git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19
  20 #include "crc.h"
  21
  22 //-----------------------------------------------------------------------------
  23 // Select, Authenticate, Read a MIFARE tag.
  24 // read block
  25 //-----------------------------------------------------------------------------
  26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  27 {
  28   // params
  29         uint8_t blockNo = arg0;
  30         uint8_t keyType = arg1;
  31         uint64_t ui64Key = 0;
  32         ui64Key = bytes_to_num(datain, 6);
  33
  34         // variables
  35         byte_t isOK = 0;
  36         byte_t dataoutbuf[16];
  37         uint8_t uid[10];
  38         uint32_t cuid;
  39         struct Crypto1State mpcs = {0, 0};
  40         struct Crypto1State *pcs;
  41         pcs = &mpcs;
  42
  43         // clear trace
  44         iso14a_clear_trace();
  45         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  46
  47         LED_A_ON();
  48         LED_B_OFF();
  49         LED_C_OFF();
  50
  51         while (true) {
  52                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  53                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  54                         break;
  55                 };
  56
  57                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  58                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  59                         break;
  60                 };
  61
  62                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  63                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  64                         break;
  65                 };
  66
  67                 if(mifare_classic_halt(pcs, cuid)) {
  68                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  69                         break;
  70                 };
  71
  72                 isOK = 1;
  73                 break;
  74         }
  75
  76         //  ----------------------------- crypto1 destroy
  77         crypto1_destroy(pcs);
  78
  79         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  80
  81         LED_B_ON();
  82         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  83         LED_B_OFF();
  84
  85         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  86         LEDsoff();
  87 }
  88
  89
  90 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  91
  92         byte_t isOK = 0;
  93         byte_t dataoutbuf[16] = {0x00};
  94         uint8_t uid[10] = {0x00};
  95         uint32_t cuid;
  96
  97         LED_A_ON();
  98         LED_B_OFF();
  99         LED_C_OFF();
 100
 101         iso14a_clear_trace();
 102         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 103
 104         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 105                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 106                         Dbprintf("Can't select card");
 107                 //OnError(0);
 108                 return;
 109         };
 110
 111         if(mifare_ultra_auth1(cuid, dataoutbuf)){
 112                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 113                         Dbprintf("Authentication part1: Fail.");
 114                 //OnError(1);
 115                 return;
 116         }
 117
 118         isOK = 1;
 119         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
 120                 DbpString("AUTH 1 FINISHED");
 121
 122     cmd_send(CMD_ACK,isOK,cuid,0,dataoutbuf,11);
 123         LEDsoff();
 124 }
 125 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 126
 127         uint32_t cuid = arg0;
 128         uint8_t key[16] = {0x00};
 129         byte_t isOK = 0;
 130         byte_t dataoutbuf[16] = {0x00};
 131
 132         memcpy(key, datain, 16);
 133
 134         LED_A_ON();
 135         LED_B_OFF();
 136         LED_C_OFF();
 137
 138         if(mifare_ultra_auth2(cuid, key, dataoutbuf)){
 139             if (MF_DBGLEVEL >= MF_DBG_ERROR)
 140                         Dbprintf("Authentication part2: Fail...");
 141                 //OnError(1);
 142                 return;
 143         }
 144
 145         isOK = 1;
 146         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
 147                 DbpString("AUTH 2 FINISHED");
 148
 149         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);
 150         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 151         LEDsoff();
 152 }
 153
 154 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
 155 {
 156         uint8_t blockNo = arg0;
 157         byte_t dataout[16] = {0x00};
 158         uint8_t uid[10] = {0x00};
 159         uint32_t cuid;
 160
 161         LED_A_ON();
 162         LED_B_OFF();
 163         LED_C_OFF();
 164
 165         iso14a_clear_trace();
 166         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 167
 168         int len = iso14443a_select_card(uid, NULL, &cuid);
 169         if(!len) {
 170                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Can't select card");
 171                 //OnError(1);
 172                 return;
 173                 };
 174
 175         len = mifare_ultra_readblock(cuid, blockNo, dataout);
 176         if(len) {
 177                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Read block error");
 178                 //OnError(2);
 179                 return;
 180                 };
 181
 182         len = mifare_ultra_halt(cuid);
 183         if(len) {
 184                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Halt error");
 185                 //OnError(3);
 186                 return;
 187                 };
 188
 189     cmd_send(CMD_ACK,1,0,0,dataout,16);
 190         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 191         LEDsoff();
 192 }
 193
 194 //-----------------------------------------------------------------------------
 195 // Select, Authenticate, Read a MIFARE tag.
 196 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 197 //-----------------------------------------------------------------------------
 198 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 199 {
 200   // params
 201         uint8_t sectorNo = arg0;
 202         uint8_t keyType = arg1;
 203         uint64_t ui64Key = 0;
 204         ui64Key = bytes_to_num(datain, 6);
 205
 206         // variables
 207         byte_t isOK = 0;
 208         byte_t dataoutbuf[16 * 16];
 209         uint8_t uid[10];
 210         uint32_t cuid;
 211         struct Crypto1State mpcs = {0, 0};
 212         struct Crypto1State *pcs;
 213         pcs = &mpcs;
 214
 215         // clear trace
 216         iso14a_clear_trace();
 217
 218         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 219
 220         LED_A_ON();
 221         LED_B_OFF();
 222         LED_C_OFF();
 223
 224         isOK = 1;
 225         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 226                 isOK = 0;
 227                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 228         }
 229
 230
 231         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 232                 isOK = 0;
 233                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 234         }
 235
 236         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 237                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 238                         isOK = 0;
 239                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 240                         break;
 241                 }
 242         }
 243
 244         if(mifare_classic_halt(pcs, cuid)) {
 245                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 246         }
 247
 248         //  ----------------------------- crypto1 destroy
 249         crypto1_destroy(pcs);
 250
 251         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 252
 253         LED_B_ON();
 254         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 255         LED_B_OFF();
 256
 257         // Thats it...
 258         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 259         LEDsoff();
 260 }
 261
 262 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 263 {
 264   // params
 265         uint8_t sectorNo = arg0;
 266         int Pages = arg1;
 267         int count_Pages = 0;
 268         byte_t dataout[176] = {0x00};;
 269         uint8_t uid[10] = {0x00};
 270         uint32_t cuid;
 271
 272         LED_A_ON();
 273         LED_B_OFF();
 274         LED_C_OFF();
 275
 276         if (MF_DBGLEVEL >= MF_DBG_ALL)
 277                 Dbprintf("Pages %d",Pages);
 278
 279         iso14a_clear_trace();
 280         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 281
 282         int len = iso14443a_select_card(uid, NULL, &cuid);
 283
 284         if (!len) {
 285                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 286                         Dbprintf("Can't select card");
 287                 //OnError(1);
 288                 return;
 289         }
 290
 291         for (int i = 0; i < Pages; i++){
 292
 293                 len = mifare_ultra_readblock(cuid, sectorNo * 4 + i, dataout + 4 * i);
 294
 295                 if (len) {
 296                         if (MF_DBGLEVEL >= MF_DBG_ERROR)
 297                                 Dbprintf("Read block %d error",i);
 298                         //OnError(2);
 299                         return;
 300                 } else {
 301                         count_Pages++;
 302                 }
 303         }
 304
 305         len = mifare_ultra_halt(cuid);
 306         if (len) {
 307                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 308                         Dbprintf("Halt error");
 309                 //OnError(3);
 310                 return;
 311         }
 312
 313         if (MF_DBGLEVEL >= MF_DBG_ALL) {
 314                 Dbprintf("Pages read %d", count_Pages);
 315         }
 316
 317         len = 16*4; //64 bytes
 318
 319         // Read a UL-C
 320         if (Pages == 44 && count_Pages > 16)
 321                 len = 176;
 322
 323         cmd_send(CMD_ACK, 1, 0, 0, dataout, len);
 324         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 325         LEDsoff();
 326 }
 327
 328
 329 //-----------------------------------------------------------------------------
 330 // Select, Authenticate, Write a MIFARE tag.
 331 // read block
 332 //-----------------------------------------------------------------------------
 333 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 334 {
 335         // params
 336         uint8_t blockNo = arg0;
 337         uint8_t keyType = arg1;
 338         uint64_t ui64Key = 0;
 339         byte_t blockdata[16];
 340
 341         ui64Key = bytes_to_num(datain, 6);
 342         memcpy(blockdata, datain + 10, 16);
 343
 344         // variables
 345         byte_t isOK = 0;
 346         uint8_t uid[10];
 347         uint32_t cuid;
 348         struct Crypto1State mpcs = {0, 0};
 349         struct Crypto1State *pcs;
 350         pcs = &mpcs;
 351
 352         // clear trace
 353         iso14a_clear_trace();
 354
 355         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 356
 357         LED_A_ON();
 358         LED_B_OFF();
 359         LED_C_OFF();
 360
 361         while (true) {
 362                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 363                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 364                         break;
 365                 };
 366
 367                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 368                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 369                         break;
 370                 };
 371
 372                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 373                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 374                         break;
 375                 };
 376
 377                 if(mifare_classic_halt(pcs, cuid)) {
 378                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 379                         break;
 380                 };
 381
 382                 isOK = 1;
 383                 break;
 384         }
 385
 386         //  ----------------------------- crypto1 destroy
 387         crypto1_destroy(pcs);
 388
 389         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 390
 391         LED_B_ON();
 392         cmd_send(CMD_ACK,isOK,0,0,0,0);
 393         LED_B_OFF();
 394
 395
 396         // Thats it...
 397         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 398         LEDsoff();
 399 }
 400
 401 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 402 {
 403         // params
 404         uint8_t blockNo = arg0;
 405         byte_t blockdata[16] = {0x00};
 406
 407         memcpy(blockdata, datain,16);
 408
 409         // variables
 410         byte_t isOK = 0;
 411         uint8_t uid[10] = {0x00};
 412         uint32_t cuid;
 413
 414         iso14a_clear_trace();
 415                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 416
 417         LED_A_ON();
 418         LED_B_OFF();
 419         LED_C_OFF();
 420
 421         while (true) {
 422                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 423                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 424                         break;
 425                 };
 426
 427                 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
 428                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 429                         break;
 430                 };
 431
 432                 if(mifare_ultra_halt(cuid)) {
 433                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 434                         break;
 435                 };
 436
 437                 isOK = 1;
 438                 break;
 439         }
 440
 441         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 442
 443                 cmd_send(CMD_ACK,isOK,0,0,0,0);
 444         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 445         LEDsoff();
 446 }
 447
 448 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 449 {
 450         // params
 451         uint8_t blockNo = arg0;
 452         byte_t blockdata[4] = {0x00};
 453
 454         memcpy(blockdata, datain,4);
 455
 456         // variables
 457         byte_t isOK = 0;
 458         uint8_t uid[10] = {0x00};
 459         uint32_t cuid;
 460
 461         iso14a_clear_trace();
 462         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 463
 464         LED_A_ON();
 465         LED_B_OFF();
 466         LED_C_OFF();
 467
 468         while (true) {
 469                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 470                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 471                         break;
 472                 };
 473
 474                 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
 475                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 476                         break;
 477                 };
 478
 479                 if(mifare_ultra_halt(cuid)) {
 480                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 481                         break;
 482                 };
 483
 484                 isOK = 1;
 485                 break;
 486         }
 487
 488         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 489
 490         cmd_send(CMD_ACK,isOK,0,0,0,0);
 491         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 492         LEDsoff();
 493 }
 494
 495 // Return 1 if the nonce is invalid else return 0
 496 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 497         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 498         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 499         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 500 }
 501
 502
 503 //-----------------------------------------------------------------------------
 504 // MIFARE nested authentication.
 505 //
 506 //-----------------------------------------------------------------------------
 507 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 508 {
 509         // params
 510         uint8_t blockNo = arg0 & 0xff;
 511         uint8_t keyType = (arg0 >> 8) & 0xff;
 512         uint8_t targetBlockNo = arg1 & 0xff;
 513         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 514         uint64_t ui64Key = 0;
 515
 516         ui64Key = bytes_to_num(datain, 6);
 517
 518         // variables
 519         uint16_t rtr, i, j, len;
 520         uint16_t davg;
 521         static uint16_t dmin, dmax;
 522         uint8_t uid[10];
 523         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 524         uint8_t par[1];
 525         uint32_t target_nt[2], target_ks[2];
 526
 527         uint8_t par_array[4];
 528         uint16_t ncount = 0;
 529         struct Crypto1State mpcs = {0, 0};
 530         struct Crypto1State *pcs;
 531         pcs = &mpcs;
 532         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
 533
 534         uint32_t auth1_time, auth2_time;
 535         static uint16_t delta_time;
 536
 537         // clear trace
 538         iso14a_clear_trace();
 539         iso14a_set_tracing(false);
 540
 541         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 542
 543         LED_A_ON();
 544         LED_C_OFF();
 545
 546
 547         // statistics on nonce distance
 548         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 549                 LED_B_ON();
 550                 WDT_HIT();
 551
 552                 davg = dmax = 0;
 553                 dmin = 2000;
 554                 delta_time = 0;
 555
 556                 for (rtr = 0; rtr < 17; rtr++) {
 557
 558                         // prepare next select. No need to power down the card.
 559                         if(mifare_classic_halt(pcs, cuid)) {
 560                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 561                                 rtr--;
 562                                 continue;
 563                         }
 564
 565                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 566                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 567                                 rtr--;
 568                                 continue;
 569                         };
 570
 571                         auth1_time = 0;
 572                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 573                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 574                                 rtr--;
 575                                 continue;
 576                         };
 577
 578                         if (delta_time) {
 579                                 auth2_time = auth1_time + delta_time;
 580                         } else {
 581                                 auth2_time = 0;
 582                         }
 583                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 584                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 585                                 rtr--;
 586                                 continue;
 587                         };
 588
 589                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 590                         for (i = 101; i < 1200; i++) {
 591                                 nttmp = prng_successor(nttmp, 1);
 592                                 if (nttmp == nt2) break;
 593                         }
 594
 595                         if (i != 1200) {
 596                                 if (rtr != 0) {
 597                                         davg += i;
 598                                         dmin = MIN(dmin, i);
 599                                         dmax = MAX(dmax, i);
 600                                 }
 601                                 else {
 602                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 603                                 }
 604                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 605                         }
 606                 }
 607
 608                 if (rtr <= 1)   return;
 609
 610                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 611
 612                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 613
 614                 dmin = davg - 2;
 615                 dmax = davg + 2;
 616
 617                 LED_B_OFF();
 618
 619         }
 620 //  -------------------------------------------------------------------------------------------------
 621
 622         LED_C_ON();
 623
 624         //  get crypted nonces for target sector
 625         for(i=0; i < 2; i++) { // look for exactly two different nonces
 626
 627                 target_nt[i] = 0;
 628                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 629
 630                         // prepare next select. No need to power down the card.
 631                         if(mifare_classic_halt(pcs, cuid)) {
 632                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 633                                 continue;
 634                         }
 635
 636                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 637                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 638                                 continue;
 639                         };
 640
 641                         auth1_time = 0;
 642                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 643                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 644                                 continue;
 645                         };
 646
 647                         // nested authentication
 648                         auth2_time = auth1_time + delta_time;
 649                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 650                         if (len != 4) {
 651                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 652                                 continue;
 653                         };
 654
 655                         nt2 = bytes_to_num(receivedAnswer, 4);
 656                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 657
 658                         // Parity validity check
 659                         for (j = 0; j < 4; j++) {
 660                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 661                         }
 662
 663                         ncount = 0;
 664                         nttest = prng_successor(nt1, dmin - 1);
 665                         for (j = dmin; j < dmax + 1; j++) {
 666                                 nttest = prng_successor(nttest, 1);
 667                                 ks1 = nt2 ^ nttest;
 668
 669                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 670                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 671                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 672                                                 target_nt[i] = 0;
 673                                                 break;
 674                                         }
 675                                         target_nt[i] = nttest;
 676                                         target_ks[i] = ks1;
 677                                         ncount++;
 678                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 679                                                 target_nt[i] = 0;
 680                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 681                                                 break;
 682                                         }
 683                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 684                                 }
 685                         }
 686                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 687                 }
 688         }
 689
 690         LED_C_OFF();
 691
 692         //  ----------------------------- crypto1 destroy
 693         crypto1_destroy(pcs);
 694
 695         byte_t buf[4 + 4 * 4];
 696         memcpy(buf, &cuid, 4);
 697         memcpy(buf+4, &target_nt[0], 4);
 698         memcpy(buf+8, &target_ks[0], 4);
 699         memcpy(buf+12, &target_nt[1], 4);
 700         memcpy(buf+16, &target_ks[1], 4);
 701
 702         LED_B_ON();
 703         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 704         LED_B_OFF();
 705
 706         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 707
 708         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 709         LEDsoff();
 710         iso14a_set_tracing(TRUE);
 711 }
 712
 713 //-----------------------------------------------------------------------------
 714 // MIFARE check keys. key count up to 85.
 715 //
 716 //-----------------------------------------------------------------------------
 717 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 718 {
 719   // params
 720         uint8_t blockNo = arg0;
 721         uint8_t keyType = arg1;
 722         uint8_t keyCount = arg2;
 723         uint64_t ui64Key = 0;
 724
 725         // variables
 726         int i;
 727         byte_t isOK = 0;
 728         uint8_t uid[10];
 729         uint32_t cuid;
 730         struct Crypto1State mpcs = {0, 0};
 731         struct Crypto1State *pcs;
 732         pcs = &mpcs;
 733
 734         // clear debug level
 735         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 736         MF_DBGLEVEL = MF_DBG_NONE;
 737
 738         // clear trace
 739         iso14a_clear_trace();
 740         iso14a_set_tracing(TRUE);
 741
 742         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 743
 744         LED_A_ON();
 745         LED_B_OFF();
 746         LED_C_OFF();
 747
 748         for (i = 0; i < keyCount; i++) {
 749                 if(mifare_classic_halt(pcs, cuid)) {
 750                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 751                 }
 752
 753                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 754                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 755                         break;
 756                 };
 757
 758                 ui64Key = bytes_to_num(datain + i * 6, 6);
 759                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 760                         continue;
 761                 };
 762
 763                 isOK = 1;
 764                 break;
 765         }
 766
 767         //  ----------------------------- crypto1 destroy
 768         crypto1_destroy(pcs);
 769
 770         LED_B_ON();
 771     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 772         LED_B_OFF();
 773
 774         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 775         LEDsoff();
 776
 777         // restore debug level
 778         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 779 }
 780
 781 //-----------------------------------------------------------------------------
 782 // MIFARE commands set debug level
 783 //
 784 //-----------------------------------------------------------------------------
 785 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 786         MF_DBGLEVEL = arg0;
 787         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 788 }
 789
 790 //-----------------------------------------------------------------------------
 791 // Work with emulator memory
 792 //
 793 //-----------------------------------------------------------------------------
 794 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 795         emlClearMem();
 796 }
 797
 798 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 799         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 800 }
 801
 802 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 803         byte_t buf[USB_CMD_DATA_SIZE];
 804         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 805
 806         LED_B_ON();
 807         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 808         LED_B_OFF();
 809 }
 810
 811 //-----------------------------------------------------------------------------
 812 // Load a card into the emulator memory
 813 //
 814 //-----------------------------------------------------------------------------
 815 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 816         uint8_t numSectors = arg0;
 817         uint8_t keyType = arg1;
 818         uint64_t ui64Key = 0;
 819         uint32_t cuid;
 820         struct Crypto1State mpcs = {0, 0};
 821         struct Crypto1State *pcs;
 822         pcs = &mpcs;
 823
 824         // variables
 825         byte_t dataoutbuf[16];
 826         byte_t dataoutbuf2[16];
 827         uint8_t uid[10];
 828
 829         // clear trace
 830         iso14a_clear_trace();
 831         iso14a_set_tracing(false);
 832
 833         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 834
 835         LED_A_ON();
 836         LED_B_OFF();
 837         LED_C_OFF();
 838
 839         bool isOK = true;
 840
 841         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 842                 isOK = false;
 843                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 844         }
 845
 846         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 847                 ui64Key = emlGetKey(sectorNo, keyType);
 848                 if (sectorNo == 0){
 849                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 850                                 isOK = false;
 851                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 852                                 break;
 853                         }
 854                 } else {
 855                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 856                                 isOK = false;
 857                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 858                                 break;
 859                         }
 860                 }
 861
 862                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 863                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 864                                 isOK = false;
 865                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 866                                 break;
 867                         };
 868                         if (isOK) {
 869                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 870                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 871                                 } else {        // sector trailer, keep the keys, set only the AC
 872                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 873                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 874                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 875                                 }
 876                         }
 877                 }
 878
 879         }
 880
 881         if(mifare_classic_halt(pcs, cuid)) {
 882                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 883         };
 884
 885         //  ----------------------------- crypto1 destroy
 886         crypto1_destroy(pcs);
 887
 888         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 889         LEDsoff();
 890
 891         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 892
 893 }
 894
 895
 896 //-----------------------------------------------------------------------------
 897 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 898 //
 899 //-----------------------------------------------------------------------------
 900 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 901
 902   // params
 903         uint8_t needWipe = arg0;
 904         // bit 0 - need get UID
 905         // bit 1 - need wupC
 906         // bit 2 - need HALT after sequence
 907         // bit 3 - need init FPGA and field before sequence
 908         // bit 4 - need reset FPGA and LED
 909         uint8_t workFlags = arg1;
 910         uint8_t blockNo = arg2;
 911
 912         // card commands
 913         uint8_t wupC1[]       = { 0x40 };
 914         uint8_t wupC2[]       = { 0x43 };
 915         uint8_t wipeC[]       = { 0x41 };
 916
 917         // variables
 918         byte_t isOK = 0;
 919         uint8_t uid[10] = {0x00};
 920         uint8_t d_block[18] = {0x00};
 921         uint32_t cuid;
 922
 923         uint8_t *receivedAnswer = get_bigbufptr_recvrespbuf();
 924         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
 925
 926         // reset FPGA and LED
 927         if (workFlags & 0x08) {
 928                 LED_A_ON();
 929                 LED_B_OFF();
 930                 LED_C_OFF();
 931
 932                 iso14a_clear_trace();
 933                 iso14a_set_tracing(TRUE);
 934                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 935         }
 936
 937         while (true) {
 938
 939                 // get UID from chip
 940                 if (workFlags & 0x01) {
 941                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 942                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 943                                 break;
 944                         };
 945
 946                         if(mifare_classic_halt(NULL, cuid)) {
 947                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 948                                 break;
 949                         };
 950                 };
 951
 952                 // reset chip
 953                 if (needWipe){
 954                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 955                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 956                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 957                                 break;
 958                         };
 959
 960                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
 961                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 962                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
 963                                 break;
 964                         };
 965
 966                         if(mifare_classic_halt(NULL, cuid)) {
 967                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 968                                 break;
 969                         };
 970                 };
 971
 972                 // write block
 973                 if (workFlags & 0x02) {
 974                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 975                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 976                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 977                                 break;
 978                         };
 979
 980                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
 981                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 982                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
 983                                 break;
 984                         };
 985                 }
 986
 987                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
 988                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
 989                         break;
 990                 };
 991
 992                 memcpy(d_block, datain, 16);
 993                 AppendCrc14443a(d_block, 16);
 994
 995                 ReaderTransmit(d_block, sizeof(d_block), NULL);
 996                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
 997                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
 998                         break;
 999                 };
1000
1001                 if (workFlags & 0x04) {
1002                         if (mifare_classic_halt(NULL, cuid)) {
1003                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1004                                 break;
1005                         };
1006                 }
1007
1008                 isOK = 1;
1009                 break;
1010         }
1011
1012         LED_B_ON();
1013         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1014         LED_B_OFF();
1015
1016         if ((workFlags & 0x10) || (!isOK)) {
1017                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1018                 LEDsoff();
1019         }
1020 }
1021
1022
1023 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1024
1025   // params
1026         // bit 1 - need wupC
1027         // bit 2 - need HALT after sequence
1028         // bit 3 - need init FPGA and field before sequence
1029         // bit 4 - need reset FPGA and LED
1030         uint8_t workFlags = arg0;
1031         uint8_t blockNo = arg2;
1032
1033         // card commands
1034         uint8_t wupC1[]       = { 0x40 };
1035         uint8_t wupC2[]       = { 0x43 };
1036
1037         // variables
1038         byte_t isOK = 0;
1039         uint8_t data[18] = {0x00};
1040         uint32_t cuid = 0;
1041
1042         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1043         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1044
1045         if (workFlags & 0x08) {
1046                 LED_A_ON();
1047                 LED_B_OFF();
1048                 LED_C_OFF();
1049
1050                 iso14a_clear_trace();
1051                 iso14a_set_tracing(TRUE);
1052                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1053         }
1054
1055         while (true) {
1056                 if (workFlags & 0x02) {
1057                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1058                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1059                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1060                                 break;
1061                         };
1062
1063                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1064                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1065                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1066                                 break;
1067                         };
1068                 }
1069
1070                 // read block
1071                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1072                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1073                         break;
1074                 };
1075                 memcpy(data, receivedAnswer, 18);
1076
1077                 if (workFlags & 0x04) {
1078                         if (mifare_classic_halt(NULL, cuid)) {
1079                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1080                                 break;
1081                         };
1082                 }
1083
1084                 isOK = 1;
1085                 break;
1086         }
1087
1088         LED_B_ON();
1089         cmd_send(CMD_ACK,isOK,0,0,data,18);
1090         LED_B_OFF();
1091
1092         if ((workFlags & 0x10) || (!isOK)) {
1093                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1094                 LEDsoff();
1095         }
1096 }
1097
1098 void MifareCIdent(){
1099
1100         // card commands
1101         uint8_t wupC1[]       = { 0x40 };
1102         uint8_t wupC2[]       = { 0x43 };
1103
1104         // variables
1105         byte_t isOK = 1;
1106
1107         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1108         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1109
1110         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1111         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1112                 isOK = 0;
1113         };
1114
1115         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1116         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1117                 isOK = 0;
1118         };
1119
1120         if (mifare_classic_halt(NULL, 0)) {
1121                 isOK = 0;
1122         };
1123
1124         cmd_send(CMD_ACK,isOK,0,0,0,0);
1125 }
1126
1127                         //
1128 // DESFIRE
1129 //
1130
1131 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1132
1133         byte_t dataout[11] = {0x00};
1134         uint8_t uid[10] = {0x00};
1135         uint32_t cuid;
1136
1137         iso14a_clear_trace();
1138         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1139
1140         int len = iso14443a_select_card(uid, NULL, &cuid);
1141         if(!len) {
1142                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1143                         Dbprintf("Can't select card");
1144                 //OnError(1);
1145                 return;
1146         };
1147
1148         if(mifare_desfire_des_auth1(cuid, dataout)){
1149                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1150                         Dbprintf("Authentication part1: Fail.");
1151                 //OnError(4);
1152                 return;
1153         }
1154
1155         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1156
1157     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1158 }
1159
1160 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1161
1162         uint32_t cuid = arg0;
1163         uint8_t key[16] = {0x00};
1164         byte_t isOK = 0;
1165         byte_t dataout[12] = {0x00};
1166
1167         memcpy(key, datain, 16);
1168
1169         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1170
1171         if( isOK) {
1172             if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1173                         Dbprintf("Authentication part2: Failed");
1174                 //OnError(4);
1175                 return;
1176         }
1177
1178         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1179                 DbpString("AUTH 2 FINISHED");
1180
1181         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1182         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1183         LEDsoff();
1184 }