]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
projects / proxmark3-svn / blob
? search:


bed2f0764c6073050e854083dfb7f2182a8ed959
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17
18 #include <stdint.h>
19
20 #include "proxmark3.h"
21 #include "cmd.h"
22 #include "crapto1/crapto1.h"
23 #include "iso14443a.h"
24 #include "BigBuf.h"
25 #include "mifareutil.h"
26 #include "apps.h"
27 #include "protocols.h"
28 #include "util.h"
29 #include "parity.h"
30 #include "crc.h"
31 #include "fpgaloader.h"
32
33 #define HARDNESTED_AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)
34 #define HARDNESTED_PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication
35
36 /*
37 // the block number for the ISO14443-4 PCB
38 static uint8_t pcb_blocknum = 0;
39 // Deselect card by sending a s-block. the crc is precalced for speed
40 static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
41
42 static void OnSuccess(){
43 pcb_blocknum = 0;
44 ReaderTransmit(deselect_cmd, 3 , NULL);
45 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
46 LEDsoff();
47 }
48 */
49
50 static void OnError(uint8_t reason){
51 // pcb_blocknum = 0;
52 // ReaderTransmit(deselect_cmd, 3 , NULL);
53 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
54 LED_D_OFF();
55 cmd_send(CMD_ACK,0,reason,0,0,0);
56 LED_A_OFF();
57 }
58
59 //-----------------------------------------------------------------------------
60 // Select, Authenticate, Read a MIFARE tag.
61 // read block
62 //-----------------------------------------------------------------------------
63 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
64 {
65 LED_A_ON();
66
67 uint8_t blockNo = arg0;
68 uint8_t keyType = arg1;
69 uint64_t ui64Key = 0;
70 ui64Key = bytes_to_num(datain, 6);
71
72 byte_t isOK = 0;
73 byte_t dataoutbuf[16];
74 uint8_t uid[10];
75 uint32_t cuid;
76 struct Crypto1State mpcs = {0, 0};
77 struct Crypto1State *pcs;
78 pcs = &mpcs;
79
80 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
81
82 clear_trace();
83
84 while (true) {
85 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
86 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
87 break;
88 };
89
90 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
91 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
92 break;
93 };
94
95 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
96 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
97 break;
98 };
99
100 if(mifare_classic_halt(pcs, cuid)) {
101 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
102 break;
103 };
104
105 isOK = 1;
106 break;
107 }
108
109 // ----------------------------- crypto1 destroy
110 crypto1_destroy(pcs);
111
112 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
113
114 LED_B_ON();
115 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
116 LED_B_OFF();
117
118 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
119 LEDsoff();
120 }
121
122 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
123
124 LED_A_ON();
125 bool turnOffField = (arg0 == 1);
126
127 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
128
129 if (!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
130 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
131 OnError(0);
132 return;
133 };
134
135 if (!mifare_ultra_auth(keybytes)){
136 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
137 OnError(1);
138 return;
139 }
140
141 if (turnOffField) {
142 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
143 LED_D_OFF();
144 }
145
146 cmd_send(CMD_ACK,1,0,0,0,0);
147 LED_A_OFF();
148 }
149
150 // Arg0 = BlockNo,
151 // Arg1 = UsePwd bool
152 // datain = PWD bytes,
153 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
154 {
155 LED_A_ON();
156
157 uint8_t blockNo = arg0;
158 byte_t dataout[16] = {0x00};
159 bool useKey = (arg1 == 1); //UL_C
160 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
161
162 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
163
164 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
165 if(!len) {
166 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
167 OnError(1);
168 return;
169 }
170
171 // UL-C authentication
172 if (useKey) {
173 uint8_t key[16] = {0x00};
174 memcpy(key, datain, sizeof(key) );
175
176 if ( !mifare_ultra_auth(key) ) {
177 OnError(1);
178 return;
179 }
180 }
181
182 // UL-EV1 / NTAG authentication
183 if (usePwd) {
184 uint8_t pwd[4] = {0x00};
185 memcpy(pwd, datain, 4);
186 uint8_t pack[4] = {0,0,0,0};
187 if (!mifare_ul_ev1_auth(pwd, pack)) {
188 OnError(1);
189 return;
190 }
191 }
192
193 if (mifare_ultra_readblock(blockNo, dataout)) {
194 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
195 OnError(2);
196 return;
197 }
198
199 if (mifare_ultra_halt()) {
200 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
201 OnError(3);
202 return;
203 }
204
205 cmd_send(CMD_ACK,1,0,0,dataout,16);
206 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
207 LED_D_OFF();
208 LED_A_OFF();
209 }
210
211 //-----------------------------------------------------------------------------
212 // Select, Authenticate, Read a MIFARE tag.
213 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
214 //-----------------------------------------------------------------------------
215 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
216 {
217 // params
218 uint8_t sectorNo = arg0;
219 uint8_t keyType = arg1;
220 uint64_t ui64Key = 0;
221 ui64Key = bytes_to_num(datain, 6);
222
223 // variables
224 byte_t isOK = 0;
225 byte_t dataoutbuf[16 * 16];
226 uint8_t uid[10];
227 uint32_t cuid;
228 struct Crypto1State mpcs = {0, 0};
229 struct Crypto1State *pcs;
230 pcs = &mpcs;
231
232 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
233
234 clear_trace();
235
236 LED_A_ON();
237 LED_B_OFF();
238 LED_C_OFF();
239
240 isOK = 1;
241 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
242 isOK = 0;
243 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
244 }
245
246
247 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
248 isOK = 0;
249 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
250 }
251
252 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
253 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
254 isOK = 0;
255 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
256 break;
257 }
258 }
259
260 if(mifare_classic_halt(pcs, cuid)) {
261 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
262 }
263
264 // ----------------------------- crypto1 destroy
265 crypto1_destroy(pcs);
266
267 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
268
269 LED_B_ON();
270 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
271 LED_B_OFF();
272
273 // Thats it...
274 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
275 LEDsoff();
276 }
277
278 // arg0 = blockNo (start)
279 // arg1 = Pages (number of blocks)
280 // arg2 = useKey
281 // datain = KEY bytes
282 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
283 {
284 LED_A_ON();
285 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
286
287 // free eventually allocated BigBuf memory
288 BigBuf_free();
289
290 // params
291 uint8_t blockNo = arg0;
292 uint16_t blocks = arg1;
293 bool useKey = (arg2 == 1); //UL_C
294 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
295 uint32_t countblocks = 0;
296 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
297 if (dataout == NULL){
298 Dbprintf("out of memory");
299 OnError(1);
300 return;
301 }
302
303 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
304 if (!len) {
305 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
306 OnError(1);
307 return;
308 }
309
310 // UL-C authentication
311 if (useKey) {
312 uint8_t key[16] = {0x00};
313 memcpy(key, datain, sizeof(key) );
314
315 if ( !mifare_ultra_auth(key) ) {
316 OnError(1);
317 return;
318 }
319 }
320
321 // UL-EV1 / NTAG authentication
322 if (usePwd) {
323 uint8_t pwd[4] = {0x00};
324 memcpy(pwd, datain, sizeof(pwd));
325 uint8_t pack[4] = {0,0,0,0};
326
327 if (!mifare_ul_ev1_auth(pwd, pack)){
328 OnError(1);
329 return;
330 }
331 }
332
333 for (int i = 0; i < blocks; i++){
334 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
335 Dbprintf("Data exceeds buffer!!");
336 break;
337 }
338
339 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
340
341 if (len) {
342 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
343 // if no blocks read - error out
344 if (i==0){
345 OnError(2);
346 return;
347 } else {
348 //stop at last successful read block and return what we got
349 break;
350 }
351 } else {
352 countblocks++;
353 }
354 }
355
356 len = mifare_ultra_halt();
357 if (len) {
358 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
359 OnError(3);
360 return;
361 }
362
363 if (MF_DBGLEVEL >= MF_DBG_DEBUG) Dbprintf("Blocks read %d", countblocks);
364
365 cmd_send(CMD_ACK, 1, countblocks*4, BigBuf_max_traceLen(), 0, 0);
366
367 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
368 LED_D_OFF();
369 BigBuf_free();
370 LED_A_OFF();
371 }
372
373 //-----------------------------------------------------------------------------
374 // Select, Authenticate, Write a MIFARE tag.
375 // read block
376 //-----------------------------------------------------------------------------
377 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
378 {
379 // params
380 uint8_t blockNo = arg0;
381 uint8_t keyType = arg1;
382 uint64_t ui64Key = 0;
383 byte_t blockdata[16];
384
385 ui64Key = bytes_to_num(datain, 6);
386 memcpy(blockdata, datain + 10, 16);
387
388 // variables
389 byte_t isOK = 0;
390 uint8_t uid[10];
391 uint32_t cuid;
392 struct Crypto1State mpcs = {0, 0};
393 struct Crypto1State *pcs;
394 pcs = &mpcs;
395
396 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
397
398 clear_trace();
399
400 LED_A_ON();
401 LED_B_OFF();
402 LED_C_OFF();
403
404 while (true) {
405 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
406 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
407 break;
408 };
409
410 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
411 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
412 break;
413 };
414
415 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
416 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
417 break;
418 };
419
420 if(mifare_classic_halt(pcs, cuid)) {
421 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
422 break;
423 };
424
425 isOK = 1;
426 break;
427 }
428
429 // ----------------------------- crypto1 destroy
430 crypto1_destroy(pcs);
431
432 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
433
434 LED_B_ON();
435 cmd_send(CMD_ACK,isOK,0,0,0,0);
436 LED_B_OFF();
437
438
439 // Thats it...
440 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
441 LEDsoff();
442 }
443
444 /* // Command not needed but left for future testing
445 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
446 {
447 uint8_t blockNo = arg0;
448 byte_t blockdata[16] = {0x00};
449
450 memcpy(blockdata, datain, 16);
451
452 uint8_t uid[10] = {0x00};
453
454 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
455
456 clear_trace();
457 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
458
459 if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
460 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
461 OnError(0);
462 return;
463 };
464
465 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
466 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
467 OnError(0);
468 return; };
469
470 if(mifare_ultra_halt()) {
471 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
472 OnError(0);
473 return;
474 };
475
476 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
477
478 cmd_send(CMD_ACK,1,0,0,0,0);
479 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
480 LEDsoff();
481 }
482 */
483
484 // Arg0 : Block to write to.
485 // Arg1 : 0 = use no authentication.
486 // 1 = use 0x1A authentication.
487 // 2 = use 0x1B authentication.
488 // datain : 4 first bytes is data to be written.
489 // : 4/16 next bytes is authentication key.
490 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
491 {
492 uint8_t blockNo = arg0;
493 bool useKey = (arg1 == 1); //UL_C
494 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
495 byte_t blockdata[4] = {0x00};
496
497 memcpy(blockdata, datain,4);
498
499 LEDsoff();
500 LED_A_ON();
501 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
502
503 clear_trace();
504
505 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
506 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
507 OnError(0);
508 return;
509 };
510
511 // UL-C authentication
512 if ( useKey ) {
513 uint8_t key[16] = {0x00};
514 memcpy(key, datain+4, sizeof(key) );
515
516 if ( !mifare_ultra_auth(key) ) {
517 OnError(1);
518 return;
519 }
520 }
521
522 // UL-EV1 / NTAG authentication
523 if (usePwd) {
524 uint8_t pwd[4] = {0x00};
525 memcpy(pwd, datain+4, 4);
526 uint8_t pack[4] = {0,0,0,0};
527 if (!mifare_ul_ev1_auth(pwd, pack)) {
528 OnError(1);
529 return;
530 }
531 }
532
533 if(mifare_ultra_writeblock(blockNo, blockdata)) {
534 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
535 OnError(0);
536 return;
537 };
538
539 if(mifare_ultra_halt()) {
540 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
541 OnError(0);
542 return;
543 };
544
545 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
546
547 cmd_send(CMD_ACK,1,0,0,0,0);
548 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
549 LEDsoff();
550 }
551
552 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
553
554 uint8_t pwd[16] = {0x00};
555 byte_t blockdata[4] = {0x00};
556
557 memcpy(pwd, datain, 16);
558
559 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
560 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
561
562 clear_trace();
563
564 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
565 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
566 OnError(0);
567 return;
568 };
569
570 blockdata[0] = pwd[7];
571 blockdata[1] = pwd[6];
572 blockdata[2] = pwd[5];
573 blockdata[3] = pwd[4];
574 if(mifare_ultra_writeblock( 44, blockdata)) {
575 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
576 OnError(44);
577 return;
578 };
579
580 blockdata[0] = pwd[3];
581 blockdata[1] = pwd[2];
582 blockdata[2] = pwd[1];
583 blockdata[3] = pwd[0];
584 if(mifare_ultra_writeblock( 45, blockdata)) {
585 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
586 OnError(45);
587 return;
588 };
589
590 blockdata[0] = pwd[15];
591 blockdata[1] = pwd[14];
592 blockdata[2] = pwd[13];
593 blockdata[3] = pwd[12];
594 if(mifare_ultra_writeblock( 46, blockdata)) {
595 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
596 OnError(46);
597 return;
598 };
599
600 blockdata[0] = pwd[11];
601 blockdata[1] = pwd[10];
602 blockdata[2] = pwd[9];
603 blockdata[3] = pwd[8];
604 if(mifare_ultra_writeblock( 47, blockdata)) {
605 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
606 OnError(47);
607 return;
608 };
609
610 if(mifare_ultra_halt()) {
611 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
612 OnError(0);
613 return;
614 };
615
616 cmd_send(CMD_ACK,1,0,0,0,0);
617 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
618 LEDsoff();
619 }
620
621 // Return 1 if the nonce is invalid else return 0
622 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
623 return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
624 (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
625 (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
626 }
627
628
629 //-----------------------------------------------------------------------------
630 // acquire encrypted nonces in order to perform the attack described in
631 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
632 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
633 // Computer and Communications Security, 2015
634 //-----------------------------------------------------------------------------
635 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
636 {
637 uint64_t ui64Key = 0;
638 uint8_t uid[10];
639 uint32_t cuid;
640 uint8_t cascade_levels = 0;
641 struct Crypto1State mpcs = {0, 0};
642 struct Crypto1State *pcs;
643 pcs = &mpcs;
644 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
645 int16_t isOK = 0;
646 uint8_t par_enc[1];
647 uint8_t nt_par_enc = 0;
648 uint8_t buf[USB_CMD_DATA_SIZE];
649 uint32_t timeout;
650
651 uint8_t blockNo = arg0 & 0xff;
652 uint8_t keyType = (arg0 >> 8) & 0xff;
653 uint8_t targetBlockNo = arg1 & 0xff;
654 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
655 ui64Key = bytes_to_num(datain, 6);
656 bool initialize = flags & 0x0001;
657 bool slow = flags & 0x0002;
658 bool field_off = flags & 0x0004;
659
660 LED_A_ON();
661 LED_C_OFF();
662
663 if (initialize) {
664 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
665 clear_trace();
666 set_tracing(true);
667 }
668
669 LED_C_ON();
670
671 uint16_t num_nonces = 0;
672 bool have_uid = false;
673 for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
674
675 // Test if the action was cancelled
676 if(BUTTON_PRESS()) {
677 isOK = 2;
678 field_off = true;
679 break;
680 }
681
682 if (!have_uid) { // need a full select cycle to get the uid first
683 iso14a_card_select_t card_info;
684 if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
685 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");
686 continue;
687 }
688 switch (card_info.uidlen) {
689 case 4 : cascade_levels = 1; break;
690 case 7 : cascade_levels = 2; break;
691 case 10: cascade_levels = 3; break;
692 default: break;
693 }
694 have_uid = true;
695 } else { // no need for anticollision. We can directly select the card
696 if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
697 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");
698 continue;
699 }
700 }
701
702 if (slow) {
703 timeout = GetCountSspClk() + HARDNESTED_PRE_AUTHENTICATION_LEADTIME;
704 while(GetCountSspClk() < timeout);
705 }
706
707 uint32_t nt1;
708 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
709 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
710 continue;
711 }
712
713 // nested authentication
714 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
715 if (len != 4) {
716 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
717 continue;
718 }
719
720 // send an incomplete dummy response in order to trigger the card's authentication failure timeout
721 uint8_t dummy_answer[1] = {0};
722 ReaderTransmit(dummy_answer, 1, NULL);
723
724 timeout = GetCountSspClk() + HARDNESTED_AUTHENTICATION_TIMEOUT;
725
726 num_nonces++;
727 if (num_nonces % 2) {
728 memcpy(buf+i, receivedAnswer, 4);
729 nt_par_enc = par_enc[0] & 0xf0;
730 } else {
731 nt_par_enc |= par_enc[0] >> 4;
732 memcpy(buf+i+4, receivedAnswer, 4);
733 memcpy(buf+i+8, &nt_par_enc, 1);
734 i += 9;
735 }
736
737 // wait for the card to become ready again
738 while(GetCountSspClk() < timeout);
739
740 }
741
742 LED_C_OFF();
743
744 crypto1_destroy(pcs);
745
746 LED_B_ON();
747 cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
748 LED_B_OFF();
749
750 if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
751
752 if (field_off) {
753 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
754 LEDsoff();
755 }
756 }
757
758
759 //-----------------------------------------------------------------------------
760 // MIFARE nested authentication.
761 //
762 //-----------------------------------------------------------------------------
763 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
764 {
765 // params
766 uint8_t blockNo = arg0 & 0xff;
767 uint8_t keyType = (arg0 >> 8) & 0xff;
768 uint8_t targetBlockNo = arg1 & 0xff;
769 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
770 uint64_t ui64Key = 0;
771
772 ui64Key = bytes_to_num(datain, 6);
773
774 // variables
775 uint16_t rtr, i, j, len;
776 uint16_t davg;
777 static uint16_t dmin, dmax;
778 uint8_t uid[10];
779 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
780 uint8_t par[1];
781 uint32_t target_nt[2], target_ks[2];
782
783 uint8_t par_array[4];
784 uint16_t ncount = 0;
785 struct Crypto1State mpcs = {0, 0};
786 struct Crypto1State *pcs;
787 pcs = &mpcs;
788 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
789
790 uint32_t auth1_time, auth2_time;
791 static uint16_t delta_time;
792
793 LED_A_ON();
794 LED_C_OFF();
795 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
796
797 // free eventually allocated BigBuf memory
798 BigBuf_free();
799
800 if (calibrate) clear_trace();
801 set_tracing(true);
802
803 // statistics on nonce distance
804 int16_t isOK = 0;
805 #define NESTED_MAX_TRIES 12
806 uint16_t unsuccessfull_tries = 0;
807 if (calibrate) { // for first call only. Otherwise reuse previous calibration
808 LED_B_ON();
809 WDT_HIT();
810
811 davg = dmax = 0;
812 dmin = 2000;
813 delta_time = 0;
814
815 for (rtr = 0; rtr < 17; rtr++) {
816
817 // Test if the action was cancelled
818 if(BUTTON_PRESS()) {
819 isOK = -2;
820 break;
821 }
822
823 // prepare next select. No need to power down the card.
824 if(mifare_classic_halt(pcs, cuid)) {
825 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
826 rtr--;
827 continue;
828 }
829
830 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
831 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
832 rtr--;
833 continue;
834 };
835
836 auth1_time = 0;
837 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
838 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
839 rtr--;
840 continue;
841 };
842
843 if (delta_time) {
844 auth2_time = auth1_time + delta_time;
845 } else {
846 auth2_time = 0;
847 }
848 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
849 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
850 rtr--;
851 continue;
852 };
853
854 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
855 for (i = 101; i < 1200; i++) {
856 nttmp = prng_successor(nttmp, 1);
857 if (nttmp == nt2) break;
858 }
859
860 if (i != 1200) {
861 if (rtr != 0) {
862 davg += i;
863 dmin = MIN(dmin, i);
864 dmax = MAX(dmax, i);
865 }
866 else {
867 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
868 }
869 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
870 } else {
871 unsuccessfull_tries++;
872 if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)
873 isOK = -3;
874 }
875 }
876 }
877
878 davg = (davg + (rtr - 1)/2) / (rtr - 1);
879
880 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
881
882 dmin = davg - 2;
883 dmax = davg + 2;
884
885 LED_B_OFF();
886
887 }
888 // -------------------------------------------------------------------------------------------------
889
890 LED_C_ON();
891
892 // get crypted nonces for target sector
893 for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
894
895 target_nt[i] = 0;
896 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
897
898 // prepare next select. No need to power down the card.
899 if(mifare_classic_halt(pcs, cuid)) {
900 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
901 continue;
902 }
903
904 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
905 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
906 continue;
907 };
908
909 auth1_time = 0;
910 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
911 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
912 continue;
913 };
914
915 // nested authentication
916 auth2_time = auth1_time + delta_time;
917 len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
918 if (len != 4) {
919 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
920 continue;
921 };
922
923 nt2 = bytes_to_num(receivedAnswer, 4);
924 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
925
926 // Parity validity check
927 for (j = 0; j < 4; j++) {
928 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
929 }
930
931 ncount = 0;
932 nttest = prng_successor(nt1, dmin - 1);
933 for (j = dmin; j < dmax + 1; j++) {
934 nttest = prng_successor(nttest, 1);
935 ks1 = nt2 ^ nttest;
936
937 if (valid_nonce(nttest, nt2, ks1, par_array)){
938 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
939 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
940 target_nt[i] = 0;
941 break;
942 }
943 target_nt[i] = nttest;
944 target_ks[i] = ks1;
945 ncount++;
946 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
947 target_nt[i] = 0;
948 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
949 break;
950 }
951 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
952 }
953 }
954 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
955 }
956 }
957
958 LED_C_OFF();
959
960 // ----------------------------- crypto1 destroy
961 crypto1_destroy(pcs);
962
963 byte_t buf[4 + 4 * 4];
964 memcpy(buf, &cuid, 4);
965 memcpy(buf+4, &target_nt[0], 4);
966 memcpy(buf+8, &target_ks[0], 4);
967 memcpy(buf+12, &target_nt[1], 4);
968 memcpy(buf+16, &target_ks[1], 4);
969
970 LED_B_ON();
971 cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
972 LED_B_OFF();
973
974 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
975
976 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
977 LEDsoff();
978 }
979
980 //-----------------------------------------------------------------------------
981 // MIFARE check keys. key count up to 85.
982 //
983 //-----------------------------------------------------------------------------
984 void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
985 {
986 uint8_t blockNo = arg0 & 0xff;
987 uint8_t keyType = (arg0 >> 8) & 0xff;
988 bool clearTrace = arg1 & 0x01;
989 bool multisectorCheck = arg1 & 0x02;
990 uint8_t set14aTimeout = (arg1 >> 8) & 0xff;
991 uint8_t keyCount = arg2;
992
993 LED_A_ON();
994
995 // clear debug level
996 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
997 MF_DBGLEVEL = MF_DBG_NONE;
998
999 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1000
1001 if (clearTrace) {
1002 clear_trace();
1003 }
1004 set_tracing(true);
1005
1006 if (set14aTimeout){
1007 iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe
1008 }
1009
1010 if (multisectorCheck) {
1011 TKeyIndex keyIndex = {{0}};
1012 uint8_t sectorCnt = blockNo;
1013 int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex);
1014
1015 if (res >= 0) {
1016 cmd_send(CMD_ACK, 1, 0, 0, keyIndex, 80);
1017 } else {
1018 cmd_send(CMD_ACK, 0, 0, 0, NULL, 0);
1019 }
1020 } else {
1021 int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL);
1022
1023 if (res > 0) {
1024 cmd_send(CMD_ACK, 1, 0, 0, datain + (res - 1) * 6, 6);
1025 } else {
1026 cmd_send(CMD_ACK, 0, 0, 0, NULL, 0);
1027 }
1028 }
1029
1030 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1031 LED_D_OFF();
1032
1033 // restore debug level
1034 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1035
1036 LED_A_OFF();
1037 }
1038
1039
1040 //-----------------------------------------------------------------------------
1041 // MIFARE Personalize UID. Only for Mifare Classic EV1 7Byte UID
1042 //-----------------------------------------------------------------------------
1043 void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint8_t *data) {
1044
1045 uint8_t uid[10];
1046 uint32_t cuid;
1047 struct Crypto1State mpcs = {0, 0};
1048 struct Crypto1State *pcs;
1049 pcs = &mpcs;
1050
1051 LED_A_ON();
1052 clear_trace();
1053
1054 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1055
1056 bool isOK = false;
1057 while (true) {
1058 if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1059 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1060 break;
1061 }
1062
1063 uint8_t block_number = 0;
1064 uint64_t key = bytes_to_num(data, 6);
1065 if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) {
1066 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
1067 break;
1068 }
1069
1070 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1071 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1072 int len = mifare_sendcmd_short(pcs, true, MIFARE_EV1_PERSONAL_UID, perso_option, receivedAnswer, receivedAnswerPar, NULL);
1073 if (len != 1 || receivedAnswer[0] != CARD_ACK) {
1074 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
1075 break;;
1076 }
1077 isOK = true;
1078 break;
1079 }
1080
1081 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1082 LED_D_OFF();
1083
1084 crypto1_destroy(pcs);
1085
1086 if (MF_DBGLEVEL >= 2) DbpString("PERSONALIZE UID FINISHED");
1087
1088 cmd_send(CMD_ACK, isOK, 0, 0, NULL, 0);
1089
1090 LED_A_OFF();
1091 }
1092
1093 //-----------------------------------------------------------------------------
1094 // MIFARE commands set debug level
1095 //
1096 //-----------------------------------------------------------------------------
1097 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1098 MF_DBGLEVEL = arg0;
1099 Dbprintf("Debug level: %d", MF_DBGLEVEL);
1100 }
1101
1102 //-----------------------------------------------------------------------------
1103 // Work with emulator memory
1104 //
1105 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1106 // involved in dealing with emulator memory. But if it is called later, it might
1107 // destroy the Emulator Memory.
1108 //-----------------------------------------------------------------------------
1109
1110 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1111 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1112 emlClearMem();
1113 }
1114
1115 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1116 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1117 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
1118 }
1119
1120 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1121 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1122 byte_t buf[USB_CMD_DATA_SIZE];
1123 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1124
1125 LED_B_ON();
1126 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1127 LED_B_OFF();
1128 }
1129
1130 //-----------------------------------------------------------------------------
1131 // Load a card into the emulator memory
1132 //
1133 //-----------------------------------------------------------------------------
1134 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1135 uint8_t numSectors = arg0;
1136 uint8_t keyType = arg1;
1137 uint64_t ui64Key = 0;
1138 uint32_t cuid;
1139 struct Crypto1State mpcs = {0, 0};
1140 struct Crypto1State *pcs;
1141 pcs = &mpcs;
1142
1143 // variables
1144 byte_t dataoutbuf[16];
1145 byte_t dataoutbuf2[16];
1146 uint8_t uid[10];
1147
1148 LED_A_ON();
1149 LED_B_OFF();
1150 LED_C_OFF();
1151 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1152
1153 clear_trace();
1154 set_tracing(false);
1155
1156 bool isOK = true;
1157
1158 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1159 isOK = false;
1160 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1161 }
1162
1163 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1164 ui64Key = emlGetKey(sectorNo, keyType);
1165 if (sectorNo == 0){
1166 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1167 isOK = false;
1168 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1169 break;
1170 }
1171 } else {
1172 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1173 isOK = false;
1174 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1175 break;
1176 }
1177 }
1178
1179 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1180 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1181 isOK = false;
1182 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1183 break;
1184 };
1185 if (isOK) {
1186 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1187 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1188 } else { // sector trailer, keep the keys, set only the AC
1189 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1190 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1191 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1192 }
1193 }
1194 }
1195
1196 }
1197
1198 if(mifare_classic_halt(pcs, cuid)) {
1199 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1200 };
1201
1202 // ----------------------------- crypto1 destroy
1203 crypto1_destroy(pcs);
1204
1205 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1206 LEDsoff();
1207
1208 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1209
1210 }
1211
1212
1213 //-----------------------------------------------------------------------------
1214 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1215 //
1216 //-----------------------------------------------------------------------------
1217
1218 static bool isBlockTrailer(int blockN) {
1219 if (blockN >= 0 && blockN < 128) {
1220 return ((blockN & 0x03) == 0x03);
1221 }
1222 if (blockN >= 128 && blockN <= 256) {
1223 return ((blockN & 0x0F) == 0x0F);
1224 }
1225 return false;
1226 }
1227
1228 void MifareCWipe(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1229 // var
1230 byte_t isOK = 0;
1231 uint32_t numBlocks = arg0;
1232 // cmdParams:
1233 // bit 0 - wipe gen1a
1234 // bit 1 - fill card with default data
1235 // bit 2 - gen1a = 0, gen1b = 1
1236 uint8_t cmdParams = arg1;
1237 bool needWipe = cmdParams & 0x01;
1238 bool needFill = cmdParams & 0x02;
1239 bool gen1b = cmdParams & 0x04;
1240
1241 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1242 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1243
1244 uint8_t block0[16] = {0x01, 0x02, 0x03, 0x04, 0x04, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0xAF};
1245 uint8_t block1[16] = {0x00};
1246 uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
1247 uint8_t d_block[18] = {0x00};
1248
1249 // card commands
1250 uint8_t wupC1[] = { 0x40 };
1251 uint8_t wupC2[] = { 0x43 };
1252 uint8_t wipeC[] = { 0x41 };
1253
1254 // iso14443 setup
1255 LED_A_ON();
1256 LED_B_OFF();
1257 LED_C_OFF();
1258 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1259
1260 // tracing
1261 clear_trace();
1262 set_tracing(true);
1263
1264 while (true){
1265 // wipe
1266 if (needWipe){
1267 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1268 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1269 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1270 break;
1271 };
1272
1273 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1274 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1275 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1276 break;
1277 };
1278
1279 if(mifare_classic_halt(NULL, 0)) {
1280 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1281 };
1282 };
1283
1284 // put default data
1285 if (needFill){
1286 // select commands
1287 ReaderTransmitBitsPar(wupC1, 7, 0, NULL);
1288
1289 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1290 if (!gen1b) {
1291
1292 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1293 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1294 break;
1295 };
1296
1297 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1298 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1299 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1300 break;
1301 };
1302 }
1303
1304 // send blocks command
1305 for (int blockNo = 0; blockNo < numBlocks; blockNo++) {
1306 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1307 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1308 break;
1309 };
1310
1311 // check type of block and add crc
1312 if (!isBlockTrailer(blockNo)){
1313 memcpy(d_block, block1, 16);
1314 } else {
1315 memcpy(d_block, blockK, 16);
1316 }
1317 if (blockNo == 0) {
1318 memcpy(d_block, block0, 16);
1319 }
1320 AppendCrc14443a(d_block, 16);
1321
1322 // send write command
1323 ReaderTransmit(d_block, sizeof(d_block), NULL);
1324 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1325 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1326 break;
1327 };
1328 }
1329
1330 // halt
1331 // do no issue halt command for gen1b
1332 if (!gen1b) {
1333 if (mifare_classic_halt(NULL, 0)) {
1334 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1335 break;
1336 }
1337 }
1338 }
1339 break;
1340 }
1341
1342 // send USB response
1343 LED_B_ON();
1344 cmd_send(CMD_ACK,isOK,0,0,NULL,0);
1345 LED_B_OFF();
1346
1347 // reset fpga
1348 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1349 LEDsoff();
1350
1351 return;
1352 }
1353
1354 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1355
1356 // params
1357 uint8_t needWipe = arg0;
1358 // bit 0 - need get UID
1359 // bit 1 - need wupC
1360 // bit 2 - need HALT after sequence
1361 // bit 3 - need init FPGA and field before sequence
1362 // bit 4 - need reset FPGA and LED
1363 // bit 6 - gen1b backdoor type
1364 uint8_t workFlags = arg1;
1365 uint8_t blockNo = arg2;
1366
1367 // card commands
1368 uint8_t wupC1[] = { 0x40 };
1369 uint8_t wupC2[] = { 0x43 };
1370 uint8_t wipeC[] = { 0x41 };
1371
1372 // variables
1373 byte_t isOK = 0;
1374 uint8_t uid[10] = {0x00};
1375 uint8_t d_block[18] = {0x00};
1376 uint32_t cuid;
1377
1378 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1379 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1380
1381 // reset FPGA and LED
1382 if (workFlags & 0x08) {
1383 LED_A_ON();
1384 LED_B_OFF();
1385 LED_C_OFF();
1386 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1387
1388 clear_trace();
1389 set_tracing(true);
1390 }
1391
1392 while (true) {
1393
1394 // get UID from chip
1395 if (workFlags & 0x01) {
1396 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1397 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1398 // Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work.
1399 //break;
1400 };
1401
1402 if(mifare_classic_halt(NULL, cuid)) {
1403 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1404 // Continue, some magic tags misbehavies and send an answer to it.
1405 // break;
1406 };
1407 };
1408
1409 // reset chip
1410 // Wipe command don't work with gen1b
1411 if (needWipe && !(workFlags & 0x40)){
1412 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1413 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1414 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1415 break;
1416 };
1417
1418 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1419 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1420 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1421 break;
1422 };
1423
1424 if(mifare_classic_halt(NULL, 0)) {
1425 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1426 // Continue, some magic tags misbehavies and send an answer to it.
1427 // break;
1428 };
1429 };
1430
1431 // write block
1432 if (workFlags & 0x02) {
1433 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1434
1435 // gen1b magic tag : do no issue wupC2 and don't expect CARD_ACK response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1436 if (!(workFlags & 0x40)) {
1437
1438 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1439 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1440 break;
1441 };
1442
1443 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1444 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1445 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1446 break;
1447 };
1448 }
1449 }
1450
1451 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1452 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1453 break;
1454 };
1455
1456 memcpy(d_block, datain, 16);
1457 AppendCrc14443a(d_block, 16);
1458
1459 ReaderTransmit(d_block, sizeof(d_block), NULL);
1460 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != CARD_ACK)) {
1461 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1462 break;
1463 };
1464
1465 if (workFlags & 0x04) {
1466 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1467 if (!(workFlags & 0x40)) {
1468 if (mifare_classic_halt(NULL, 0)) {
1469 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1470 // Continue, some magic tags misbehavies and send an answer to it.
1471 // break;
1472 }
1473 }
1474 }
1475
1476 isOK = 1;
1477 break;
1478 }
1479
1480 LED_B_ON();
1481 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1482 LED_B_OFF();
1483
1484 if ((workFlags & 0x10) || (!isOK)) {
1485 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1486 LEDsoff();
1487 }
1488 }
1489
1490
1491 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1492
1493 // params
1494 // bit 1 - need wupC
1495 // bit 2 - need HALT after sequence
1496 // bit 3 - need init FPGA and field before sequence
1497 // bit 4 - need reset FPGA and LED
1498 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1499 // bit 6 - gen1b backdoor type
1500 uint8_t workFlags = arg0;
1501 uint8_t blockNo = arg2;
1502
1503 // card commands
1504 uint8_t wupC1[] = { 0x40 };
1505 uint8_t wupC2[] = { 0x43 };
1506
1507 // variables
1508 byte_t isOK = 0;
1509 uint8_t data[18] = {0x00};
1510 uint32_t cuid = 0;
1511
1512 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1513 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1514
1515 if (workFlags & 0x08) {
1516 LED_A_ON();
1517 LED_B_OFF();
1518 LED_C_OFF();
1519 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1520
1521 clear_trace();
1522 set_tracing(true);
1523 }
1524
1525 while (true) {
1526 if (workFlags & 0x02) {
1527 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1528 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1529 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1530 break;
1531 };
1532 // do no issue for gen1b magic tag
1533 if (!(workFlags & 0x40)) {
1534 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1535 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != CARD_ACK)) {
1536 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1537 break;
1538 };
1539 }
1540 }
1541
1542 // read block
1543 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1544 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1545 break;
1546 };
1547 memcpy(data, receivedAnswer, 18);
1548
1549 if (workFlags & 0x04) {
1550 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1551 if (!(workFlags & 0x40)) {
1552 if (mifare_classic_halt(NULL, cuid)) {
1553 if (MF_DBGLEVEL > 1) Dbprintf("Halt error");
1554 // Continue, some magic tags misbehavies and send an answer to it.
1555 // break;
1556 }
1557 }
1558 }
1559
1560 isOK = 1;
1561 break;
1562 }
1563
1564 LED_B_ON();
1565 if (workFlags & 0x20) {
1566 if (isOK)
1567 memcpy(datain, data, 18);
1568 }
1569 else
1570 cmd_send(CMD_ACK,isOK,0,0,data,18);
1571 LED_B_OFF();
1572
1573 if ((workFlags & 0x10) || (!isOK)) {
1574 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1575 LEDsoff();
1576 }
1577 }
1578
1579 void MifareCIdent(){
1580
1581 // card commands
1582 uint8_t wupC1[] = { 0x40 };
1583 uint8_t wupC2[] = { 0x43 };
1584
1585 // variables
1586 byte_t isOK = 0;
1587
1588 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1589 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1590
1591 LED_A_ON();
1592 LED_B_OFF();
1593 LED_C_OFF();
1594 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1595
1596 clear_trace();
1597 set_tracing(true);
1598
1599 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1600 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1601 isOK = 2;
1602
1603 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1604 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == CARD_ACK)) {
1605 isOK = 1;
1606 };
1607 };
1608
1609 // From iceman1001: removed the if, since some magic tags misbehavies and send an answer to it.
1610 mifare_classic_halt(NULL, 0);
1611
1612 LED_B_ON();
1613 cmd_send(CMD_ACK,isOK,0,0,0,0);
1614 LED_B_OFF();
1615
1616 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1617 LEDsoff();
1618 }
1619
1620 //
1621 // DESFIRE
1622 //
1623
1624 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1625
1626 byte_t dataout[11] = {0x00};
1627 uint8_t uid[10] = {0x00};
1628 uint32_t cuid;
1629
1630 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1631 clear_trace();
1632
1633 int len = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
1634 if(!len) {
1635 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1636 OnError(1);
1637 return;
1638 };
1639
1640 if(mifare_desfire_des_auth1(cuid, dataout)){
1641 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1642 OnError(4);
1643 return;
1644 }
1645
1646 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1647 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1648 }
1649
1650 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1651
1652 uint32_t cuid = arg0;
1653 uint8_t key[16] = {0x00};
1654 byte_t isOK = 0;
1655 byte_t dataout[12] = {0x00};
1656
1657 memcpy(key, datain, 16);
1658
1659 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1660
1661 if( isOK) {
1662 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1663 OnError(4);
1664 return;
1665 }
1666
1667 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1668
1669 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1670 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1671 LEDsoff();
1672 }
1673
Proxmark3 GIT tracking
Impressum, Datenschutz