]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
projects / proxmark3-svn / blob
? search:


b9032c5fafc3dd9dff78f973a495648459a48abc
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17
18 #include <stdint.h>
19
20 #include "proxmark3.h"
21 #include "cmd.h"
22 #include "crapto1/crapto1.h"
23 #include "iso14443a.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "apps.h"
27 #include "protocols.h"
28 #include "util.h"
29 #include "parity.h"
30 #include "crc.h"
31 #include "fpgaloader.h"
32
33 #define HARDNESTED_AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)
34 #define HARDNESTED_PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication
35
36 /*
37 // the block number for the ISO14443-4 PCB
38 static uint8_t pcb_blocknum = 0;
39 // Deselect card by sending a s-block. the crc is precalced for speed
40 static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
41
42 static void OnSuccess(){
43 pcb_blocknum = 0;
44 ReaderTransmit(deselect_cmd, 3 , NULL);
45 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
46 LEDsoff();
47 }
48 */
49
50 static void OnError(uint8_t reason){
51 // pcb_blocknum = 0;
52 // ReaderTransmit(deselect_cmd, 3 , NULL);
53 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
54 LED_D_OFF();
55 cmd_send(CMD_ACK,0,reason,0,0,0);
56 LED_A_OFF();
57 }
58
59 //-----------------------------------------------------------------------------
60 // Select, Authenticate, Read a MIFARE tag.
61 // read block
62 //-----------------------------------------------------------------------------
63 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
64 {
65 LED_A_ON();
66
67 uint8_t blockNo = arg0;
68 uint8_t keyType = arg1;
69 uint64_t ui64Key = 0;
70 ui64Key = bytes_to_num(datain, 6);
71
72 byte_t isOK = 0;
73 byte_t dataoutbuf[16];
74 uint8_t uid[10];
75 uint32_t cuid;
76 struct Crypto1State mpcs = {0, 0};
77 struct Crypto1State *pcs;
78 pcs = &mpcs;
79
80 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
81
82 clear_trace();
83
84 while (true) {
85 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
86 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
87 break;
88 };
89
90 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
91 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
92 break;
93 };
94
95 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
96 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
97 break;
98 };
99
100 if(mifare_classic_halt(pcs, cuid)) {
101 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
102 break;
103 };
104
105 isOK = 1;
106 break;
107 }
108
109 // ----------------------------- crypto1 destroy
110 crypto1_destroy(pcs);
111
112 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
113
114 LED_B_ON();
115 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
116 LED_B_OFF();
117
118 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
119 LEDsoff();
120 }
121
122 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
123
124 LED_A_ON();
125 bool turnOffField = (arg0 == 1);
126
127 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
128
129 if (!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
130 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
131 OnError(0);
132 return;
133 };
134
135 if (!mifare_ultra_auth(keybytes)){
136 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
137 OnError(1);
138 return;
139 }
140
141 if (turnOffField) {
142 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
143 LED_D_OFF();
144 }
145
146 cmd_send(CMD_ACK,1,0,0,0,0);
147 LED_A_OFF();
148 }
149
150 // Arg0 = BlockNo,
151 // Arg1 = UsePwd bool
152 // datain = PWD bytes,
153 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
154 {
155 LED_A_ON();
156
157 uint8_t blockNo = arg0;
158 byte_t dataout[16] = {0x00};
159 bool useKey = (arg1 == 1); //UL_C
160 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
161
162 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
163
164 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
165 if(!len) {
166 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
167 OnError(1);
168 return;
169 }
170
171 // UL-C authentication
172 if (useKey) {
173 uint8_t key[16] = {0x00};
174 memcpy(key, datain, sizeof(key) );
175
176 if ( !mifare_ultra_auth(key) ) {
177 OnError(1);
178 return;
179 }
180 }
181
182 // UL-EV1 / NTAG authentication
183 if (usePwd) {
184 uint8_t pwd[4] = {0x00};
185 memcpy(pwd, datain, 4);
186 uint8_t pack[4] = {0,0,0,0};
187 if (!mifare_ul_ev1_auth(pwd, pack)) {
188 OnError(1);
189 return;
190 }
191 }
192
193 if (mifare_ultra_readblock(blockNo, dataout)) {
194 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
195 OnError(2);
196 return;
197 }
198
199 if (mifare_ultra_halt()) {
200 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
201 OnError(3);
202 return;
203 }
204
205 cmd_send(CMD_ACK,1,0,0,dataout,16);
206 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
207 LED_D_OFF();
208 LED_A_OFF();
209 }
210
211 //-----------------------------------------------------------------------------
212 // Select, Authenticate, Read a MIFARE tag.
213 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
214 //-----------------------------------------------------------------------------
215 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
216 {
217 // params
218 uint8_t sectorNo = arg0;
219 uint8_t keyType = arg1;
220 uint64_t ui64Key = 0;
221 ui64Key = bytes_to_num(datain, 6);
222
223 // variables
224 byte_t isOK = 0;
225 byte_t dataoutbuf[16 * 16];
226 uint8_t uid[10];
227 uint32_t cuid;
228 struct Crypto1State mpcs = {0, 0};
229 struct Crypto1State *pcs;
230 pcs = &mpcs;
231
232 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
233
234 clear_trace();
235
236 LED_A_ON();
237 LED_B_OFF();
238 LED_C_OFF();
239
240 isOK = 1;
241 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
242 isOK = 0;
243 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
244 }
245
246
247 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
248 isOK = 0;
249 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
250 }
251
252 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
253 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
254 isOK = 0;
255 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
256 break;
257 }
258 }
259
260 if(mifare_classic_halt(pcs, cuid)) {
261 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
262 }
263
264 // ----------------------------- crypto1 destroy
265 crypto1_destroy(pcs);
266
267 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
268
269 LED_B_ON();
270 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
271 LED_B_OFF();
272
273 // Thats it...
274 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
275 LEDsoff();
276 }
277
278 // arg0 = blockNo (start)
279 // arg1 = Pages (number of blocks)
280 // arg2 = useKey
281 // datain = KEY bytes
282 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
283 {
284 LED_A_ON();
285 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
286
287 // free eventually allocated BigBuf memory
288 BigBuf_free();
289
290 // params
291 uint8_t blockNo = arg0;
292 uint16_t blocks = arg1;
293 bool useKey = (arg2 == 1); //UL_C
294 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
295 uint32_t countblocks = 0;
296 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
297 if (dataout == NULL){
298 Dbprintf("out of memory");
299 OnError(1);
300 return;
301 }
302
303 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
304 if (!len) {
305 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
306 OnError(1);
307 return;
308 }
309
310 // UL-C authentication
311 if (useKey) {
312 uint8_t key[16] = {0x00};
313 memcpy(key, datain, sizeof(key) );
314
315 if ( !mifare_ultra_auth(key) ) {
316 OnError(1);
317 return;
318 }
319 }
320
321 // UL-EV1 / NTAG authentication
322 if (usePwd) {
323 uint8_t pwd[4] = {0x00};
324 memcpy(pwd, datain, sizeof(pwd));
325 uint8_t pack[4] = {0,0,0,0};
326
327 if (!mifare_ul_ev1_auth(pwd, pack)){
328 OnError(1);
329 return;
330 }
331 }
332
333 for (int i = 0; i < blocks; i++){
334 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
335 Dbprintf("Data exceeds buffer!!");
336 break;
337 }
338
339 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
340
341 if (len) {
342 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
343 // if no blocks read - error out
344 if (i==0){
345 OnError(2);
346 return;
347 } else {
348 //stop at last successful read block and return what we got
349 break;
350 }
351 } else {
352 countblocks++;
353 }
354 }
355
356 len = mifare_ultra_halt();
357 if (len) {
358 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
359 OnError(3);
360 return;
361 }
362
363 if (MF_DBGLEVEL >= MF_DBG_DEBUG) Dbprintf("Blocks read %d", countblocks);
364
365 cmd_send(CMD_ACK, 1, countblocks*4, BigBuf_max_traceLen(), 0, 0);
366
367 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
368 LED_D_OFF();
369 BigBuf_free();
370 LED_A_OFF();
371 }
372
373 //-----------------------------------------------------------------------------
374 // Select, Authenticate, Write a MIFARE tag.
375 // read block
376 //-----------------------------------------------------------------------------
377 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
378 {
379 // params
380 uint8_t blockNo = arg0;
381 uint8_t keyType = arg1;
382 uint64_t ui64Key = 0;
383 byte_t blockdata[16];
384
385 ui64Key = bytes_to_num(datain, 6);
386 memcpy(blockdata, datain + 10, 16);
387
388 // variables
389 byte_t isOK = 0;
390 uint8_t uid[10];
391 uint32_t cuid;
392 struct Crypto1State mpcs = {0, 0};
393 struct Crypto1State *pcs;
394 pcs = &mpcs;
395
396 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
397
398 clear_trace();
399
400 LED_A_ON();
401 LED_B_OFF();
402 LED_C_OFF();
403
404 while (true) {
405 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
406 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
407 break;
408 };
409
410 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {
411 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
412 break;
413 };
414
415 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
416 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
417 break;
418 };
419
420 if(mifare_classic_halt(pcs, cuid)) {
421 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
422 break;
423 };
424
425 isOK = 1;
426 break;
427 }
428
429 // ----------------------------- crypto1 destroy
430 crypto1_destroy(pcs);
431
432 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
433
434 LED_B_ON();
435 cmd_send(CMD_ACK,isOK,0,0,0,0);
436 LED_B_OFF();
437
438
439 // Thats it...
440 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
441 LEDsoff();
442 }
443
444 /* // Command not needed but left for future testing
445 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
446 {
447 uint8_t blockNo = arg0;
448 byte_t blockdata[16] = {0x00};
449
450 memcpy(blockdata, datain, 16);
451
452 uint8_t uid[10] = {0x00};
453
454 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
455
456 clear_trace();
457 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
458
459 if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
460 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
461 OnError(0);
462 return;
463 };
464
465 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
466 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
467 OnError(0);
468 return; };
469
470 if(mifare_ultra_halt()) {
471 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
472 OnError(0);
473 return;
474 };
475
476 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
477
478 cmd_send(CMD_ACK,1,0,0,0,0);
479 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
480 LEDsoff();
481 }
482 */
483
484 // Arg0 : Block to write to.
485 // Arg1 : 0 = use no authentication.
486 // 1 = use 0x1A authentication.
487 // 2 = use 0x1B authentication.
488 // datain : 4 first bytes is data to be written.
489 // : 4/16 next bytes is authentication key.
490 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
491 {
492 uint8_t blockNo = arg0;
493 bool useKey = (arg1 == 1); //UL_C
494 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
495 byte_t blockdata[4] = {0x00};
496
497 memcpy(blockdata, datain,4);
498
499 LEDsoff();
500 LED_A_ON();
501 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
502
503 clear_trace();
504
505 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
506 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
507 OnError(0);
508 return;
509 };
510
511 // UL-C authentication
512 if ( useKey ) {
513 uint8_t key[16] = {0x00};
514 memcpy(key, datain+4, sizeof(key) );
515
516 if ( !mifare_ultra_auth(key) ) {
517 OnError(1);
518 return;
519 }
520 }
521
522 // UL-EV1 / NTAG authentication
523 if (usePwd) {
524 uint8_t pwd[4] = {0x00};
525 memcpy(pwd, datain+4, 4);
526 uint8_t pack[4] = {0,0,0,0};
527 if (!mifare_ul_ev1_auth(pwd, pack)) {
528 OnError(1);
529 return;
530 }
531 }
532
533 if(mifare_ultra_writeblock(blockNo, blockdata)) {
534 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
535 OnError(0);
536 return;
537 };
538
539 if(mifare_ultra_halt()) {
540 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
541 OnError(0);
542 return;
543 };
544
545 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
546
547 cmd_send(CMD_ACK,1,0,0,0,0);
548 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
549 LEDsoff();
550 }
551
552 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
553
554 uint8_t pwd[16] = {0x00};
555 byte_t blockdata[4] = {0x00};
556
557 memcpy(pwd, datain, 16);
558
559 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
560 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
561
562 clear_trace();
563
564 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
565 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
566 OnError(0);
567 return;
568 };
569
570 blockdata[0] = pwd[7];
571 blockdata[1] = pwd[6];
572 blockdata[2] = pwd[5];
573 blockdata[3] = pwd[4];
574 if(mifare_ultra_writeblock( 44, blockdata)) {
575 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
576 OnError(44);
577 return;
578 };
579
580 blockdata[0] = pwd[3];
581 blockdata[1] = pwd[2];
582 blockdata[2] = pwd[1];
583 blockdata[3] = pwd[0];
584 if(mifare_ultra_writeblock( 45, blockdata)) {
585 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
586 OnError(45);
587 return;
588 };
589
590 blockdata[0] = pwd[15];
591 blockdata[1] = pwd[14];
592 blockdata[2] = pwd[13];
593 blockdata[3] = pwd[12];
594 if(mifare_ultra_writeblock( 46, blockdata)) {
595 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
596 OnError(46);
597 return;
598 };
599
600 blockdata[0] = pwd[11];
601 blockdata[1] = pwd[10];
602 blockdata[2] = pwd[9];
603 blockdata[3] = pwd[8];
604 if(mifare_ultra_writeblock( 47, blockdata)) {
605 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
606 OnError(47);
607 return;
608 };
609
610 if(mifare_ultra_halt()) {
611 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
612 OnError(0);
613 return;
614 };
615
616 cmd_send(CMD_ACK,1,0,0,0,0);
617 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
618 LEDsoff();
619 }
620
621 // Return 1 if the nonce is invalid else return 0
622 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
623 return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
624 (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
625 (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
626 }
627
628
629 //-----------------------------------------------------------------------------
630 // acquire encrypted nonces in order to perform the attack described in
631 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
632 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
633 // Computer and Communications Security, 2015
634 //-----------------------------------------------------------------------------
635 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
636 {
637 uint64_t ui64Key = 0;
638 uint8_t uid[10];
639 uint32_t cuid;
640 uint8_t cascade_levels = 0;
641 struct Crypto1State mpcs = {0, 0};
642 struct Crypto1State *pcs;
643 pcs = &mpcs;
644 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
645 int16_t isOK = 0;
646 uint8_t par_enc[1];
647 uint8_t nt_par_enc = 0;
648 uint8_t buf[USB_CMD_DATA_SIZE];
649 uint32_t timeout;
650
651 uint8_t blockNo = arg0 & 0xff;
652 uint8_t keyType = (arg0 >> 8) & 0xff;
653 uint8_t targetBlockNo = arg1 & 0xff;
654 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
655 ui64Key = bytes_to_num(datain, 6);
656 bool initialize = flags & 0x0001;
657 bool slow = flags & 0x0002;
658 bool field_off = flags & 0x0004;
659
660 LED_A_ON();
661 LED_C_OFF();
662
663 if (initialize) {
664 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
665 clear_trace();
666 set_tracing(true);
667 }
668
669 LED_C_ON();
670
671 uint16_t num_nonces = 0;
672 bool have_uid = false;
673 for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
674
675 // Test if the action was cancelled
676 if(BUTTON_PRESS()) {
677 isOK = 2;
678 field_off = true;
679 break;
680 }
681
682 if (!have_uid) { // need a full select cycle to get the uid first
683 iso14a_card_select_t card_info;
684 if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
685 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");
686 continue;
687 }
688 switch (card_info.uidlen) {
689 case 4 : cascade_levels = 1; break;
690 case 7 : cascade_levels = 2; break;
691 case 10: cascade_levels = 3; break;
692 default: break;
693 }
694 have_uid = true;
695 } else { // no need for anticollision. We can directly select the card
696 if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
697 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");
698 continue;
699 }
700 }
701
702 if (slow) {
703 timeout = GetCountSspClk() + HARDNESTED_PRE_AUTHENTICATION_LEADTIME;
704 while(GetCountSspClk() < timeout);
705 }
706
707 uint32_t nt1;
708 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL, NULL)) {
709 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
710 continue;
711 }
712
713 // nested authentication
714 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
715 if (len != 4) {
716 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
717 continue;
718 }
719
720 // send an incomplete dummy response in order to trigger the card's authentication failure timeout
721 uint8_t dummy_answer[1] = {0};
722 ReaderTransmit(dummy_answer, 1, NULL);
723
724 timeout = GetCountSspClk() + HARDNESTED_AUTHENTICATION_TIMEOUT;
725
726 num_nonces++;
727 if (num_nonces % 2) {
728 memcpy(buf+i, receivedAnswer, 4);
729 nt_par_enc = par_enc[0] & 0xf0;
730 } else {
731 nt_par_enc |= par_enc[0] >> 4;
732 memcpy(buf+i+4, receivedAnswer, 4);
733 memcpy(buf+i+8, &nt_par_enc, 1);
734 i += 9;
735 }
736
737 // wait for the card to become ready again
738 while(GetCountSspClk() < timeout);
739
740 }
741
742 LED_C_OFF();
743
744 crypto1_destroy(pcs);
745
746 LED_B_ON();
747 cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
748 LED_B_OFF();
749
750 if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
751
752 if (field_off) {
753 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
754 LEDsoff();
755 }
756 }
757
758
759 //-----------------------------------------------------------------------------
760 // MIFARE nested authentication.
761 //
762 //-----------------------------------------------------------------------------
763 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) {
764
765 uint8_t blockNo = arg0 & 0xff;
766 uint8_t keyType = (arg0 >> 8) & 0xff;
767 uint8_t targetBlockNo = arg1 & 0xff;
768 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
769 uint64_t ui64Key = 0;
770
771 ui64Key = bytes_to_num(datain, 6);
772
773 uint16_t rtr, i, j, len;
774 uint16_t davg;
775 static uint16_t dmin, dmax;
776 uint8_t uid[10];
777 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
778 uint8_t par[1];
779 uint32_t target_nt[2], target_ks[2];
780 uint8_t target_nt_duplicate_count = 0;
781
782 uint8_t par_array[4];
783 uint16_t ncount = 0;
784 struct Crypto1State mpcs = {0, 0};
785 struct Crypto1State *pcs;
786 pcs = &mpcs;
787 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
788
789 uint32_t auth1_time, auth2_time, authentication_timeout = 0;
790 static uint16_t delta_time;
791
792 LED_A_ON();
793 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
794
795 // free eventually allocated BigBuf memory
796 BigBuf_free();
797
798 if (calibrate) clear_trace();
799 set_tracing(true);
800
801 // statistics on nonce distance
802 int16_t isOK = 0;
803 #define NESTED_MAX_TRIES 12
804 uint16_t unsuccessfull_tries = 0;
805 if (calibrate) { // for first call only. Otherwise reuse previous calibration
806 LED_B_ON();
807 WDT_HIT();
808
809 davg = dmax = 0;
810 dmin = 2000;
811 delta_time = 0;
812
813 for (rtr = 0; rtr < 17; rtr++) {
814
815 // prepare next select. No need to power down the card.
816 if (mifare_classic_halt(pcs, cuid)) {
817 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
818 rtr--;
819 continue;
820 }
821
822 // Test if the action was cancelled
823 if (BUTTON_PRESS()) {
824 isOK = -2;
825 break;
826 }
827
828 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
829 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
830 rtr--;
831 continue;
832 };
833
834 auth1_time = 0;
835 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, NULL)) {
836 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
837 rtr--;
838 continue;
839 };
840
841 if (delta_time) {
842 auth2_time = auth1_time + delta_time;
843 } else {
844 auth2_time = 0;
845 }
846 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {
847 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
848 rtr--;
849 continue;
850 };
851
852 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
853 for (i = 101; i < 1200; i++) {
854 nttmp = prng_successor(nttmp, 1);
855 if (nttmp == nt2) break;
856 }
857
858 if (i != 1200) {
859 if (rtr != 0) {
860 davg += i;
861 dmin = MIN(dmin, i);
862 dmax = MAX(dmax, i);
863 }
864 else {
865 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
866 }
867 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
868 } else {
869 unsuccessfull_tries++;
870 if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)
871 isOK = -3;
872 }
873 }
874 }
875
876 davg = (davg + (rtr - 1)/2) / (rtr - 1);
877
878 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
879
880 dmin = davg - 2;
881 dmax = davg + 2;
882
883 LED_B_OFF();
884
885 }
886 // -------------------------------------------------------------------------------------------------
887
888 LED_C_ON();
889
890 // get crypted nonces for target sector
891 for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
892
893 target_nt[i] = 0;
894 while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
895
896 // prepare next select. No need to power down the card.
897 if(mifare_classic_halt(pcs, cuid)) {
898 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
899 continue;
900 }
901
902 // break out of the loop on button press
903 if (BUTTON_PRESS()) {
904 isOK = -2;
905 break;
906 }
907
908 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
909 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
910 continue;
911 }
912
913 auth1_time = 0;
914 authentication_timeout = 0;
915 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, &authentication_timeout)) {
916 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
917 continue;
918 }
919
920 // nested authentication
921 auth2_time = auth1_time + delta_time;
922 len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
923 if (len != 4) {
924 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
925 continue;
926 }
927
928 nt2 = bytes_to_num(receivedAnswer, 4);
929 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
930
931 // Parity validity check
932 for (j = 0; j < 4; j++) {
933 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
934 }
935
936 ncount = 0;
937 nttest = prng_successor(nt1, dmin - 1);
938 for (j = dmin; j < dmax + 1; j++) {
939 nttest = prng_successor(nttest, 1);
940 ks1 = nt2 ^ nttest;
941
942 if (valid_nonce(nttest, nt2, ks1, par_array)){
943 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
944 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
945 target_nt[i] = 0;
946 break;
947 }
948 target_nt[i] = nttest;
949 target_ks[i] = ks1;
950 ncount++;
951 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
952 if( ++target_nt_duplicate_count >= NESTED_MAX_TRIES ) { // unable to get a 2nd nonce after NESTED_MAX_TRIES tries, probably a fixed nonce
953 if (MF_DBGLEVEL >= 2) Dbprintf("Nonce#2: cannot get nonce that != nonce#1, continuing anyway with single nonce! ntdist=%d", j);
954 break;
955 }
956
957 target_nt[1] = 0;
958 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
959 break;
960 }
961 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
962 }
963 }
964 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
965 }
966 }
967
968 LED_C_OFF();
969
970 // ----------------------------- crypto1 destroy
971 crypto1_destroy(pcs);
972
973 uint8_t buf[4 + 4 * 4 + 4];
974 memcpy(buf, &cuid, 4);
975 memcpy(buf+4, &target_nt[0], 4);
976 memcpy(buf+8, &target_ks[0], 4);
977 memcpy(buf+12, &target_nt[1], 4);
978 memcpy(buf+16, &target_ks[1], 4);
979 memcpy(buf+20, &authentication_timeout, 4);
980
981 LED_B_ON();
982 cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
983 LED_B_OFF();
984
985 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
986
987 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
988 LEDsoff();
989 }
990
991
992 //-----------------------------------------------------------------------------
993 // MIFARE check keys. key count up to 85.
994 //
995 //-----------------------------------------------------------------------------
996 void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain) {
997
998 uint8_t blockNo = arg0 & 0xff;
999 uint8_t keyType = arg0 >> 8;
1000 bool clearTrace = arg1 & 0x01;
1001 bool multisectorCheck = arg1 & 0x02;
1002 bool init = arg1 & 0x04;
1003 bool drop_field = arg1 & 0x08;
1004 uint32_t auth_timeout = arg1 >> 16;
1005 uint8_t keyCount = arg2;
1006
1007 LED_A_ON();
1008
1009 if (init) {
1010 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1011 }
1012
1013 if (clearTrace) {
1014 clear_trace();
1015 }
1016 set_tracing(true);
1017
1018 // clear debug level. We are expecting lots of authentication failures...
1019 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
1020 MF_DBGLEVEL = MF_DBG_NONE;
1021
1022 int res = 0;
1023 if (multisectorCheck) {
1024 TKeyIndex keyIndex = {{0}};
1025 uint8_t sectorCnt = blockNo;
1026 res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, &auth_timeout, OLD_MF_DBGLEVEL, &keyIndex);
1027 if (res >= 0) {
1028 cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);
1029 } else {
1030 cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
1031 }
1032 } else {
1033 res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
1034 if (res > 0) {
1035 cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
1036 } else {
1037 cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
1038 }
1039 }
1040
1041 if (drop_field || res != 0) {
1042 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1043 LED_D_OFF();
1044 }
1045
1046 // restore debug level
1047 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1048
1049 LED_A_OFF();
1050 }
1051
1052
1053 //-----------------------------------------------------------------------------
1054 // MIFARE Personalize UID. Only for Mifare Classic EV1 7Byte UID
1055 //-----------------------------------------------------------------------------
1056 void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data) {
1057
1058 uint8_t uid[10];
1059 uint32_t cuid;
1060 struct Crypto1State mpcs = {0, 0};
1061 struct Crypto1State *pcs;
1062 pcs = &mpcs;
1063
1064 LED_A_ON();
1065 clear_trace();
1066
1067 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1068
1069 bool isOK = false;
1070 while (true) {
1071 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1072 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1073 break;
1074 }
1075
1076 uint8_t block_number = 0;
1077 uint64_t key = bytes_to_num(data, 6);
1078 if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST, NULL)) {
1079 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
1080 break;
1081 }
1082
1083 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1084 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1085 int len = mifare_sendcmd_short(pcs, true, MIFARE_EV1_PERSONAL_UID, perso_option, receivedAnswer, receivedAnswerPar, NULL);
1086 if (len != 1 || receivedAnswer[0] != CARD_ACK) {
1087 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
1088 break;;
1089 }
1090 isOK = true;
1091 break;
1092 }
1093
1094 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1095 LED_D_OFF();
1096
1097 crypto1_destroy(pcs);
1098
1099 if (MF_DBGLEVEL >= 2) DbpString("PERSONALIZE UID FINISHED");
1100
1101 cmd_send(CMD_ACK, isOK, 0, 0, NULL, 0);
1102
1103 LED_A_OFF();
1104 }
1105
1106 //-----------------------------------------------------------------------------
1107 // MIFARE commands set debug level
1108 //
1109 //-----------------------------------------------------------------------------
1110 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1111 MF_DBGLEVEL = arg0;
1112 Dbprintf("Debug level: %d", MF_DBGLEVEL);
1113 }
1114
1115 //-----------------------------------------------------------------------------
1116 // Work with emulator memory
1117 //
1118 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1119 // involved in dealing with emulator memory. But if it is called later, it might
1120 // destroy the Emulator Memory.
1121 //-----------------------------------------------------------------------------
1122
1123 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1124 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1125 emlClearMem();
1126 }
1127
1128 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1129 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1130 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
1131 }
1132
1133 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1134 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1135 byte_t buf[USB_CMD_DATA_SIZE];
1136 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1137
1138 LED_B_ON();
1139 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1140 LED_B_OFF();
1141 }
1142
1143 //-----------------------------------------------------------------------------
1144 // Load a card into the emulator memory
1145 //
1146 //-----------------------------------------------------------------------------
1147 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1148 uint8_t numSectors = arg0;
1149 uint8_t keyType = arg1;
1150 uint64_t ui64Key = 0;
1151 uint32_t cuid;
1152 struct Crypto1State mpcs = {0, 0};
1153 struct Crypto1State *pcs;
1154 pcs = &mpcs;
1155
1156 // variables
1157 byte_t dataoutbuf[16];
1158 byte_t dataoutbuf2[16];
1159 uint8_t uid[10];
1160
1161 LED_A_ON();
1162 LED_B_OFF();
1163 LED_C_OFF();
1164 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1165
1166 clear_trace();
1167 set_tracing(false);
1168
1169 bool isOK = true;
1170
1171 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1172 isOK = false;
1173 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1174 }
1175
1176 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1177 ui64Key = emlGetKey(sectorNo, keyType);
1178 if (sectorNo == 0){
1179 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {
1180 isOK = false;
1181 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1182 break;
1183 }
1184 } else {
1185 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED, NULL)) {
1186 isOK = false;
1187 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1188 break;
1189 }
1190 }
1191
1192 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1193 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1194 isOK = false;
1195 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1196 break;
1197 };
1198 if (isOK) {
1199 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1200 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1201 } else { // sector trailer, keep the keys, set only the AC
1202 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1203 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1204 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1205 }
1206 }
1207 }
1208
1209 }
1210
1211 if(mifare_classic_halt(pcs, cuid)) {
1212 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1213 };
1214
1215 // ----------------------------- crypto1 destroy
1216 crypto1_destroy(pcs);
1217
1218 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1219 LEDsoff();
1220
1221 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1222
1223 }
1224
1225
1226 //-----------------------------------------------------------------------------
1227 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1228 //
1229 //-----------------------------------------------------------------------------
1230
1231 static bool isBlockTrailer(int blockN) {
1232 if (blockN >= 0 && blockN < 128) {
1233 return ((blockN & 0x03) == 0x03);
1234 }
1235 if (blockN >= 128 && blockN <= 256) {
1236 return ((blockN & 0x0F) == 0x0F);
1237 }
1238 return false;
1239 }
1240
1241 void MifareCWipe(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1242 // var
1243 byte_t isOK = 0;
1244 uint32_t numBlocks = arg0;
1245 // cmdParams:
1246 // bit 0 - wipe gen1a
1247 // bit 1 - fill card with default data
1248 // bit 2 - gen1a = 0, gen1b = 1
1249 uint8_t cmdParams = arg1;
1250 bool needWipe = cmdParams & 0x01;
1251 bool needFill = cmdParams & 0x02;
1252 bool gen1b = cmdParams & 0x04;
1253
1254 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1255 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1256
1257 uint8_t block0[16] = {0x01, 0x02, 0x03, 0x04, 0x04, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0xAF};
1258 uint8_t block1[16] = {0x00};
1259 uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
1260 uint8_t d_block[18] = {0x00};
1261
1262 // card commands
1263 uint8_t wupC1[] = { 0x40 };
1264 uint8_t wupC2[] = { 0x43 };
1265 uint8_t wipeC[] = { 0x41 };
1266
1267 // iso14443 setup
1268 LED_A_ON();
1269 LED_B_OFF();
1270 LED_C_OFF();
1271 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1272
1273 // tracing
1274 clear_trace();
1275 set_tracing(true);
1276
1277 while (true){
1278 // wipe
1279 if (needWipe){
1280 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1281 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1282 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1283 break;
1284 };
1285
1286 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1287 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1288 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1289 break;
1290 };
1291
1292 if(mifare_classic_halt(NULL, 0)) {
1293 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1294 };
1295 };
1296
1297 // put default data
1298 if (needFill){
1299 // select commands
1300 ReaderTransmitBitsPar(wupC1, 7, 0, NULL);
1301
1302 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1303 if (!gen1b) {
1304
1305 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1306 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1307 break;
1308 };
1309
1310 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1311 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1312 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1313 break;
1314 };
1315 }
1316
1317 // send blocks command
1318 for (int blockNo = 0; blockNo < numBlocks; blockNo++) {
1319 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1320 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1321 break;
1322 };
1323
1324 // check type of block and add crc
1325 if (!isBlockTrailer(blockNo)){
1326 memcpy(d_block, block1, 16);
1327 } else {
1328 memcpy(d_block, blockK, 16);
1329 }
1330 if (blockNo == 0) {
1331 memcpy(d_block, block0, 16);
1332 }
1333 AppendCrc14443a(d_block, 16);
1334
1335 // send write command
1336 ReaderTransmit(d_block, sizeof(d_block), NULL);
1337 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1338 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1339 break;
1340 };
1341 }
1342
1343 // halt
1344 // do no issue halt command for gen1b
1345 if (!gen1b) {
1346 if (mifare_classic_halt(NULL, 0)) {
1347 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1348 break;
1349 }
1350 }
1351 }
1352 break;
1353 }
1354
1355 // send USB response
1356 LED_B_ON();
1357 cmd_send(CMD_ACK,isOK,0,0,NULL,0);
1358 LED_B_OFF();
1359
1360 // reset fpga
1361 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1362 LEDsoff();
1363
1364 return;
1365 }
1366
1367 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1368
1369 // params
1370 uint8_t needWipe = arg0;
1371 // bit 0 - need get UID
1372 // bit 1 - need wupC
1373 // bit 2 - need HALT after sequence
1374 // bit 3 - need init FPGA and field before sequence
1375 // bit 4 - need reset FPGA and LED
1376 // bit 6 - gen1b backdoor type
1377 uint8_t workFlags = arg1;
1378 uint8_t blockNo = arg2;
1379
1380 // card commands
1381 uint8_t wupC1[] = { 0x40 };
1382 uint8_t wupC2[] = { 0x43 };
1383 uint8_t wipeC[] = { 0x41 };
1384
1385 // variables
1386 byte_t isOK = 0;
1387 uint8_t uid[10] = {0x00};
1388 uint8_t d_block[18] = {0x00};
1389 uint32_t cuid;
1390
1391 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1392 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1393
1394 // reset FPGA and LED
1395 if (workFlags & 0x08) {
1396 LED_A_ON();
1397 LED_B_OFF();
1398 LED_C_OFF();
1399 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1400
1401 clear_trace();
1402 set_tracing(true);
1403 }
1404
1405 while (true) {
1406
1407 // get UID from chip
1408 if (workFlags & 0x01) {
1409 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1410 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1411 // Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work.
1412 //break;
1413 };
1414
1415 if(mifare_classic_halt(NULL, cuid)) {
1416 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1417 // Continue, some magic tags misbehavies and send an answer to it.
1418 // break;
1419 };
1420 };
1421
1422 // reset chip
1423 // Wipe command don't work with gen1b
1424 if (needWipe && !(workFlags & 0x40)){
1425 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1426 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1427 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1428 break;
1429 };
1430
1431 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1432 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1433 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1434 break;
1435 };
1436
1437 if(mifare_classic_halt(NULL, 0)) {
1438 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1439 // Continue, some magic tags misbehavies and send an answer to it.
1440 // break;
1441 };
1442 };
1443
1444 // write block
1445 if (workFlags & 0x02) {
1446 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1447
1448 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1449 if (!(workFlags & 0x40)) {
1450
1451 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1452 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1453 break;
1454 };
1455
1456 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1457 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1458 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1459 break;
1460 };
1461 }
1462 }
1463
1464 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1465 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1466 break;
1467 };
1468
1469 memcpy(d_block, datain, 16);
1470 AppendCrc14443a(d_block, 16);
1471
1472 ReaderTransmit(d_block, sizeof(d_block), NULL);
1473 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1474 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1475 break;
1476 };
1477
1478 if (workFlags & 0x04) {
1479 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1480 if (!(workFlags & 0x40)) {
1481 if (mifare_classic_halt(NULL, 0)) {
1482 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1483 // Continue, some magic tags misbehavies and send an answer to it.
1484 // break;
1485 }
1486 }
1487 }
1488
1489 isOK = 1;
1490 break;
1491 }
1492
1493 LED_B_ON();
1494 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1495 LED_B_OFF();
1496
1497 if ((workFlags & 0x10) || (!isOK)) {
1498 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1499 LEDsoff();
1500 }
1501 }
1502
1503
1504 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1505
1506 // params
1507 // bit 1 - need wupC
1508 // bit 2 - need HALT after sequence
1509 // bit 3 - need init FPGA and field before sequence
1510 // bit 4 - need reset FPGA and LED
1511 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1512 // bit 6 - gen1b backdoor type
1513 uint8_t workFlags = arg0;
1514 uint8_t blockNo = arg2;
1515
1516 // card commands
1517 uint8_t wupC1[] = { 0x40 };
1518 uint8_t wupC2[] = { 0x43 };
1519
1520 // variables
1521 byte_t isOK = 0;
1522 uint8_t data[18] = {0x00};
1523 uint32_t cuid = 0;
1524
1525 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1526 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1527
1528 if (workFlags & 0x08) {
1529 LED_A_ON();
1530 LED_B_OFF();
1531 LED_C_OFF();
1532 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1533
1534 clear_trace();
1535 set_tracing(true);
1536 }
1537
1538 while (true) {
1539 if (workFlags & 0x02) {
1540 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1541 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1542 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1543 break;
1544 };
1545 // do no issue for gen1b magic tag
1546 if (!(workFlags & 0x40)) {
1547 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1548 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1549 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1550 break;
1551 };
1552 }
1553 }
1554
1555 // read block
1556 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1557 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1558 break;
1559 };
1560 memcpy(data, receivedAnswer, 18);
1561
1562 if (workFlags & 0x04) {
1563 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1564 if (!(workFlags & 0x40)) {
1565 if (mifare_classic_halt(NULL, cuid)) {
1566 if (MF_DBGLEVEL > 1) Dbprintf("Halt error");
1567 // Continue, some magic tags misbehavies and send an answer to it.
1568 // break;
1569 }
1570 }
1571 }
1572
1573 isOK = 1;
1574 break;
1575 }
1576
1577 LED_B_ON();
1578 if (workFlags & 0x20) {
1579 if (isOK)
1580 memcpy(datain, data, 18);
1581 }
1582 else
1583 cmd_send(CMD_ACK,isOK,0,0,data,18);
1584 LED_B_OFF();
1585
1586 if ((workFlags & 0x10) || (!isOK)) {
1587 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1588 LEDsoff();
1589 }
1590 }
1591
1592 void MifareCIdent(){
1593
1594 // card commands
1595 uint8_t wupC1[] = { 0x40 };
1596 uint8_t wupC2[] = { 0x43 };
1597
1598 // variables
1599 byte_t isOK = 0;
1600
1601 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1602 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1603
1604 LED_A_ON();
1605 LED_B_OFF();
1606 LED_C_OFF();
1607 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1608
1609 clear_trace();
1610 set_tracing(true);
1611
1612 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1613 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1614 isOK = 2;
1615
1616 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1617 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1618 isOK = 1;
1619 };
1620 };
1621
1622 // From iceman1001: removed the if, since some magic tags misbehavies and send an answer to it.
1623 mifare_classic_halt(NULL, 0);
1624
1625 LED_B_ON();
1626 cmd_send(CMD_ACK,isOK,0,0,0,0);
1627 LED_B_OFF();
1628
1629 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1630 LEDsoff();
1631 }
1632
1633 //
1634 // DESFIRE
1635 //
1636
1637 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1638
1639 byte_t dataout[11] = {0x00};
1640 uint8_t uid[10] = {0x00};
1641 uint32_t cuid;
1642
1643 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1644 clear_trace();
1645
1646 int len = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
1647 if(!len) {
1648 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1649 OnError(1);
1650 return;
1651 };
1652
1653 if(mifare_desfire_des_auth1(cuid, dataout)){
1654 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1655 OnError(4);
1656 return;
1657 }
1658
1659 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1660 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1661 }
1662
1663 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1664
1665 uint32_t cuid = arg0;
1666 uint8_t key[16] = {0x00};
1667 byte_t isOK = 0;
1668 byte_t dataout[12] = {0x00};
1669
1670 memcpy(key, datain, 16);
1671
1672 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1673
1674 if( isOK) {
1675 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1676 OnError(4);
1677 return;
1678 }
1679
1680 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1681
1682 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1683 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1684 LEDsoff();
1685 }
1686
Proxmark3 GIT tracking
Impressum, Datenschutz