 673                                 case 4 : cascade_levels = 1; break;
 674                                 case 7 : cascade_levels = 2; break;
 675                                 case 10: cascade_levels = 3; break;
 676                                 default: break;
 677                         }
 678                         have_uid = true;
 679                 } else { // no need for anticollision. We can directly select the card
 680                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
 681                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (UID)");
 682                                 continue;
 683                         }
 684                 }
 685
 686                 if (slow) {
 687                         timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
 688                         while(GetCountSspClk() < timeout);
 689                 }
 690
 691                 uint32_t nt1;
 692                 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
 693                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth1 error");
 694                         continue;
 695                 }
 696
 697                 // nested authentication
 698                 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
 699                 if (len != 4) {
 700                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth2 error len=%d", len);
 701                         continue;
 702                 }
 703
 704                 // send a dummy byte as reader response in order to trigger the cards authentication timeout
 705                 uint8_t dummy_answer = 0;
 706                 ReaderTransmit(&dummy_answer, 1, NULL);
 707                 timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
 708
 709                 num_nonces++;
 710                 if (num_nonces % 2) {
 711                         memcpy(buf+i, receivedAnswer, 4);
 712                         nt_par_enc = par_enc[0] & 0xf0;
 713                 } else {
 714                         nt_par_enc |= par_enc[0] >> 4;
 715                         memcpy(buf+i+4, receivedAnswer, 4);
 716                         memcpy(buf+i+8, &nt_par_enc, 1);
 717                         i += 9;
 718                 }
 719                 // wait for the card to become ready again
 720                 while(GetCountSspClk() < timeout);
 721         }
 722
 723         LED_C_OFF();
 724
 725         crypto1_destroy(pcs);
 726
 727         LED_B_ON();
 728         cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
 729         LED_B_OFF();
 730
 731         if (MF_DBGLEVEL >= 3)   DbpString("AcquireEncryptedNonces finished");
 732
 733         if (field_off) {
 734                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 735                 LEDsoff();
 736                 set_tracing(FALSE);
 737         }
 738 }
 739
 740
 741 //-----------------------------------------------------------------------------
 742 // MIFARE nested authentication.
 743 //
 744 //-----------------------------------------------------------------------------
 745 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 746 {
 747         // params
 748         uint8_t blockNo = arg0 & 0xff;
 749         uint8_t keyType = (arg0 >> 8) & 0xff;
 750         uint8_t targetBlockNo = arg1 & 0xff;
 751         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 752         uint64_t ui64Key = 0;
 753
 754         ui64Key = bytes_to_num(datain, 6);
 755
 756         // variables
 757         uint16_t rtr, i, j, len;
 758         uint16_t davg = 0;
 759         static uint16_t dmin, dmax;
 760         uint8_t uid[10] = {0x00};
 761         uint32_t cuid = 0, nt1, nt2, nttmp, nttest, ks1;
 762         uint8_t par[1] = {0x00};
 763         uint32_t target_nt[2] = {0x00}, target_ks[2] = {0x00};
 764
 765         uint8_t par_array[4] = {0x00};
 766         uint16_t ncount = 0;
 767         struct Crypto1State mpcs = {0, 0};
 768         struct Crypto1State *pcs;
 769         pcs = &mpcs;
 770         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
 771
 772         uint32_t auth1_time, auth2_time;
 773         static uint16_t delta_time = 0;
 774
 775         LED_A_ON();
 776         LED_C_OFF();
 777         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 778
 779         // free eventually allocated BigBuf memory
 780         BigBuf_free(); BigBuf_Clear_ext(false);
 781
 782         if (calibrate) clear_trace();
 783         set_tracing(true);
 784
 785         // statistics on nonce distance
 786         int16_t isOK = 0;
 787         #define NESTED_MAX_TRIES 12
 788         uint16_t unsuccessfull_tries = 0;
 789         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 790                 LED_B_ON();
 791                 WDT_HIT();
 792
 793                 davg = dmax = 0;
 794                 dmin = 2000;
 795                 delta_time = 0;
 796
 797                 for (rtr = 0; rtr < 17; rtr++) {
 798
 799                         // Test if the action was cancelled
 800                         if(BUTTON_PRESS()) {
 801                                 isOK = -2;
 802                                 break;
 803                         }
 804
 805                         // prepare next select. No need to power down the card.
 806                         if(mifare_classic_halt(pcs, cuid)) {
 807                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 808                                 rtr--;
 809                                 continue;
 810                         }
 811
 812                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 813                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 814                                 rtr--;
 815                                 continue;
 816                         };
 817
 818                         auth1_time = 0;
 819                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 820                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 821                                 rtr--;
 822                                 continue;
 823                         };
 824                         auth2_time = (delta_time) ? auth1_time + delta_time : 0;
 825
 826                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 827                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 828                                 rtr--;
 829                                 continue;
 830                         };
 831
 832                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 833                         for (i = 101; i < 1200; i++) {
 834                                 nttmp = prng_successor(nttmp, 1);
 835                                 if (nttmp == nt2) break;
 836                         }
 837
 838                         if (i != 1200) {
 839                                 if (rtr != 0) {
 840                                         davg += i;
 841                                         dmin = MIN(dmin, i);
 842                                         dmax = MAX(dmax, i);
 843                                 }
 844                                 else {
 845                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 846                                 }
 847                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 848                         } else {
 849                                 unsuccessfull_tries++;
 850                                 if (unsuccessfull_tries > NESTED_MAX_TRIES) {   // card isn't vulnerable to nested attack (random numbers are not predictable)
 851                                         isOK = -3;
 852                                 }
 853                         }
 854                 }
 855
 856                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 857
 858                 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
 859
 860                 dmin = davg - 2;
 861                 dmax = davg + 2;
 862
 863                 LED_B_OFF();
 864         }
 865 //  -------------------------------------------------------------------------------------------------
 866
 867         LED_C_ON();
 868
 869         //  get crypted nonces for target sector
 870         for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
 871
 872                 target_nt[i] = 0;
 873                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 874
 875                         // prepare next select. No need to power down the card.
 876                         if(mifare_classic_halt(pcs, cuid)) {
 877                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 878                                 continue;
 879                         }
 880
 881                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 882                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 883                                 continue;
 884                         };
 885
 886                         auth1_time = 0;
 887                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 888                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 889                                 continue;
 890                         };
 891
 892                         // nested authentication
 893                         auth2_time = auth1_time + delta_time;
 894
 895                         len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 896                         if (len != 4) {
 897                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 898                                 continue;
 899                         };
 900
 901                         nt2 = bytes_to_num(receivedAnswer, 4);
 902                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 903
 904                         // Parity validity check
 905 //                      for (j = 0; j < 4; j++) {
 906 //                              par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 907 //                      }
 908                         par_array[0] = (oddparity8(receivedAnswer[0]) != ((par[0] >> (7-0)) & 0x01));
 909                         par_array[1] = (oddparity8(receivedAnswer[1]) != ((par[0] >> (7-1)) & 0x01));
 910                         par_array[2] = (oddparity8(receivedAnswer[2]) != ((par[0] >> (7-2)) & 0x01));
 911                         par_array[3] = (oddparity8(receivedAnswer[3]) != ((par[0] >> (7-3)) & 0x01));
 912
 913                         ncount = 0;
 914                         nttest = prng_successor(nt1, dmin - 1);
 915                         for (j = dmin; j < dmax + 1; j++) {
 916                                 nttest = prng_successor(nttest, 1);
 917                                 ks1 = nt2 ^ nttest;
 918
 919                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 920                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 921                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 922                                                 target_nt[i] = 0;
 923                                                 break;
 924                                         }
 925                                         target_nt[i] = nttest;
 926                                         target_ks[i] = ks1;
 927                                         ncount++;
 928                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 929                                                 target_nt[i] = 0;
 930                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 931                                                 break;
 932                                         }
 933                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 934                                 }
 935                         }
 936                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 937                 }
 938         }
 939
 940         LED_C_OFF();
 941
 942         crypto1_destroy(pcs);
 943
 944         byte_t buf[4 + 4 * 4] = {0};
 945         memcpy(buf, &cuid, 4);
 946         memcpy(buf+4, &target_nt[0], 4);
 947         memcpy(buf+8, &target_ks[0], 4);
 948         memcpy(buf+12, &target_nt[1], 4);
 949         memcpy(buf+16, &target_ks[1], 4);
 950
 951         LED_B_ON();
 952         cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 953         LED_B_OFF();
 954
 955         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 956
 957         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 958         LEDsoff();
 959         set_tracing(FALSE);
 960 }
 961
 962 //-----------------------------------------------------------------------------
 963 // MIFARE check keys. key count up to 85.
 964 //
 965 //-----------------------------------------------------------------------------
 966 void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) {
 967         uint8_t blockNo = arg0 & 0xff;
 968         uint8_t keyType = (arg0 >> 8) & 0xff;
 969         bool clearTrace = arg1;
 970         uint8_t keyCount = arg2;
 971         uint64_t ui64Key = 0;
 972
 973         bool have_uid = FALSE;
 974         uint8_t cascade_levels = 0;
 975         uint32_t timeout = 0;
 976
 977         int i;
 978         byte_t isOK = 0;
 979         uint8_t uid[10] = {0x00};
 980         uint32_t cuid = 0;
 981         struct Crypto1State mpcs = {0, 0};
 982         struct Crypto1State *pcs;
 983         pcs = &mpcs;
 984
 985         // save old debuglevel, and tempory turn off dbg printing. speedissues.
 986         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 987         MF_DBGLEVEL = MF_DBG_NONE;
 988
 989         LEDsoff();
 990         LED_A_ON();
 991
 992         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 993
 994         if (clearTrace)
 995                 clear_trace();
 996
 997         set_tracing(TRUE);
 998
 999         for (i = 0; i < keyCount; ++i) {
1000
1001                 //mifare_classic_halt(pcs, cuid);
1002
1003                 // this part is from Piwi's faster nonce collecting part in Hardnested.
1004                 if (!have_uid) { // need a full select cycle to get the uid first
1005                         iso14a_card_select_t card_info;
1006                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
1007                                 if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Can't select card (ALL)");
1008                                 break;
1009                         }
1010                         switch (card_info.uidlen) {
1011                                 case 4 : cascade_levels = 1; break;
1012                                 case 7 : cascade_levels = 2; break;
1013                                 case 10: cascade_levels = 3; break;
1014                                 default: break;
1015                         }
1016                         have_uid = TRUE;
1017                 } else { // no need for anticollision. We can directly select the card
1018                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
1019                                 if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Can't select card (UID)");
1020                                 continue;
1021                         }
1022                 }
1023
1024                 ui64Key = bytes_to_num(datain + i * 6, 6);
1025
1026                 if (mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
1027
1028                         uint8_t dummy_answer = 0;
1029                         ReaderTransmit(&dummy_answer, 1, NULL);
1030                         timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
1031
1032                         // wait for the card to become ready again
1033                         while(GetCountSspClk() < timeout);
1034
1035                         continue;
1036                 }
1037                 isOK = 1;
1038                 break;
1039         }
1040
1041         LED_B_ON();
1042     cmd_send(CMD_ACK, isOK, 0, 0, datain + i * 6, 6);
1043
1044         // restore debug level
1045         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1046
1047         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1048         LEDsoff();
1049         set_tracing(FALSE);
1050         crypto1_destroy(pcs);
1051 }
1052
1053 //-----------------------------------------------------------------------------
1054 // MIFARE commands set debug level
1055 //
1056 //-----------------------------------------------------------------------------
1057 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1058         MF_DBGLEVEL = arg0;
1059         Dbprintf("Debug level: %d", MF_DBGLEVEL);
1060 }
1061
1062 //-----------------------------------------------------------------------------
1063 // Work with emulator memory
1064 //
1065 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1066 // involved in dealing with emulator memory. But if it is called later, it might
1067 // destroy the Emulator Memory.
1068 //-----------------------------------------------------------------------------
1069
1070 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1071         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1072         emlClearMem();
1073 }
1074
1075 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1076         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1077         if (arg2==0) arg2 = 16; // backwards compat... default bytewidth
1078         emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width
1079 }
1080
1081 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1082         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1083         byte_t buf[USB_CMD_DATA_SIZE] = {0x00};
1084         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1085
1086         LED_B_ON();
1087         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1088         LED_B_OFF();
1089 }
1090
1091 //-----------------------------------------------------------------------------
1092 // Load a card into the emulator memory
1093 //
1094 //-----------------------------------------------------------------------------
1095 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1096         uint8_t numSectors = arg0;
1097         uint8_t keyType = arg1;
1098         uint64_t ui64Key = 0;
1099         uint32_t cuid = 0;
1100         struct Crypto1State mpcs = {0, 0};
1101         struct Crypto1State *pcs;
1102         pcs = &mpcs;
1103
1104         // variables
1105         byte_t dataoutbuf[16] = {0x00};
1106         byte_t dataoutbuf2[16] = {0x00};
1107         uint8_t uid[10] = {0x00};
1108
1109         LED_A_ON();
1110         LED_B_OFF();
1111         LED_C_OFF();
1112         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1113
1114         clear_trace();
1115         set_tracing(TRUE);
1116
1117         bool isOK = true;
1118
1119         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1120                 isOK = false;
1121                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1122         }
1123
1124         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1125                 ui64Key = emlGetKey(sectorNo, keyType);
1126                 if (sectorNo == 0){
1127                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1128                                 isOK = false;
1129                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
1130                                 break;
1131                         }
1132                 } else {
1133                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1134                                 isOK = false;
1135                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1136                                 break;
1137                         }
1138                 }
1139
1140                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1141                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1142                                 isOK = false;
1143                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1144                                 break;
1145                         }
1146                         if (isOK) {
1147                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1148                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1149                                 } else {        // sector trailer, keep the keys, set only the AC
1150                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1151                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1152                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
1153                                 }
1154                         }
1155                 }
1156
1157         }
1158
1159         if(mifare_classic_halt(pcs, cuid))
1160                 if (MF_DBGLEVEL >= 1)
1161                         Dbprintf("Halt error");
1162
1163         //  ----------------------------- crypto1 destroy
1164         crypto1_destroy(pcs);
1165
1166         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1167         LEDsoff();
1168
1169         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1170
1171         set_tracing(FALSE);
1172 }
1173
1174
1175 //-----------------------------------------------------------------------------
1176 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1177 //
1178 // PARAMS - workFlags
1179 // bit 0 - need get UID
1180 // bit 1 - need wupC
1181 // bit 2 - need HALT after sequence
1182 // bit 3 - need turn on FPGA before sequence
1183 // bit 4 - need turn off FPGA
1184 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1185 // bit 6 - wipe tag.
1186 //-----------------------------------------------------------------------------
1187 // magic uid card generation 1 commands
1188 uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
1189 uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
1190 uint8_t wipeC[] = { MIFARE_MAGICWIPEC };
1191
1192 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1193
1194         // params
1195         uint8_t workFlags = arg0;
1196         uint8_t blockNo = arg1;
1197
1198         // variables
1199         bool isOK = false; //assume we will get an error
1200         uint8_t errormsg = 0x00;
1201         uint8_t uid[10] = {0x00};
1202         uint8_t data[18] = {0x00};
1203         uint32_t cuid = 0;
1204
1205         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
1206         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
1207
1208         if (workFlags & MAGIC_INIT) {
1209                 LED_A_ON();
1210                 LED_B_OFF();
1211                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1212                 clear_trace();
1213                 set_tracing(TRUE);
1214         }
1215
1216         //loop doesn't loop just breaks out if error
1217         while (true) {
1218                 // read UID and return to client with write
1219                 if (workFlags & MAGIC_UID) {
1220                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1221                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Can't select card");
1222                                 errormsg = MAGIC_UID;
1223                                 // break;
1224                         }
1225
1226                         if ( mifare_classic_halt_ex(NULL) ) break;
1227                 }
1228
1229                 // wipe tag, fill it with zeros
1230                 if (workFlags & MAGIC_WIPE){
1231                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1232                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1233                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1234                                 errormsg = MAGIC_WIPE;
1235                                 break;
1236                         }
1237
1238                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1239                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1240                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wipeC error");
1241                                 errormsg = MAGIC_WIPE;
1242                                 break;
1243                         }
1244
1245                         if ( mifare_classic_halt_ex(NULL) ) break;
1246                 }
1247
1248                 // write block
1249                 if (workFlags & MAGIC_WUPC) {
1250                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1251                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1252                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1253                                 errormsg = MAGIC_WUPC;
1254                                 break;
1255                         }
1256
1257                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1258                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1259                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC2 error");
1260                                 errormsg = MAGIC_WUPC;
1261                                 break;
1262                         }
1263                 }
1264
1265                 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1266                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send command error");
1267                         errormsg = 4;
1268                         break;
1269                 }
1270
1271                 memcpy(data, datain, 16);
1272                 AppendCrc14443a(data, 16);
1273
1274                 ReaderTransmit(data, sizeof(data), NULL);
1275                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1276                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send data error");
1277                         errormsg = 0;
1278                         break;
1279                 }
1280
1281                 if (workFlags & MAGIC_OFF)
1282                         if ( mifare_classic_halt_ex(NULL) ) break;
1283
1284                 isOK = true;
1285                 break;
1286
1287         } // end while
1288
1289         if (isOK )
1290                 cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));
1291         else
1292                 OnErrorMagic(errormsg);
1293
1294         if (workFlags & MAGIC_OFF)
1295                 OnSuccessMagic();
1296 }
1297
1298 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1299
1300         uint8_t workFlags = arg0;
1301         uint8_t blockNo = arg1;
1302         uint8_t errormsg = 0x00;
1303         bool isOK = false; //assume we will get an error
1304
1305         // variables
1306         uint8_t data[MAX_MIFARE_FRAME_SIZE];
1307         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
1308         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
1309
1310         memset(data, 0x00, sizeof(data));
1311
1312         if (workFlags & MAGIC_INIT) {
1313                 LED_A_ON();
1314                 LED_B_OFF();
1315                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1316                 clear_trace();
1317                 set_tracing(TRUE);
1318         }
1319
1320         //loop doesn't loop just breaks out if error or done
1321         while (true) {
1322                 if (workFlags & MAGIC_WUPC) {
1323                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1324                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1325                                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1326                                 errormsg = MAGIC_WUPC;
1327                                 break;
1328                         }
1329
1330                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1331                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1332                                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1333                                 errormsg = MAGIC_WUPC;
1334                                 break;
1335                         }
1336                 }
1337
1338                 // read block
1339                 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1340                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");
1341                         errormsg = 0;
1342                         break;
1343                 }
1344
1345                 memcpy(data, receivedAnswer, sizeof(data));
1346
1347                 // send HALT
1348                 if (workFlags & MAGIC_HALT)
1349                         mifare_classic_halt_ex(NULL);
1350
1351                 isOK = true;
1352                 break;
1353         }
1354         // if MAGIC_DATAIN, the data stays on device side.
1355         if (workFlags & MAGIC_DATAIN) {
1356                 if (isOK)
1357                         memcpy(datain, data, sizeof(data));
1358         } else {
1359                 if (isOK)
1360                         cmd_send(CMD_ACK,1,0,0,data,sizeof(data));
1361                 else
1362                         OnErrorMagic(errormsg);
1363         }
1364
1365         if (workFlags & MAGIC_OFF)
1366                 OnSuccessMagic();
1367 }
1368
1369 void MifareCIdent(){
1370
1371         // variables
1372         bool isOK = true;
1373         uint8_t receivedAnswer[1] = {0x00};
1374         uint8_t receivedAnswerPar[1] = {0x00};
1375
1376         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1377         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1378                 isOK = false;
1379         }
1380
1381         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1382         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1383                 isOK = false;
1384         }
1385
1386         // removed the if,  since some magic tags misbehavies and send an answer to it.
1387         mifare_classic_halt(NULL, 0);
1388         cmd_send(CMD_ACK,isOK,0,0,0,0);
1389 }
1390
1391 void OnSuccessMagic(){
1392         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1393         LEDsoff();
1394         set_tracing(FALSE);
1395 }
1396 void OnErrorMagic(uint8_t reason){
1397         //          ACK, ISOK, reason,0,0,0
1398         cmd_send(CMD_ACK,0,reason,0,0,0);
1399         OnSuccessMagic();
1400 }
1401 //
1402 // DESFIRE
1403 //
1404 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1405         byte_t dataout[12] = {0x00};
1406         uint8_t uid[10] = {0x00};
1407         uint32_t cuid = 0;
1408
1409         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1410         clear_trace();
1411         set_tracing(true);
1412
1413         int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);
1414         if(!len) {
1415                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1416                 OnError(1);
1417                 return;
1418         };
1419
1420         if(mifare_desfire_des_auth1(cuid, dataout)){
1421                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1422                 OnError(4);
1423                 return;
1424         }
1425
1426         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1427     cmd_send(CMD_ACK, 1, cuid, 0, dataout, sizeof(dataout));
1428 }
1429
1430 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1431
1432         uint32_t cuid = arg0;
1433         uint8_t key[16] = {0x00};
1434         byte_t dataout[12] = {0x00};
1435         byte_t isOK = 0;
1436
1437         memcpy(key, datain, 16);
1438
1439         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1440
1441         if( isOK) {
1442             if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1443                 OnError(4);
1444                 return;
1445         }
1446
1447         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1448
1449         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1450         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1451         LEDsoff();
1452         set_tracing(FALSE);
1453 }