]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifareutil.c
FIX: `hf mf sim` - authentication works again.
[proxmark3-svn] / armsrc / mifareutil.c
1 //-----------------------------------------------------------------------------
2 // Merlok, May 2011, 2012
3 // Many authors, whom made it possible
4 //
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
7 // the license.
8 //-----------------------------------------------------------------------------
9 // Work with mifare cards.
10 //-----------------------------------------------------------------------------
11 #include "mifareutil.h"
12
13 int MF_DBGLEVEL = MF_DBG_ALL;
14
15 // crypto1 helpers
16 void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len){
17 uint8_t bt = 0;
18 int i;
19
20 if (len != 1) {
21 for (i = 0; i < len; i++)
22 data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];
23 } else {
24 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data[0], 0)) << 0;
25 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data[0], 1)) << 1;
26 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data[0], 2)) << 2;
27 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data[0], 3)) << 3;
28 data[0] = bt;
29 }
30 return;
31 }
32
33 void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, uint16_t len, uint8_t *par) {
34 uint8_t bt = 0;
35 int i;
36 par[0] = 0;
37
38 for (i = 0; i < len; i++) {
39 bt = data[i];
40 data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];
41 if ( ( i & 0x0007 ) == 0)
42 par[ i >> 3 ] = 0;
43 par[ i >> 3 ] |= (((filter(pcs->odd) ^ oddparity8(bt)) & 0x01)<<(7-(i&0x0007)));
44 }
45 }
46
47 uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data) {
48 uint8_t bt = 0;
49 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data, 0)) << 0;
50 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data, 1)) << 1;
51 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data, 2)) << 2;
52 bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data, 3)) << 3;
53 return bt;
54 }
55
56 // send X byte basic commands
57 int mifare_sendcmd(uint8_t cmd, uint8_t* data, uint8_t data_size, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing) {
58 uint8_t dcmd[data_size+3];
59 dcmd[0] = cmd;
60 memcpy(dcmd+1, data, data_size);
61 AppendCrc14443a(dcmd, data_size+1);
62 ReaderTransmit(dcmd, sizeof(dcmd), timing);
63 int len = ReaderReceive(answer, answer_parity);
64 if(!len) {
65 if (MF_DBGLEVEL >= MF_DBG_ERROR)
66 Dbprintf("%02X Cmd failed. Card timeout.", cmd);
67 len = ReaderReceive(answer,answer_parity);
68 }
69 return len;
70 }
71
72 // send 2 byte commands
73 int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing) {
74 uint16_t pos, res;
75 uint8_t dcmd[4] = {cmd, data, 0x00, 0x00};
76 uint8_t ecmd[4] = {0x00, 0x00, 0x00, 0x00};
77 uint8_t par[1] = {0x00}; // 1 Byte parity is enough here
78 AppendCrc14443a(dcmd, 2);
79 memcpy(ecmd, dcmd, sizeof(dcmd));
80
81 if (crypted) {
82 par[0] = 0;
83 for (pos = 0; pos < 4; pos++) {
84 ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];
85 par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos));
86 }
87 ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);
88 } else {
89 ReaderTransmit(dcmd, sizeof(dcmd), timing);
90 }
91
92 int len = ReaderReceive(answer, par);
93
94 if (answer_parity) *answer_parity = par[0];
95
96 if (crypted == CRYPT_ALL) {
97 if (len == 1) {
98 res = 0;
99 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(answer[0], 0)) << 0;
100 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(answer[0], 1)) << 1;
101 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(answer[0], 2)) << 2;
102 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(answer[0], 3)) << 3;
103 answer[0] = res;
104 } else {
105 for (pos = 0; pos < len; pos++)
106 answer[pos] = crypto1_byte(pcs, 0x00, 0) ^ answer[pos];
107 }
108 }
109 return len;
110 }
111
112 // mifare classic commands
113 int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested) {
114 return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL);
115 }
116
117 int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing) {
118 int len;
119 uint32_t pos;
120 uint8_t par[1] = {0x00};
121
122 // "random" reader nonce:
123 //byte_t nr[4] = {0x55, 0x41, 0x49, 0x92};
124 fast_prand();
125 byte_t nr[4];
126 num_to_bytes(prand(), 4, nr);
127 //byte_t nr[4] = {0x01, 0x01, 0x01, 0x01};
128
129 uint32_t nt, ntpp; // Supplied tag nonce
130
131 uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
132 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
133 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
134
135 // Transmit MIFARE_CLASSIC_AUTH
136 len = mifare_sendcmd_short(pcs, isNested, 0x60 + (keyType & 0x01), blockNo, receivedAnswer, receivedAnswerPar, timing);
137 if (MF_DBGLEVEL >= 4) Dbprintf("rand tag nonce len: %x", len);
138 if (len != 4) return 1;
139
140 // Save the tag nonce (nt)
141 nt = bytes_to_num(receivedAnswer, 4);
142
143 // ----------------------------- crypto1 create
144 if (isNested)
145 crypto1_destroy(pcs);
146
147 // Init cipher with key
148 crypto1_create(pcs, ui64Key);
149
150 if (isNested == AUTH_NESTED) {
151 // decrypt nt with help of new key
152 nt = crypto1_word(pcs, nt ^ uid, 1) ^ nt;
153 } else {
154 // Load (plain) uid^nt into the cipher
155 crypto1_word(pcs, nt ^ uid, 0);
156 }
157
158 // some statistic
159 if (!ntptr && (MF_DBGLEVEL >= 3))
160 Dbprintf("auth uid: %08x | nr: %08x | nt: %08x", uid, nr, nt);
161
162 // save Nt
163 if (ntptr)
164 *ntptr = nt;
165
166 // Generate (encrypted) nr+parity by loading it into the cipher (Nr)
167 par[0] = 0;
168 for (pos = 0; pos < 4; pos++) {
169 mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];
170 par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));
171 }
172
173 // Skip 32 bits in pseudo random generator
174 nt = prng_successor(nt, 32);
175
176 // ar+parity
177 for (pos = 4; pos < 8; pos++) {
178 nt = prng_successor(nt,8);
179 mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);
180 par[0] |= (((filter(pcs->odd) ^ oddparity8(nt & 0xff)) & 0x01) << (7-pos));
181 }
182
183 // Transmit reader nonce and reader answer
184 ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);
185
186 // Receive 4 byte tag answer
187 len = ReaderReceive(receivedAnswer, receivedAnswerPar);
188 if (!len) {
189 if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");
190 return 2;
191 }
192
193 ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);
194
195 if (ntpp != bytes_to_num(receivedAnswer, 4)) {
196 if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response.");
197 return 3;
198 }
199 return 0;
200 }
201
202 int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) {
203
204 int len;
205 uint8_t bt[2] = {0x00, 0x00};
206 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
207 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
208
209 len = mifare_sendcmd_short(pcs, 1, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL);
210 if (len == 1) {
211 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
212 return 1;
213 }
214 if (len != 18) {
215 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: card timeout. len: %x", len);
216 return 2;
217 }
218
219 memcpy(bt, receivedAnswer + 16, 2);
220 AppendCrc14443a(receivedAnswer, 16);
221 if (bt[0] != receivedAnswer[16] || bt[1] != receivedAnswer[17]) {
222 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd CRC response error.");
223 return 3;
224 }
225
226 memcpy(blockData, receivedAnswer, 16);
227 return 0;
228 }
229
230 // mifare ultralight commands
231 int mifare_ul_ev1_auth(uint8_t *keybytes, uint8_t *pack){
232
233 uint16_t len = 0;
234 uint8_t resp[4] = {0x00, 0x00, 0x00, 0x00};
235 uint8_t respPar[1] = {0x00};
236 uint8_t key[4] = {0x00, 0x00, 0x00, 0x00};
237 memcpy(key, keybytes, 4);
238
239 if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
240 Dbprintf("EV1 Auth : %02x%02x%02x%02x", key[0], key[1], key[2], key[3]);
241
242 len = mifare_sendcmd(0x1B, key, sizeof(key), resp, respPar, NULL);
243
244 if (len != 4) {
245 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", resp[0], len);
246 return 0;
247 }
248
249 if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
250 Dbprintf("Auth Resp: %02x%02x%02x%02x", resp[0],resp[1],resp[2],resp[3]);
251
252 memcpy(pack, resp, 4);
253 return 1;
254 }
255
256 int mifare_ultra_auth(uint8_t *keybytes){
257
258 /// 3des2k
259 uint8_t random_a[8] = {1,1,1,1,1,1,1,1};
260 uint8_t random_b[8] = {0x00};
261 uint8_t enc_random_b[8] = {0x00};
262 uint8_t rnd_ab[16] = {0x00};
263 uint8_t IV[8] = {0x00};
264 uint8_t key[16] = {0x00};
265 memcpy(key, keybytes, 16);
266
267 uint16_t len = 0;
268 uint8_t resp[19] = {0x00};
269 uint8_t respPar[3] = {0,0,0};
270
271 // REQUEST AUTHENTICATION
272 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, resp, respPar ,NULL);
273 if (len != 11) {
274 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);
275 return 0;
276 }
277
278 // tag nonce.
279 memcpy(enc_random_b,resp+1,8);
280
281 // decrypt nonce.
282 tdes_2key_dec((void*)random_b, (void*)enc_random_b, sizeof(random_b), (const void*)key, IV );
283 rol(random_b,8);
284 memcpy(rnd_ab ,random_a,8);
285 memcpy(rnd_ab+8,random_b,8);
286
287 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
288 Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
289 enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
290
291 Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",
292 random_b[0],random_b[1],random_b[2],random_b[3],random_b[4],random_b[5],random_b[6],random_b[7]);
293
294 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
295 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
296
297 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
298 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
299 }
300
301 // encrypt out, in, length, key, iv
302 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
303
304 len = mifare_sendcmd(0xAF, rnd_ab, sizeof(rnd_ab), resp, respPar, NULL);
305 if (len != 11) {
306 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);
307 return 0;
308 }
309
310 uint8_t enc_resp[8] = { 0,0,0,0,0,0,0,0 };
311 uint8_t resp_random_a[8] = { 0,0,0,0,0,0,0,0 };
312 memcpy(enc_resp, resp+1, 8);
313
314 // decrypt out, in, length, key, iv
315 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
316 if ( memcmp(resp_random_a, random_a, 8) != 0 ) {
317 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("failed authentication");
318 return 0;
319 }
320
321 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
322 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
323 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
324 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
325
326 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
327 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
328 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
329
330 Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
331 random_a[0],random_a[1],random_a[2],random_a[3],
332 random_a[4],random_a[5],random_a[6],random_a[7]);
333
334 Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
335 resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
336 resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
337 }
338 return 1;
339 }
340
341 int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData) {
342 uint16_t len = 0;
343 uint8_t bt[2] = {0x00, 0x00};
344 uint8_t receivedAnswer[MAX_FRAME_SIZE] = {0x00};
345 uint8_t receivedAnswerPar[MAX_PARITY_SIZE] = {0x00};
346
347 len = mifare_sendcmd_short(NULL, 1, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL);
348 if (len == 1) {
349 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
350 return 1;
351 }
352 if (len != 18) {
353 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: card timeout. len: %x", len);
354 return 2;
355 }
356
357 memcpy(bt, receivedAnswer + 16, 2);
358 AppendCrc14443a(receivedAnswer, 16);
359 if (bt[0] != receivedAnswer[16] || bt[1] != receivedAnswer[17]) {
360 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd CRC response error.");
361 return 3;
362 }
363
364 memcpy(blockData, receivedAnswer, 14);
365 return 0;
366 }
367
368 int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) {
369 // variables
370 uint16_t len = 0;
371 uint32_t pos = 0;
372 uint8_t par[3] = {0x00, 0x00, 0x00}; // enough for 18 Bytes to send
373 byte_t res = 0;
374
375 uint8_t d_block[18], d_block_enc[18];
376 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
377 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
378
379 // command MIFARE_CLASSIC_WRITEBLOCK
380 len = mifare_sendcmd_short(pcs, 1, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL);
381
382 if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK
383 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
384 return 1;
385 }
386
387 memcpy(d_block, blockData, 16);
388 AppendCrc14443a(d_block, 16);
389
390 // crypto
391 for (pos = 0; pos < 18; pos++) {
392 d_block_enc[pos] = crypto1_byte(pcs, 0x00, 0) ^ d_block[pos];
393 par[pos>>3] |= (((filter(pcs->odd) ^ oddparity8(d_block[pos])) & 0x01) << (7 - (pos&0x0007)));
394 }
395
396 ReaderTransmitPar(d_block_enc, sizeof(d_block_enc), par, NULL);
397
398 // Receive the response
399 len = ReaderReceive(receivedAnswer, receivedAnswerPar);
400
401 res = 0;
402 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 0)) << 0;
403 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 1)) << 1;
404 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 2)) << 2;
405 res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], 3)) << 3;
406
407 if ((len != 1) || (res != 0x0A)) {
408 if (MF_DBGLEVEL >= 1) Dbprintf("Cmd send data2 Error: %02x", res);
409 return 2;
410 }
411 return 0;
412 }
413
414 /* // command not needed, but left for future testing
415 int mifare_ultra_writeblock_compat(uint8_t blockNo, uint8_t *blockData) {
416 uint16_t len;
417 uint8_t par[3] = {0}; // enough for 18 parity bits
418 uint8_t d_block[18] = {0x00};
419 uint8_t receivedAnswer[MAX_FRAME_SIZE];
420 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
421
422 len = mifare_sendcmd_short(NULL, true, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL);
423
424 if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK
425 if (MF_DBGLEVEL >= MF_DBG_ERROR)
426 Dbprintf("Cmd Addr Error: %02x", receivedAnswer[0]);
427 return 1;
428 }
429
430 memcpy(d_block, blockData, 16);
431 AppendCrc14443a(d_block, 16);
432
433 ReaderTransmitPar(d_block, sizeof(d_block), par, NULL);
434
435 len = ReaderReceive(receivedAnswer, receivedAnswerPar);
436
437 if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK
438 if (MF_DBGLEVEL >= MF_DBG_ERROR)
439 Dbprintf("Cmd Data Error: %02x %d", receivedAnswer[0],len);
440 return 2;
441 }
442 return 0;
443 }
444 */
445
446 int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData) {
447 uint16_t len = 0;
448 uint8_t block[5] = {blockNo, 0x00, 0x00, 0x00, 0x00 };
449 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
450 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
451
452 // command MIFARE_CLASSIC_WRITEBLOCK
453 memcpy(block+1, blockData, 4);
454
455 len = mifare_sendcmd( MIFARE_ULC_WRITE, block, sizeof(block), receivedAnswer, receivedAnswerPar, NULL);
456
457 if (receivedAnswer[0] != 0x0A) { // 0x0a - ACK
458 if (MF_DBGLEVEL >= MF_DBG_ERROR)
459 Dbprintf("Cmd Send Error: %02x %d", receivedAnswer[0],len);
460 return 1;
461 }
462 return 0;
463 }
464 int mifare_classic_halt_ex(struct Crypto1State *pcs) {
465 uint8_t receivedAnswer[4] = {0x00, 0x00, 0x00, 0x00};
466 uint16_t len = mifare_sendcmd_short(pcs, (pcs == NULL) ? CRYPT_NONE : CRYPT_ALL, 0x50, 0x00, receivedAnswer, NULL, NULL);
467 if (len != 0) {
468 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("halt warning. response len: %x", len);
469 return 1;
470 }
471 return 0;
472 }
473 int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid) {
474 return mifare_classic_halt_ex(pcs);
475 }
476
477 int mifare_ultra_halt() {
478 uint16_t len = 0;
479 uint8_t receivedAnswer[4] = {0x00, 0x00, 0x00, 0x00};
480 len = mifare_sendcmd_short(NULL, CRYPT_NONE, 0x50, 0x00, receivedAnswer, NULL, NULL);
481 if (len != 0) {
482 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("halt error. response len: %x", len);
483 return 1;
484 }
485 return 0;
486 }
487
488
489 // Mifare Memory Structure: up to 32 Sectors with 4 blocks each (1k and 2k cards),
490 // plus evtl. 8 sectors with 16 blocks each (4k cards)
491 uint8_t NumBlocksPerSector(uint8_t sectorNo) {
492 return (sectorNo < 32) ? 4 : 16;
493 }
494
495 uint8_t FirstBlockOfSector(uint8_t sectorNo) {
496 if (sectorNo < 32)
497 return sectorNo * 4;
498 else
499 return 32*4 + (sectorNo - 32) * 16;
500
501 }
502
503 // work with emulator memory
504 void emlSetMem(uint8_t *data, int blockNum, int blocksCount) {
505 emlSetMem_xt(data, blockNum, blocksCount, 16);
506 }
507
508 void emlSetMem_xt(uint8_t *data, int blockNum, int blocksCount, int blockBtWidth) {
509 uint8_t* emCARD = BigBuf_get_EM_addr();
510 memcpy(emCARD + blockNum * blockBtWidth, data, blocksCount * blockBtWidth);
511 }
512
513 void emlGetMem(uint8_t *data, int blockNum, int blocksCount) {
514 uint8_t* emCARD = BigBuf_get_EM_addr();
515 memcpy(data, emCARD + blockNum * 16, blocksCount * 16);
516 }
517
518 void emlGetMemBt(uint8_t *data, int bytePtr, int byteCount) {
519 uint8_t* emCARD = BigBuf_get_EM_addr();
520 memcpy(data, emCARD + bytePtr, byteCount);
521 }
522
523 int emlCheckValBl(int blockNum) {
524 uint8_t* emCARD = BigBuf_get_EM_addr();
525 uint8_t* data = emCARD + blockNum * 16;
526
527 if ((data[0] != (data[4] ^ 0xff)) || (data[0] != data[8]) ||
528 (data[1] != (data[5] ^ 0xff)) || (data[1] != data[9]) ||
529 (data[2] != (data[6] ^ 0xff)) || (data[2] != data[10]) ||
530 (data[3] != (data[7] ^ 0xff)) || (data[3] != data[11]) ||
531 (data[12] != (data[13] ^ 0xff)) || (data[12] != data[14]) ||
532 (data[12] != (data[15] ^ 0xff))
533 )
534 return 1;
535 return 0;
536 }
537
538 int emlGetValBl(uint32_t *blReg, uint8_t *blBlock, int blockNum) {
539 uint8_t* emCARD = BigBuf_get_EM_addr();
540 uint8_t* data = emCARD + blockNum * 16;
541
542 if (emlCheckValBl(blockNum))
543 return 1;
544
545 memcpy(blReg, data, 4);
546 *blBlock = data[12];
547 return 0;
548 }
549
550 int emlSetValBl(uint32_t blReg, uint8_t blBlock, int blockNum) {
551 uint8_t* emCARD = BigBuf_get_EM_addr();
552 uint8_t* data = emCARD + blockNum * 16;
553
554 memcpy(data + 0, &blReg, 4);
555 memcpy(data + 8, &blReg, 4);
556 blReg = blReg ^ 0xffffffff;
557 memcpy(data + 4, &blReg, 4);
558
559 data[12] = blBlock;
560 data[13] = blBlock ^ 0xff;
561 data[14] = blBlock;
562 data[15] = blBlock ^ 0xff;
563
564 return 0;
565 }
566
567 uint64_t emlGetKey(int sectorNum, int keyType) {
568 uint8_t key[6] = {0x00};
569 uint8_t* emCARD = BigBuf_get_EM_addr();
570 memcpy(key, emCARD + 16 * (FirstBlockOfSector(sectorNum) + NumBlocksPerSector(sectorNum) - 1) + keyType * 10, 6);
571 return bytes_to_num(key, 6);
572 }
573
574 void emlClearMem(void) {
575 const uint8_t trailer[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07, 0x80, 0x69, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
576 const uint8_t uid[] = {0xe6, 0x84, 0x87, 0xf3, 0x16, 0x88, 0x04, 0x00, 0x46, 0x8e, 0x45, 0x55, 0x4d, 0x70, 0x41, 0x04};
577 uint8_t* emCARD = BigBuf_get_EM_addr();
578 memset(emCARD, 0, CARD_MEMORY_SIZE);
579
580 // fill sectors trailer data
581 for(uint8_t b = 3; b < 256; b < 127 ? (b += 4) : (b += 16))
582 emlSetMem((uint8_t *)trailer, b, 1);
583
584 // uid
585 emlSetMem((uint8_t *)uid, 0, 1);
586 return;
587 }
588
589
590 // Mifare desfire commands
591 int mifare_sendcmd_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t* data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing)
592 {
593 uint8_t dcmd[5] = {cmd, data[0], data[1], 0x00, 0x00};
594 AppendCrc14443a(dcmd, 3);
595
596 ReaderTransmit(dcmd, sizeof(dcmd), NULL);
597 int len = ReaderReceive(answer, answer_parity);
598 if(!len) {
599 if (MF_DBGLEVEL >= MF_DBG_ERROR)
600 Dbprintf("Authentication failed. Card timeout.");
601 return 1;
602 }
603 return len;
604 }
605
606 int mifare_sendcmd_special2(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t* data, uint8_t* answer,uint8_t *answer_parity, uint32_t *timing)
607 {
608 uint8_t dcmd[20] = {0x00};
609 dcmd[0] = cmd;
610 memcpy(dcmd+1,data,17);
611 AppendCrc14443a(dcmd, 18);
612
613 ReaderTransmit(dcmd, sizeof(dcmd), NULL);
614 int len = ReaderReceive(answer, answer_parity);
615 if(!len){
616 if (MF_DBGLEVEL >= MF_DBG_ERROR)
617 Dbprintf("Authentication failed. Card timeout.");
618 return 1;
619 }
620 return len;
621 }
622
623 int mifare_desfire_des_auth1(uint32_t uid, uint8_t *blockData){
624
625 int len;
626 // load key, keynumber
627 uint8_t data[2]={0x0a, 0x00};
628 uint8_t receivedAnswer[MAX_FRAME_SIZE] = {0x00};
629 uint8_t receivedAnswerPar[MAX_PARITY_SIZE] = {0x00};
630
631 len = mifare_sendcmd_special(NULL, 1, 0x02, data, receivedAnswer,receivedAnswerPar,NULL);
632 if (len == 1) {
633 if (MF_DBGLEVEL >= MF_DBG_ERROR)
634 Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
635 return 1;
636 }
637
638 if (len == 12) {
639 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
640 Dbprintf("Auth1 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
641 receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],
642 receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],
643 receivedAnswer[10],receivedAnswer[11]);
644 }
645 memcpy(blockData, receivedAnswer, 12);
646 return 0;
647 }
648 return 1;
649 }
650
651 int mifare_desfire_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
652
653 int len;
654 uint8_t data[17] = {0x00};
655 data[0] = 0xAF;
656 memcpy(data+1,key,16);
657
658 uint8_t receivedAnswer[MAX_FRAME_SIZE] = {0x00};
659 uint8_t receivedAnswerPar[MAX_PARITY_SIZE] = {0x00};
660
661 len = mifare_sendcmd_special2(NULL, 1, 0x03, data, receivedAnswer, receivedAnswerPar ,NULL);
662
663 if ((receivedAnswer[0] == 0x03) && (receivedAnswer[1] == 0xae)) {
664 if (MF_DBGLEVEL >= MF_DBG_ERROR)
665 Dbprintf("Auth Error: %02x %02x", receivedAnswer[0], receivedAnswer[1]);
666 return 1;
667 }
668
669 if (len == 12){
670 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
671 Dbprintf("Auth2 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
672 receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],
673 receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],
674 receivedAnswer[10],receivedAnswer[11]);
675 }
676 memcpy(blockData, receivedAnswer, 12);
677 return 0;
678 }
679 return 1;
680 }
Impressum, Datenschutz