]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
ADD: Added the possibility to exit the bruteforce mode (either rangesearch or file...
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "crc.h"
20 #include "protocols.h"
21
22 //-----------------------------------------------------------------------------
23 // Select, Authenticate, Read a MIFARE tag.
24 // read block
25 //-----------------------------------------------------------------------------
26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
27 {
28 // params
29 uint8_t blockNo = arg0;
30 uint8_t keyType = arg1;
31 uint64_t ui64Key = 0;
32 ui64Key = bytes_to_num(datain, 6);
33
34 // variables
35 byte_t isOK = 0;
36 byte_t dataoutbuf[16];
37 uint8_t uid[10];
38 uint32_t cuid;
39 struct Crypto1State mpcs = {0, 0};
40 struct Crypto1State *pcs;
41 pcs = &mpcs;
42
43 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
44
45 clear_trace();
46
47 LED_A_ON();
48 LED_B_OFF();
49 LED_C_OFF();
50
51 while (true) {
52 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
53 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
54 break;
55 };
56
57 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
58 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
59 break;
60 };
61
62 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
63 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
64 break;
65 };
66
67 if(mifare_classic_halt(pcs, cuid)) {
68 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
69 break;
70 };
71
72 isOK = 1;
73 break;
74 }
75
76 // ----------------------------- crypto1 destroy
77 crypto1_destroy(pcs);
78
79 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
80
81 LED_B_ON();
82 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
83 LED_B_OFF();
84
85 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
86 LEDsoff();
87 }
88
89 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
90
91 bool turnOffField = (arg0 == 1);
92
93 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
94
95 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
96
97 clear_trace();
98
99 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
100 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
101 OnError(0);
102 return;
103 };
104
105 if(!mifare_ultra_auth(keybytes)){
106 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
107 OnError(1);
108 return;
109 }
110
111 if (turnOffField) {
112 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
113 LEDsoff();
114 }
115 cmd_send(CMD_ACK,1,0,0,0,0);
116 }
117
118 // Arg0 = BlockNo,
119 // Arg1 = UsePwd bool
120 // datain = PWD bytes,
121 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
122 {
123 uint8_t blockNo = arg0;
124 byte_t dataout[16] = {0x00};
125 bool useKey = (arg1 == 1); //UL_C
126 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
127
128 LEDsoff();
129 LED_A_ON();
130 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
131
132 clear_trace();
133
134 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
135 if(!len) {
136 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
137 OnError(1);
138 return;
139 }
140
141 // UL-C authentication
142 if ( useKey ) {
143 uint8_t key[16] = {0x00};
144 memcpy(key, datain, sizeof(key) );
145
146 if ( !mifare_ultra_auth(key) ) {
147 OnError(1);
148 return;
149 }
150 }
151
152 // UL-EV1 / NTAG authentication
153 if ( usePwd ) {
154 uint8_t pwd[4] = {0x00};
155 memcpy(pwd, datain, 4);
156 uint8_t pack[4] = {0,0,0,0};
157 if (!mifare_ul_ev1_auth(pwd, pack)) {
158 OnError(1);
159 return;
160 }
161 }
162
163 if( mifare_ultra_readblock(blockNo, dataout) ) {
164 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
165 OnError(2);
166 return;
167 }
168
169 if( mifare_ultra_halt() ) {
170 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
171 OnError(3);
172 return;
173 }
174
175 cmd_send(CMD_ACK,1,0,0,dataout,16);
176 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
177 LEDsoff();
178 }
179
180 //-----------------------------------------------------------------------------
181 // Select, Authenticate, Read a MIFARE tag.
182 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
183 //-----------------------------------------------------------------------------
184 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
185 {
186 // params
187 uint8_t sectorNo = arg0;
188 uint8_t keyType = arg1;
189 uint64_t ui64Key = 0;
190 ui64Key = bytes_to_num(datain, 6);
191
192 // variables
193 byte_t isOK = 0;
194 byte_t dataoutbuf[16 * 16];
195 uint8_t uid[10];
196 uint32_t cuid;
197 struct Crypto1State mpcs = {0, 0};
198 struct Crypto1State *pcs;
199 pcs = &mpcs;
200
201 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
202
203 clear_trace();
204
205 LED_A_ON();
206 LED_B_OFF();
207 LED_C_OFF();
208
209 isOK = 1;
210 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
211 isOK = 0;
212 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
213 }
214
215
216 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
217 isOK = 0;
218 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
219 }
220
221 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
222 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
223 isOK = 0;
224 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
225 break;
226 }
227 }
228
229 if(mifare_classic_halt(pcs, cuid)) {
230 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
231 }
232
233 // ----------------------------- crypto1 destroy
234 crypto1_destroy(pcs);
235
236 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
237
238 LED_B_ON();
239 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
240 LED_B_OFF();
241
242 // Thats it...
243 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
244 LEDsoff();
245 }
246
247 // arg0 = blockNo (start)
248 // arg1 = Pages (number of blocks)
249 // arg2 = useKey
250 // datain = KEY bytes
251 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
252 {
253 LEDsoff();
254 LED_A_ON();
255 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
256
257 // free eventually allocated BigBuf memory
258 BigBuf_free();
259 clear_trace();
260
261 // params
262 uint8_t blockNo = arg0;
263 uint16_t blocks = arg1;
264 bool useKey = (arg2 == 1); //UL_C
265 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
266 uint32_t countblocks = 0;
267 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
268 if (dataout == NULL){
269 Dbprintf("out of memory");
270 OnError(1);
271 return;
272 }
273
274 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
275 if (!len) {
276 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
277 OnError(1);
278 return;
279 }
280
281 // UL-C authentication
282 if ( useKey ) {
283 uint8_t key[16] = {0x00};
284 memcpy(key, datain, sizeof(key) );
285
286 if ( !mifare_ultra_auth(key) ) {
287 OnError(1);
288 return;
289 }
290 }
291
292 // UL-EV1 / NTAG authentication
293 if (usePwd) {
294 uint8_t pwd[4] = {0x00};
295 memcpy(pwd, datain, sizeof(pwd));
296 uint8_t pack[4] = {0,0,0,0};
297
298 if (!mifare_ul_ev1_auth(pwd, pack)){
299 OnError(1);
300 return;
301 }
302 }
303
304 for (int i = 0; i < blocks; i++){
305 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
306 Dbprintf("Data exceeds buffer!!");
307 break;
308 }
309
310 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
311
312 if (len) {
313 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
314 // if no blocks read - error out
315 if (i==0){
316 OnError(2);
317 return;
318 } else {
319 //stop at last successful read block and return what we got
320 break;
321 }
322 } else {
323 countblocks++;
324 }
325 }
326
327 len = mifare_ultra_halt();
328 if (len) {
329 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
330 OnError(3);
331 return;
332 }
333
334 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
335
336 countblocks *= 4;
337
338 cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
339 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
340 LEDsoff();
341 BigBuf_free();
342 }
343
344 //-----------------------------------------------------------------------------
345 // Select, Authenticate, Write a MIFARE tag.
346 // read block
347 //-----------------------------------------------------------------------------
348 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
349 {
350 // params
351 uint8_t blockNo = arg0;
352 uint8_t keyType = arg1;
353 uint64_t ui64Key = 0;
354 byte_t blockdata[16];
355
356 ui64Key = bytes_to_num(datain, 6);
357 memcpy(blockdata, datain + 10, 16);
358
359 // variables
360 byte_t isOK = 0;
361 uint8_t uid[10];
362 uint32_t cuid;
363 struct Crypto1State mpcs = {0, 0};
364 struct Crypto1State *pcs;
365 pcs = &mpcs;
366
367 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
368
369 clear_trace();
370
371 LED_A_ON();
372 LED_B_OFF();
373 LED_C_OFF();
374
375 while (true) {
376 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
377 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
378 break;
379 };
380
381 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
382 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
383 break;
384 };
385
386 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
387 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
388 break;
389 };
390
391 if(mifare_classic_halt(pcs, cuid)) {
392 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
393 break;
394 };
395
396 isOK = 1;
397 break;
398 }
399
400 // ----------------------------- crypto1 destroy
401 crypto1_destroy(pcs);
402
403 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
404
405 LED_B_ON();
406 cmd_send(CMD_ACK,isOK,0,0,0,0);
407 LED_B_OFF();
408
409
410 // Thats it...
411 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
412 LEDsoff();
413 }
414
415 /* // Command not needed but left for future testing
416 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
417 {
418 uint8_t blockNo = arg0;
419 byte_t blockdata[16] = {0x00};
420
421 memcpy(blockdata, datain, 16);
422
423 uint8_t uid[10] = {0x00};
424
425 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
426
427 clear_trace();
428 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
429
430 if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
431 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
432 OnError(0);
433 return;
434 };
435
436 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
437 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
438 OnError(0);
439 return; };
440
441 if(mifare_ultra_halt()) {
442 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
443 OnError(0);
444 return;
445 };
446
447 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
448
449 cmd_send(CMD_ACK,1,0,0,0,0);
450 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
451 LEDsoff();
452 }
453 */
454
455 // Arg0 : Block to write to.
456 // Arg1 : 0 = use no authentication.
457 // 1 = use 0x1A authentication.
458 // 2 = use 0x1B authentication.
459 // datain : 4 first bytes is data to be written.
460 // : 4/16 next bytes is authentication key.
461 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
462 {
463 uint8_t blockNo = arg0;
464 bool useKey = (arg1 == 1); //UL_C
465 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
466 byte_t blockdata[4] = {0x00};
467
468 memcpy(blockdata, datain,4);
469
470 LEDsoff();
471 LED_A_ON();
472 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
473
474 clear_trace();
475
476 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
477 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
478 OnError(0);
479 return;
480 };
481
482 // UL-C authentication
483 if ( useKey ) {
484 uint8_t key[16] = {0x00};
485 memcpy(key, datain+4, sizeof(key) );
486
487 if ( !mifare_ultra_auth(key) ) {
488 OnError(1);
489 return;
490 }
491 }
492
493 // UL-EV1 / NTAG authentication
494 if (usePwd) {
495 uint8_t pwd[4] = {0x00};
496 memcpy(pwd, datain+4, 4);
497 uint8_t pack[4] = {0,0,0,0};
498 if (!mifare_ul_ev1_auth(pwd, pack)) {
499 OnError(1);
500 return;
501 }
502 }
503
504 if(mifare_ultra_writeblock(blockNo, blockdata)) {
505 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
506 OnError(0);
507 return;
508 };
509
510 if(mifare_ultra_halt()) {
511 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
512 OnError(0);
513 return;
514 };
515
516 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
517
518 cmd_send(CMD_ACK,1,0,0,0,0);
519 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
520 LEDsoff();
521 }
522
523 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
524
525 uint8_t pwd[16] = {0x00};
526 byte_t blockdata[4] = {0x00};
527
528 memcpy(pwd, datain, 16);
529
530 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
531 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
532
533 clear_trace();
534
535 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
536 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
537 OnError(0);
538 return;
539 };
540
541 blockdata[0] = pwd[7];
542 blockdata[1] = pwd[6];
543 blockdata[2] = pwd[5];
544 blockdata[3] = pwd[4];
545 if(mifare_ultra_writeblock( 44, blockdata)) {
546 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
547 OnError(44);
548 return;
549 };
550
551 blockdata[0] = pwd[3];
552 blockdata[1] = pwd[2];
553 blockdata[2] = pwd[1];
554 blockdata[3] = pwd[0];
555 if(mifare_ultra_writeblock( 45, blockdata)) {
556 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
557 OnError(45);
558 return;
559 };
560
561 blockdata[0] = pwd[15];
562 blockdata[1] = pwd[14];
563 blockdata[2] = pwd[13];
564 blockdata[3] = pwd[12];
565 if(mifare_ultra_writeblock( 46, blockdata)) {
566 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
567 OnError(46);
568 return;
569 };
570
571 blockdata[0] = pwd[11];
572 blockdata[1] = pwd[10];
573 blockdata[2] = pwd[9];
574 blockdata[3] = pwd[8];
575 if(mifare_ultra_writeblock( 47, blockdata)) {
576 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
577 OnError(47);
578 return;
579 };
580
581 if(mifare_ultra_halt()) {
582 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
583 OnError(0);
584 return;
585 };
586
587 cmd_send(CMD_ACK,1,0,0,0,0);
588 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
589 LEDsoff();
590 }
591
592 // Return 1 if the nonce is invalid else return 0
593 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
594 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
595 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
596 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
597 }
598
599
600 //-----------------------------------------------------------------------------
601 // acquire encrypted nonces in order to perform the attack described in
602 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
603 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
604 // Computer and Communications Security, 2015
605 //-----------------------------------------------------------------------------
606 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
607 {
608 uint64_t ui64Key = 0;
609 uint8_t uid[10];
610 uint32_t cuid;
611 uint8_t cascade_levels = 0;
612 struct Crypto1State mpcs = {0, 0};
613 struct Crypto1State *pcs;
614 pcs = &mpcs;
615 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
616 int16_t isOK = 0;
617 uint8_t par_enc[1];
618 uint8_t nt_par_enc = 0;
619 uint8_t buf[USB_CMD_DATA_SIZE];
620 uint32_t timeout;
621
622 uint8_t blockNo = arg0 & 0xff;
623 uint8_t keyType = (arg0 >> 8) & 0xff;
624 uint8_t targetBlockNo = arg1 & 0xff;
625 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
626 ui64Key = bytes_to_num(datain, 6);
627 bool initialize = flags & 0x0001;
628 bool slow = flags & 0x0002;
629 bool field_off = flags & 0x0004;
630
631 #define AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)
632 #define PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication
633
634 LED_A_ON();
635 LED_C_OFF();
636
637 if (initialize) {
638 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
639 clear_trace();
640 set_tracing(true);
641 }
642
643 LED_C_ON();
644
645 uint16_t num_nonces = 0;
646 bool have_uid = false;
647 for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
648
649 // Test if the action was cancelled
650 if(BUTTON_PRESS()) {
651 isOK = 2;
652 field_off = true;
653 break;
654 }
655
656 if (!have_uid) { // need a full select cycle to get the uid first
657 iso14a_card_select_t card_info;
658 if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
659 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");
660 continue;
661 }
662 switch (card_info.uidlen) {
663 case 4 : cascade_levels = 1; break;
664 case 7 : cascade_levels = 2; break;
665 case 10: cascade_levels = 3; break;
666 default: break;
667 }
668 have_uid = true;
669 } else { // no need for anticollision. We can directly select the card
670 if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
671 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");
672 continue;
673 }
674 }
675
676 if (slow) {
677 timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
678 while(GetCountSspClk() < timeout);
679 }
680
681 uint32_t nt1;
682 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
683 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
684 continue;
685 }
686
687 // nested authentication
688 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
689 if (len != 4) {
690 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
691 continue;
692 }
693
694 // send a dummy byte as reader response in order to trigger the cards authentication timeout
695 uint8_t dummy_answer = 0;
696 ReaderTransmit(&dummy_answer, 1, NULL);
697 timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
698
699 num_nonces++;
700 if (num_nonces % 2) {
701 memcpy(buf+i, receivedAnswer, 4);
702 nt_par_enc = par_enc[0] & 0xf0;
703 } else {
704 nt_par_enc |= par_enc[0] >> 4;
705 memcpy(buf+i+4, receivedAnswer, 4);
706 memcpy(buf+i+8, &nt_par_enc, 1);
707 i += 9;
708 }
709
710 // wait for the card to become ready again
711 while(GetCountSspClk() < timeout);
712
713 }
714
715 LED_C_OFF();
716
717 crypto1_destroy(pcs);
718
719 LED_B_ON();
720 cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
721 LED_B_OFF();
722
723 if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
724
725 if (field_off) {
726 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
727 LEDsoff();
728 }
729 }
730
731
732 //-----------------------------------------------------------------------------
733 // MIFARE nested authentication.
734 //
735 //-----------------------------------------------------------------------------
736 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
737 {
738 // params
739 uint8_t blockNo = arg0 & 0xff;
740 uint8_t keyType = (arg0 >> 8) & 0xff;
741 uint8_t targetBlockNo = arg1 & 0xff;
742 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
743 uint64_t ui64Key = 0;
744
745 ui64Key = bytes_to_num(datain, 6);
746
747 // variables
748 uint16_t rtr, i, j, len;
749 uint16_t davg;
750 static uint16_t dmin, dmax;
751 uint8_t uid[10];
752 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
753 uint8_t par[1];
754 uint32_t target_nt[2], target_ks[2];
755
756 uint8_t par_array[4];
757 uint16_t ncount = 0;
758 struct Crypto1State mpcs = {0, 0};
759 struct Crypto1State *pcs;
760 pcs = &mpcs;
761 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
762
763 uint32_t auth1_time, auth2_time;
764 static uint16_t delta_time;
765
766 LED_A_ON();
767 LED_C_OFF();
768 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
769
770 // free eventually allocated BigBuf memory
771 BigBuf_free();
772
773 if (calibrate) clear_trace();
774 set_tracing(true);
775
776 // statistics on nonce distance
777 int16_t isOK = 0;
778 #define NESTED_MAX_TRIES 12
779 uint16_t unsuccessfull_tries = 0;
780 if (calibrate) { // for first call only. Otherwise reuse previous calibration
781 LED_B_ON();
782 WDT_HIT();
783
784 davg = dmax = 0;
785 dmin = 2000;
786 delta_time = 0;
787
788 for (rtr = 0; rtr < 17; rtr++) {
789
790 // Test if the action was cancelled
791 if(BUTTON_PRESS()) {
792 isOK = -2;
793 break;
794 }
795
796 // prepare next select. No need to power down the card.
797 if(mifare_classic_halt(pcs, cuid)) {
798 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
799 rtr--;
800 continue;
801 }
802
803 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
804 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
805 rtr--;
806 continue;
807 };
808
809 auth1_time = 0;
810 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
811 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
812 rtr--;
813 continue;
814 };
815
816 if (delta_time) {
817 auth2_time = auth1_time + delta_time;
818 } else {
819 auth2_time = 0;
820 }
821 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
822 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
823 rtr--;
824 continue;
825 };
826
827 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
828 for (i = 101; i < 1200; i++) {
829 nttmp = prng_successor(nttmp, 1);
830 if (nttmp == nt2) break;
831 }
832
833 if (i != 1200) {
834 if (rtr != 0) {
835 davg += i;
836 dmin = MIN(dmin, i);
837 dmax = MAX(dmax, i);
838 }
839 else {
840 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
841 }
842 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
843 } else {
844 unsuccessfull_tries++;
845 if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)
846 isOK = -3;
847 }
848 }
849 }
850
851 davg = (davg + (rtr - 1)/2) / (rtr - 1);
852
853 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
854
855 dmin = davg - 2;
856 dmax = davg + 2;
857
858 LED_B_OFF();
859 }
860 // -------------------------------------------------------------------------------------------------
861
862 LED_C_ON();
863
864 // get crypted nonces for target sector
865 for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
866
867 target_nt[i] = 0;
868 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
869
870 // prepare next select. No need to power down the card.
871 if(mifare_classic_halt(pcs, cuid)) {
872 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
873 continue;
874 }
875
876 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
877 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
878 continue;
879 };
880
881 auth1_time = 0;
882 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
883 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
884 continue;
885 };
886
887 // nested authentication
888 auth2_time = auth1_time + delta_time;
889 len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
890 if (len != 4) {
891 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
892 continue;
893 };
894
895 nt2 = bytes_to_num(receivedAnswer, 4);
896 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
897
898 // Parity validity check
899 for (j = 0; j < 4; j++) {
900 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
901 }
902
903 ncount = 0;
904 nttest = prng_successor(nt1, dmin - 1);
905 for (j = dmin; j < dmax + 1; j++) {
906 nttest = prng_successor(nttest, 1);
907 ks1 = nt2 ^ nttest;
908
909 if (valid_nonce(nttest, nt2, ks1, par_array)){
910 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
911 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
912 target_nt[i] = 0;
913 break;
914 }
915 target_nt[i] = nttest;
916 target_ks[i] = ks1;
917 ncount++;
918 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
919 target_nt[i] = 0;
920 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
921 break;
922 }
923 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
924 }
925 }
926 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
927 }
928 }
929
930 LED_C_OFF();
931
932 // ----------------------------- crypto1 destroy
933 crypto1_destroy(pcs);
934
935 byte_t buf[4 + 4 * 4];
936 memcpy(buf, &cuid, 4);
937 memcpy(buf+4, &target_nt[0], 4);
938 memcpy(buf+8, &target_ks[0], 4);
939 memcpy(buf+12, &target_nt[1], 4);
940 memcpy(buf+16, &target_ks[1], 4);
941
942 LED_B_ON();
943 cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
944 LED_B_OFF();
945
946 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
947
948 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
949 LEDsoff();
950 set_tracing(FALSE);
951 }
952
953 //-----------------------------------------------------------------------------
954 // MIFARE check keys. key count up to 85.
955 //
956 //-----------------------------------------------------------------------------
957 void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
958 {
959 // params
960 uint8_t blockNo = arg0 & 0xff;
961 uint8_t keyType = (arg0 >> 8) & 0xff;
962 bool clearTrace = arg1;
963 uint8_t keyCount = arg2;
964 uint64_t ui64Key = 0;
965
966 // variables
967 int i;
968 byte_t isOK = 0;
969 uint8_t uid[10];
970 uint32_t cuid;
971 struct Crypto1State mpcs = {0, 0};
972 struct Crypto1State *pcs;
973 pcs = &mpcs;
974
975 // clear debug level
976 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
977 MF_DBGLEVEL = MF_DBG_NONE;
978
979 LED_A_ON();
980 LED_B_OFF();
981 LED_C_OFF();
982 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
983
984 if (clearTrace) clear_trace();
985 set_tracing(TRUE);
986
987 for (i = 0; i < keyCount; i++) {
988 if(mifare_classic_halt(pcs, cuid)) {
989 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
990 }
991
992 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
993 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
994 break;
995 };
996
997 ui64Key = bytes_to_num(datain + i * 6, 6);
998 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
999 continue;
1000 };
1001
1002 isOK = 1;
1003 break;
1004 }
1005
1006 // ----------------------------- crypto1 destroy
1007 crypto1_destroy(pcs);
1008
1009 LED_B_ON();
1010 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
1011 LED_B_OFF();
1012
1013 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1014 LEDsoff();
1015 set_tracing(FALSE);
1016
1017 // restore debug level
1018 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1019 }
1020
1021 //-----------------------------------------------------------------------------
1022 // MIFARE commands set debug level
1023 //
1024 //-----------------------------------------------------------------------------
1025 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1026 MF_DBGLEVEL = arg0;
1027 Dbprintf("Debug level: %d", MF_DBGLEVEL);
1028 }
1029
1030 //-----------------------------------------------------------------------------
1031 // Work with emulator memory
1032 //
1033 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1034 // involved in dealing with emulator memory. But if it is called later, it might
1035 // destroy the Emulator Memory.
1036 //-----------------------------------------------------------------------------
1037
1038 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1039 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1040 emlClearMem();
1041 }
1042
1043 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1044 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1045 //emlSetMem(datain, arg0, arg1); // data, block num, blocks count
1046 emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width
1047 }
1048
1049 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1050 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1051 byte_t buf[USB_CMD_DATA_SIZE];
1052 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1053
1054 LED_B_ON();
1055 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1056 LED_B_OFF();
1057 }
1058
1059 //-----------------------------------------------------------------------------
1060 // Load a card into the emulator memory
1061 //
1062 //-----------------------------------------------------------------------------
1063 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1064 uint8_t numSectors = arg0;
1065 uint8_t keyType = arg1;
1066 uint64_t ui64Key = 0;
1067 uint32_t cuid;
1068 struct Crypto1State mpcs = {0, 0};
1069 struct Crypto1State *pcs;
1070 pcs = &mpcs;
1071
1072 // variables
1073 byte_t dataoutbuf[16];
1074 byte_t dataoutbuf2[16];
1075 uint8_t uid[10];
1076
1077 LED_A_ON();
1078 LED_B_OFF();
1079 LED_C_OFF();
1080 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1081
1082 clear_trace();
1083 set_tracing(TRUE);
1084
1085 bool isOK = true;
1086
1087 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1088 isOK = false;
1089 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1090 }
1091
1092 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1093 ui64Key = emlGetKey(sectorNo, keyType);
1094 if (sectorNo == 0){
1095 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1096 isOK = false;
1097 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1098 break;
1099 }
1100 } else {
1101 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1102 isOK = false;
1103 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1104 break;
1105 }
1106 }
1107
1108 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1109 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1110 isOK = false;
1111 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1112 break;
1113 };
1114 if (isOK) {
1115 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1116 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1117 } else { // sector trailer, keep the keys, set only the AC
1118 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1119 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1120 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1121 }
1122 }
1123 }
1124
1125 }
1126
1127 if(mifare_classic_halt(pcs, cuid)) {
1128 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1129 };
1130
1131 // ----------------------------- crypto1 destroy
1132 crypto1_destroy(pcs);
1133
1134 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1135 LEDsoff();
1136
1137 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1138
1139 set_tracing(FALSE);
1140 }
1141
1142
1143 //-----------------------------------------------------------------------------
1144 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1145 //
1146 // PARAMS - workFlags
1147 // bit 0 - need get UID
1148 // bit 1 - need wupC
1149 // bit 2 - need HALT after sequence
1150 // bit 3 - need turn on FPGA before sequence
1151 // bit 4 - need turn off FPGA
1152 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1153 // bit 6 - wipe tag.
1154 //-----------------------------------------------------------------------------
1155 // magic uid card generation 1 commands
1156 uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
1157 uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
1158 uint8_t wipeC[] = { MIFARE_MAGICWIPEC };
1159
1160 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1161
1162 // params
1163 uint8_t workFlags = arg0;
1164 uint8_t blockNo = arg1;
1165
1166 Dbprintf("ICE :: CSetBlocks Flags %02x", workFlags);
1167
1168 // variables
1169 uint8_t uid[10] = {0x00};
1170 uint8_t data[18] = {0x00};
1171 uint32_t cuid;
1172
1173 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1174 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1175
1176 if (workFlags & MAGIC_INIT) {
1177 LED_A_ON();
1178 LED_B_OFF();
1179 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1180 clear_trace();
1181 set_tracing(TRUE);
1182 }
1183
1184 // read UID and return to client
1185 if (workFlags & MAGIC_UID) {
1186 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1187 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1188 OnErrorMagic(MAGIC_UID);
1189 };
1190 };
1191
1192 // wipe tag, fill it with zeros
1193 if (workFlags & MAGIC_WIPE){
1194 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1195 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1196 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1197 OnErrorMagic(MAGIC_WIPE);
1198 };
1199
1200 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1201 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1202 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wipeC error");
1203 OnErrorMagic(MAGIC_WIPE);
1204 };
1205 };
1206
1207 // write block
1208 if (workFlags & MAGIC_WUPC) {
1209 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1210 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1211 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1212 OnErrorMagic(MAGIC_WUPC);
1213 };
1214
1215 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1216 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1217 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1218 OnErrorMagic(MAGIC_WUPC);
1219 };
1220 }
1221
1222 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1223 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send command error");
1224 OnErrorMagic(4);
1225 };
1226
1227 memcpy(data, datain, 16);
1228 AppendCrc14443a(data, 16);
1229
1230 ReaderTransmit(data, sizeof(data), NULL);
1231 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1232 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send data error");
1233 OnErrorMagic(0);
1234 };
1235
1236 if (workFlags & MAGIC_OFF)
1237 mifare_classic_halt_ex(NULL);
1238
1239 LED_B_ON();
1240 // check if uid is cuid?
1241 cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));
1242 LED_B_OFF();
1243
1244 if (workFlags & MAGIC_OFF)
1245 OnSuccessMagic();
1246 }
1247
1248 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1249
1250 uint8_t workFlags = arg0;
1251 uint8_t blockNo = arg1;
1252
1253 // variables
1254 uint8_t data[MAX_MIFARE_FRAME_SIZE];
1255 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1256 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1257
1258 memset(data, 0x00, sizeof(data));
1259
1260 if (workFlags & MAGIC_INIT) {
1261 LED_A_ON();
1262 LED_B_OFF();
1263 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1264 clear_trace();
1265 set_tracing(TRUE);
1266 }
1267
1268 if (workFlags & MAGIC_WUPC) {
1269 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1270 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1271 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1272 OnErrorMagic(MAGIC_WUPC);
1273 };
1274
1275 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1276 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1277 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1278 OnErrorMagic(MAGIC_WUPC);
1279 };
1280 }
1281
1282 // read block
1283 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1284 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");
1285 OnErrorMagic(0);
1286 };
1287
1288 memcpy(data, receivedAnswer, sizeof(data));
1289
1290 // send HALT
1291 if (workFlags & MAGIC_HALT)
1292 mifare_classic_halt_ex(NULL);
1293
1294 LED_B_ON();
1295
1296 // if MAGIC_DATAIN, the data stays on device side.
1297 if (workFlags & MAGIC_DATAIN)
1298 memcpy(datain, data, sizeof(data));
1299 else
1300 cmd_send(CMD_ACK,1,0,0,data,sizeof(data));
1301
1302 LED_B_OFF();
1303
1304 if (workFlags & MAGIC_OFF)
1305 OnSuccessMagic();
1306 }
1307
1308 void MifareCIdent(){
1309
1310 // variables
1311 byte_t isOK = 1;
1312 uint8_t receivedAnswer[1];
1313 uint8_t receivedAnswerPar[1];
1314
1315 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1316 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1317 isOK = 0;
1318 };
1319
1320 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1321 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1322 isOK = 0;
1323 };
1324
1325 // removed the if, since some magic tags misbehavies and send an answer to it.
1326 mifare_classic_halt(NULL, 0);
1327 cmd_send(CMD_ACK,isOK,0,0,0,0);
1328 }
1329
1330 void OnSuccessMagic(){
1331 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1332 LEDsoff();
1333 set_tracing(FALSE);
1334 }
1335 void OnErrorMagic(uint8_t reason){
1336 // ACK, ISOK, reason,0,0,0
1337 cmd_send(CMD_ACK,0,reason,0,0,0);
1338 OnSuccessMagic();
1339 }
1340
1341 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1342 }
1343
1344 //
1345 // DESFIRE
1346 //
1347
1348 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1349
1350 byte_t dataout[11] = {0x00};
1351 uint8_t uid[10] = {0x00};
1352 uint32_t cuid = 0x00;
1353
1354 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1355 clear_trace();
1356
1357 int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);
1358 if(!len) {
1359 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1360 OnError(1);
1361 return;
1362 };
1363
1364 if(mifare_desfire_des_auth1(cuid, dataout)){
1365 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1366 OnError(4);
1367 return;
1368 }
1369
1370 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1371 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1372 }
1373
1374 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1375
1376 uint32_t cuid = arg0;
1377 uint8_t key[16] = {0x00};
1378 byte_t dataout[12] = {0x00};
1379 byte_t isOK = 0;
1380
1381 memcpy(key, datain, 16);
1382
1383 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1384
1385 if( isOK) {
1386 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1387 OnError(4);
1388 return;
1389 }
1390
1391 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1392
1393 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1394 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1395 LEDsoff();
1396 }
Impressum, Datenschutz