]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
projects / proxmark3-svn / blob
? search:


fcfd7e8fddb80f9c1bac092def66cd5fbb1d23c0
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17
18 #include "apps.h"
19 #include "util.h"
20 #include "parity.h"
21 #include "crc.h"
22
23 // the block number for the ISO14443-4 PCB
24 static uint8_t pcb_blocknum = 0;
25 // Deselect card by sending a s-block. the crc is precalced for speed
26 static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
27
28 //-----------------------------------------------------------------------------
29 // Select, Authenticate, Read a MIFARE tag.
30 // read block
31 //-----------------------------------------------------------------------------
32 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
33 {
34 // params
35 uint8_t blockNo = arg0;
36 uint8_t keyType = arg1;
37 uint64_t ui64Key = 0;
38 ui64Key = bytes_to_num(datain, 6);
39
40 // variables
41 byte_t isOK = 0;
42 byte_t dataoutbuf[16];
43 uint8_t uid[10];
44 uint32_t cuid;
45 struct Crypto1State mpcs = {0, 0};
46 struct Crypto1State *pcs;
47 pcs = &mpcs;
48
49 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
50
51 clear_trace();
52
53 LED_A_ON();
54 LED_B_OFF();
55 LED_C_OFF();
56
57 while (true) {
58 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
59 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
60 break;
61 };
62
63 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
64 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
65 break;
66 };
67
68 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
69 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
70 break;
71 };
72
73 if(mifare_classic_halt(pcs, cuid)) {
74 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
75 break;
76 };
77
78 isOK = 1;
79 break;
80 }
81
82 // ----------------------------- crypto1 destroy
83 crypto1_destroy(pcs);
84
85 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
86
87 LED_B_ON();
88 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
89 LED_B_OFF();
90
91 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
92 LEDsoff();
93 }
94
95 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
96
97 bool turnOffField = (arg0 == 1);
98
99 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
100
101 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
102
103 clear_trace();
104
105 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
106 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
107 OnError(0);
108 return;
109 };
110
111 if(!mifare_ultra_auth(keybytes)){
112 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
113 OnError(1);
114 return;
115 }
116
117 if (turnOffField) {
118 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
119 LEDsoff();
120 }
121 cmd_send(CMD_ACK,1,0,0,0,0);
122 }
123
124 // Arg0 = BlockNo,
125 // Arg1 = UsePwd bool
126 // datain = PWD bytes,
127 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
128 {
129 uint8_t blockNo = arg0;
130 byte_t dataout[16] = {0x00};
131 bool useKey = (arg1 == 1); //UL_C
132 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
133
134 LEDsoff();
135 LED_A_ON();
136 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
137
138 clear_trace();
139
140 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
141 if(!len) {
142 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
143 OnError(1);
144 return;
145 }
146
147 // UL-C authentication
148 if ( useKey ) {
149 uint8_t key[16] = {0x00};
150 memcpy(key, datain, sizeof(key) );
151
152 if ( !mifare_ultra_auth(key) ) {
153 OnError(1);
154 return;
155 }
156 }
157
158 // UL-EV1 / NTAG authentication
159 if ( usePwd ) {
160 uint8_t pwd[4] = {0x00};
161 memcpy(pwd, datain, 4);
162 uint8_t pack[4] = {0,0,0,0};
163 if (!mifare_ul_ev1_auth(pwd, pack)) {
164 OnError(1);
165 return;
166 }
167 }
168
169 if( mifare_ultra_readblock(blockNo, dataout) ) {
170 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
171 OnError(2);
172 return;
173 }
174
175 if( mifare_ultra_halt() ) {
176 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
177 OnError(3);
178 return;
179 }
180
181 cmd_send(CMD_ACK,1,0,0,dataout,16);
182 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
183 LEDsoff();
184 }
185
186 //-----------------------------------------------------------------------------
187 // Select, Authenticate, Read a MIFARE tag.
188 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
189 //-----------------------------------------------------------------------------
190 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
191 {
192 // params
193 uint8_t sectorNo = arg0;
194 uint8_t keyType = arg1;
195 uint64_t ui64Key = 0;
196 ui64Key = bytes_to_num(datain, 6);
197
198 // variables
199 byte_t isOK = 0;
200 byte_t dataoutbuf[16 * 16];
201 uint8_t uid[10];
202 uint32_t cuid;
203 struct Crypto1State mpcs = {0, 0};
204 struct Crypto1State *pcs;
205 pcs = &mpcs;
206
207 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
208
209 clear_trace();
210
211 LED_A_ON();
212 LED_B_OFF();
213 LED_C_OFF();
214
215 isOK = 1;
216 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
217 isOK = 0;
218 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
219 }
220
221
222 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
223 isOK = 0;
224 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
225 }
226
227 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
228 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
229 isOK = 0;
230 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
231 break;
232 }
233 }
234
235 if(mifare_classic_halt(pcs, cuid)) {
236 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
237 }
238
239 // ----------------------------- crypto1 destroy
240 crypto1_destroy(pcs);
241
242 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
243
244 LED_B_ON();
245 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
246 LED_B_OFF();
247
248 // Thats it...
249 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
250 LEDsoff();
251 }
252
253 // arg0 = blockNo (start)
254 // arg1 = Pages (number of blocks)
255 // arg2 = useKey
256 // datain = KEY bytes
257 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
258 {
259 LEDsoff();
260 LED_A_ON();
261 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
262
263 // free eventually allocated BigBuf memory
264 BigBuf_free();
265 clear_trace();
266
267 // params
268 uint8_t blockNo = arg0;
269 uint16_t blocks = arg1;
270 bool useKey = (arg2 == 1); //UL_C
271 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
272 uint32_t countblocks = 0;
273 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
274 if (dataout == NULL){
275 Dbprintf("out of memory");
276 OnError(1);
277 return;
278 }
279
280 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);
281 if (!len) {
282 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
283 OnError(1);
284 return;
285 }
286
287 // UL-C authentication
288 if ( useKey ) {
289 uint8_t key[16] = {0x00};
290 memcpy(key, datain, sizeof(key) );
291
292 if ( !mifare_ultra_auth(key) ) {
293 OnError(1);
294 return;
295 }
296 }
297
298 // UL-EV1 / NTAG authentication
299 if (usePwd) {
300 uint8_t pwd[4] = {0x00};
301 memcpy(pwd, datain, sizeof(pwd));
302 uint8_t pack[4] = {0,0,0,0};
303
304 if (!mifare_ul_ev1_auth(pwd, pack)){
305 OnError(1);
306 return;
307 }
308 }
309
310 for (int i = 0; i < blocks; i++){
311 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
312 Dbprintf("Data exceeds buffer!!");
313 break;
314 }
315
316 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
317
318 if (len) {
319 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
320 // if no blocks read - error out
321 if (i==0){
322 OnError(2);
323 return;
324 } else {
325 //stop at last successful read block and return what we got
326 break;
327 }
328 } else {
329 countblocks++;
330 }
331 }
332
333 len = mifare_ultra_halt();
334 if (len) {
335 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
336 OnError(3);
337 return;
338 }
339
340 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
341
342 countblocks *= 4;
343
344 cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
345 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
346 LEDsoff();
347 BigBuf_free();
348 }
349
350 //-----------------------------------------------------------------------------
351 // Select, Authenticate, Write a MIFARE tag.
352 // read block
353 //-----------------------------------------------------------------------------
354 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
355 {
356 // params
357 uint8_t blockNo = arg0;
358 uint8_t keyType = arg1;
359 uint64_t ui64Key = 0;
360 byte_t blockdata[16];
361
362 ui64Key = bytes_to_num(datain, 6);
363 memcpy(blockdata, datain + 10, 16);
364
365 // variables
366 byte_t isOK = 0;
367 uint8_t uid[10];
368 uint32_t cuid;
369 struct Crypto1State mpcs = {0, 0};
370 struct Crypto1State *pcs;
371 pcs = &mpcs;
372
373 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
374
375 clear_trace();
376
377 LED_A_ON();
378 LED_B_OFF();
379 LED_C_OFF();
380
381 while (true) {
382 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
383 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
384 break;
385 };
386
387 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
388 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
389 break;
390 };
391
392 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
393 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
394 break;
395 };
396
397 if(mifare_classic_halt(pcs, cuid)) {
398 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
399 break;
400 };
401
402 isOK = 1;
403 break;
404 }
405
406 // ----------------------------- crypto1 destroy
407 crypto1_destroy(pcs);
408
409 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
410
411 LED_B_ON();
412 cmd_send(CMD_ACK,isOK,0,0,0,0);
413 LED_B_OFF();
414
415
416 // Thats it...
417 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
418 LEDsoff();
419 }
420
421 /* // Command not needed but left for future testing
422 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
423 {
424 uint8_t blockNo = arg0;
425 byte_t blockdata[16] = {0x00};
426
427 memcpy(blockdata, datain, 16);
428
429 uint8_t uid[10] = {0x00};
430
431 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
432
433 clear_trace();
434 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
435
436 if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
437 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
438 OnError(0);
439 return;
440 };
441
442 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
443 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
444 OnError(0);
445 return; };
446
447 if(mifare_ultra_halt()) {
448 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
449 OnError(0);
450 return;
451 };
452
453 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
454
455 cmd_send(CMD_ACK,1,0,0,0,0);
456 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
457 LEDsoff();
458 }
459 */
460
461 // Arg0 : Block to write to.
462 // Arg1 : 0 = use no authentication.
463 // 1 = use 0x1A authentication.
464 // 2 = use 0x1B authentication.
465 // datain : 4 first bytes is data to be written.
466 // : 4/16 next bytes is authentication key.
467 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
468 {
469 uint8_t blockNo = arg0;
470 bool useKey = (arg1 == 1); //UL_C
471 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
472 byte_t blockdata[4] = {0x00};
473
474 memcpy(blockdata, datain,4);
475
476 LEDsoff();
477 LED_A_ON();
478 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
479
480 clear_trace();
481
482 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
483 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
484 OnError(0);
485 return;
486 };
487
488 // UL-C authentication
489 if ( useKey ) {
490 uint8_t key[16] = {0x00};
491 memcpy(key, datain+4, sizeof(key) );
492
493 if ( !mifare_ultra_auth(key) ) {
494 OnError(1);
495 return;
496 }
497 }
498
499 // UL-EV1 / NTAG authentication
500 if (usePwd) {
501 uint8_t pwd[4] = {0x00};
502 memcpy(pwd, datain+4, 4);
503 uint8_t pack[4] = {0,0,0,0};
504 if (!mifare_ul_ev1_auth(pwd, pack)) {
505 OnError(1);
506 return;
507 }
508 }
509
510 if(mifare_ultra_writeblock(blockNo, blockdata)) {
511 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
512 OnError(0);
513 return;
514 };
515
516 if(mifare_ultra_halt()) {
517 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
518 OnError(0);
519 return;
520 };
521
522 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
523
524 cmd_send(CMD_ACK,1,0,0,0,0);
525 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
526 LEDsoff();
527 }
528
529 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
530
531 uint8_t pwd[16] = {0x00};
532 byte_t blockdata[4] = {0x00};
533
534 memcpy(pwd, datain, 16);
535
536 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
537 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
538
539 clear_trace();
540
541 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {
542 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
543 OnError(0);
544 return;
545 };
546
547 blockdata[0] = pwd[7];
548 blockdata[1] = pwd[6];
549 blockdata[2] = pwd[5];
550 blockdata[3] = pwd[4];
551 if(mifare_ultra_writeblock( 44, blockdata)) {
552 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
553 OnError(44);
554 return;
555 };
556
557 blockdata[0] = pwd[3];
558 blockdata[1] = pwd[2];
559 blockdata[2] = pwd[1];
560 blockdata[3] = pwd[0];
561 if(mifare_ultra_writeblock( 45, blockdata)) {
562 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
563 OnError(45);
564 return;
565 };
566
567 blockdata[0] = pwd[15];
568 blockdata[1] = pwd[14];
569 blockdata[2] = pwd[13];
570 blockdata[3] = pwd[12];
571 if(mifare_ultra_writeblock( 46, blockdata)) {
572 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
573 OnError(46);
574 return;
575 };
576
577 blockdata[0] = pwd[11];
578 blockdata[1] = pwd[10];
579 blockdata[2] = pwd[9];
580 blockdata[3] = pwd[8];
581 if(mifare_ultra_writeblock( 47, blockdata)) {
582 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
583 OnError(47);
584 return;
585 };
586
587 if(mifare_ultra_halt()) {
588 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
589 OnError(0);
590 return;
591 };
592
593 cmd_send(CMD_ACK,1,0,0,0,0);
594 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
595 LEDsoff();
596 }
597
598 // Return 1 if the nonce is invalid else return 0
599 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
600 return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
601 (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
602 (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
603 }
604
605
606 //-----------------------------------------------------------------------------
607 // acquire encrypted nonces in order to perform the attack described in
608 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
609 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
610 // Computer and Communications Security, 2015
611 //-----------------------------------------------------------------------------
612 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
613 {
614 uint64_t ui64Key = 0;
615 uint8_t uid[10];
616 uint32_t cuid;
617 uint8_t cascade_levels = 0;
618 struct Crypto1State mpcs = {0, 0};
619 struct Crypto1State *pcs;
620 pcs = &mpcs;
621 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
622 int16_t isOK = 0;
623 uint8_t par_enc[1];
624 uint8_t nt_par_enc = 0;
625 uint8_t buf[USB_CMD_DATA_SIZE];
626 uint32_t timeout;
627
628 uint8_t blockNo = arg0 & 0xff;
629 uint8_t keyType = (arg0 >> 8) & 0xff;
630 uint8_t targetBlockNo = arg1 & 0xff;
631 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
632 ui64Key = bytes_to_num(datain, 6);
633 bool initialize = flags & 0x0001;
634 bool slow = flags & 0x0002;
635 bool field_off = flags & 0x0004;
636
637 LED_A_ON();
638 LED_C_OFF();
639
640 if (initialize) {
641 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
642 clear_trace();
643 set_tracing(true);
644 }
645
646 LED_C_ON();
647
648 uint16_t num_nonces = 0;
649 bool have_uid = false;
650 for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
651
652 // Test if the action was cancelled
653 if(BUTTON_PRESS()) {
654 isOK = 2;
655 field_off = true;
656 break;
657 }
658
659 if (!have_uid) { // need a full select cycle to get the uid first
660 iso14a_card_select_t card_info;
661 if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
662 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");
663 continue;
664 }
665 switch (card_info.uidlen) {
666 case 4 : cascade_levels = 1; break;
667 case 7 : cascade_levels = 2; break;
668 case 10: cascade_levels = 3; break;
669 default: break;
670 }
671 have_uid = true;
672 } else { // no need for anticollision. We can directly select the card
673 if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {
674 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");
675 continue;
676 }
677 }
678
679 if (slow) {
680 timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
681 while(GetCountSspClk() < timeout);
682 }
683
684 uint32_t nt1;
685 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
686 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
687 continue;
688 }
689
690 // nested authentication
691 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
692 if (len != 4) {
693 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
694 continue;
695 }
696
697 // send a dummy response in order to trigger the cards authentication failure timeout
698 uint8_t dummy_answer[8] = {0};
699 ReaderTransmit(dummy_answer, 8, NULL);
700
701 num_nonces++;
702 if (num_nonces % 2) {
703 memcpy(buf+i, receivedAnswer, 4);
704 nt_par_enc = par_enc[0] & 0xf0;
705 } else {
706 nt_par_enc |= par_enc[0] >> 4;
707 memcpy(buf+i+4, receivedAnswer, 4);
708 memcpy(buf+i+8, &nt_par_enc, 1);
709 i += 9;
710 }
711
712 }
713
714 LED_C_OFF();
715
716 crypto1_destroy(pcs);
717
718 LED_B_ON();
719 cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
720 LED_B_OFF();
721
722 if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
723
724 if (field_off) {
725 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
726 LEDsoff();
727 }
728 }
729
730
731 //-----------------------------------------------------------------------------
732 // MIFARE nested authentication.
733 //
734 //-----------------------------------------------------------------------------
735 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
736 {
737 // params
738 uint8_t blockNo = arg0 & 0xff;
739 uint8_t keyType = (arg0 >> 8) & 0xff;
740 uint8_t targetBlockNo = arg1 & 0xff;
741 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
742 uint64_t ui64Key = 0;
743
744 ui64Key = bytes_to_num(datain, 6);
745
746 // variables
747 uint16_t rtr, i, j, len;
748 uint16_t davg;
749 static uint16_t dmin, dmax;
750 uint8_t uid[10];
751 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
752 uint8_t par[1];
753 uint32_t target_nt[2], target_ks[2];
754
755 uint8_t par_array[4];
756 uint16_t ncount = 0;
757 struct Crypto1State mpcs = {0, 0};
758 struct Crypto1State *pcs;
759 pcs = &mpcs;
760 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
761
762 uint32_t auth1_time, auth2_time;
763 static uint16_t delta_time;
764
765 LED_A_ON();
766 LED_C_OFF();
767 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
768
769 // free eventually allocated BigBuf memory
770 BigBuf_free();
771
772 if (calibrate) clear_trace();
773 set_tracing(true);
774
775 // statistics on nonce distance
776 int16_t isOK = 0;
777 #define NESTED_MAX_TRIES 12
778 uint16_t unsuccessfull_tries = 0;
779 if (calibrate) { // for first call only. Otherwise reuse previous calibration
780 LED_B_ON();
781 WDT_HIT();
782
783 davg = dmax = 0;
784 dmin = 2000;
785 delta_time = 0;
786
787 for (rtr = 0; rtr < 17; rtr++) {
788
789 // Test if the action was cancelled
790 if(BUTTON_PRESS()) {
791 isOK = -2;
792 break;
793 }
794
795 // prepare next select. No need to power down the card.
796 if(mifare_classic_halt(pcs, cuid)) {
797 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
798 rtr--;
799 continue;
800 }
801
802 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
803 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
804 rtr--;
805 continue;
806 };
807
808 auth1_time = 0;
809 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
810 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
811 rtr--;
812 continue;
813 };
814
815 if (delta_time) {
816 auth2_time = auth1_time + delta_time;
817 } else {
818 auth2_time = 0;
819 }
820 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
821 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
822 rtr--;
823 continue;
824 };
825
826 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
827 for (i = 101; i < 1200; i++) {
828 nttmp = prng_successor(nttmp, 1);
829 if (nttmp == nt2) break;
830 }
831
832 if (i != 1200) {
833 if (rtr != 0) {
834 davg += i;
835 dmin = MIN(dmin, i);
836 dmax = MAX(dmax, i);
837 }
838 else {
839 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
840 }
841 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
842 } else {
843 unsuccessfull_tries++;
844 if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)
845 isOK = -3;
846 }
847 }
848 }
849
850 davg = (davg + (rtr - 1)/2) / (rtr - 1);
851
852 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
853
854 dmin = davg - 2;
855 dmax = davg + 2;
856
857 LED_B_OFF();
858
859 }
860 // -------------------------------------------------------------------------------------------------
861
862 LED_C_ON();
863
864 // get crypted nonces for target sector
865 for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
866
867 target_nt[i] = 0;
868 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
869
870 // prepare next select. No need to power down the card.
871 if(mifare_classic_halt(pcs, cuid)) {
872 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
873 continue;
874 }
875
876 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
877 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
878 continue;
879 };
880
881 auth1_time = 0;
882 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
883 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
884 continue;
885 };
886
887 // nested authentication
888 auth2_time = auth1_time + delta_time;
889 len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
890 if (len != 4) {
891 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
892 continue;
893 };
894
895 nt2 = bytes_to_num(receivedAnswer, 4);
896 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
897
898 // Parity validity check
899 for (j = 0; j < 4; j++) {
900 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
901 }
902
903 ncount = 0;
904 nttest = prng_successor(nt1, dmin - 1);
905 for (j = dmin; j < dmax + 1; j++) {
906 nttest = prng_successor(nttest, 1);
907 ks1 = nt2 ^ nttest;
908
909 if (valid_nonce(nttest, nt2, ks1, par_array)){
910 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
911 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
912 target_nt[i] = 0;
913 break;
914 }
915 target_nt[i] = nttest;
916 target_ks[i] = ks1;
917 ncount++;
918 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
919 target_nt[i] = 0;
920 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
921 break;
922 }
923 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
924 }
925 }
926 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
927 }
928 }
929
930 LED_C_OFF();
931
932 // ----------------------------- crypto1 destroy
933 crypto1_destroy(pcs);
934
935 byte_t buf[4 + 4 * 4];
936 memcpy(buf, &cuid, 4);
937 memcpy(buf+4, &target_nt[0], 4);
938 memcpy(buf+8, &target_ks[0], 4);
939 memcpy(buf+12, &target_nt[1], 4);
940 memcpy(buf+16, &target_ks[1], 4);
941
942 LED_B_ON();
943 cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
944 LED_B_OFF();
945
946 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
947
948 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
949 LEDsoff();
950 }
951
952 //-----------------------------------------------------------------------------
953 // MIFARE check keys. key count up to 85.
954 //
955 //-----------------------------------------------------------------------------
956 void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
957 {
958 uint8_t blockNo = arg0 & 0xff;
959 uint8_t keyType = (arg0 >> 8) & 0xff;
960 bool clearTrace = arg1 & 0x01;
961 bool multisectorCheck = arg1 & 0x02;
962 uint8_t set14aTimeout = (arg1 >> 8) & 0xff;
963 uint8_t keyCount = arg2;
964
965 // clear debug level
966 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
967 MF_DBGLEVEL = MF_DBG_NONE;
968
969 LED_A_ON();
970 LED_B_OFF();
971 LED_C_OFF();
972 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
973
974 if (clearTrace) clear_trace();
975 set_tracing(true);
976
977 if (set14aTimeout){
978 iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe
979 }
980
981 if (multisectorCheck) {
982 TKeyIndex keyIndex = {{0}};
983 uint8_t sectorCnt = blockNo;
984 int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex);
985
986 LED_B_ON();
987 if (res >= 0) {
988 cmd_send(CMD_ACK, 1, 0, 0, keyIndex, 80);
989 } else {
990 cmd_send(CMD_ACK, 0, 0, 0, NULL, 0);
991 }
992 LED_B_OFF();
993 } else {
994 int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL);
995
996 LED_B_ON();
997 if (res > 0) {
998 cmd_send(CMD_ACK, 1, 0, 0, datain + (res - 1) * 6, 6);
999 } else {
1000 cmd_send(CMD_ACK, 0, 0, 0, NULL, 0);
1001 }
1002 LED_B_OFF();
1003 }
1004
1005 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1006 LEDsoff();
1007
1008 // restore debug level
1009 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1010 }
1011
1012 //-----------------------------------------------------------------------------
1013 // MIFARE commands set debug level
1014 //
1015 //-----------------------------------------------------------------------------
1016 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1017 MF_DBGLEVEL = arg0;
1018 Dbprintf("Debug level: %d", MF_DBGLEVEL);
1019 }
1020
1021 //-----------------------------------------------------------------------------
1022 // Work with emulator memory
1023 //
1024 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1025 // involved in dealing with emulator memory. But if it is called later, it might
1026 // destroy the Emulator Memory.
1027 //-----------------------------------------------------------------------------
1028
1029 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1030 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1031 emlClearMem();
1032 }
1033
1034 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1035 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1036 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
1037 }
1038
1039 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1040 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1041 byte_t buf[USB_CMD_DATA_SIZE];
1042 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1043
1044 LED_B_ON();
1045 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1046 LED_B_OFF();
1047 }
1048
1049 //-----------------------------------------------------------------------------
1050 // Load a card into the emulator memory
1051 //
1052 //-----------------------------------------------------------------------------
1053 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1054 uint8_t numSectors = arg0;
1055 uint8_t keyType = arg1;
1056 uint64_t ui64Key = 0;
1057 uint32_t cuid;
1058 struct Crypto1State mpcs = {0, 0};
1059 struct Crypto1State *pcs;
1060 pcs = &mpcs;
1061
1062 // variables
1063 byte_t dataoutbuf[16];
1064 byte_t dataoutbuf2[16];
1065 uint8_t uid[10];
1066
1067 LED_A_ON();
1068 LED_B_OFF();
1069 LED_C_OFF();
1070 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1071
1072 clear_trace();
1073 set_tracing(false);
1074
1075 bool isOK = true;
1076
1077 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1078 isOK = false;
1079 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1080 }
1081
1082 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1083 ui64Key = emlGetKey(sectorNo, keyType);
1084 if (sectorNo == 0){
1085 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1086 isOK = false;
1087 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1088 break;
1089 }
1090 } else {
1091 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1092 isOK = false;
1093 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1094 break;
1095 }
1096 }
1097
1098 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1099 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1100 isOK = false;
1101 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1102 break;
1103 };
1104 if (isOK) {
1105 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1106 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1107 } else { // sector trailer, keep the keys, set only the AC
1108 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1109 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1110 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1111 }
1112 }
1113 }
1114
1115 }
1116
1117 if(mifare_classic_halt(pcs, cuid)) {
1118 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1119 };
1120
1121 // ----------------------------- crypto1 destroy
1122 crypto1_destroy(pcs);
1123
1124 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1125 LEDsoff();
1126
1127 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1128
1129 }
1130
1131
1132 //-----------------------------------------------------------------------------
1133 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1134 //
1135 //-----------------------------------------------------------------------------
1136
1137 static bool isBlockTrailer(int blockN) {
1138 if (blockN >= 0 && blockN < 128) {
1139 return ((blockN & 0x03) == 0x03);
1140 }
1141 if (blockN >= 128 && blockN <= 256) {
1142 return ((blockN & 0x0F) == 0x0F);
1143 }
1144 return FALSE;
1145 }
1146
1147 void MifareCWipe(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1148 // var
1149 byte_t isOK = 0;
1150 uint32_t numBlocks = arg0;
1151 // cmdParams:
1152 // bit 0 - wipe gen1a
1153 // bit 1 - fill card with default data
1154 // bit 2 - gen1a = 0, gen1b = 1
1155 uint8_t cmdParams = arg1;
1156 bool needWipe = cmdParams & 0x01;
1157 bool needFill = cmdParams & 0x02;
1158 bool gen1b = cmdParams & 0x04;
1159
1160 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1161 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1162
1163 uint8_t block0[16] = {0x01, 0x02, 0x03, 0x04, 0x04, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0xAF};
1164 uint8_t block1[16] = {0x00};
1165 uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
1166 uint8_t d_block[18] = {0x00};
1167
1168 // card commands
1169 uint8_t wupC1[] = { 0x40 };
1170 uint8_t wupC2[] = { 0x43 };
1171 uint8_t wipeC[] = { 0x41 };
1172
1173 // iso14443 setup
1174 LED_A_ON();
1175 LED_B_OFF();
1176 LED_C_OFF();
1177 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1178
1179 // tracing
1180 clear_trace();
1181 set_tracing(true);
1182
1183 while (true){
1184 // wipe
1185 if (needWipe){
1186 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1187 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1188 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1189 break;
1190 };
1191
1192 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1193 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1194 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1195 break;
1196 };
1197
1198 if(mifare_classic_halt(NULL, 0)) {
1199 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1200 };
1201 };
1202
1203 // put default data
1204 if (needFill){
1205 // select commands
1206 ReaderTransmitBitsPar(wupC1, 7, 0, NULL);
1207
1208 // gen1b magic tag : do no issue wupC2 and don't expect 0x0a response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1209 if (!gen1b) {
1210
1211 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1212 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1213 break;
1214 };
1215
1216 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1217 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1218 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1219 break;
1220 };
1221 }
1222
1223 // send blocks command
1224 for (int blockNo = 0; blockNo < numBlocks; blockNo++) {
1225 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1226 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1227 break;
1228 };
1229
1230 // check type of block and add crc
1231 if (!isBlockTrailer(blockNo)){
1232 memcpy(d_block, block1, 16);
1233 } else {
1234 memcpy(d_block, blockK, 16);
1235 }
1236 if (blockNo == 0) {
1237 memcpy(d_block, block0, 16);
1238 }
1239 AppendCrc14443a(d_block, 16);
1240
1241 // send write command
1242 ReaderTransmit(d_block, sizeof(d_block), NULL);
1243 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1244 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1245 break;
1246 };
1247 }
1248
1249 // halt
1250 // do no issue halt command for gen1b
1251 if (!gen1b) {
1252 if (mifare_classic_halt(NULL, 0)) {
1253 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1254 break;
1255 }
1256 }
1257 }
1258 break;
1259 }
1260
1261 // send USB response
1262 LED_B_ON();
1263 cmd_send(CMD_ACK,isOK,0,0,NULL,0);
1264 LED_B_OFF();
1265
1266 // reset fpga
1267 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1268 LEDsoff();
1269
1270 return;
1271 }
1272
1273 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1274
1275 // params
1276 uint8_t needWipe = arg0;
1277 // bit 0 - need get UID
1278 // bit 1 - need wupC
1279 // bit 2 - need HALT after sequence
1280 // bit 3 - need init FPGA and field before sequence
1281 // bit 4 - need reset FPGA and LED
1282 // bit 6 - gen1b backdoor type
1283 uint8_t workFlags = arg1;
1284 uint8_t blockNo = arg2;
1285
1286 // card commands
1287 uint8_t wupC1[] = { 0x40 };
1288 uint8_t wupC2[] = { 0x43 };
1289 uint8_t wipeC[] = { 0x41 };
1290
1291 // variables
1292 byte_t isOK = 0;
1293 uint8_t uid[10] = {0x00};
1294 uint8_t d_block[18] = {0x00};
1295 uint32_t cuid;
1296
1297 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1298 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1299
1300 // reset FPGA and LED
1301 if (workFlags & 0x08) {
1302 LED_A_ON();
1303 LED_B_OFF();
1304 LED_C_OFF();
1305 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1306
1307 clear_trace();
1308 set_tracing(true);
1309 }
1310
1311 while (true) {
1312
1313 // get UID from chip
1314 if (workFlags & 0x01) {
1315 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
1316 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1317 // Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work.
1318 //break;
1319 };
1320
1321 if(mifare_classic_halt(NULL, cuid)) {
1322 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1323 // Continue, some magic tags misbehavies and send an answer to it.
1324 // break;
1325 };
1326 };
1327
1328 // reset chip
1329 // Wipe command don't work with gen1b
1330 if (needWipe && !(workFlags & 0x40)){
1331 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1332 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1333 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1334 break;
1335 };
1336
1337 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1338 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1339 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1340 break;
1341 };
1342
1343 if(mifare_classic_halt(NULL, 0)) {
1344 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1345 // Continue, some magic tags misbehavies and send an answer to it.
1346 // break;
1347 };
1348 };
1349
1350 // write block
1351 if (workFlags & 0x02) {
1352 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1353
1354 // gen1b magic tag : do no issue wupC2 and don't expect 0x0a response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)
1355 if (!(workFlags & 0x40)) {
1356
1357 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1358 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1359 break;
1360 };
1361
1362 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1363 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1364 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1365 break;
1366 };
1367 }
1368 }
1369
1370 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1371 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1372 break;
1373 };
1374
1375 memcpy(d_block, datain, 16);
1376 AppendCrc14443a(d_block, 16);
1377
1378 ReaderTransmit(d_block, sizeof(d_block), NULL);
1379 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1380 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1381 break;
1382 };
1383
1384 if (workFlags & 0x04) {
1385 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1386 if (!(workFlags & 0x40)) {
1387 if (mifare_classic_halt(NULL, 0)) {
1388 if (MF_DBGLEVEL > 2) Dbprintf("Halt error");
1389 // Continue, some magic tags misbehavies and send an answer to it.
1390 // break;
1391 }
1392 }
1393 }
1394
1395 isOK = 1;
1396 break;
1397 }
1398
1399 LED_B_ON();
1400 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1401 LED_B_OFF();
1402
1403 if ((workFlags & 0x10) || (!isOK)) {
1404 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1405 LEDsoff();
1406 }
1407 }
1408
1409
1410 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1411
1412 // params
1413 // bit 1 - need wupC
1414 // bit 2 - need HALT after sequence
1415 // bit 3 - need init FPGA and field before sequence
1416 // bit 4 - need reset FPGA and LED
1417 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1418 // bit 6 - gen1b backdoor type
1419 uint8_t workFlags = arg0;
1420 uint8_t blockNo = arg2;
1421
1422 // card commands
1423 uint8_t wupC1[] = { 0x40 };
1424 uint8_t wupC2[] = { 0x43 };
1425
1426 // variables
1427 byte_t isOK = 0;
1428 uint8_t data[18] = {0x00};
1429 uint32_t cuid = 0;
1430
1431 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1432 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1433
1434 if (workFlags & 0x08) {
1435 LED_A_ON();
1436 LED_B_OFF();
1437 LED_C_OFF();
1438 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1439
1440 clear_trace();
1441 set_tracing(true);
1442 }
1443
1444 while (true) {
1445 if (workFlags & 0x02) {
1446 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1447 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1448 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1449 break;
1450 };
1451 // do no issue for gen1b magic tag
1452 if (!(workFlags & 0x40)) {
1453 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1454 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1455 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1456 break;
1457 };
1458 }
1459 }
1460
1461 // read block
1462 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1463 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1464 break;
1465 };
1466 memcpy(data, receivedAnswer, 18);
1467
1468 if (workFlags & 0x04) {
1469 // do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)
1470 if (!(workFlags & 0x40)) {
1471 if (mifare_classic_halt(NULL, cuid)) {
1472 if (MF_DBGLEVEL > 1) Dbprintf("Halt error");
1473 // Continue, some magic tags misbehavies and send an answer to it.
1474 // break;
1475 }
1476 }
1477 }
1478
1479 isOK = 1;
1480 break;
1481 }
1482
1483 LED_B_ON();
1484 if (workFlags & 0x20) {
1485 if (isOK)
1486 memcpy(datain, data, 18);
1487 }
1488 else
1489 cmd_send(CMD_ACK,isOK,0,0,data,18);
1490 LED_B_OFF();
1491
1492 if ((workFlags & 0x10) || (!isOK)) {
1493 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1494 LEDsoff();
1495 }
1496 }
1497
1498 void MifareCIdent(){
1499
1500 // card commands
1501 uint8_t wupC1[] = { 0x40 };
1502 uint8_t wupC2[] = { 0x43 };
1503
1504 // variables
1505 byte_t isOK = 0;
1506
1507 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1508 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1509
1510 LED_A_ON();
1511 LED_B_OFF();
1512 LED_C_OFF();
1513 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1514
1515 clear_trace();
1516 set_tracing(true);
1517
1518 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1519 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == 0x0a)) {
1520 isOK = 2;
1521
1522 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1523 if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == 0x0a)) {
1524 isOK = 1;
1525 };
1526 };
1527
1528 // From iceman1001: removed the if, since some magic tags misbehavies and send an answer to it.
1529 mifare_classic_halt(NULL, 0);
1530
1531 LED_B_ON();
1532 cmd_send(CMD_ACK,isOK,0,0,0,0);
1533 LED_B_OFF();
1534
1535 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1536 LEDsoff();
1537 }
1538
1539 //
1540 // DESFIRE
1541 //
1542
1543 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1544
1545 byte_t dataout[11] = {0x00};
1546 uint8_t uid[10] = {0x00};
1547 uint32_t cuid;
1548
1549 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1550 clear_trace();
1551
1552 int len = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);
1553 if(!len) {
1554 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1555 OnError(1);
1556 return;
1557 };
1558
1559 if(mifare_desfire_des_auth1(cuid, dataout)){
1560 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1561 OnError(4);
1562 return;
1563 }
1564
1565 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1566 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1567 }
1568
1569 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1570
1571 uint32_t cuid = arg0;
1572 uint8_t key[16] = {0x00};
1573 byte_t isOK = 0;
1574 byte_t dataout[12] = {0x00};
1575
1576 memcpy(key, datain, 16);
1577
1578 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1579
1580 if( isOK) {
1581 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1582 OnError(4);
1583 return;
1584 }
1585
1586 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1587
1588 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1589 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1590 LEDsoff();
1591 }
1592
1593 void OnSuccess(){
1594 pcb_blocknum = 0;
1595 ReaderTransmit(deselect_cmd, 3 , NULL);
1596 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1597 LEDsoff();
1598 }
1599
1600 void OnError(uint8_t reason){
1601 pcb_blocknum = 0;
1602 ReaderTransmit(deselect_cmd, 3 , NULL);
1603 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1604 cmd_send(CMD_ACK,0,reason,0,0,0);
1605 LEDsoff();
1606 }
Proxmark3 GIT tracking
Impressum, Datenschutz