1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
16 #include "mifarecmd.h"
21 // the block number for the ISO14443-4 PCB
22 uint8_t pcb_blocknum
= 0;
23 // Deselect card by sending a s-block. the crc is precalced for speed
24 static uint8_t deselect_cmd
[] = {0xc2,0xe0,0xb4};
26 //-----------------------------------------------------------------------------
27 // Select, Authenticate, Read a MIFARE tag.
29 //-----------------------------------------------------------------------------
30 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
33 uint8_t blockNo
= arg0
;
34 uint8_t keyType
= arg1
;
36 ui64Key
= bytes_to_num(datain
, 6);
40 byte_t dataoutbuf
[16];
43 struct Crypto1State mpcs
= {0, 0};
44 struct Crypto1State
*pcs
;
49 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
56 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
57 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
61 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
62 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
66 if(mifare_classic_readblock(pcs
, cuid
, blockNo
, dataoutbuf
)) {
67 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block error");
71 if(mifare_classic_halt(pcs
, cuid
)) {
72 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
80 // ----------------------------- crypto1 destroy
83 if (MF_DBGLEVEL
>= 2) DbpString("READ BLOCK FINISHED");
86 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16);
89 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
93 void MifareUC_Auth(uint8_t arg0
, uint8_t *keybytes
){
95 bool turnOffField
= (arg0
== 1);
97 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
99 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
101 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
102 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card");
107 if(!mifare_ultra_auth(keybytes
)){
108 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Authentication failed");
114 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
117 cmd_send(CMD_ACK
,1,0,0,0,0);
121 // Arg1 = UsePwd bool
122 // datain = PWD bytes,
123 void MifareUReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
)
125 uint8_t blockNo
= arg0
;
126 byte_t dataout
[16] = {0x00};
127 bool useKey
= (arg1
== 1); //UL_C
128 bool usePwd
= (arg1
== 2); //UL_EV1/NTAG
133 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
135 int len
= iso14443a_select_card(NULL
, NULL
, NULL
);
137 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card (RC:%02X)",len
);
142 // UL-C authentication
144 uint8_t key
[16] = {0x00};
145 memcpy(key
, datain
, sizeof(key
) );
147 if ( !mifare_ultra_auth(key
) ) {
153 // UL-EV1 / NTAG authentication
155 uint8_t pwd
[4] = {0x00};
156 memcpy(pwd
, datain
, 4);
157 uint8_t pack
[4] = {0,0,0,0};
158 if (!mifare_ul_ev1_auth(pwd
, pack
)) {
164 if( mifare_ultra_readblock(blockNo
, dataout
) ) {
165 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Read block error");
170 if( mifare_ultra_halt() ) {
171 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Halt error");
176 cmd_send(CMD_ACK
,1,0,0,dataout
,16);
177 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
181 //-----------------------------------------------------------------------------
182 // Select, Authenticate, Read a MIFARE tag.
183 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
184 //-----------------------------------------------------------------------------
185 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
188 uint8_t sectorNo
= arg0
;
189 uint8_t keyType
= arg1
;
190 uint64_t ui64Key
= 0;
191 ui64Key
= bytes_to_num(datain
, 6);
195 byte_t dataoutbuf
[16 * 16];
198 struct Crypto1State mpcs
= {0, 0};
199 struct Crypto1State
*pcs
;
205 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
212 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
214 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
218 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
220 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
223 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
224 if(mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
+ 16 * blockNo
)) {
226 if (MF_DBGLEVEL
>= 1) Dbprintf("Read sector %2d block %2d error", sectorNo
, blockNo
);
231 if(mifare_classic_halt(pcs
, cuid
)) {
232 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
235 // ----------------------------- crypto1 destroy
236 crypto1_destroy(pcs
);
238 if (MF_DBGLEVEL
>= 2) DbpString("READ SECTOR FINISHED");
241 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16*NumBlocksPerSector(sectorNo
));
245 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
249 // arg0 = blockNo (start)
250 // arg1 = Pages (number of blocks)
252 // datain = KEY bytes
253 void MifareUReadCard(uint8_t arg0
, uint16_t arg1
, uint8_t arg2
, uint8_t *datain
)
255 // free eventually allocated BigBuf memory
260 uint8_t blockNo
= arg0
;
261 uint16_t blocks
= arg1
;
262 bool useKey
= (arg2
== 1); //UL_C
263 bool usePwd
= (arg2
== 2); //UL_EV1/NTAG
264 uint32_t countblocks
= 0;
265 uint8_t *dataout
= BigBuf_malloc(CARD_MEMORY_SIZE
);
266 if (dataout
== NULL
){
267 Dbprintf("out of memory");
274 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
276 int len
= iso14443a_select_card(NULL
, NULL
, NULL
);
278 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card (RC:%d)",len
);
283 // UL-C authentication
285 uint8_t key
[16] = {0x00};
286 memcpy(key
, datain
, sizeof(key
) );
288 if ( !mifare_ultra_auth(key
) ) {
294 // UL-EV1 / NTAG authentication
296 uint8_t pwd
[4] = {0x00};
297 memcpy(pwd
, datain
, sizeof(pwd
));
298 uint8_t pack
[4] = {0,0,0,0};
300 if (!mifare_ul_ev1_auth(pwd
, pack
)){
306 for (int i
= 0; i
< blocks
; i
++){
307 if ((i
*4) + 4 >= CARD_MEMORY_SIZE
) {
308 Dbprintf("Data exceeds buffer!!");
312 len
= mifare_ultra_readblock(blockNo
+ i
, dataout
+ 4 * i
);
315 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Read block %d error",i
);
316 // if no blocks read - error out
321 //stop at last successful read block and return what we got
329 len
= mifare_ultra_halt();
331 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Halt error");
336 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) Dbprintf("Blocks read %d", countblocks
);
340 cmd_send(CMD_ACK
, 1, countblocks
, BigBuf_max_traceLen(), 0, 0);
341 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
346 //-----------------------------------------------------------------------------
347 // Select, Authenticate, Write a MIFARE tag.
349 //-----------------------------------------------------------------------------
350 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
353 uint8_t blockNo
= arg0
;
354 uint8_t keyType
= arg1
;
355 uint64_t ui64Key
= 0;
356 byte_t blockdata
[16];
358 ui64Key
= bytes_to_num(datain
, 6);
359 memcpy(blockdata
, datain
+ 10, 16);
365 struct Crypto1State mpcs
= {0, 0};
366 struct Crypto1State
*pcs
;
372 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
379 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
380 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
384 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
385 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
389 if(mifare_classic_writeblock(pcs
, cuid
, blockNo
, blockdata
)) {
390 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
394 if(mifare_classic_halt(pcs
, cuid
)) {
395 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
403 // ----------------------------- crypto1 destroy
404 crypto1_destroy(pcs
);
406 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
409 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
414 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
418 /* // Command not needed but left for future testing
419 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
421 uint8_t blockNo = arg0;
422 byte_t blockdata[16] = {0x00};
424 memcpy(blockdata, datain, 16);
426 uint8_t uid[10] = {0x00};
428 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
431 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
433 if(!iso14443a_select_card(uid, NULL, NULL)) {
434 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
439 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
440 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
444 if(mifare_ultra_halt()) {
445 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
450 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
452 cmd_send(CMD_ACK,1,0,0,0,0);
453 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
458 // Arg0 : Block to write to.
459 // Arg1 : 0 = use no authentication.
460 // 1 = use 0x1A authentication.
461 // 2 = use 0x1B authentication.
462 // datain : 4 first bytes is data to be written.
463 // : 4/16 next bytes is authentication key.
464 void MifareUWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
)
466 uint8_t blockNo
= arg0
;
467 bool useKey
= (arg1
== 1); //UL_C
468 bool usePwd
= (arg1
== 2); //UL_EV1/NTAG
469 byte_t blockdata
[4] = {0x00};
471 memcpy(blockdata
, datain
,4);
476 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
478 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
479 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
484 // UL-C authentication
486 uint8_t key
[16] = {0x00};
487 memcpy(key
, datain
+4, sizeof(key
) );
489 if ( !mifare_ultra_auth(key
) ) {
495 // UL-EV1 / NTAG authentication
497 uint8_t pwd
[4] = {0x00};
498 memcpy(pwd
, datain
+4, 4);
499 uint8_t pack
[4] = {0,0,0,0};
500 if (!mifare_ul_ev1_auth(pwd
, pack
)) {
506 if(mifare_ultra_writeblock(blockNo
, blockdata
)) {
507 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
512 if(mifare_ultra_halt()) {
513 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
518 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
520 cmd_send(CMD_ACK
,1,0,0,0,0);
521 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
525 void MifareUSetPwd(uint8_t arg0
, uint8_t *datain
){
527 uint8_t pwd
[16] = {0x00};
528 byte_t blockdata
[4] = {0x00};
530 memcpy(pwd
, datain
, 16);
532 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
534 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
536 if(!iso14443a_select_card(NULL
, NULL
, NULL
)) {
537 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
542 blockdata
[0] = pwd
[7];
543 blockdata
[1] = pwd
[6];
544 blockdata
[2] = pwd
[5];
545 blockdata
[3] = pwd
[4];
546 if(mifare_ultra_writeblock( 44, blockdata
)) {
547 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
552 blockdata
[0] = pwd
[3];
553 blockdata
[1] = pwd
[2];
554 blockdata
[2] = pwd
[1];
555 blockdata
[3] = pwd
[0];
556 if(mifare_ultra_writeblock( 45, blockdata
)) {
557 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
562 blockdata
[0] = pwd
[15];
563 blockdata
[1] = pwd
[14];
564 blockdata
[2] = pwd
[13];
565 blockdata
[3] = pwd
[12];
566 if(mifare_ultra_writeblock( 46, blockdata
)) {
567 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
572 blockdata
[0] = pwd
[11];
573 blockdata
[1] = pwd
[10];
574 blockdata
[2] = pwd
[9];
575 blockdata
[3] = pwd
[8];
576 if(mifare_ultra_writeblock( 47, blockdata
)) {
577 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
582 if(mifare_ultra_halt()) {
583 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
588 cmd_send(CMD_ACK
,1,0,0,0,0);
589 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
593 // Return 1 if the nonce is invalid else return 0
594 int valid_nonce(uint32_t Nt
, uint32_t NtEnc
, uint32_t Ks1
, uint8_t *parity
) {
595 return ((oddparity((Nt
>> 24) & 0xFF) == ((parity
[0]) ^ oddparity((NtEnc
>> 24) & 0xFF) ^ BIT(Ks1
,16))) & \
596 (oddparity((Nt
>> 16) & 0xFF) == ((parity
[1]) ^ oddparity((NtEnc
>> 16) & 0xFF) ^ BIT(Ks1
,8))) & \
597 (oddparity((Nt
>> 8) & 0xFF) == ((parity
[2]) ^ oddparity((NtEnc
>> 8) & 0xFF) ^ BIT(Ks1
,0)))) ? 1 : 0;
601 //-----------------------------------------------------------------------------
602 // MIFARE nested authentication.
604 //-----------------------------------------------------------------------------
605 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t calibrate
, uint8_t *datain
)
608 uint8_t blockNo
= arg0
& 0xff;
609 uint8_t keyType
= (arg0
>> 8) & 0xff;
610 uint8_t targetBlockNo
= arg1
& 0xff;
611 uint8_t targetKeyType
= (arg1
>> 8) & 0xff;
612 uint64_t ui64Key
= 0;
614 ui64Key
= bytes_to_num(datain
, 6);
617 uint16_t rtr
, i
, j
, len
;
619 static uint16_t dmin
, dmax
;
621 uint32_t cuid
, nt1
, nt2
, nttmp
, nttest
, ks1
;
623 uint32_t target_nt
[2], target_ks
[2];
625 uint8_t par_array
[4];
627 struct Crypto1State mpcs
= {0, 0};
628 struct Crypto1State
*pcs
;
630 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
632 uint32_t auth1_time
, auth2_time
;
633 static uint16_t delta_time
;
635 // free eventually allocated BigBuf memory
641 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
647 // statistics on nonce distance
649 #define NESTED_MAX_TRIES 12
650 uint16_t unsuccessfull_tries
= 0;
651 if (calibrate
) { // for first call only. Otherwise reuse previous calibration
659 for (rtr
= 0; rtr
< 17; rtr
++) {
661 // Test if the action was cancelled
667 // prepare next select. No need to power down the card.
668 if(mifare_classic_halt(pcs
, cuid
)) {
669 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
674 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
675 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
681 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
682 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
688 auth2_time
= auth1_time
+ delta_time
;
692 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_NESTED
, &nt2
, &auth2_time
)) {
693 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error");
698 nttmp
= prng_successor(nt1
, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
699 for (i
= 101; i
< 1200; i
++) {
700 nttmp
= prng_successor(nttmp
, 1);
701 if (nttmp
== nt2
) break;
711 delta_time
= auth2_time
- auth1_time
+ 32; // allow some slack for proper timing
713 if (MF_DBGLEVEL
>= 3) Dbprintf("Nested: calibrating... ntdist=%d", i
);
715 unsuccessfull_tries
++;
716 if (unsuccessfull_tries
> NESTED_MAX_TRIES
) { // card isn't vulnerable to nested attack (random numbers are not predictable)
722 davg
= (davg
+ (rtr
- 1)/2) / (rtr
- 1);
724 if (MF_DBGLEVEL
>= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr
, isOK
, dmin
, dmax
, davg
, delta_time
);
732 // -------------------------------------------------------------------------------------------------
736 // get crypted nonces for target sector
737 for(i
=0; i
< 2 && !isOK
; i
++) { // look for exactly two different nonces
740 while(target_nt
[i
] == 0) { // continue until we have an unambiguous nonce
742 // prepare next select. No need to power down the card.
743 if(mifare_classic_halt(pcs
, cuid
)) {
744 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
748 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
749 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
754 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
755 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
759 // nested authentication
760 auth2_time
= auth1_time
+ delta_time
;
761 len
= mifare_sendcmd_short(pcs
, AUTH_NESTED
, 0x60 + (targetKeyType
& 0x01), targetBlockNo
, receivedAnswer
, par
, &auth2_time
);
763 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error len=%d", len
);
767 nt2
= bytes_to_num(receivedAnswer
, 4);
768 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i
+1, nt1
, nt2
, par
[0]);
770 // Parity validity check
771 for (j
= 0; j
< 4; j
++) {
772 par_array
[j
] = (oddparity(receivedAnswer
[j
]) != ((par
[0] >> (7-j
)) & 0x01));
776 nttest
= prng_successor(nt1
, dmin
- 1);
777 for (j
= dmin
; j
< dmax
+ 1; j
++) {
778 nttest
= prng_successor(nttest
, 1);
781 if (valid_nonce(nttest
, nt2
, ks1
, par_array
)){
782 if (ncount
> 0) { // we are only interested in disambiguous nonces, try again
783 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i
+1, j
);
787 target_nt
[i
] = nttest
;
790 if (i
== 1 && target_nt
[1] == target_nt
[0]) { // we need two different nonces
792 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j
);
795 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i
+1, j
);
798 if (target_nt
[i
] == 0 && j
== dmax
+1 && MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i
+1);
804 // ----------------------------- crypto1 destroy
805 crypto1_destroy(pcs
);
807 byte_t buf
[4 + 4 * 4];
808 memcpy(buf
, &cuid
, 4);
809 memcpy(buf
+4, &target_nt
[0], 4);
810 memcpy(buf
+8, &target_ks
[0], 4);
811 memcpy(buf
+12, &target_nt
[1], 4);
812 memcpy(buf
+16, &target_ks
[1], 4);
815 cmd_send(CMD_ACK
, isOK
, 0, targetBlockNo
+ (targetKeyType
* 0x100), buf
, sizeof(buf
));
818 if (MF_DBGLEVEL
>= 3) DbpString("NESTED FINISHED");
820 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
825 //-----------------------------------------------------------------------------
826 // MIFARE check keys. key count up to 85.
828 //-----------------------------------------------------------------------------
829 void MifareChkKeys(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
832 uint8_t blockNo
= arg0
;
833 uint8_t keyType
= arg1
;
834 uint8_t keyCount
= arg2
;
835 uint64_t ui64Key
= 0;
842 struct Crypto1State mpcs
= {0, 0};
843 struct Crypto1State
*pcs
;
847 int OLD_MF_DBGLEVEL
= MF_DBGLEVEL
;
848 MF_DBGLEVEL
= MF_DBG_NONE
;
854 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
860 for (i
= 0; i
< keyCount
; i
++) {
861 if(mifare_classic_halt(pcs
, cuid
)) {
862 if (MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Halt error");
865 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
866 if (OLD_MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Can't select card");
870 ui64Key
= bytes_to_num(datain
+ i
* 6, 6);
871 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
879 // ----------------------------- crypto1 destroy
880 crypto1_destroy(pcs
);
883 cmd_send(CMD_ACK
,isOK
,0,0,datain
+ i
* 6,6);
886 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
889 // restore debug level
890 MF_DBGLEVEL
= OLD_MF_DBGLEVEL
;
893 //-----------------------------------------------------------------------------
894 // MIFARE commands set debug level
896 //-----------------------------------------------------------------------------
897 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
899 Dbprintf("Debug level: %d", MF_DBGLEVEL
);
902 //-----------------------------------------------------------------------------
903 // Work with emulator memory
905 //-----------------------------------------------------------------------------
906 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
910 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
911 emlSetMem(datain
, arg0
, arg1
); // data, block num, blocks count
914 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
915 byte_t buf
[USB_CMD_DATA_SIZE
];
916 emlGetMem(buf
, arg0
, arg1
); // data, block num, blocks count (max 4)
919 cmd_send(CMD_ACK
,arg0
,arg1
,0,buf
,USB_CMD_DATA_SIZE
);
923 //-----------------------------------------------------------------------------
924 // Load a card into the emulator memory
926 //-----------------------------------------------------------------------------
927 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
928 uint8_t numSectors
= arg0
;
929 uint8_t keyType
= arg1
;
930 uint64_t ui64Key
= 0;
932 struct Crypto1State mpcs
= {0, 0};
933 struct Crypto1State
*pcs
;
937 byte_t dataoutbuf
[16];
938 byte_t dataoutbuf2
[16];
945 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
953 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
955 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
958 for (uint8_t sectorNo
= 0; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
959 ui64Key
= emlGetKey(sectorNo
, keyType
);
961 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
963 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo
);
967 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_NESTED
)) {
969 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo
);
974 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
975 if(isOK
&& mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
)) {
977 if (MF_DBGLEVEL
>= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo
, blockNo
);
981 if (blockNo
< NumBlocksPerSector(sectorNo
) - 1) {
982 emlSetMem(dataoutbuf
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
983 } else { // sector trailer, keep the keys, set only the AC
984 emlGetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
985 memcpy(&dataoutbuf2
[6], &dataoutbuf
[6], 4);
986 emlSetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
993 if(mifare_classic_halt(pcs
, cuid
)) {
994 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
997 // ----------------------------- crypto1 destroy
998 crypto1_destroy(pcs
);
1000 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1003 if (MF_DBGLEVEL
>= 2) DbpString("EMUL FILL SECTORS FINISHED");
1008 //-----------------------------------------------------------------------------
1009 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1011 //-----------------------------------------------------------------------------
1012 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
1015 uint8_t needWipe
= arg0
;
1016 // bit 0 - need get UID
1017 // bit 1 - need wupC
1018 // bit 2 - need HALT after sequence
1019 // bit 3 - need init FPGA and field before sequence
1020 // bit 4 - need reset FPGA and LED
1021 uint8_t workFlags
= arg1
;
1022 uint8_t blockNo
= arg2
;
1025 uint8_t wupC1
[] = { 0x40 };
1026 uint8_t wupC2
[] = { 0x43 };
1027 uint8_t wipeC
[] = { 0x41 };
1031 uint8_t uid
[10] = {0x00};
1032 uint8_t d_block
[18] = {0x00};
1035 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1036 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1038 // reset FPGA and LED
1039 if (workFlags
& 0x08) {
1046 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1051 // get UID from chip
1052 if (workFlags
& 0x01) {
1053 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
1054 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
1058 if(mifare_classic_halt(NULL
, cuid
)) {
1059 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1066 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1067 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1068 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1072 ReaderTransmit(wipeC
, sizeof(wipeC
), NULL
);
1073 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1074 if (MF_DBGLEVEL
>= 1) Dbprintf("wipeC error");
1078 if(mifare_classic_halt(NULL
, cuid
)) {
1079 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1085 if (workFlags
& 0x02) {
1086 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1087 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1088 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1092 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1093 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1094 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1099 if ((mifare_sendcmd_short(NULL
, 0, 0xA0, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1100 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send command error");
1104 memcpy(d_block
, datain
, 16);
1105 AppendCrc14443a(d_block
, 16);
1107 ReaderTransmit(d_block
, sizeof(d_block
), NULL
);
1108 if ((ReaderReceive(receivedAnswer
, receivedAnswerPar
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1109 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send data error");
1113 if (workFlags
& 0x04) {
1114 if (mifare_classic_halt(NULL
, cuid
)) {
1115 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1125 cmd_send(CMD_ACK
,isOK
,0,0,uid
,4);
1128 if ((workFlags
& 0x10) || (!isOK
)) {
1129 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1135 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
1138 // bit 1 - need wupC
1139 // bit 2 - need HALT after sequence
1140 // bit 3 - need init FPGA and field before sequence
1141 // bit 4 - need reset FPGA and LED
1142 uint8_t workFlags
= arg0
;
1143 uint8_t blockNo
= arg2
;
1146 uint8_t wupC1
[] = { 0x40 };
1147 uint8_t wupC2
[] = { 0x43 };
1151 uint8_t data
[18] = {0x00};
1154 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1155 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1157 if (workFlags
& 0x08) {
1164 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1168 if (workFlags
& 0x02) {
1169 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1170 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1171 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1175 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1176 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1177 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1183 if ((mifare_sendcmd_short(NULL
, 0, 0x30, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 18)) {
1184 if (MF_DBGLEVEL
>= 1) Dbprintf("read block send command error");
1187 memcpy(data
, receivedAnswer
, 18);
1189 if (workFlags
& 0x04) {
1190 if (mifare_classic_halt(NULL
, cuid
)) {
1191 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1201 cmd_send(CMD_ACK
,isOK
,0,0,data
,18);
1204 if ((workFlags
& 0x10) || (!isOK
)) {
1205 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1210 void MifareCIdent(){
1213 uint8_t wupC1
[] = { 0x40 };
1214 uint8_t wupC2
[] = { 0x43 };
1219 uint8_t receivedAnswer
[MAX_MIFARE_FRAME_SIZE
];
1220 uint8_t receivedAnswerPar
[MAX_MIFARE_PARITY_SIZE
];
1222 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1223 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1227 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1228 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1232 if (mifare_classic_halt(NULL
, 0)) {
1236 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
1243 void Mifare_DES_Auth1(uint8_t arg0
, uint8_t *datain
){
1245 byte_t dataout
[11] = {0x00};
1246 uint8_t uid
[10] = {0x00};
1250 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1252 int len
= iso14443a_select_card(uid
, NULL
, &cuid
);
1254 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Can't select card");
1259 if(mifare_desfire_des_auth1(cuid
, dataout
)){
1260 if (MF_DBGLEVEL
>= MF_DBG_ERROR
) Dbprintf("Authentication part1: Fail.");
1265 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) DbpString("AUTH 1 FINISHED");
1266 cmd_send(CMD_ACK
,1,cuid
,0,dataout
, sizeof(dataout
));
1269 void Mifare_DES_Auth2(uint32_t arg0
, uint8_t *datain
){
1271 uint32_t cuid
= arg0
;
1272 uint8_t key
[16] = {0x00};
1274 byte_t dataout
[12] = {0x00};
1276 memcpy(key
, datain
, 16);
1278 isOK
= mifare_desfire_des_auth2(cuid
, key
, dataout
);
1281 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) Dbprintf("Authentication part2: Failed");
1286 if (MF_DBGLEVEL
>= MF_DBG_EXTENDED
) DbpString("AUTH 2 FINISHED");
1288 cmd_send(CMD_ACK
, isOK
, 0, 0, dataout
, sizeof(dataout
));
1289 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1295 ReaderTransmit(deselect_cmd
, 3 , NULL
);
1296 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1300 void OnError(uint8_t reason
){
1302 ReaderTransmit(deselect_cmd
, 3 , NULL
);
1303 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1304 cmd_send(CMD_ACK
,0,reason
,0,0,0);