git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014,2015,2016
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17
  18 //-----------------------------------------------------------------------------
  19 // Select, Authenticate, Read a MIFARE tag.
  20 // read block
  21 //-----------------------------------------------------------------------------
  22 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  23 {
  24   // params
  25         uint8_t blockNo = arg0;
  26         uint8_t keyType = arg1;
  27         uint64_t ui64Key = 0;
  28         ui64Key = bytes_to_num(datain, 6);
  29
  30         // variables
  31         byte_t isOK = 0;
  32         byte_t dataoutbuf[16] = {0x00};
  33         uint8_t uid[10] = {0x00};
  34         uint32_t cuid = 0;
  35         struct Crypto1State mpcs = {0, 0};
  36         struct Crypto1State *pcs;
  37         pcs = &mpcs;
  38
  39         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  40
  41         clear_trace();
  42         set_tracing(true);
  43
  44         LED_A_ON();
  45         LED_B_OFF();
  46         LED_C_OFF();
  47
  48         while (true) {
  49                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
  50                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  51                         break;
  52                 };
  53
  54                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  55                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  56                         break;
  57                 };
  58
  59                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  60                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  61                         break;
  62                 };
  63
  64                 if(mifare_classic_halt(pcs, cuid)) {
  65                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  66                         break;
  67                 };
  68
  69                 isOK = 1;
  70                 break;
  71         }
  72
  73         crypto1_destroy(pcs);
  74
  75         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  76
  77         LED_B_ON();
  78         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  79         LED_B_OFF();
  80
  81         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  82         LEDsoff();
  83 }
  84
  85 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
  86
  87         bool turnOffField = (arg0 == 1);
  88
  89         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
  90
  91         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  92
  93         clear_trace();
  94         set_tracing(true);
  95
  96         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
  97                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
  98                 OnError(0);
  99                 return;
 100         };
 101
 102         if(!mifare_ultra_auth(keybytes)){
 103                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
 104                 OnError(1);
 105                 return;
 106         }
 107
 108         if (turnOffField) {
 109                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 110                 LEDsoff();
 111         }
 112         cmd_send(CMD_ACK,1,0,0,0,0);
 113 }
 114
 115 // Arg0 = BlockNo,
 116 // Arg1 = UsePwd bool
 117 // datain = PWD bytes,
 118 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 119 {
 120         uint8_t blockNo = arg0;
 121         byte_t dataout[16] = {0x00};
 122         bool useKey = (arg1 == 1); //UL_C
 123         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 124
 125         LEDsoff();
 126         LED_A_ON();
 127         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 128
 129         clear_trace();
 130         set_tracing(true);
 131
 132         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 133         if(!len) {
 134                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 135                 OnError(1);
 136                 return;
 137         }
 138
 139         // UL-C authentication
 140         if ( useKey ) {
 141                 uint8_t key[16] = {0x00};
 142                 memcpy(key, datain, sizeof(key) );
 143
 144                 if ( !mifare_ultra_auth(key) ) {
 145                         OnError(1);
 146                         return;
 147                 }
 148         }
 149
 150         // UL-EV1 / NTAG authentication
 151         if ( usePwd ) {
 152                 uint8_t pwd[4] = {0x00};
 153                 memcpy(pwd, datain, 4);
 154                 uint8_t pack[4] = {0,0,0,0};
 155                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 156                         OnError(1);
 157                         return;
 158                 }
 159         }
 160
 161         if( mifare_ultra_readblock(blockNo, dataout) ) {
 162                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 163                 OnError(2);
 164                 return;
 165         }
 166
 167         if( mifare_ultra_halt() ) {
 168                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 169                 OnError(3);
 170                 return;
 171         }
 172
 173     cmd_send(CMD_ACK,1,0,0,dataout,16);
 174         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 175         LEDsoff();
 176 }
 177
 178 //-----------------------------------------------------------------------------
 179 // Select, Authenticate, Read a MIFARE tag.
 180 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 181 //-----------------------------------------------------------------------------
 182 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 183 {
 184   // params
 185         uint8_t sectorNo = arg0;
 186         uint8_t keyType = arg1;
 187         uint64_t ui64Key = 0;
 188         ui64Key = bytes_to_num(datain, 6);
 189
 190         // variables
 191         byte_t isOK = 0;
 192         byte_t dataoutbuf[16 * 16];
 193         uint8_t uid[10] = {0x00};
 194         uint32_t cuid = 0;
 195         struct Crypto1State mpcs = {0, 0};
 196         struct Crypto1State *pcs;
 197         pcs = &mpcs;
 198
 199         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 200
 201         clear_trace();
 202         set_tracing(true);
 203
 204         LED_A_ON();
 205         LED_B_OFF();
 206         LED_C_OFF();
 207
 208         isOK = 1;
 209         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 210                 isOK = 0;
 211                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 212         }
 213
 214
 215         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 216                 isOK = 0;
 217                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 218         }
 219
 220         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 221                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 222                         isOK = 0;
 223                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 224                         break;
 225                 }
 226         }
 227
 228         if(mifare_classic_halt(pcs, cuid)) {
 229                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 230         }
 231
 232         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 233
 234         crypto1_destroy(pcs);
 235
 236         LED_B_ON();
 237         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 238         LED_B_OFF();
 239
 240         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 241         LEDsoff();
 242         set_tracing(FALSE);
 243 }
 244
 245 // arg0 = blockNo (start)
 246 // arg1 = Pages (number of blocks)
 247 // arg2 = useKey
 248 // datain = KEY bytes
 249 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 250 {
 251         LEDsoff();
 252         LED_A_ON();
 253         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 254
 255         // free eventually allocated BigBuf memory
 256         BigBuf_free(); BigBuf_Clear_ext(false);
 257         clear_trace();
 258         set_tracing(true);
 259
 260         // params
 261         uint8_t blockNo = arg0;
 262         uint16_t blocks = arg1;
 263         bool useKey = (arg2 == 1); //UL_C
 264         bool usePwd = (arg2 == 2); //UL_EV1/NTAG
 265         uint32_t countblocks = 0;
 266         uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
 267         if (dataout == NULL){
 268                 Dbprintf("out of memory");
 269                 OnError(1);
 270                 return;
 271         }
 272
 273         int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
 274         if (!len) {
 275                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 276                 OnError(1);
 277                 return;
 278         }
 279
 280         // UL-C authentication
 281         if ( useKey ) {
 282                 uint8_t key[16] = {0x00};
 283                 memcpy(key, datain, sizeof(key) );
 284
 285                 if ( !mifare_ultra_auth(key) ) {
 286                         OnError(1);
 287                         return;
 288                 }
 289         }
 290
 291         // UL-EV1 / NTAG authentication
 292         if (usePwd) {
 293                 uint8_t pwd[4] = {0x00};
 294                 memcpy(pwd, datain, sizeof(pwd));
 295                 uint8_t pack[4] = {0,0,0,0};
 296
 297                 if (!mifare_ul_ev1_auth(pwd, pack)){
 298                         OnError(1);
 299                         return;
 300                 }
 301         }
 302
 303         for (int i = 0; i < blocks; i++){
 304                 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
 305                         Dbprintf("Data exceeds buffer!!");
 306                         break;
 307                 }
 308
 309                 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
 310
 311                 if (len) {
 312                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 313                         // if no blocks read - error out
 314                         if (i==0){
 315                                 OnError(2);
 316                         return;
 317                         } else {
 318                                 //stop at last successful read block and return what we got
 319                                 break;
 320                         }
 321                 } else {
 322                         countblocks++;
 323                 }
 324         }
 325
 326         len = mifare_ultra_halt();
 327         if (len) {
 328                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 329                 OnError(3);
 330                 return;
 331         }
 332
 333         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 334
 335         countblocks *= 4;
 336
 337         cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
 338         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 339         LEDsoff();
 340         BigBuf_free();
 341         set_tracing(FALSE);
 342 }
 343
 344 //-----------------------------------------------------------------------------
 345 // Select, Authenticate, Write a MIFARE tag.
 346 // read block
 347 //-----------------------------------------------------------------------------
 348 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 349 {
 350         // params
 351         uint8_t blockNo = arg0;
 352         uint8_t keyType = arg1;
 353         uint64_t ui64Key = 0;
 354         byte_t blockdata[16] = {0x00};
 355
 356         ui64Key = bytes_to_num(datain, 6);
 357         memcpy(blockdata, datain + 10, 16);
 358
 359         // variables
 360         byte_t isOK = 0;
 361         uint8_t uid[10] = {0x00};
 362         uint32_t cuid = 0;
 363         struct Crypto1State mpcs = {0, 0};
 364         struct Crypto1State *pcs;
 365         pcs = &mpcs;
 366
 367         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 368
 369         clear_trace();
 370         set_tracing(true);
 371
 372         LED_A_ON();
 373         LED_B_OFF();
 374         LED_C_OFF();
 375
 376         while (true) {
 377                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 378                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 379                         break;
 380                 };
 381
 382                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 383                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 384                         break;
 385                 };
 386
 387                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 388                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 389                         break;
 390                 };
 391
 392                 if(mifare_classic_halt(pcs, cuid)) {
 393                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 394                         break;
 395                 };
 396
 397                 isOK = 1;
 398                 break;
 399         }
 400
 401         crypto1_destroy(pcs);
 402
 403         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 404
 405         cmd_send(CMD_ACK,isOK,0,0,0,0);
 406
 407         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 408         LEDsoff();
 409         set_tracing(FALSE);
 410 }
 411
 412 /* // Command not needed but left for future testing
 413 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
 414 {
 415         uint8_t blockNo = arg0;
 416         byte_t blockdata[16] = {0x00};
 417
 418         memcpy(blockdata, datain, 16);
 419
 420         uint8_t uid[10] = {0x00};
 421
 422         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 423
 424         clear_trace();
 425         set_tracing(true);
 426         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 427
 428         if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
 429                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 430                 OnError(0);
 431                 return;
 432         };
 433
 434         if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
 435                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 436                 OnError(0);
 437                 return; };
 438
 439         if(mifare_ultra_halt()) {
 440                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 441                 OnError(0);
 442                 return;
 443         };
 444
 445         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 446
 447         cmd_send(CMD_ACK,1,0,0,0,0);
 448         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 449         LEDsoff();
 450 }
 451 */
 452
 453 // Arg0   : Block to write to.
 454 // Arg1   : 0 = use no authentication.
 455 //          1 = use 0x1A authentication.
 456 //          2 = use 0x1B authentication.
 457 // datain : 4 first bytes is data to be written.
 458 //        : 4/16 next bytes is authentication key.
 459 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 460 {
 461         uint8_t blockNo = arg0;
 462         bool useKey = (arg1 == 1); //UL_C
 463         bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 464         byte_t blockdata[4] = {0x00};
 465
 466         memcpy(blockdata, datain,4);
 467
 468         LEDsoff();
 469         LED_A_ON();
 470         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 471
 472         clear_trace();
 473         set_tracing(true);
 474
 475         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 476                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 477                 OnError(0);
 478                 return;
 479         };
 480
 481         // UL-C authentication
 482         if ( useKey ) {
 483                 uint8_t key[16] = {0x00};
 484                 memcpy(key, datain+4, sizeof(key) );
 485
 486                 if ( !mifare_ultra_auth(key) ) {
 487                         OnError(1);
 488                         return;
 489                 }
 490         }
 491
 492         // UL-EV1 / NTAG authentication
 493         if (usePwd) {
 494                 uint8_t pwd[4] = {0x00};
 495                 memcpy(pwd, datain+4, 4);
 496                 uint8_t pack[4] = {0,0,0,0};
 497                 if (!mifare_ul_ev1_auth(pwd, pack)) {
 498                         OnError(1);
 499                         return;
 500                 }
 501         }
 502
 503         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 504                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 505                 OnError(0);
 506                 return;
 507         };
 508
 509         if(mifare_ultra_halt()) {
 510                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 511                 OnError(0);
 512                 return;
 513         };
 514
 515         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 516
 517         cmd_send(CMD_ACK,1,0,0,0,0);
 518         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 519         LEDsoff();
 520         set_tracing(FALSE);
 521 }
 522
 523 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 524
 525         uint8_t pwd[16] = {0x00};
 526         byte_t blockdata[4] = {0x00};
 527
 528         memcpy(pwd, datain, 16);
 529
 530         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 531         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 532
 533         clear_trace();
 534         set_tracing(true);
 535
 536         if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
 537                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 538                 OnError(0);
 539                 return;
 540         };
 541
 542         blockdata[0] = pwd[7];
 543         blockdata[1] = pwd[6];
 544         blockdata[2] = pwd[5];
 545         blockdata[3] = pwd[4];
 546         if(mifare_ultra_writeblock( 44, blockdata)) {
 547                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 548                 OnError(44);
 549                 return;
 550         };
 551
 552         blockdata[0] = pwd[3];
 553         blockdata[1] = pwd[2];
 554         blockdata[2] = pwd[1];
 555         blockdata[3] = pwd[0];
 556         if(mifare_ultra_writeblock( 45, blockdata)) {
 557                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 558                 OnError(45);
 559                 return;
 560         };
 561
 562         blockdata[0] = pwd[15];
 563         blockdata[1] = pwd[14];
 564         blockdata[2] = pwd[13];
 565         blockdata[3] = pwd[12];
 566         if(mifare_ultra_writeblock( 46, blockdata)) {
 567                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 568                 OnError(46);
 569                 return;
 570         };
 571
 572         blockdata[0] = pwd[11];
 573         blockdata[1] = pwd[10];
 574         blockdata[2] = pwd[9];
 575         blockdata[3] = pwd[8];
 576         if(mifare_ultra_writeblock( 47, blockdata)) {
 577                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 578                 OnError(47);
 579                 return;
 580         };
 581
 582         if(mifare_ultra_halt()) {
 583                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 584                 OnError(0);
 585                 return;
 586         };
 587
 588         cmd_send(CMD_ACK,1,0,0,0,0);
 589         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 590         LEDsoff();
 591         set_tracing(FALSE);
 592 }
 593
 594 // Return 1 if the nonce is invalid else return 0
 595 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 596         return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 597         (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 598         (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 599 }
 600
 601
 602 //-----------------------------------------------------------------------------
 603 // acquire encrypted nonces in order to perform the attack described in
 604 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
 605 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
 606 // Computer and Communications Security, 2015
 607 //-----------------------------------------------------------------------------
 608 #define AUTHENTICATION_TIMEOUT  848 //848                       // card times out 1ms after wrong authentication (according to NXP documentation)
 609 #define PRE_AUTHENTICATION_LEADTIME 400         // some (non standard) cards need a pause after select before they are ready for first authentication
 610
 611 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
 612 {
 613         uint64_t ui64Key = 0;
 614         uint8_t uid[10] = {0x00};
 615         uint32_t cuid = 0;
 616         uint8_t cascade_levels = 0;
 617         struct Crypto1State mpcs = {0, 0};
 618         struct Crypto1State *pcs;
 619         pcs = &mpcs;
 620         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
 621         int16_t isOK = 0;
 622         uint8_t par_enc[1] = {0x00};
 623         uint8_t nt_par_enc = 0;
 624         uint8_t buf[USB_CMD_DATA_SIZE] = {0x00};
 625         uint32_t timeout = 0;
 626
 627         uint8_t blockNo = arg0 & 0xff;
 628         uint8_t keyType = (arg0 >> 8) & 0xff;
 629         uint8_t targetBlockNo = arg1 & 0xff;
 630         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 631         ui64Key = bytes_to_num(datain, 6);
 632         bool initialize = flags & 0x0001;
 633         bool slow = flags & 0x0002;
 634         bool field_off = flags & 0x0004;
 635
 636         LED_A_ON();
 637         LED_C_OFF();
 638
 639         BigBuf_free(); BigBuf_Clear_ext(false);
 640         clear_trace();
 641         set_tracing(FALSE);
 642
 643         if (initialize) {
 644                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 645         }
 646
 647         LED_C_ON();
 648
 649         uint8_t dummy_answer = 0;
 650         uint16_t num_nonces = 0;
 651         bool have_uid = false;
 652         for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
 653
 654                 // Test if the action was cancelled
 655                 if(BUTTON_PRESS()) {
 656                         isOK = 2;
 657                         field_off = true;
 658                         break;
 659                 }
 660
 661                 if (!have_uid) { // need a full select cycle to get the uid first
 662                         iso14a_card_select_t card_info;
 663                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
 664                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (ALL)");
 665                                 continue;
 666                         }
 667                         switch (card_info.uidlen) {
 668                                 case 4 : cascade_levels = 1; break;
 669                                 case 7 : cascade_levels = 2; break;
 670                                 case 10: cascade_levels = 3; break;
 671                                 default: break;
 672                         }
 673                         have_uid = true;
 674                 } else { // no need for anticollision. We can directly select the card
 675                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
 676                                 if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Can't select card (UID)");
 677                                 continue;
 678                         }
 679                 }
 680
 681                 if (slow) {
 682                         timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
 683                         while(GetCountSspClk() < timeout);
 684                 }
 685
 686                 uint32_t nt1;
 687                 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
 688                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth1 error");
 689                         continue;
 690                 }
 691
 692                 // nested authentication
 693                 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
 694                 if (len != 4) {
 695                         if (MF_DBGLEVEL >= 1)   Dbprintf("AcquireNonces: Auth2 error len=%d", len);
 696                         continue;
 697                 }
 698
 699                 // send a dummy byte as reader response in order to trigger the cards authentication timeout
 700                 ReaderTransmit(&dummy_answer, 1, NULL);
 701                 timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
 702
 703                 num_nonces++;
 704                 if (num_nonces % 2) {
 705                         memcpy(buf+i, receivedAnswer, 4);
 706                         nt_par_enc = par_enc[0] & 0xf0;
 707                 } else {
 708                         nt_par_enc |= par_enc[0]  >> 4;
 709                         memcpy(buf+i+4, receivedAnswer, 4);
 710                         memcpy(buf+i+8, &nt_par_enc, 1);
 711                         i += 9;
 712                 }
 713                 // wait for the card to become ready again
 714                 while(GetCountSspClk() < timeout);
 715         }
 716
 717         LED_C_OFF();
 718         crypto1_destroy(pcs);
 719         LED_B_ON();
 720         cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
 721         LED_B_OFF();
 722
 723         if (MF_DBGLEVEL >= 3)   DbpString("AcquireEncryptedNonces finished");
 724
 725         if (field_off) {
 726                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 727                 LEDsoff();
 728                 set_tracing(FALSE);
 729         }
 730 }
 731
 732
 733 //-----------------------------------------------------------------------------
 734 // MIFARE nested authentication.
 735 //
 736 //-----------------------------------------------------------------------------
 737 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 738 {
 739         // params
 740         uint8_t blockNo = arg0 & 0xff;
 741         uint8_t keyType = (arg0 >> 8) & 0xff;
 742         uint8_t targetBlockNo = arg1 & 0xff;
 743         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 744         uint64_t ui64Key = 0;
 745
 746         ui64Key = bytes_to_num(datain, 6);
 747
 748         // variables
 749         uint16_t rtr, i, j, len;
 750         uint16_t davg = 0;
 751         static uint16_t dmin, dmax;
 752         uint8_t uid[10] = {0x00};
 753         uint32_t cuid = 0, nt1, nt2, nttmp, nttest, ks1;
 754         uint8_t par[1] = {0x00};
 755         uint32_t target_nt[2] = {0x00}, target_ks[2] = {0x00};
 756
 757         uint8_t par_array[4] = {0x00};
 758         uint16_t ncount = 0;
 759         struct Crypto1State mpcs = {0, 0};
 760         struct Crypto1State *pcs;
 761         pcs = &mpcs;
 762         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
 763
 764         uint32_t auth1_time, auth2_time;
 765         static uint16_t delta_time = 0;
 766
 767         LED_A_ON();
 768         LED_C_OFF();
 769         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 770
 771         // free eventually allocated BigBuf memory
 772         BigBuf_free(); BigBuf_Clear_ext(false);
 773
 774         if (calibrate) clear_trace();
 775         set_tracing(true);
 776
 777         // statistics on nonce distance
 778         int16_t isOK = 0;
 779         #define NESTED_MAX_TRIES 12
 780         uint16_t unsuccessfull_tries = 0;
 781         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 782                 LED_B_ON();
 783                 WDT_HIT();
 784
 785                 davg = dmax = 0;
 786                 dmin = 2000;
 787                 delta_time = 0;
 788
 789                 for (rtr = 0; rtr < 17; rtr++) {
 790
 791                         // Test if the action was cancelled
 792                         if(BUTTON_PRESS()) {
 793                                 isOK = -2;
 794                                 break;
 795                         }
 796
 797                         // prepare next select. No need to power down the card.
 798                         if(mifare_classic_halt(pcs, cuid)) {
 799                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 800                                 rtr--;
 801                                 continue;
 802                         }
 803
 804                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 805                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 806                                 rtr--;
 807                                 continue;
 808                         };
 809
 810                         auth1_time = 0;
 811                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 812                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 813                                 rtr--;
 814                                 continue;
 815                         };
 816                         auth2_time = (delta_time) ? auth1_time + delta_time : 0;
 817
 818                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 819                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 820                                 rtr--;
 821                                 continue;
 822                         };
 823
 824                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 825                         for (i = 101; i < 1200; i++) {
 826                                 nttmp = prng_successor(nttmp, 1);
 827                                 if (nttmp == nt2) break;
 828                         }
 829
 830                         if (i != 1200) {
 831                                 if (rtr != 0) {
 832                                         davg += i;
 833                                         dmin = MIN(dmin, i);
 834                                         dmax = MAX(dmax, i);
 835                                 }
 836                                 else {
 837                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 838                                 }
 839                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 840                         } else {
 841                                 unsuccessfull_tries++;
 842                                 if (unsuccessfull_tries > NESTED_MAX_TRIES) {   // card isn't vulnerable to nested attack (random numbers are not predictable)
 843                                         isOK = -3;
 844                                 }
 845                         }
 846                 }
 847
 848                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 849
 850                 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
 851
 852                 dmin = davg - 2;
 853                 dmax = davg + 2;
 854
 855                 LED_B_OFF();
 856         }
 857 //  -------------------------------------------------------------------------------------------------
 858
 859         LED_C_ON();
 860
 861         //  get crypted nonces for target sector
 862         for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
 863
 864                 target_nt[i] = 0;
 865                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 866
 867                         // prepare next select. No need to power down the card.
 868                         if(mifare_classic_halt(pcs, cuid)) {
 869                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 870                                 continue;
 871                         }
 872
 873                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
 874                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 875                                 continue;
 876                         };
 877
 878                         auth1_time = 0;
 879                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 880                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 881                                 continue;
 882                         };
 883
 884                         // nested authentication
 885                         auth2_time = auth1_time + delta_time;
 886
 887                         len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 888                         if (len != 4) {
 889                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 890                                 continue;
 891                         };
 892
 893                         nt2 = bytes_to_num(receivedAnswer, 4);
 894                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 895
 896                         // Parity validity check
 897 //                      for (j = 0; j < 4; j++) {
 898 //                              par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 899 //                      }
 900                         par_array[0] = (oddparity8(receivedAnswer[0]) != ((par[0] >> (7-0)) & 0x01));
 901                         par_array[1] = (oddparity8(receivedAnswer[1]) != ((par[0] >> (7-1)) & 0x01));
 902                         par_array[2] = (oddparity8(receivedAnswer[2]) != ((par[0] >> (7-2)) & 0x01));
 903                         par_array[3] = (oddparity8(receivedAnswer[3]) != ((par[0] >> (7-3)) & 0x01));
 904
 905                         ncount = 0;
 906                         nttest = prng_successor(nt1, dmin - 1);
 907                         for (j = dmin; j < dmax + 1; j++) {
 908                                 nttest = prng_successor(nttest, 1);
 909                                 ks1 = nt2 ^ nttest;
 910
 911                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 912                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 913                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 914                                                 target_nt[i] = 0;
 915                                                 break;
 916                                         }
 917                                         target_nt[i] = nttest;
 918                                         target_ks[i] = ks1;
 919                                         ncount++;
 920                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 921                                                 target_nt[i] = 0;
 922                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 923                                                 break;
 924                                         }
 925                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 926                                 }
 927                         }
 928                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 929                 }
 930         }
 931
 932         LED_C_OFF();
 933
 934         crypto1_destroy(pcs);
 935
 936         byte_t buf[4 + 4 * 4] = {0};
 937         memcpy(buf, &cuid, 4);
 938         memcpy(buf+4, &target_nt[0], 4);
 939         memcpy(buf+8, &target_ks[0], 4);
 940         memcpy(buf+12, &target_nt[1], 4);
 941         memcpy(buf+16, &target_ks[1], 4);
 942
 943         LED_B_ON();
 944         cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 945         LED_B_OFF();
 946
 947         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 948
 949         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 950         LEDsoff();
 951         set_tracing(FALSE);
 952 }
 953
 954 //-----------------------------------------------------------------------------
 955 // MIFARE check keys. key count up to 85.
 956 //
 957 //-----------------------------------------------------------------------------
 958 void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) {
 959 #define STD_SEARCH 1
 960 #define EXT_SEARCH 2
 961
 962         uint8_t blockNo = arg0 & 0xFF;
 963         uint8_t keyType = (arg0 >> 8) & 0xFF;
 964         //uint8_t searchType = (arg1 >> 8 ) & 0xFF;
 965         bool clearTrace = arg1 & 0xFF;
 966         uint8_t keyCount = arg2;
 967         uint64_t ui64Key = 0;
 968
 969         bool have_uid = FALSE;
 970         uint8_t cascade_levels = 0;
 971         uint32_t timeout = 0;
 972
 973         int i;
 974         byte_t isOK = 0;
 975         uint8_t uid[10] = {0x00};
 976         uint32_t cuid = 0;
 977         struct Crypto1State mpcs = {0, 0};
 978         struct Crypto1State *pcs;
 979         pcs = &mpcs;
 980
 981         // save old debuglevel, and tempory turn off dbg printing. speedissues.
 982         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 983         MF_DBGLEVEL = MF_DBG_NONE;
 984
 985         LEDsoff();
 986         LED_A_ON();
 987
 988         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 989
 990         if (clearTrace)
 991                 clear_trace();
 992
 993         set_tracing(TRUE);
 994
 995         for (i = 0; i < keyCount; ++i) {
 996
 997                 //mifare_classic_halt(pcs, cuid);
 998
 999                 // this part is from Piwi's faster nonce collecting part in Hardnested.
1000                 if (!have_uid) { // need a full select cycle to get the uid first
1001                         iso14a_card_select_t card_info;
1002                         if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
1003                                 if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Can't select card (ALL)");
1004                                 break;
1005                         }
1006                         switch (card_info.uidlen) {
1007                                 case 4 : cascade_levels = 1; break;
1008                                 case 7 : cascade_levels = 2; break;
1009                                 case 10: cascade_levels = 3; break;
1010                                 default: break;
1011                         }
1012                         have_uid = TRUE;
1013                 } else { // no need for anticollision. We can directly select the card
1014                         if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
1015                                 if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Can't select card (UID)");
1016                                 continue;
1017                         }
1018                 }
1019
1020                 ui64Key = bytes_to_num(datain + i * 6, 6);
1021
1022                 if (mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
1023
1024                         uint8_t dummy_answer = 0;
1025                         ReaderTransmit(&dummy_answer, 1, NULL);
1026                         timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
1027
1028                         // wait for the card to become ready again
1029                         while(GetCountSspClk() < timeout);
1030
1031                         continue;
1032                 }
1033
1034                 // found a key.
1035                 //
1036                 //if ( searchType == EXT_SEARCH) {
1037
1038                 //}
1039                 //else {
1040                         isOK = 1;
1041                         break;
1042                 //}
1043         }
1044
1045         LED_B_ON();
1046     cmd_send(CMD_ACK, isOK, 0, 0, datain + i * 6, 6);
1047
1048         // restore debug level
1049         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1050
1051         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1052         LEDsoff();
1053         set_tracing(FALSE);
1054         crypto1_destroy(pcs);
1055 }
1056
1057 //-----------------------------------------------------------------------------
1058 // MIFARE commands set debug level
1059 //
1060 //-----------------------------------------------------------------------------
1061 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1062         MF_DBGLEVEL = arg0;
1063         Dbprintf("Debug level: %d", MF_DBGLEVEL);
1064 }
1065
1066 //-----------------------------------------------------------------------------
1067 // Work with emulator memory
1068 //
1069 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1070 // involved in dealing with emulator memory. But if it is called later, it might
1071 // destroy the Emulator Memory.
1072 //-----------------------------------------------------------------------------
1073
1074 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1075         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1076         emlClearMem();
1077 }
1078
1079 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1080         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1081         if (arg2==0) arg2 = 16; // backwards compat... default bytewidth
1082         emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width
1083 }
1084
1085 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1086         FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1087         byte_t buf[USB_CMD_DATA_SIZE] = {0x00};
1088         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1089
1090         LED_B_ON();
1091         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1092         LED_B_OFF();
1093 }
1094
1095 //-----------------------------------------------------------------------------
1096 // Load a card into the emulator memory
1097 //
1098 //-----------------------------------------------------------------------------
1099 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1100         uint8_t numSectors = arg0;
1101         uint8_t keyType = arg1;
1102         uint64_t ui64Key = 0;
1103         uint32_t cuid = 0;
1104         struct Crypto1State mpcs = {0, 0};
1105         struct Crypto1State *pcs;
1106         pcs = &mpcs;
1107
1108         // variables
1109         byte_t dataoutbuf[16] = {0x00};
1110         byte_t dataoutbuf2[16] = {0x00};
1111         uint8_t uid[10] = {0x00};
1112
1113         LED_A_ON();
1114         LED_B_OFF();
1115         LED_C_OFF();
1116         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1117
1118         clear_trace();
1119         set_tracing(TRUE);
1120
1121         bool isOK = true;
1122
1123         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1124                 isOK = false;
1125                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1126         }
1127
1128         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1129                 ui64Key = emlGetKey(sectorNo, keyType);
1130                 if (sectorNo == 0){
1131                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1132                                 isOK = false;
1133                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
1134                                 break;
1135                         }
1136                 } else {
1137                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1138                                 isOK = false;
1139                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1140                                 break;
1141                         }
1142                 }
1143
1144                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1145                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1146                                 isOK = false;
1147                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1148                                 break;
1149                         }
1150                         if (isOK) {
1151                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1152                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1153                                 } else {        // sector trailer, keep the keys, set only the AC
1154                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1155                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1156                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
1157                                 }
1158                         }
1159                 }
1160
1161         }
1162
1163         if(mifare_classic_halt(pcs, cuid))
1164                 if (MF_DBGLEVEL >= 1)
1165                         Dbprintf("Halt error");
1166
1167         //  ----------------------------- crypto1 destroy
1168         crypto1_destroy(pcs);
1169
1170         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1171         LEDsoff();
1172
1173         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1174
1175         set_tracing(FALSE);
1176 }
1177
1178
1179 //-----------------------------------------------------------------------------
1180 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1181 //
1182 // PARAMS - workFlags
1183 // bit 0 - need get UID
1184 // bit 1 - need wupC
1185 // bit 2 - need HALT after sequence
1186 // bit 3 - need turn on FPGA before sequence
1187 // bit 4 - need turn off FPGA
1188 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1189 // bit 6 - wipe tag.
1190 //-----------------------------------------------------------------------------
1191 // magic uid card generation 1 commands
1192 uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
1193 uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
1194 uint8_t wipeC[] = { MIFARE_MAGICWIPEC };
1195
1196 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1197
1198         // params
1199         uint8_t workFlags = arg0;
1200         uint8_t blockNo = arg1;
1201
1202         // variables
1203         bool isOK = false; //assume we will get an error
1204         uint8_t errormsg = 0x00;
1205         uint8_t uid[10] = {0x00};
1206         uint8_t data[18] = {0x00};
1207         uint32_t cuid = 0;
1208
1209         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
1210         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
1211
1212         if (workFlags & MAGIC_INIT) {
1213                 LED_A_ON();
1214                 LED_B_OFF();
1215                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1216                 clear_trace();
1217                 set_tracing(TRUE);
1218         }
1219
1220         //loop doesn't loop just breaks out if error
1221         while (true) {
1222                 // read UID and return to client with write
1223                 if (workFlags & MAGIC_UID) {
1224                         if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1225                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Can't select card");
1226                                 errormsg = MAGIC_UID;
1227                         }
1228                         mifare_classic_halt_ex(NULL);
1229                         break;
1230                 }
1231
1232                 // wipe tag, fill it with zeros
1233                 if (workFlags & MAGIC_WIPE){
1234                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1235                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1236                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1237                                 errormsg = MAGIC_WIPE;
1238                                 break;
1239                         }
1240
1241                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1242                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1243                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wipeC error");
1244                                 errormsg = MAGIC_WIPE;
1245                                 break;
1246                         }
1247
1248                         mifare_classic_halt_ex(NULL);
1249                 }
1250
1251                 // write block
1252                 if (workFlags & MAGIC_WUPC) {
1253                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1254                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1255                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC1 error");
1256                                 errormsg = MAGIC_WUPC;
1257                                 break;
1258                         }
1259
1260                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1261                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1262                                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("wupC2 error");
1263                                 errormsg = MAGIC_WUPC;
1264                                 break;
1265                         }
1266                 }
1267
1268                 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1269                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send command error");
1270                         errormsg = 4;
1271                         break;
1272                 }
1273
1274                 memcpy(data, datain, 16);
1275                 AppendCrc14443a(data, 16);
1276
1277                 ReaderTransmit(data, sizeof(data), NULL);
1278                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1279                         if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("write block send data error");
1280                         errormsg = 0;
1281                         break;
1282                 }
1283
1284                 if (workFlags & MAGIC_OFF)
1285                         mifare_classic_halt_ex(NULL);
1286
1287                 isOK = true;
1288                 break;
1289
1290         } // end while
1291
1292         if (isOK )
1293                 cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));
1294         else
1295                 OnErrorMagic(errormsg);
1296
1297         if (workFlags & MAGIC_OFF)
1298                 OnSuccessMagic();
1299 }
1300
1301 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1302
1303         uint8_t workFlags = arg0;
1304         uint8_t blockNo = arg1;
1305         uint8_t errormsg = 0x00;
1306         bool isOK = false; //assume we will get an error
1307
1308         // variables
1309         uint8_t data[MAX_MIFARE_FRAME_SIZE];
1310         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
1311         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
1312
1313         memset(data, 0x00, sizeof(data));
1314
1315         if (workFlags & MAGIC_INIT) {
1316                 LED_A_ON();
1317                 LED_B_OFF();
1318                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1319                 clear_trace();
1320                 set_tracing(TRUE);
1321         }
1322
1323         //loop doesn't loop just breaks out if error or done
1324         while (true) {
1325                 if (workFlags & MAGIC_WUPC) {
1326                         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1327                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1328                                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1329                                 errormsg = MAGIC_WUPC;
1330                                 break;
1331                         }
1332
1333                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1334                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1335                                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1336                                 errormsg = MAGIC_WUPC;
1337                                 break;
1338                         }
1339                 }
1340
1341                 // read block
1342                 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1343                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");
1344                         errormsg = 0;
1345                         break;
1346                 }
1347
1348                 memcpy(data, receivedAnswer, sizeof(data));
1349
1350                 // send HALT
1351                 if (workFlags & MAGIC_HALT)
1352                         mifare_classic_halt_ex(NULL);
1353
1354                 isOK = true;
1355                 break;
1356         }
1357         // if MAGIC_DATAIN, the data stays on device side.
1358         if (workFlags & MAGIC_DATAIN) {
1359                 if (isOK)
1360                         memcpy(datain, data, sizeof(data));
1361         } else {
1362                 if (isOK)
1363                         cmd_send(CMD_ACK,1,0,0,data,sizeof(data));
1364                 else
1365                         OnErrorMagic(errormsg);
1366         }
1367
1368         if (workFlags & MAGIC_OFF)
1369                 OnSuccessMagic();
1370 }
1371
1372 void MifareCIdent(){
1373         #define GEN_1A 1
1374         #define GEN_1B 2
1375         #define GEN_2  4
1376         // variables
1377         uint8_t isGen = 0;
1378         uint8_t rec[1] = {0x00};
1379         uint8_t recpar[1] = {0x00};
1380
1381         // Generation 1 test
1382         ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);
1383         if(!ReaderReceive(rec, recpar) || (rec[0] != 0x0a)) {
1384                 goto TEST2;
1385         };
1386         isGen = GEN_1B;
1387
1388         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1389         if(!ReaderReceive(rec, recpar) || (rec[0] != 0x0a)) {
1390                 goto OUT;
1391         };
1392         isGen = GEN_1A;
1393         goto OUT;
1394
1395 TEST2:;
1396 /*
1397         // Generation 2 test
1398         struct Crypto1State mpcs = {0, 0};
1399         struct Crypto1State *pcs = &mpcs;
1400
1401         // halt previous.
1402         mifare_classic_halt(NULL, 0);
1403
1404         //select
1405         if (!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
1406                 goto OUT;
1407         };
1408
1409         // MIFARE_CLASSIC_WRITEBLOCK 0xA0
1410         // ACK 0x0a
1411         uint16_t len = mifare_sendcmd_short(pcs, 1, 0xA0, 0, rec, recpar, NULL);
1412         if ((len != 1) || (rec[0] != 0x0A)) {
1413                 isGen = GEN_2;
1414         };
1415         */
1416 OUT:;
1417         // removed the if,  since some magic tags misbehavies and send an answer to it.
1418         mifare_classic_halt(NULL, 0);
1419         cmd_send(CMD_ACK,isGen, 0, 0, 0, 0);
1420 }
1421
1422 void OnSuccessMagic(){
1423         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1424         LEDsoff();
1425         set_tracing(FALSE);
1426 }
1427 void OnErrorMagic(uint8_t reason){
1428         //          ACK, ISOK, reason,0,0,0
1429         cmd_send(CMD_ACK,0,reason,0,0,0);
1430         OnSuccessMagic();
1431 }
1432
1433 void MifareSetMod(uint8_t mod, uint8_t *key) {
1434         uint64_t ui64Key = bytes_to_num(key, 6);
1435
1436         // variables
1437         uint8_t isOK = 0;
1438         uint8_t uid[10] = {0};
1439         uint32_t cuid = 0;
1440         struct Crypto1State mpcs = {0, 0};
1441         struct Crypto1State *pcs = &mpcs;
1442         int respLen = 0;
1443         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0};
1444         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0};
1445
1446         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1447
1448         clear_trace();
1449         set_tracing(true);
1450
1451         LED_A_ON();
1452         LED_B_OFF();
1453         LED_C_OFF();
1454
1455         while (true) {
1456                 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1457                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1458                         break;
1459                 }
1460
1461                 if(mifare_classic_auth(pcs, cuid, 0, 0, ui64Key, AUTH_FIRST)) {
1462                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
1463                         break;
1464                 }
1465
1466                 if (((respLen = mifare_sendcmd_short(pcs, 1, 0x43, mod, receivedAnswer, receivedAnswerPar, NULL)) != 1) || (receivedAnswer[0] != 0x0a)) {
1467                         if (MF_DBGLEVEL >= 1)   Dbprintf("SetMod error; response[0]: %hhX, len: %d", receivedAnswer[0], respLen);
1468                         break;
1469                 }
1470
1471                 if(mifare_classic_halt(pcs, cuid)) {
1472                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1473                         break;
1474                 }
1475
1476                 isOK = 1;
1477                 break;
1478         }
1479
1480         crypto1_destroy(pcs);
1481
1482         LED_B_ON();
1483         cmd_send(CMD_ACK, isOK, 0, 0, 0, 0);
1484         LED_B_OFF();
1485
1486         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1487         LEDsoff();
1488 }
1489
1490 //
1491 // DESFIRE
1492 //
1493 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1494         byte_t dataout[12] = {0x00};
1495         uint8_t uid[10] = {0x00};
1496         uint32_t cuid = 0;
1497
1498         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1499         clear_trace();
1500         set_tracing(true);
1501
1502         int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);
1503         if(!len) {
1504                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1505                 OnError(1);
1506                 return;
1507         };
1508
1509         if(mifare_desfire_des_auth1(cuid, dataout)){
1510                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1511                 OnError(4);
1512                 return;
1513         }
1514
1515         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1516     cmd_send(CMD_ACK, 1, cuid, 0, dataout, sizeof(dataout));
1517 }
1518
1519 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1520         uint32_t cuid = arg0;
1521         uint8_t key[16] = {0x00};
1522         byte_t dataout[12] = {0x00};
1523         byte_t isOK = 0;
1524
1525         memcpy(key, datain, 16);
1526
1527         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1528
1529         if( isOK) {
1530             if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1531                 OnError(4);
1532                 return;
1533         }
1534
1535         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1536
1537         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1538         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1539         LEDsoff();
1540         set_tracing(FALSE);
1541 }