git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "crc.h"
  20 #include "protocols.h"
  21 #include "parity.h"
  22
  23 //-----------------------------------------------------------------------------
  24 // Select, Authenticate, Read a MIFARE tag.
  25 // read block
  26 //-----------------------------------------------------------------------------
  27 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  28 {
  29   // params
  30         uint8_t blockNo = arg0;
  31         uint8_t keyType = arg1;
  32         uint64_t ui64Key = 0;
  33         ui64Key = bytes_to_num(datain, 6);
  34
  35         // variables
  36         byte_t isOK = 0;
  37         byte_t dataoutbuf[16];
  38         uint8_t uid[10];
  39         uint32_t cuid;
  40         struct Crypto1State mpcs = {0, 0};
  41         struct Crypto1State *pcs;
  42         pcs = &mpcs;
  43
  44         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  45
  46         clear_trace();
  47
  48         LED_A_ON();
  49         LED_B_OFF();
  50         LED_C_OFF();
  51
  52         while (true) {
  53                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
  54                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  55                         break;
  56                 };
  57
  58                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  59                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  60                         break;
  61                 };
  62
  63                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  64                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  65                         break;
  66                 };
  67
  68                 if(mifare_classic_halt(pcs, cuid)) {
  69                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  70                         break;
  71                 };
  72
  73                 isOK = 1;
  74                 break;
  75         }
  76
  77         //  ----------------------------- crypto1 destroy
  78         crypto1_destroy(pcs);
  79
  80         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  81
  82         LED_B_ON();
  83         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  84         LED_B_OFF();
  85
  86         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  87         LEDsoff();
  88 }
  89
  90 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
  91
  92         bool turnOffField = (arg0 == 1);
  93
  94         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
  95
  96         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  97
  98         clear_trace();
  99
 100         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 101                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 102                 OnError(0);
 103                 return;
 104         };
 105
 106         if(!mifare_ultra_auth(keybytes)){
 107                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
 108                 OnError(1);
 109                 return;
 110         }
 111
 112         if (turnOffField) {
 113                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 114                 LEDsoff();
 115         }
 116         cmd_send(CMD_ACK,1,0,0,0,0);
 117 }
 118
 119 // Arg0 = BlockNo,
 120 // Arg1 = UsePwd bool
 121 // datain = PWD bytes,
 122 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 123 {
 124         uint8_t blockNo = arg0;
 125         byte_t dataout[16] = {0x00};
 126         bool useKey = (arg1 == 1); //UL_C
 127         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 128
 129         LEDsoff();
 130         LED_A_ON();
 131         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 132
 133         clear_trace();
 134
 135         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 136         if(!len) {
 137                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 138                 OnError(1);
 139                 return;
 140         }
 141
 142         // UL-C authentication
 143         if ( useKey ) {
 144                 uint8_t key[16] = {0x00};
 145                 memcpy(key, datain, sizeof(key) );
 146
 147                 if ( !mifare_ultra_auth(key) ) {
 148                         OnError(1);
 149                         return;
 150                 }
 151         }
 152
 153         // UL-EV1 / NTAG authentication
 154         if ( usePwd ) {
 155                 uint8_t pwd[4] = {0x00};
 156                 memcpy(pwd, datain, 4);
 157                 uint8_t pack[4] = {0,0,0,0};
 158                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 159                         OnError(1);
 160                         return;
 161                 }
 162         }
 163
 164         if( mifare_ultra_readblock(blockNo, dataout) ) {
 165                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 166                 OnError(2);
 167                 return;
 168         }
 169
 170         if( mifare_ultra_halt() ) {
 171                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 172                 OnError(3);
 173                 return;
 174         }
 175
 176     cmd_send(CMD_ACK,1,0,0,dataout,16);
 177         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 178         LEDsoff();
 179 }
 180
 181 //-----------------------------------------------------------------------------
 182 // Select, Authenticate, Read a MIFARE tag.
 183 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 184 //-----------------------------------------------------------------------------
 185 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 186 {
 187   // params
 188         uint8_t sectorNo = arg0;
 189         uint8_t keyType = arg1;
 190         uint64_t ui64Key = 0;
 191         ui64Key = bytes_to_num(datain, 6);
 192
 193         // variables
 194         byte_t isOK = 0;
 195         byte_t dataoutbuf[16 * 16];
 196         uint8_t uid[10];
 197         uint32_t cuid;
 198         struct Crypto1State mpcs = {0, 0};
 199         struct Crypto1State *pcs;
 200         pcs = &mpcs;
 201
 202         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 203
 204         clear_trace();
 205
 206         LED_A_ON();
 207         LED_B_OFF();
 208         LED_C_OFF();
 209
 210         isOK = 1;
 211         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 212                 isOK = 0;
 213                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 214         }
 215
 216
 217         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 218                 isOK = 0;
 219                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 220         }
 221
 222         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 223                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 224                         isOK = 0;
 225                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 226                         break;
 227                 }
 228         }
 229
 230         if(mifare_classic_halt(pcs, cuid)) {
 231                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 232         }
 233
 234         //  ----------------------------- crypto1 destroy
 235         crypto1_destroy(pcs);
 236
 237         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 238
 239         LED_B_ON();
 240         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 241         LED_B_OFF();
 242
 243         // Thats it...
 244         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 245         LEDsoff();
 246 }
 247
 248 // arg0 = blockNo (start)
 249 // arg1 = Pages (number of blocks)
 250 // arg2 = useKey
 251 // datain = KEY bytes
 252 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 253 {
 254         LEDsoff();
 255         LED_A_ON();
 256         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 257
 258         // free eventually allocated BigBuf memory
 259         BigBuf_free();
 260         clear_trace();
 261
 262         // params
 263         uint8_t blockNo = arg0;
 264         uint16_t blocks = arg1;
 265         bool useKey = (arg2 == 1); //UL_C
 266         bool usePwd = (arg2 == 2); //UL_EV1/NTAG
 267         uint32_t countblocks = 0;
 268         uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
 269         if (dataout == NULL){
 270                 Dbprintf("out of memory");
 271                 OnError(1);
 272                 return;
 273         }
 274
 275         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 276         if (!len) {
 277                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 278                 OnError(1);
 279                 return;
 280         }
 281
 282         // UL-C authentication
 283         if ( useKey ) {
 284                 uint8_t key[16] = {0x00};
 285                 memcpy(key, datain, sizeof(key) );
 286
 287                 if ( !mifare_ultra_auth(key) ) {
 288                         OnError(1);
 289                         return;
 290                 }
 291         }
 292
 293         // UL-EV1 / NTAG authentication
 294         if (usePwd) {
 295                 uint8_t pwd[4] = {0x00};
 296                 memcpy(pwd, datain, sizeof(pwd));
 297                 uint8_t pack[4] = {0,0,0,0};
 298
 299                 if (!mifare_ul_ev1_auth(pwd, pack)){
 300                         OnError(1);
 301                         return;
 302                 }
 303         }
 304
 305         for (int i = 0; i < blocks; i++){
 306                 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
 307                         Dbprintf("Data exceeds buffer!!");
 308                         break;
 309                 }
 310
 311                 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
 312
 313                 if (len) {
 314                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 315                         // if no blocks read - error out
 316                         if (i==0){
 317                                 OnError(2);
 318                         return;
 319                         } else {
 320                                 //stop at last successful read block and return what we got
 321                                 break;
 322                         }
 323                 } else {
 324                         countblocks++;
 325                 }
 326         }
 327
 328         len = mifare_ultra_halt();
 329         if (len) {
 330                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 331                 OnError(3);
 332                 return;
 333         }
 334
 335         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 336
 337         countblocks *= 4;
 338
 339         cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
 340         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 341         LEDsoff();
 342         BigBuf_free();
 343 }
 344
 345 //-----------------------------------------------------------------------------
 346 // Select, Authenticate, Write a MIFARE tag.
 347 // read block
 348 //-----------------------------------------------------------------------------
 349 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 350 {
 351         // params
 352         uint8_t blockNo = arg0;
 353         uint8_t keyType = arg1;
 354         uint64_t ui64Key = 0;
 355         byte_t blockdata[16];
 356
 357         ui64Key = bytes_to_num(datain, 6);
 358         memcpy(blockdata, datain + 10, 16);
 359
 360         // variables
 361         byte_t isOK = 0;
 362         uint8_t uid[10];
 363         uint32_t cuid;
 364         struct Crypto1State mpcs = {0, 0};
 365         struct Crypto1State *pcs;
 366         pcs = &mpcs;
 367
 368         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 369
 370         clear_trace();
 371
 372         LED_A_ON();
 373         LED_B_OFF();
 374         LED_C_OFF();
 375
 376         while (true) {
 377                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 378                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 379                         break;
 380                 };
 381
 382                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 383                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 384                         break;
 385                 };
 386
 387                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 388                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 389                         break;
 390                 };
 391
 392                 if(mifare_classic_halt(pcs, cuid)) {
 393                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 394                         break;
 395                 };
 396
 397                 isOK = 1;
 398                 break;
 399         }
 400
 401         //  ----------------------------- crypto1 destroy
 402         crypto1_destroy(pcs);
 403
 404         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 405
 406         LED_B_ON();
 407         cmd_send(CMD_ACK,isOK,0,0,0,0);
 408         LED_B_OFF();
 409
 410
 411         // Thats it...
 412         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 413         LEDsoff();
 414 }
 415
 416 /* // Command not needed but left for future testing
 417 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
 418 {
 419         uint8_t blockNo = arg0;
 420         byte_t blockdata[16] = {0x00};
 421
 422         memcpy(blockdata, datain, 16);
 423
 424         uint8_t uid[10] = {0x00};
 425
 426         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 427
 428         clear_trace();
 429         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 430
 431         if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
 432                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 433                 OnError(0);
 434                 return;
 435         };
 436
 437         if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
 438                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 439                 OnError(0);
 440                 return; };
 441
 442         if(mifare_ultra_halt()) {
 443                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 444                 OnError(0);
 445                 return;
 446         };
 447
 448         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 449
 450         cmd_send(CMD_ACK,1,0,0,0,0);
 451         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 452         LEDsoff();
 453 }
 454 */
 455
 456 // Arg0   : Block to write to.
 457 // Arg1   : 0 = use no authentication.
 458 //          1 = use 0x1A authentication.
 459 //          2 = use 0x1B authentication.
 460 // datain : 4 first bytes is data to be written.
 461 //        : 4/16 next bytes is authentication key.
 462 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 463 {
 464         uint8_t blockNo = arg0;
 465         bool useKey = (arg1 == 1); //UL_C
 466         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 467         byte_t blockdata[4] = {0x00};
 468
 469         memcpy(blockdata, datain,4);
 470
 471         LEDsoff();
 472         LED_A_ON();
 473         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 474
 475         clear_trace();
 476
 477         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 478                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 479                 OnError(0);
 480                 return;
 481         };
 482
 483         // UL-C authentication
 484         if ( useKey ) {
 485                 uint8_t key[16] = {0x00};
 486                 memcpy(key, datain+4, sizeof(key) );
 487
 488                 if ( !mifare_ultra_auth(key) ) {
 489                         OnError(1);
 490                         return;
 491                 }
 492         }
 493
 494         // UL-EV1 / NTAG authentication
 495         if (usePwd) {
 496                 uint8_t pwd[4] = {0x00};
 497                 memcpy(pwd, datain+4, 4);
 498                 uint8_t pack[4] = {0,0,0,0};
 499                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 500                         OnError(1);
 501                         return;
 502                 }
 503         }
 504
 505         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 506                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 507                 OnError(0);
 508                 return;
 509         };
 510
 511         if(mifare_ultra_halt()) {
 512                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 513                 OnError(0);
 514                 return;
 515         };
 516
 517         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 518
 519         cmd_send(CMD_ACK,1,0,0,0,0);
 520         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 521         LEDsoff();
 522 }
 523
 524 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 525
 526         uint8_t pwd[16] = {0x00};
 527         byte_t blockdata[4] = {0x00};
 528
 529         memcpy(pwd, datain, 16);
 530
 531         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 532         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 533
 534         clear_trace();
 535
 536         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 537                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 538                 OnError(0);
 539                 return;
 540         };
 541
 542         blockdata[0] = pwd[7];
 543         blockdata[1] = pwd[6];
 544         blockdata[2] = pwd[5];
 545         blockdata[3] = pwd[4];
 546         if(mifare_ultra_writeblock( 44, blockdata)) {
 547                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 548                 OnError(44);
 549                 return;
 550         };
 551
 552         blockdata[0] = pwd[3];
 553         blockdata[1] = pwd[2];
 554         blockdata[2] = pwd[1];
 555         blockdata[3] = pwd[0];
 556         if(mifare_ultra_writeblock( 45, blockdata)) {
 557                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 558                 OnError(45);
 559                 return;
 560         };
 561
 562         blockdata[0] = pwd[15];
 563         blockdata[1] = pwd[14];
 564         blockdata[2] = pwd[13];
 565         blockdata[3] = pwd[12];
 566         if(mifare_ultra_writeblock( 46, blockdata)) {
 567                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 568                 OnError(46);
 569                 return;
 570         };
 571
 572         blockdata[0] = pwd[11];
 573         blockdata[1] = pwd[10];
 574         blockdata[2] = pwd[9];
 575         blockdata[3] = pwd[8];
 576         if(mifare_ultra_writeblock( 47, blockdata)) {
 577                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 578                 OnError(47);
 579                 return;
 580         };
 581
 582         if(mifare_ultra_halt()) {
 583                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 584                 OnError(0);
 585                 return;
 586         };
 587
 588         cmd_send(CMD_ACK,1,0,0,0,0);
 589         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 590         LEDsoff();
 591 }
 592
 593 // Return 1 if the nonce is invalid else return 0
 594 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 595         return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 596         (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 597         (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 598 }
 599
 600
 601 //-----------------------------------------------------------------------------
 602 // acquire encrypted nonces in order to perform the attack described in
 603 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
 604 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
 605 // Computer and Communications Security, 2015
 606 //-----------------------------------------------------------------------------
 607 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
 608 {
 609         uint64_t ui64Key = 0;
 610         uint8_t uid[10];
 611         uint32_t cuid;
 612         uint8_t cascade_levels = 0;
 613         struct Crypto1State mpcs = {0, 0};
 614         struct Crypto1State *pcs;
 615         pcs = &mpcs;
 616         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 617         int16_t isOK = 0;
 618         uint8_t par_enc[1];
 619         uint8_t nt_par_enc = 0;
 620         uint8_t buf[USB_CMD_DATA_SIZE];
 621         uint32_t timeout;
 622
 623         uint8_t blockNo = arg0 & 0xff;
 624         uint8_t keyType = (arg0 >> 8) & 0xff;
 625         uint8_t targetBlockNo = arg1 & 0xff;
 626         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 627         ui64Key = bytes_to_num(datain, 6);
 628         bool initialize = flags & 0x0001;
 629         bool slow = flags & 0x0002;
 630         bool field_off = flags & 0x0004;
 631
 632         #define AUTHENTICATION_TIMEOUT 848                      // card times out 1ms after wrong authentication (according to NXP documentation)
 633         #define PRE_AUTHENTICATION_LEADTIME 400         // some (non standard) cards need a pause after select before they are ready for first authentication
 634
 635         LED_A_ON();
 636         LED_C_OFF();
 637
 638         if (initialize) {
 639                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 640                 clear_trace();
 641                 set_tracing(true);
 642         }
 643
 644         LED_C_ON();
 645
 646         uint16_t num_nonces = 0;
 647         bool have_uid = false;
 648         for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
 649
 650                 // Test if the action was cancelled
 651                 if(BUTTON_PRESS()) {
 652                         isOK = 2;
 653                         field_off = true;
 654                         break;
 655                 }
 656
 657                 if (!have_uid) { // need a full select cycle to get the uid first
 658                         iso14a_card_select_t card_info;
 659                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
 660                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (ALL)");
 661                                 continue;
 662                         }
 663                         switch (card_info.uidlen) {
 664                                 case 4 : cascade_levels = 1; break;
 665                                 case 7 : cascade_levels = 2; break;
 666                                 case 10: cascade_levels = 3; break;
 667                                 default: break;
 668                         }
 669                         have_uid = true;
 670                 } else { // no need for anticollision. We can directly select the card
 671                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
 672                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (UID)");
 673                                 continue;
 674                         }
 675                 }
 676
 677                 if (slow) {
 678                         timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
 679                         while(GetCountSspClk() < timeout);
 680                 }
 681
 682                 uint32_t nt1;
 683                 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
 684                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth1 error");
 685                         continue;
 686                 }
 687
 688                 // nested authentication
 689                 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
 690                 if (len != 4) {
 691                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth2 error len=%d", len);
 692                         continue;
 693                 }
 694
 695                 // send a dummy byte as reader response in order to trigger the cards authentication timeout
 696                 uint8_t dummy_answer = 0;
 697                 ReaderTransmit(&dummy_answer, 1, NULL);
 698                 timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
 699
 700                 num_nonces++;
 701                 if (num_nonces % 2) {
 702                         memcpy(buf+i, receivedAnswer, 4);
 703                         nt_par_enc = par_enc[0] & 0xf0;
 704                 } else {
 705                         nt_par_enc |= par_enc[0] >> 4;
 706                         memcpy(buf+i+4, receivedAnswer, 4);
 707                         memcpy(buf+i+8, &nt_par_enc, 1);
 708                         i += 9;
 709                 }
 710
 711                 // wait for the card to become ready again
 712                 while(GetCountSspClk() < timeout);
 713
 714         }
 715
 716         LED_C_OFF();
 717
 718         crypto1_destroy(pcs);
 719
 720         LED_B_ON();
 721         cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
 722         LED_B_OFF();
 723
 724         if (MF_DBGLEVEL >= 3)   DbpString("AcquireEncryptedNonces finished");
 725
 726         if (field_off) {
 727                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 728                 LEDsoff();
 729         }
 730 }
 731
 732
 733 //-----------------------------------------------------------------------------
 734 // MIFARE nested authentication.
 735 //
 736 //-----------------------------------------------------------------------------
 737 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 738 {
 739         // params
 740         uint8_t blockNo = arg0 & 0xff;
 741         uint8_t keyType = (arg0 >> 8) & 0xff;
 742         uint8_t targetBlockNo = arg1 & 0xff;
 743         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 744         uint64_t ui64Key = 0;
 745
 746         ui64Key = bytes_to_num(datain, 6);
 747
 748         // variables
 749         uint16_t rtr, i, j, len;
 750         uint16_t davg;
 751         static uint16_t dmin, dmax;
 752         uint8_t uid[10];
 753         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 754         uint8_t par[1];
 755         uint32_t target_nt[2], target_ks[2];
 756
 757         uint8_t par_array[4];
 758         uint16_t ncount = 0;
 759         struct Crypto1State mpcs = {0, 0};
 760         struct Crypto1State *pcs;
 761         pcs = &mpcs;
 762         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 763
 764         uint32_t auth1_time, auth2_time;
 765         static uint16_t delta_time;
 766
 767         LED_A_ON();
 768         LED_C_OFF();
 769         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 770
 771         // free eventually allocated BigBuf memory
 772         BigBuf_free();
 773
 774         if (calibrate) clear_trace();
 775         set_tracing(true);
 776
 777         // statistics on nonce distance
 778         int16_t isOK = 0;
 779         #define NESTED_MAX_TRIES 12
 780         uint16_t unsuccessfull_tries = 0;
 781         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 782                 LED_B_ON();
 783                 WDT_HIT();
 784
 785                 davg = dmax = 0;
 786                 dmin = 2000;
 787                 delta_time = 0;
 788
 789                 for (rtr = 0; rtr < 17; rtr++) {
 790
 791                         // Test if the action was cancelled
 792                         if(BUTTON_PRESS()) {
 793                                 isOK = -2;
 794                                 break;
 795                         }
 796
 797                         // prepare next select. No need to power down the card.
 798                         if(mifare_classic_halt(pcs, cuid)) {
 799                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 800                                 rtr--;
 801                                 continue;
 802                         }
 803
 804                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 805                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 806                                 rtr--;
 807                                 continue;
 808                         };
 809
 810                         auth1_time = 0;
 811                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 812                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 813                                 rtr--;
 814                                 continue;
 815                         };
 816
 817                         if (delta_time) {
 818                                 auth2_time = auth1_time + delta_time;
 819                         } else {
 820                                 auth2_time = 0;
 821                         }
 822                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 823                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 824                                 rtr--;
 825                                 continue;
 826                         };
 827
 828                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 829                         for (i = 101; i < 1200; i++) {
 830                                 nttmp = prng_successor(nttmp, 1);
 831                                 if (nttmp == nt2) break;
 832                         }
 833
 834                         if (i != 1200) {
 835                                 if (rtr != 0) {
 836                                         davg += i;
 837                                         dmin = MIN(dmin, i);
 838                                         dmax = MAX(dmax, i);
 839                                 }
 840                                 else {
 841                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 842                                 }
 843                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 844                         } else {
 845                                 unsuccessfull_tries++;
 846                                 if (unsuccessfull_tries > NESTED_MAX_TRIES) {   // card isn't vulnerable to nested attack (random numbers are not predictable)
 847                                         isOK = -3;
 848                                 }
 849                         }
 850                 }
 851
 852                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 853
 854                 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
 855
 856                 dmin = davg - 2;
 857                 dmax = davg + 2;
 858
 859                 LED_B_OFF();
 860         }
 861 //  -------------------------------------------------------------------------------------------------
 862
 863         LED_C_ON();
 864
 865         //  get crypted nonces for target sector
 866         for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
 867
 868                 target_nt[i] = 0;
 869                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 870
 871                         // prepare next select. No need to power down the card.
 872                         if(mifare_classic_halt(pcs, cuid)) {
 873                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 874                                 continue;
 875                         }
 876
 877                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 878                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 879                                 continue;
 880                         };
 881
 882                         auth1_time = 0;
 883                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 884                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 885                                 continue;
 886                         };
 887
 888                         // nested authentication
 889                         auth2_time = auth1_time + delta_time;
 890                         len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 891                         if (len != 4) {
 892                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 893                                 continue;
 894                         };
 895
 896                         nt2 = bytes_to_num(receivedAnswer, 4);
 897                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 898
 899                         // Parity validity check
 900                         for (j = 0; j < 4; j++) {
 901                                 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 902                         }
 903
 904                         ncount = 0;
 905                         nttest = prng_successor(nt1, dmin - 1);
 906                         for (j = dmin; j < dmax + 1; j++) {
 907                                 nttest = prng_successor(nttest, 1);
 908                                 ks1 = nt2 ^ nttest;
 909
 910                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 911                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 912                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 913                                                 target_nt[i] = 0;
 914                                                 break;
 915                                         }
 916                                         target_nt[i] = nttest;
 917                                         target_ks[i] = ks1;
 918                                         ncount++;
 919                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 920                                                 target_nt[i] = 0;
 921                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 922                                                 break;
 923                                         }
 924                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 925                                 }
 926                         }
 927                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 928                 }
 929         }
 930
 931         LED_C_OFF();
 932
 933         //  ----------------------------- crypto1 destroy
 934         crypto1_destroy(pcs);
 935
 936         byte_t buf[4 + 4 * 4];
 937         memcpy(buf, &cuid, 4);
 938         memcpy(buf+4, &target_nt[0], 4);
 939         memcpy(buf+8, &target_ks[0], 4);
 940         memcpy(buf+12, &target_nt[1], 4);
 941         memcpy(buf+16, &target_ks[1], 4);
 942
 943         LED_B_ON();
 944         cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 945         LED_B_OFF();
 946
 947         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 948
 949         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 950         LEDsoff();
 951         set_tracing(FALSE);
 952 }
 953
 954 //-----------------------------------------------------------------------------
 955 // MIFARE check keys. key count up to 85.
 956 //
 957 //-----------------------------------------------------------------------------
 958 void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 959 {
 960   // params
 961         uint8_t blockNo = arg0 & 0xff;
 962         uint8_t keyType = (arg0 >> 8) & 0xff;
 963         bool clearTrace = arg1;
 964         uint8_t keyCount = arg2;
 965         uint64_t ui64Key = 0;
 966
 967         // variables
 968         int i;
 969         byte_t isOK = 0;
 970         uint8_t uid[10];
 971         uint32_t cuid;
 972         struct Crypto1State mpcs = {0, 0};
 973         struct Crypto1State *pcs;
 974         pcs = &mpcs;
 975
 976         // clear debug level
 977         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 978         MF_DBGLEVEL = MF_DBG_NONE;
 979
 980         LED_A_ON();
 981         LED_B_OFF();
 982         LED_C_OFF();
 983         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 984
 985         if (clearTrace) clear_trace();
 986         set_tracing(TRUE);
 987
 988         for (i = 0; i < keyCount; i++) {
 989                 if(mifare_classic_halt(pcs, cuid)) {
 990                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 991                 }
 992
 993                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 994                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 995                         break;
 996                 };
 997
 998                 ui64Key = bytes_to_num(datain + i * 6, 6);
 999                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
1000                         continue;
1001                 };
1002
1003                 isOK = 1;
1004                 break;
1005         }
1006
1007         //  ----------------------------- crypto1 destroy
1008         crypto1_destroy(pcs);
1009
1010         LED_B_ON();
1011     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
1012         LED_B_OFF();
1013
1014         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1015         LEDsoff();
1016         set_tracing(FALSE);
1017
1018         // restore debug level
1019         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1020 }
1021
1022 //-----------------------------------------------------------------------------
1023 // MIFARE commands set debug level
1024 //
1025 //-----------------------------------------------------------------------------
1026 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1027         MF_DBGLEVEL = arg0;
1028         Dbprintf("Debug level: %d", MF_DBGLEVEL);
1029 }
1030
1031 //-----------------------------------------------------------------------------
1032 // Work with emulator memory
1033 //
1034 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1035 // involved in dealing with emulator memory. But if it is called later, it might
1036 // destroy the Emulator Memory.
1037 //-----------------------------------------------------------------------------
1038
1039 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1040         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1041         emlClearMem();
1042 }
1043
1044 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1045         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1046         if (arg2==0) arg2 = 16; // backwards compat... default bytewidth
1047         emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width
1048 }
1049
1050 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1051         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1052         byte_t buf[USB_CMD_DATA_SIZE];
1053         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1054
1055         LED_B_ON();
1056         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1057         LED_B_OFF();
1058 }
1059
1060 //-----------------------------------------------------------------------------
1061 // Load a card into the emulator memory
1062 //
1063 //-----------------------------------------------------------------------------
1064 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1065         uint8_t numSectors = arg0;
1066         uint8_t keyType = arg1;
1067         uint64_t ui64Key = 0;
1068         uint32_t cuid;
1069         struct Crypto1State mpcs = {0, 0};
1070         struct Crypto1State *pcs;
1071         pcs = &mpcs;
1072
1073         // variables
1074         byte_t dataoutbuf[16];
1075         byte_t dataoutbuf2[16];
1076         uint8_t uid[10];
1077
1078         LED_A_ON();
1079         LED_B_OFF();
1080         LED_C_OFF();
1081         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1082
1083         clear_trace();
1084         set_tracing(TRUE);
1085
1086         bool isOK = true;
1087
1088         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1089                 isOK = false;
1090                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1091         }
1092
1093         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1094                 ui64Key = emlGetKey(sectorNo, keyType);
1095                 if (sectorNo == 0){
1096                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1097                                 isOK = false;
1098                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
1099                                 break;
1100                         }
1101                 } else {
1102                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1103                                 isOK = false;
1104                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1105                                 break;
1106                         }
1107                 }
1108
1109                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1110                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1111                                 isOK = false;
1112                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1113                                 break;
1114                         };
1115                         if (isOK) {
1116                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1117                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1118                                 } else {        // sector trailer, keep the keys, set only the AC
1119                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1120                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1121                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
1122                                 }
1123                         }
1124                 }
1125
1126         }
1127
1128         if(mifare_classic_halt(pcs, cuid)) {
1129                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1130         };
1131
1132         //  ----------------------------- crypto1 destroy
1133         crypto1_destroy(pcs);
1134
1135         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1136         LEDsoff();
1137
1138         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1139
1140         set_tracing(FALSE);
1141 }
1142
1143
1144 //-----------------------------------------------------------------------------
1145 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1146 //
1147 // PARAMS - workFlags
1148 // bit 0 - need get UID
1149 // bit 1 - need wupC
1150 // bit 2 - need HALT after sequence
1151 // bit 3 - need turn on FPGA before sequence
1152 // bit 4 - need turn off FPGA
1153 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1154 // bit 6 - wipe tag.
1155 //-----------------------------------------------------------------------------
1156 // magic uid card generation 1 commands
1157 uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
1158 uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
1159 uint8_t wipeC[] = { MIFARE_MAGICWIPEC };
1160
1161 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1162
1163         // params
1164         uint8_t workFlags = arg0;
1165         uint8_t blockNo = arg1;
1166
1167         Dbprintf("ICE :: CSetBlocks Flags %02x", workFlags);
1168
1169         // variables
1170         uint8_t uid[10] = {0x00};
1171         uint8_t data[18] = {0x00};
1172         uint32_t cuid;
1173
1174         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1175         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1176
1177         if (workFlags & MAGIC_INIT) {
1178                 LED_A_ON();
1179                 LED_B_OFF();
1180                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1181                 clear_trace();
1182                 set_tracing(TRUE);
1183         }
1184
1185         // read UID and return to client
1186         if (workFlags & MAGIC_UID) {
1187                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1188                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Can't select card");
1189                         OnErrorMagic(MAGIC_UID);
1190                 }
1191         }
1192
1193         // wipe tag, fill it with zeros
1194         if (workFlags & MAGIC_WIPE){
1195                 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1196                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1197                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1198                         OnErrorMagic(MAGIC_WIPE);
1199                 }
1200
1201                 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1202                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1203                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wipeC error");
1204                         OnErrorMagic(MAGIC_WIPE);
1205                 }
1206         }
1207
1208         // write block
1209         if (workFlags & MAGIC_WUPC) {
1210                 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1211                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1212                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1213                         OnErrorMagic(MAGIC_WUPC);
1214                 }
1215
1216                 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1217                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1218                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC2 error");
1219                         OnErrorMagic(MAGIC_WUPC);
1220                 }
1221         }
1222
1223         if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1224                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send command error");
1225                 OnErrorMagic(4);
1226         }
1227
1228         memcpy(data, datain, 16);
1229         AppendCrc14443a(data, 16);
1230
1231         ReaderTransmit(data, sizeof(data), NULL);
1232         if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1233                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send data error");
1234                 OnErrorMagic(0);
1235         }
1236
1237         if (workFlags & MAGIC_OFF)
1238                 mifare_classic_halt_ex(NULL);
1239
1240         LED_B_ON();
1241         // check if uid is cuid?
1242         cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));
1243         LED_B_OFF();
1244
1245         if (workFlags & MAGIC_OFF)
1246                 OnSuccessMagic();
1247 }
1248
1249 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1250
1251         uint8_t workFlags = arg0;
1252         uint8_t blockNo = arg1;
1253
1254         // variables
1255         uint8_t data[MAX_MIFARE_FRAME_SIZE];
1256         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1257         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1258
1259         memset(data, 0x00, sizeof(data));
1260
1261         if (workFlags & MAGIC_INIT) {
1262                 LED_A_ON();
1263                 LED_B_OFF();
1264                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1265                 clear_trace();
1266                 set_tracing(TRUE);
1267         }
1268
1269         if (workFlags & MAGIC_WUPC) {
1270                 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1271                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1272                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1273                         OnErrorMagic(MAGIC_WUPC);
1274                 }
1275
1276                 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1277                 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1278                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1279                         OnErrorMagic(MAGIC_WUPC);
1280                 }
1281         }
1282
1283         // read block
1284         if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1285                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");
1286                 OnErrorMagic(0);
1287         }
1288
1289         memcpy(data, receivedAnswer, sizeof(data));
1290
1291         // send HALT
1292         if (workFlags & MAGIC_HALT)
1293                 mifare_classic_halt_ex(NULL);
1294
1295         LED_B_ON();
1296
1297         // if MAGIC_DATAIN, the data stays on device side.
1298         if (workFlags & MAGIC_DATAIN)
1299                 memcpy(datain, data, sizeof(data));
1300         else
1301                 cmd_send(CMD_ACK,1,0,0,data,sizeof(data));
1302
1303         LED_B_OFF();
1304
1305         if (workFlags & MAGIC_OFF)
1306                 OnSuccessMagic();
1307 }
1308
1309 void MifareCIdent(){
1310
1311         // variables
1312         bool isOK = true;
1313         uint8_t receivedAnswer[1];
1314         uint8_t receivedAnswerPar[1];
1315
1316         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1317         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1318                 isOK = false;
1319         }
1320
1321         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1322         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1323                 isOK = false;
1324         }
1325
1326         // removed the if,  since some magic tags misbehavies and send an answer to it.
1327         mifare_classic_halt(NULL, 0);
1328         cmd_send(CMD_ACK,isOK,0,0,0,0);
1329 }
1330
1331 void OnSuccessMagic(){
1332         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1333         LEDsoff();
1334         set_tracing(FALSE);
1335 }
1336 void OnErrorMagic(uint8_t reason){
1337         //          ACK, ISOK, reason,0,0,0
1338         cmd_send(CMD_ACK,0,reason,0,0,0);
1339         OnSuccessMagic();
1340 }
1341
1342 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1343 }
1344
1345 //
1346 // DESFIRE
1347 //
1348
1349 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1350
1351         byte_t dataout[11] = {0x00};
1352         uint8_t uid[10] = {0x00};
1353         uint32_t cuid = 0x00;
1354
1355         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1356         clear_trace();
1357
1358         int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);
1359         if(!len) {
1360                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1361                 OnError(1);
1362                 return;
1363         };
1364
1365         if(mifare_desfire_des_auth1(cuid, dataout)){
1366                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1367                 OnError(4);
1368                 return;
1369         }
1370
1371         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1372     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1373 }
1374
1375 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1376
1377         uint32_t cuid = arg0;
1378         uint8_t key[16] = {0x00};
1379         byte_t dataout[12] = {0x00};
1380         byte_t isOK = 0;
1381
1382         memcpy(key, datain, 16);
1383
1384         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1385
1386         if( isOK) {
1387             if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1388                 OnError(4);
1389                 return;
1390         }
1391
1392         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1393
1394         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1395         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1396         LEDsoff();
1397 }