git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19
  20 #include "crc.h"
  21
  22 //-----------------------------------------------------------------------------
  23 // Select, Authenticate, Read a MIFARE tag.
  24 // read block
  25 //-----------------------------------------------------------------------------
  26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  27 {
  28   // params
  29         uint8_t blockNo = arg0;
  30         uint8_t keyType = arg1;
  31         uint64_t ui64Key = 0;
  32         ui64Key = bytes_to_num(datain, 6);
  33
  34         // variables
  35         byte_t isOK = 0;
  36         byte_t dataoutbuf[16];
  37         uint8_t uid[10];
  38         uint32_t cuid;
  39         struct Crypto1State mpcs = {0, 0};
  40         struct Crypto1State *pcs;
  41         pcs = &mpcs;
  42
  43         // clear trace
  44         clear_trace();
  45         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  46
  47         LED_A_ON();
  48         LED_B_OFF();
  49         LED_C_OFF();
  50
  51         while (true) {
  52                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  53                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  54                         break;
  55                 };
  56
  57                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  58                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  59                         break;
  60                 };
  61
  62                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  63                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  64                         break;
  65                 };
  66
  67                 if(mifare_classic_halt(pcs, cuid)) {
  68                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  69                         break;
  70                 };
  71
  72                 isOK = 1;
  73                 break;
  74         }
  75
  76         //  ----------------------------- crypto1 destroy
  77         crypto1_destroy(pcs);
  78
  79         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  80
  81         LED_B_ON();
  82         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  83         LED_B_OFF();
  84
  85         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  86         LEDsoff();
  87 }
  88
  89 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
  90
  91         bool turnOffField = (arg0 == 1);
  92
  93         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
  94         clear_trace();
  95         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  96
  97         if(!iso14443a_select_card(NULL, NULL, NULL)) {
  98                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
  99                 OnError(0);
 100                 return;
 101         };
 102
 103         if(!mifare_ultra_auth(keybytes)){
 104                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
 105                 OnError(1);
 106                 return;
 107         }
 108
 109         if (turnOffField) {
 110                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 111                 LEDsoff();
 112         }
 113         cmd_send(CMD_ACK,1,0,0,0,0);
 114 }
 115
 116 // Arg0 = BlockNo,
 117 // Arg1 = UsePwd bool
 118 // datain = PWD bytes,
 119 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 120 {
 121         uint8_t blockNo = arg0;
 122         byte_t dataout[16] = {0x00};
 123         bool useKey = (arg1 == 1); //UL_C
 124         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 125
 126         LEDsoff();
 127         LED_A_ON();
 128         clear_trace();
 129         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 130
 131         int len = iso14443a_select_card(NULL, NULL, NULL);
 132         if(!len) {
 133                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 134                 OnError(1);
 135                 return;
 136         }
 137
 138         // UL-C authentication
 139         if ( useKey ) {
 140                 uint8_t key[16] = {0x00};
 141                 memcpy(key, datain, sizeof(key) );
 142
 143                 if ( !mifare_ultra_auth(key) ) {
 144                         OnError(1);
 145                         return;
 146                 }
 147         }
 148
 149         // UL-EV1 / NTAG authentication
 150         if ( usePwd ) {
 151                 uint8_t pwd[4] = {0x00};
 152                 memcpy(pwd, datain, 4);
 153                 uint8_t pack[4] = {0,0,0,0};
 154                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 155                         OnError(1);
 156                         return;
 157                 }
 158         }
 159
 160         if( mifare_ultra_readblock(blockNo, dataout) ) {
 161                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 162                 OnError(2);
 163                 return;
 164         }
 165
 166         if( mifare_ultra_halt() ) {
 167                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 168                 OnError(3);
 169                 return;
 170         }
 171
 172     cmd_send(CMD_ACK,1,0,0,dataout,16);
 173         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 174         LEDsoff();
 175 }
 176
 177 //-----------------------------------------------------------------------------
 178 // Select, Authenticate, Read a MIFARE tag.
 179 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 180 //-----------------------------------------------------------------------------
 181 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 182 {
 183   // params
 184         uint8_t sectorNo = arg0;
 185         uint8_t keyType = arg1;
 186         uint64_t ui64Key = 0;
 187         ui64Key = bytes_to_num(datain, 6);
 188
 189         // variables
 190         byte_t isOK = 0;
 191         byte_t dataoutbuf[16 * 16];
 192         uint8_t uid[10];
 193         uint32_t cuid;
 194         struct Crypto1State mpcs = {0, 0};
 195         struct Crypto1State *pcs;
 196         pcs = &mpcs;
 197
 198         // clear trace
 199         clear_trace();
 200
 201         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 202
 203         LED_A_ON();
 204         LED_B_OFF();
 205         LED_C_OFF();
 206
 207         isOK = 1;
 208         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 209                 isOK = 0;
 210                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 211         }
 212
 213
 214         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 215                 isOK = 0;
 216                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 217         }
 218
 219         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 220                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 221                         isOK = 0;
 222                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 223                         break;
 224                 }
 225         }
 226
 227         if(mifare_classic_halt(pcs, cuid)) {
 228                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 229         }
 230
 231         //  ----------------------------- crypto1 destroy
 232         crypto1_destroy(pcs);
 233
 234         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 235
 236         LED_B_ON();
 237         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 238         LED_B_OFF();
 239
 240         // Thats it...
 241         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 242         LEDsoff();
 243 }
 244
 245 // arg0 = blockNo (start)
 246 // arg1 = Pages (number of blocks)
 247 // arg2 = useKey
 248 // datain = KEY bytes
 249 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 250 {
 251         // free eventually allocated BigBuf memory
 252         BigBuf_free();
 253         clear_trace();
 254
 255         // params
 256         uint8_t blockNo = arg0;
 257         uint16_t blocks = arg1;
 258         bool useKey = (arg2 == 1); //UL_C
 259         bool usePwd = (arg2 == 2); //UL_EV1/NTAG
 260         uint32_t countblocks = 0;
 261         uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
 262         if (dataout == NULL){
 263                 Dbprintf("out of memory");
 264                 OnError(1);
 265                 return;
 266         }
 267
 268         LEDsoff();
 269         LED_A_ON();
 270         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 271
 272         int len = iso14443a_select_card(NULL, NULL, NULL);
 273         if (!len) {
 274                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 275                 OnError(1);
 276                 return;
 277         }
 278
 279         // UL-C authentication
 280         if ( useKey ) {
 281                 uint8_t key[16] = {0x00};
 282                 memcpy(key, datain, sizeof(key) );
 283
 284                 if ( !mifare_ultra_auth(key) ) {
 285                         OnError(1);
 286                         return;
 287                 }
 288         }
 289
 290         // UL-EV1 / NTAG authentication
 291         if (usePwd) {
 292                 uint8_t pwd[4] = {0x00};
 293                 memcpy(pwd, datain, sizeof(pwd));
 294                 uint8_t pack[4] = {0,0,0,0};
 295
 296                 if (!mifare_ul_ev1_auth(pwd, pack)){
 297                         OnError(1);
 298                         return;
 299                 }
 300         }
 301
 302         for (int i = 0; i < blocks; i++){
 303                 if ((i*4) + 4 > CARD_MEMORY_SIZE) {
 304                         Dbprintf("Data exceeds buffer!!");
 305                         break;
 306                 }
 307
 308                 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
 309
 310                 if (len) {
 311                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 312                         // if no blocks read - error out
 313                         if (i==0){
 314                                 OnError(2);
 315                         return;
 316                         } else {
 317                                 //stop at last successful read block and return what we got
 318                                 break;
 319                         }
 320                 } else {
 321                         countblocks++;
 322                 }
 323         }
 324
 325         len = mifare_ultra_halt();
 326         if (len) {
 327                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 328                 OnError(3);
 329                 return;
 330         }
 331
 332         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 333
 334         countblocks *= 4;
 335         cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
 336         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 337         LEDsoff();
 338
 339         BigBuf_free();
 340 }
 341
 342 //-----------------------------------------------------------------------------
 343 // Select, Authenticate, Write a MIFARE tag.
 344 // read block
 345 //-----------------------------------------------------------------------------
 346 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 347 {
 348         // params
 349         uint8_t blockNo = arg0;
 350         uint8_t keyType = arg1;
 351         uint64_t ui64Key = 0;
 352         byte_t blockdata[16];
 353
 354         ui64Key = bytes_to_num(datain, 6);
 355         memcpy(blockdata, datain + 10, 16);
 356
 357         // variables
 358         byte_t isOK = 0;
 359         uint8_t uid[10];
 360         uint32_t cuid;
 361         struct Crypto1State mpcs = {0, 0};
 362         struct Crypto1State *pcs;
 363         pcs = &mpcs;
 364
 365         // clear trace
 366         clear_trace();
 367
 368         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 369
 370         LED_A_ON();
 371         LED_B_OFF();
 372         LED_C_OFF();
 373
 374         while (true) {
 375                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 376                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 377                         break;
 378                 };
 379
 380                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 381                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 382                         break;
 383                 };
 384
 385                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 386                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 387                         break;
 388                 };
 389
 390                 if(mifare_classic_halt(pcs, cuid)) {
 391                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 392                         break;
 393                 };
 394
 395                 isOK = 1;
 396                 break;
 397         }
 398
 399         //  ----------------------------- crypto1 destroy
 400         crypto1_destroy(pcs);
 401
 402         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 403
 404         LED_B_ON();
 405         cmd_send(CMD_ACK,isOK,0,0,0,0);
 406         LED_B_OFF();
 407
 408
 409         // Thats it...
 410         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 411         LEDsoff();
 412 }
 413
 414 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 415 {
 416         uint8_t blockNo = arg0;
 417         byte_t blockdata[16] = {0x00};
 418
 419         memcpy(blockdata, datain, 16);
 420
 421         uint8_t uid[10] = {0x00};
 422
 423         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 424
 425         clear_trace();
 426         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 427
 428         if(!iso14443a_select_card(uid, NULL, NULL)) {
 429                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 430                 OnError(0);
 431                 return;
 432         };
 433
 434         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 435                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 436                 OnError(0);
 437                 return; };
 438
 439         if(mifare_ultra_halt()) {
 440                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 441                 OnError(0);
 442                 return;
 443         };
 444
 445         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 446
 447         cmd_send(CMD_ACK,1,0,0,0,0);
 448         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 449         LEDsoff();
 450 }
 451
 452 // Arg0   : Block to write to.
 453 // Arg1   : 0 = use no authentication.
 454 //          1 = use 0x1A authentication.
 455 //          2 = use 0x1B authentication.
 456 // datain : 4 first bytes is data to be written.
 457 //        : 4/16 next bytes is authentication key.
 458 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 459 {
 460         uint8_t blockNo = arg0;
 461         bool useKey = (arg1 == 1); //UL_C
 462         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 463         byte_t blockdata[4] = {0x00};
 464
 465         memcpy(blockdata, datain,4);
 466
 467         LEDsoff();
 468         LED_A_ON();
 469         clear_trace();
 470         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 471
 472         if(!iso14443a_select_card(NULL, NULL, NULL)) {
 473                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 474                 OnError(0);
 475                 return;
 476         };
 477
 478         // UL-C authentication
 479         if ( useKey ) {
 480                 uint8_t key[16] = {0x00};
 481                 memcpy(key, datain+4, sizeof(key) );
 482
 483                 if ( !mifare_ultra_auth(key) ) {
 484                         OnError(1);
 485                         return;
 486                 }
 487         }
 488
 489         // UL-EV1 / NTAG authentication
 490         if (usePwd) {
 491                 uint8_t pwd[4] = {0x00};
 492                 memcpy(pwd, datain+4, 4);
 493                 uint8_t pack[4] = {0,0,0,0};
 494                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 495                         OnError(1);
 496                         return;
 497                 }
 498         }
 499
 500         if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
 501                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 502                 OnError(0);
 503                 return;
 504         };
 505
 506         if(mifare_ultra_halt()) {
 507                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 508                 OnError(0);
 509                 return;
 510         };
 511
 512         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 513
 514         cmd_send(CMD_ACK,1,0,0,0,0);
 515         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 516         LEDsoff();
 517 }
 518
 519 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 520
 521         uint8_t pwd[16] = {0x00};
 522         byte_t blockdata[4] = {0x00};
 523
 524         memcpy(pwd, datain, 16);
 525
 526         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 527         clear_trace();
 528         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 529
 530         if(!iso14443a_select_card(NULL, NULL, NULL)) {
 531                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 532                 OnError(0);
 533                 return;
 534         };
 535
 536         blockdata[0] = pwd[7];
 537         blockdata[1] = pwd[6];
 538         blockdata[2] = pwd[5];
 539         blockdata[3] = pwd[4];
 540         if(mifare_ultra_special_writeblock( 44, blockdata)) {
 541                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 542                 OnError(44);
 543                 return;
 544         };
 545
 546         blockdata[0] = pwd[3];
 547         blockdata[1] = pwd[2];
 548         blockdata[2] = pwd[1];
 549         blockdata[3] = pwd[0];
 550         if(mifare_ultra_special_writeblock( 45, blockdata)) {
 551                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 552                 OnError(45);
 553                 return;
 554         };
 555
 556         blockdata[0] = pwd[15];
 557         blockdata[1] = pwd[14];
 558         blockdata[2] = pwd[13];
 559         blockdata[3] = pwd[12];
 560         if(mifare_ultra_special_writeblock( 46, blockdata)) {
 561                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 562                 OnError(46);
 563                 return;
 564         };
 565
 566         blockdata[0] = pwd[11];
 567         blockdata[1] = pwd[10];
 568         blockdata[2] = pwd[9];
 569         blockdata[3] = pwd[8];
 570         if(mifare_ultra_special_writeblock( 47, blockdata)) {
 571                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 572                 OnError(47);
 573                 return;
 574         };
 575
 576         if(mifare_ultra_halt()) {
 577                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 578                 OnError(0);
 579                 return;
 580         };
 581
 582         cmd_send(CMD_ACK,1,0,0,0,0);
 583         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 584         LEDsoff();
 585 }
 586
 587 // Return 1 if the nonce is invalid else return 0
 588 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 589         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 590         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 591         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 592 }
 593
 594
 595 //-----------------------------------------------------------------------------
 596 // MIFARE nested authentication.
 597 //
 598 //-----------------------------------------------------------------------------
 599 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 600 {
 601         // params
 602         uint8_t blockNo = arg0 & 0xff;
 603         uint8_t keyType = (arg0 >> 8) & 0xff;
 604         uint8_t targetBlockNo = arg1 & 0xff;
 605         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 606         uint64_t ui64Key = 0;
 607
 608         ui64Key = bytes_to_num(datain, 6);
 609
 610         // variables
 611         uint16_t rtr, i, j, len;
 612         uint16_t davg;
 613         static uint16_t dmin, dmax;
 614         uint8_t uid[10];
 615         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 616         uint8_t par[1];
 617         uint32_t target_nt[2], target_ks[2];
 618
 619         uint8_t par_array[4];
 620         uint16_t ncount = 0;
 621         struct Crypto1State mpcs = {0, 0};
 622         struct Crypto1State *pcs;
 623         pcs = &mpcs;
 624         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 625
 626         uint32_t auth1_time, auth2_time;
 627         static uint16_t delta_time;
 628
 629         // free eventually allocated BigBuf memory
 630         BigBuf_free();
 631         // clear trace
 632         clear_trace();
 633         set_tracing(false);
 634
 635         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 636
 637         LED_A_ON();
 638         LED_C_OFF();
 639
 640
 641         // statistics on nonce distance
 642         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 643                 LED_B_ON();
 644                 WDT_HIT();
 645
 646                 davg = dmax = 0;
 647                 dmin = 2000;
 648                 delta_time = 0;
 649
 650                 for (rtr = 0; rtr < 17; rtr++) {
 651
 652                         // prepare next select. No need to power down the card.
 653                         if(mifare_classic_halt(pcs, cuid)) {
 654                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 655                                 rtr--;
 656                                 continue;
 657                         }
 658
 659                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 660                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 661                                 rtr--;
 662                                 continue;
 663                         };
 664
 665                         auth1_time = 0;
 666                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 667                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 668                                 rtr--;
 669                                 continue;
 670                         };
 671
 672                         if (delta_time) {
 673                                 auth2_time = auth1_time + delta_time;
 674                         } else {
 675                                 auth2_time = 0;
 676                         }
 677                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 678                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 679                                 rtr--;
 680                                 continue;
 681                         };
 682
 683                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 684                         for (i = 101; i < 1200; i++) {
 685                                 nttmp = prng_successor(nttmp, 1);
 686                                 if (nttmp == nt2) break;
 687                         }
 688
 689                         if (i != 1200) {
 690                                 if (rtr != 0) {
 691                                         davg += i;
 692                                         dmin = MIN(dmin, i);
 693                                         dmax = MAX(dmax, i);
 694                                 }
 695                                 else {
 696                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 697                                 }
 698                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 699                         }
 700                 }
 701
 702                 if (rtr <= 1)   return;
 703
 704                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 705
 706                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 707
 708                 dmin = davg - 2;
 709                 dmax = davg + 2;
 710
 711                 LED_B_OFF();
 712
 713         }
 714 //  -------------------------------------------------------------------------------------------------
 715
 716         LED_C_ON();
 717
 718         //  get crypted nonces for target sector
 719         for(i=0; i < 2; i++) { // look for exactly two different nonces
 720
 721                 target_nt[i] = 0;
 722                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 723
 724                         // prepare next select. No need to power down the card.
 725                         if(mifare_classic_halt(pcs, cuid)) {
 726                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 727                                 continue;
 728                         }
 729
 730                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 731                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 732                                 continue;
 733                         };
 734
 735                         auth1_time = 0;
 736                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 737                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 738                                 continue;
 739                         };
 740
 741                         // nested authentication
 742                         auth2_time = auth1_time + delta_time;
 743                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 744                         if (len != 4) {
 745                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 746                                 continue;
 747                         };
 748
 749                         nt2 = bytes_to_num(receivedAnswer, 4);
 750                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 751
 752                         // Parity validity check
 753                         for (j = 0; j < 4; j++) {
 754                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 755                         }
 756
 757                         ncount = 0;
 758                         nttest = prng_successor(nt1, dmin - 1);
 759                         for (j = dmin; j < dmax + 1; j++) {
 760                                 nttest = prng_successor(nttest, 1);
 761                                 ks1 = nt2 ^ nttest;
 762
 763                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 764                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 765                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 766                                                 target_nt[i] = 0;
 767                                                 break;
 768                                         }
 769                                         target_nt[i] = nttest;
 770                                         target_ks[i] = ks1;
 771                                         ncount++;
 772                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 773                                                 target_nt[i] = 0;
 774                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 775                                                 break;
 776                                         }
 777                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 778                                 }
 779                         }
 780                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 781                 }
 782         }
 783
 784         LED_C_OFF();
 785
 786         //  ----------------------------- crypto1 destroy
 787         crypto1_destroy(pcs);
 788
 789         byte_t buf[4 + 4 * 4];
 790         memcpy(buf, &cuid, 4);
 791         memcpy(buf+4, &target_nt[0], 4);
 792         memcpy(buf+8, &target_ks[0], 4);
 793         memcpy(buf+12, &target_nt[1], 4);
 794         memcpy(buf+16, &target_ks[1], 4);
 795
 796         LED_B_ON();
 797         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 798         LED_B_OFF();
 799
 800         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 801
 802         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 803         LEDsoff();
 804         set_tracing(TRUE);
 805 }
 806
 807 //-----------------------------------------------------------------------------
 808 // MIFARE check keys. key count up to 85.
 809 //
 810 //-----------------------------------------------------------------------------
 811 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 812 {
 813   // params
 814         uint8_t blockNo = arg0;
 815         uint8_t keyType = arg1;
 816         uint8_t keyCount = arg2;
 817         uint64_t ui64Key = 0;
 818
 819         // variables
 820         int i;
 821         byte_t isOK = 0;
 822         uint8_t uid[10];
 823         uint32_t cuid;
 824         struct Crypto1State mpcs = {0, 0};
 825         struct Crypto1State *pcs;
 826         pcs = &mpcs;
 827
 828         // clear debug level
 829         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 830         MF_DBGLEVEL = MF_DBG_NONE;
 831
 832         // clear trace
 833         clear_trace();
 834         set_tracing(TRUE);
 835
 836         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 837
 838         LED_A_ON();
 839         LED_B_OFF();
 840         LED_C_OFF();
 841
 842         for (i = 0; i < keyCount; i++) {
 843                 if(mifare_classic_halt(pcs, cuid)) {
 844                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 845                 }
 846
 847                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 848                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 849                         break;
 850                 };
 851
 852                 ui64Key = bytes_to_num(datain + i * 6, 6);
 853                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 854                         continue;
 855                 };
 856
 857                 isOK = 1;
 858                 break;
 859         }
 860
 861         //  ----------------------------- crypto1 destroy
 862         crypto1_destroy(pcs);
 863
 864         LED_B_ON();
 865     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 866         LED_B_OFF();
 867
 868         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 869         LEDsoff();
 870
 871         // restore debug level
 872         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 873 }
 874
 875 //-----------------------------------------------------------------------------
 876 // MIFARE commands set debug level
 877 //
 878 //-----------------------------------------------------------------------------
 879 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 880         MF_DBGLEVEL = arg0;
 881         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 882 }
 883
 884 //-----------------------------------------------------------------------------
 885 // Work with emulator memory
 886 //
 887 //-----------------------------------------------------------------------------
 888 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 889         emlClearMem();
 890 }
 891
 892 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 893         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 894 }
 895
 896 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 897         byte_t buf[USB_CMD_DATA_SIZE];
 898         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 899
 900         LED_B_ON();
 901         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 902         LED_B_OFF();
 903 }
 904
 905 //-----------------------------------------------------------------------------
 906 // Load a card into the emulator memory
 907 //
 908 //-----------------------------------------------------------------------------
 909 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 910         uint8_t numSectors = arg0;
 911         uint8_t keyType = arg1;
 912         uint64_t ui64Key = 0;
 913         uint32_t cuid;
 914         struct Crypto1State mpcs = {0, 0};
 915         struct Crypto1State *pcs;
 916         pcs = &mpcs;
 917
 918         // variables
 919         byte_t dataoutbuf[16];
 920         byte_t dataoutbuf2[16];
 921         uint8_t uid[10];
 922
 923         // clear trace
 924         clear_trace();
 925         set_tracing(false);
 926
 927         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 928
 929         LED_A_ON();
 930         LED_B_OFF();
 931         LED_C_OFF();
 932
 933         bool isOK = true;
 934
 935         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 936                 isOK = false;
 937                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 938         }
 939
 940         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 941                 ui64Key = emlGetKey(sectorNo, keyType);
 942                 if (sectorNo == 0){
 943                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 944                                 isOK = false;
 945                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 946                                 break;
 947                         }
 948                 } else {
 949                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 950                                 isOK = false;
 951                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 952                                 break;
 953                         }
 954                 }
 955
 956                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 957                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 958                                 isOK = false;
 959                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 960                                 break;
 961                         };
 962                         if (isOK) {
 963                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 964                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 965                                 } else {        // sector trailer, keep the keys, set only the AC
 966                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 967                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 968                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 969                                 }
 970                         }
 971                 }
 972
 973         }
 974
 975         if(mifare_classic_halt(pcs, cuid)) {
 976                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 977         };
 978
 979         //  ----------------------------- crypto1 destroy
 980         crypto1_destroy(pcs);
 981
 982         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 983         LEDsoff();
 984
 985         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 986
 987 }
 988
 989
 990 //-----------------------------------------------------------------------------
 991 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 992 //
 993 //-----------------------------------------------------------------------------
 994 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 995
 996   // params
 997         uint8_t needWipe = arg0;
 998         // bit 0 - need get UID
 999         // bit 1 - need wupC
1000         // bit 2 - need HALT after sequence
1001         // bit 3 - need init FPGA and field before sequence
1002         // bit 4 - need reset FPGA and LED
1003         uint8_t workFlags = arg1;
1004         uint8_t blockNo = arg2;
1005
1006         // card commands
1007         uint8_t wupC1[]       = { 0x40 };
1008         uint8_t wupC2[]       = { 0x43 };
1009         uint8_t wipeC[]       = { 0x41 };
1010
1011         // variables
1012         byte_t isOK = 0;
1013         uint8_t uid[10] = {0x00};
1014         uint8_t d_block[18] = {0x00};
1015         uint32_t cuid;
1016
1017         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1018         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1019
1020         // reset FPGA and LED
1021         if (workFlags & 0x08) {
1022                 LED_A_ON();
1023                 LED_B_OFF();
1024                 LED_C_OFF();
1025
1026                 clear_trace();
1027                 set_tracing(TRUE);
1028                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1029         }
1030
1031         while (true) {
1032
1033                 // get UID from chip
1034                 if (workFlags & 0x01) {
1035                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
1036                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1037                                 //break;
1038                         };
1039
1040                         if(mifare_classic_halt(NULL, cuid)) {
1041                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1042                                 //break;
1043                         };
1044                 };
1045
1046                 // reset chip
1047                 if (needWipe){
1048                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1049                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1050                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1051                                 break;
1052                         };
1053
1054                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1055                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1056                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
1057                                 break;
1058                         };
1059
1060                         if(mifare_classic_halt(NULL, cuid)) {
1061                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1062                                 break;
1063                         };
1064                 };
1065
1066                 // write block
1067                 if (workFlags & 0x02) {
1068                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1069                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1070                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1071                                 break;
1072                         };
1073
1074                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1075                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1076                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1077                                 break;
1078                         };
1079                 }
1080
1081                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1082                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
1083                         break;
1084                 };
1085
1086                 memcpy(d_block, datain, 16);
1087                 AppendCrc14443a(d_block, 16);
1088
1089                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1090                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1091                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1092                         break;
1093                 };
1094
1095                 if (workFlags & 0x04) {
1096                         if (mifare_classic_halt(NULL, cuid)) {
1097                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1098                                 break;
1099                         };
1100                 }
1101
1102                 isOK = 1;
1103                 break;
1104         }
1105
1106         LED_B_ON();
1107         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1108         LED_B_OFF();
1109
1110         if ((workFlags & 0x10) || (!isOK)) {
1111                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1112                 LEDsoff();
1113         }
1114 }
1115
1116
1117 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1118
1119   // params
1120         // bit 1 - need wupC
1121         // bit 2 - need HALT after sequence
1122         // bit 3 - need init FPGA and field before sequence
1123         // bit 4 - need reset FPGA and LED
1124         uint8_t workFlags = arg0;
1125         uint8_t blockNo = arg2;
1126
1127         // card commands
1128         uint8_t wupC1[]       = { 0x40 };
1129         uint8_t wupC2[]       = { 0x43 };
1130
1131         // variables
1132         byte_t isOK = 0;
1133         uint8_t data[18] = {0x00};
1134         uint32_t cuid = 0;
1135
1136         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1137         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1138
1139         if (workFlags & 0x08) {
1140                 LED_A_ON();
1141                 LED_B_OFF();
1142                 LED_C_OFF();
1143
1144                 clear_trace();
1145                 set_tracing(TRUE);
1146                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1147         }
1148
1149         while (true) {
1150                 if (workFlags & 0x02) {
1151                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1152                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1153                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1154                                 break;
1155                         };
1156
1157                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1158                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1159                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1160                                 break;
1161                         };
1162                 }
1163
1164                 // read block
1165                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1166                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1167                         break;
1168                 };
1169                 memcpy(data, receivedAnswer, 18);
1170
1171                 if (workFlags & 0x04) {
1172                         if (mifare_classic_halt(NULL, cuid)) {
1173                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1174                                 break;
1175                         };
1176                 }
1177
1178                 isOK = 1;
1179                 break;
1180         }
1181
1182         LED_B_ON();
1183         cmd_send(CMD_ACK,isOK,0,0,data,18);
1184         LED_B_OFF();
1185
1186         if ((workFlags & 0x10) || (!isOK)) {
1187                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1188                 LEDsoff();
1189         }
1190 }
1191
1192 void MifareCIdent(){
1193
1194         // card commands
1195         uint8_t wupC1[]       = { 0x40 };
1196         uint8_t wupC2[]       = { 0x43 };
1197
1198         // variables
1199         byte_t isOK = 1;
1200
1201         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1202         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1203
1204         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1205         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1206                 isOK = 0;
1207         };
1208
1209         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1210         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1211                 isOK = 0;
1212         };
1213
1214         if (mifare_classic_halt(NULL, 0)) {
1215                 isOK = 0;
1216         };
1217
1218         cmd_send(CMD_ACK,isOK,0,0,0,0);
1219 }
1220
1221 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1222
1223         BigBuf_free();
1224
1225         uint32_t iterations = arg0;
1226         uint8_t uid[10] = {0x00};
1227
1228         uint8_t *response = BigBuf_malloc(MAX_MIFARE_FRAME_SIZE);
1229         uint8_t *responsePar = BigBuf_malloc(MAX_MIFARE_PARITY_SIZE);
1230
1231         uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1232
1233         // get memory from BigBuf.
1234         uint8_t *nonces = BigBuf_malloc(iterations * 4);
1235
1236         LED_A_ON();
1237         LED_B_OFF();
1238         LED_C_OFF();
1239
1240         clear_trace();
1241         set_tracing(TRUE);
1242         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1243
1244         for (int i = 0; i < iterations; i++) {
1245
1246                 WDT_HIT();
1247
1248                 // Test if the action was cancelled
1249                 if(BUTTON_PRESS()) break;
1250
1251                 //              if(mifare_classic_halt(pcs, cuid)) {
1252                 //                      if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1253                 //}
1254
1255                 if(!iso14443a_select_card(uid, NULL, NULL)) {
1256                         if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1257                         continue;
1258                 };
1259
1260                 // Transmit MIFARE_CLASSIC_AUTH.
1261                 ReaderTransmit(mf_auth, sizeof(mf_auth), NULL);
1262
1263                 // Receive the (4 Byte) "random" nonce
1264                 if (!ReaderReceive(response, responsePar)) {
1265                         if (MF_DBGLEVEL >= 1)   Dbprintf("Couldn't receive tag nonce");
1266                         continue;
1267                 }
1268
1269                 nonces[i*4] = bytes_to_num(response, 4);
1270         }
1271
1272         int packLen =  iterations * 4;
1273         int packSize = 0;
1274         int packNum = 0;
1275         while (packLen > 0) {
1276                 packSize = MIN(USB_CMD_DATA_SIZE, packLen);
1277                 LED_B_ON();
1278                 cmd_send(CMD_ACK, 77, 0, packSize, nonces - packLen, packSize);
1279                 LED_B_OFF();
1280
1281                 packLen -= packSize;
1282                 packNum++;
1283         }
1284         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1285         LEDsoff();
1286 }
1287
1288 //
1289 // DESFIRE
1290 //
1291
1292 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1293
1294         byte_t dataout[11] = {0x00};
1295         uint8_t uid[10] = {0x00};
1296         uint32_t cuid = 0x00;
1297
1298         clear_trace();
1299         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1300
1301         int len = iso14443a_select_card(uid, NULL, &cuid);
1302         if(!len) {
1303                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1304                 OnError(1);
1305                 return;
1306         };
1307
1308         if(mifare_desfire_des_auth1(cuid, dataout)){
1309                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1310                 OnError(4);
1311                 return;
1312         }
1313
1314         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1315     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1316 }
1317
1318 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1319
1320         uint32_t cuid = arg0;
1321         uint8_t key[16] = {0x00};
1322         byte_t dataout[12] = {0x00};
1323         byte_t isOK = 0;
1324
1325         memcpy(key, datain, 16);
1326
1327         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1328
1329         if( isOK) {
1330             if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1331                 OnError(4);
1332                 return;
1333         }
1334
1335         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1336
1337         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1338         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1339         LEDsoff();
1340 }