replaced string.find with str.find in findbits.search()

[proxmark3-svn] / armsrc / iso14443a.c

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index e66a64f5892dbb13e558f06fe6772edb8279a7e2..54fbb246458f36ec1695a0841de26556659ddba9 100644 (file)
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -156,7 +156,7 @@ static struct {
 
 static RAMFUNC int MillerDecoding(int bit)
 {
 
 static RAMFUNC int MillerDecoding(int bit)
 {

-       int error = 0;
+       //int error = 0;

        int bitright;
 
        if(!Uart.bitBuffer) {
        int bitright;
 
        if(!Uart.bitBuffer) {


@@ -202,7 +202,7 @@ static RAMFUNC int MillerDecoding(int bit)
                                // measured a drop in first and second half
                                // which should not be possible
                                Uart.state = STATE_ERROR_WAIT;
                                // measured a drop in first and second half
                                // which should not be possible
                                Uart.state = STATE_ERROR_WAIT;

-                               error = 0x01;
+                               //error = 0x01;

                        }
 
                        Uart.posCnt = 0;
                        }
 
                        Uart.posCnt = 0;


@@ -213,7 +213,7 @@ static RAMFUNC int MillerDecoding(int bit)
                                        if(Uart.drop == DROP_SECOND_HALF) {
                                                // error, should not happen in SOC
                                                Uart.state = STATE_ERROR_WAIT;
                                        if(Uart.drop == DROP_SECOND_HALF) {
                                                // error, should not happen in SOC
                                                Uart.state = STATE_ERROR_WAIT;

-                                               error = 0x02;
+                                               //error = 0x02;

                                        }
                                        else {
                                                // correct SOC
                                        }
                                        else {
                                                // correct SOC


@@ -251,7 +251,7 @@ static RAMFUNC int MillerDecoding(int bit)
                                                // Would be STATE_MILLER_Z
                                                // but Z does not follow X, so error
                                                Uart.state = STATE_ERROR_WAIT;
                                                // Would be STATE_MILLER_Z
                                                // but Z does not follow X, so error
                                                Uart.state = STATE_ERROR_WAIT;

-                                               error = 0x03;
+                                               //error = 0x03;

                                        }
                                        if(Uart.drop == DROP_SECOND_HALF) {
                                                // We see a '1' and stay in state X
                                        }
                                        if(Uart.drop == DROP_SECOND_HALF) {
                                                // We see a '1' and stay in state X


@@ -372,7 +372,7 @@ static RAMFUNC int MillerDecoding(int bit)
                                Uart.bitCnt = 0;
                                Uart.byteCnt = 0;
                                Uart.parityBits = 0;
                                Uart.bitCnt = 0;
                                Uart.byteCnt = 0;
                                Uart.parityBits = 0;

-                               error = 0;
+                               //error = 0;

                        }
                        else {
                                Uart.highCnt = 0;
                        }
                        else {
                                Uart.highCnt = 0;


@@ -422,7 +422,7 @@ static RAMFUNC int ManchesterDecoding(int v)
 {
        int bit;
        int modulation;
 {
        int bit;
        int modulation;

-       int error = 0;
+       //int error = 0;

 
        if(!Demod.buff) {
                Demod.buff = 1;
 
        if(!Demod.buff) {
                Demod.buff = 1;


@@ -479,7 +479,7 @@ static RAMFUNC int ManchesterDecoding(int v)
                                        case 0x01: Demod.samples = 0; break;
                                }
                        }
                                        case 0x01: Demod.samples = 0; break;
                                }
                        }

-                       error = 0;
+                       //error = 0;

                }
        }
        else {
                }
        }
        else {


@@ -503,7 +503,7 @@ static RAMFUNC int ManchesterDecoding(int v)
                                if(Demod.state!=DEMOD_ERROR_WAIT) {
                                        Demod.state = DEMOD_ERROR_WAIT;
                                        Demod.output[Demod.len] = 0xaa;
                                if(Demod.state!=DEMOD_ERROR_WAIT) {
                                        Demod.state = DEMOD_ERROR_WAIT;
                                        Demod.output[Demod.len] = 0xaa;

-                                       error = 0x01;
+                                       //error = 0x01;

                                }
                        }
                        else if(modulation) {
                                }
                        }
                        else if(modulation) {


@@ -518,7 +518,7 @@ static RAMFUNC int ManchesterDecoding(int v)
                                        else {
                                                Demod.output[Demod.len] = 0xab;
                                                Demod.state = DEMOD_ERROR_WAIT;
                                        else {
                                                Demod.output[Demod.len] = 0xab;
                                                Demod.state = DEMOD_ERROR_WAIT;

-                                               error = 0x02;
+                                               //error = 0x02;

                                        }
                                        break;
 
                                        }
                                        break;
 


@@ -556,7 +556,7 @@ static RAMFUNC int ManchesterDecoding(int v)
                                        else {
                                                Demod.output[Demod.len] = 0xad;
                                                Demod.state = DEMOD_ERROR_WAIT;
                                        else {
                                                Demod.output[Demod.len] = 0xad;
                                                Demod.state = DEMOD_ERROR_WAIT;

-                                               error = 0x03;
+                                               //error = 0x03;

                                        }
                                        break;
 
                                        }
                                        break;
 


@@ -768,13 +768,10 @@ void RAMFUNC SnoopIso14443a(void)
 
     DbpString("COMMAND FINISHED");
 
 
     DbpString("COMMAND FINISHED");
 

-    Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);
-    Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);
-

 done:
     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
 done:
     AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;

-    Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);
-    Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);
+    Dbprintf("maxBehindBy=%x, Uart.state=%x, Uart.byteCnt=%x", maxBehindBy, Uart.state, Uart.byteCnt);
+    Dbprintf("Uart.byteCntMax=%x, traceLen=%x, Uart.output[0]=%x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);

     LED_A_OFF();
     LED_B_OFF();
        LED_C_OFF();
     LED_A_OFF();
     LED_B_OFF();
        LED_C_OFF();


@@ -787,7 +784,6 @@ done:
 static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity)
 {
        int i;
 static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity)
 {
        int i;

-//     int oddparity;

 
        ToSendReset();
 
 
        ToSendReset();
 


@@ -809,9 +805,7 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity
                uint8_t b = cmd[i];
 
                // Data bits
                uint8_t b = cmd[i];
 
                // Data bits

-//             oddparity = 0x01;

                for(j = 0; j < 8; j++) {
                for(j = 0; j < 8; j++) {

-//                     oddparity ^= (b & 1);

                        if(b & 1) {
                                ToSend[++ToSendMax] = SEC_D;
                        } else {
                        if(b & 1) {
                                ToSend[++ToSendMax] = SEC_D;
                        } else {


@@ -820,38 +814,19 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity
                        b >>= 1;
                }
 
                        b >>= 1;
                }
 

-       // Get the parity bit
+               // Get the parity bit

                if ((dwParity >> i) & 0x01) {
                        ToSend[++ToSendMax] = SEC_D;
                } else {
                        ToSend[++ToSendMax] = SEC_E;
                }
                if ((dwParity >> i) & 0x01) {
                        ToSend[++ToSendMax] = SEC_D;
                } else {
                        ToSend[++ToSendMax] = SEC_E;
                }

-               
-                       // Parity bit
-//                     if(oddparity) {
-//                             ToSend[++ToSendMax] = SEC_D;
-//                     } else {
-//                             ToSend[++ToSendMax] = SEC_E;
-//                     }
-
-//             if (oddparity != ((dwParity >> i) & 0x01))
-//               Dbprintf("par error. i=%d", i);

        }
 
        // Send stopbit
        ToSend[++ToSendMax] = SEC_F;
 
        }
 
        // Send stopbit
        ToSend[++ToSendMax] = SEC_F;
 

-       // Flush the buffer in FPGA!!
-       for(i = 0; i < 5; i++) {
-//             ToSend[++ToSendMax] = SEC_F;
-       }
-

        // Convert from last byte pos to length
        ToSendMax++;
        // Convert from last byte pos to length
        ToSendMax++;

-
-    // Add a few more for slop
-//    ToSend[ToSendMax++] = 0x00;
-//     ToSend[ToSendMax++] = 0x00;

 }
 
 static void CodeIso14443aAsTag(const uint8_t *cmd, int len){
 }
 
 static void CodeIso14443aAsTag(const uint8_t *cmd, int len){


@@ -1070,9 +1045,9 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
     uint8_t *receivedCmd = (uint8_t *)BigBuf;
     int len;
 
     uint8_t *receivedCmd = (uint8_t *)BigBuf;
     int len;
 

-    int i;
-       int u;
-       uint8_t b;
+    //int i;
+       //int u;
+       //uint8_t b;

 
        // To control where we are in the protocol
        int order = 0;
 
        // To control where we are in the protocol
        int order = 0;


@@ -1084,7 +1059,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
 
     int cmdsRecvd = 0;
 
 
     int cmdsRecvd = 0;
 

-       int fdt_indicator;
+       //int fdt_indicator;

 
     memset(receivedCmd, 0x44, 400);
 
 
     memset(receivedCmd, 0x44, 400);
 


@@ -1135,7 +1110,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
        // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
         // Okay, look at the command now.
         lastorder = order;
        // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated
         // Okay, look at the command now.
         lastorder = order;

-               i = 1; // first byte transmitted
+               //i = 1; // first byte transmitted

         if(receivedCmd[0] == 0x26) {
                        // Received a REQUEST
                        resp = resp1; respLen = resp1Len; order = 1;
         if(receivedCmd[0] == 0x26) {
                        // Received a REQUEST
                        resp = resp1; respLen = resp1Len; order = 1;


@@ -1216,7 +1191,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
                // Look at last parity bit to determine timing of answer
                if((Uart.parityBits & 0x01) || receivedCmd[0] == 0x52) {
                        // 1236, so correction bit needed
                // Look at last parity bit to determine timing of answer
                if((Uart.parityBits & 0x01) || receivedCmd[0] == 0x52) {
                        // 1236, so correction bit needed

-                       i = 0;
+                       //i = 0;

                }
 
         memset(receivedCmd, 0x44, 32);
                }
 
         memset(receivedCmd, 0x44, 32);


@@ -1231,9 +1206,9 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
 
         if(respLen <= 0) continue;
                //----------------------------
 
         if(respLen <= 0) continue;
                //----------------------------

-               u = 0;
-               b = 0x00;
-               fdt_indicator = FALSE;
+               //u = 0;
+               //b = 0x00;
+               //fdt_indicator = FALSE;

 
                EmSendCmd14443aRaw(resp, respLen, receivedCmd[0] == 0x52);
 /*        // Modulate Manchester
 
                EmSendCmd14443aRaw(resp, respLen, receivedCmd[0] == 0x52);
 /*        // Modulate Manchester


@@ -1895,7 +1870,7 @@ void ReaderMifare(uint32_t parameter)
        byte_t nt_diff = 0;
        LED_A_OFF();
        byte_t par = 0;
        byte_t nt_diff = 0;
        LED_A_OFF();
        byte_t par = 0;

-       byte_t par_mask = 0xff;
+       //byte_t par_mask = 0xff;

        byte_t par_low = 0;
        int led_on = TRUE;
        uint8_t uid[8];
        byte_t par_low = 0;
        int led_on = TRUE;
        uint8_t uid[8];


@@ -1939,14 +1914,14 @@ void ReaderMifare(uint32_t parameter)
                {
                        if ( (parameter != 0) && (memcmp(nt, nt_noattack, 4) == 0) ) continue;
 
                {
                        if ( (parameter != 0) && (memcmp(nt, nt_noattack, 4) == 0) ) continue;
 

-                       isNULL = (nt_attacked[0] = 0) && (nt_attacked[1] = 0) && (nt_attacked[2] = 0) && (nt_attacked[3] = 0);
+                       isNULL = (nt_attacked[0] == 0) && (nt_attacked[1] == 0) && (nt_attacked[2] == 0) && (nt_attacked[3] == 0);

                        if ( (isNULL != 0 ) && (memcmp(nt, nt_attacked, 4) != 0) ) continue;
 
                        if (nt_diff == 0)
                        {
                                LED_A_ON();
                                memcpy(nt_attacked, nt, 4);
                        if ( (isNULL != 0 ) && (memcmp(nt, nt_attacked, 4) != 0) ) continue;
 
                        if (nt_diff == 0)
                        {
                                LED_A_ON();
                                memcpy(nt_attacked, nt, 4);

-                               par_mask = 0xf8;
+                               //par_mask = 0xf8;

                                par_low = par & 0x07;
                        }
 
                                par_low = par & 0x07;
                        }
 


@@ -2006,7 +1981,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        int cardSTATE = MFEMUL_NOFIELD;
        int _7BUID = 0;
        int vHf = 0;    // in mV
        int cardSTATE = MFEMUL_NOFIELD;
        int _7BUID = 0;
        int vHf = 0;    // in mV

-       int nextCycleTimeout = 0;
+       //int nextCycleTimeout = 0;

        int res;
 //     uint32_t timer = 0;
        uint32_t selTimer = 0;
        int res;
 //     uint32_t timer = 0;
        uint32_t selTimer = 0;


@@ -2016,11 +1991,13 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        uint8_t cardWRBL = 0;
        uint8_t cardAUTHSC = 0;
        uint8_t cardAUTHKEY = 0xff;  // no authentication
        uint8_t cardWRBL = 0;
        uint8_t cardAUTHSC = 0;
        uint8_t cardAUTHKEY = 0xff;  // no authentication

-       uint32_t cardRn = 0;
+       //uint32_t cardRn = 0;

        uint32_t cardRr = 0;
        uint32_t cuid = 0;
        uint32_t cardRr = 0;
        uint32_t cuid = 0;

-       uint32_t rn_enc = 0;
+       //uint32_t rn_enc = 0;

        uint32_t ans = 0;
        uint32_t ans = 0;

+       uint32_t cardINTREG = 0;
+       uint8_t cardINTBLOCK = 0;

        struct Crypto1State mpcs = {0, 0};
        struct Crypto1State *pcs;
        pcs = &mpcs;
        struct Crypto1State mpcs = {0, 0};
        struct Crypto1State *pcs;
        pcs = &mpcs;


@@ -2036,9 +2013,10 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        static uint8_t rSAK[] = {0x08, 0xb6, 0xdd};
        static uint8_t rSAK1[] = {0x04, 0xda, 0x17};
 
        static uint8_t rSAK[] = {0x08, 0xb6, 0xdd};
        static uint8_t rSAK1[] = {0x04, 0xda, 0x17};
 

-       static uint8_t rAUTH_NT[] = {0x1a, 0xac, 0xff, 0x4f};
+       static uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04};
+//     static uint8_t rAUTH_NT[] = {0x1a, 0xac, 0xff, 0x4f};

        static uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
        static uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};

-       
+

        // clear trace
        traceLen = 0;
        tracing = true;
        // clear trace
        traceLen = 0;
        tracing = true;


@@ -2077,7 +2055,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
   FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
        SpinDelay(200);
 
   FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
        SpinDelay(200);
 

-       Dbprintf("--> start. 7buid=%d", _7BUID);
+       if (MF_DBGLEVEL >= 1)   Dbprintf("Started. 7buid=%d", _7BUID);

        // calibrate mkseconds counter
        GetDeltaCountUS();
        while (true) {
        // calibrate mkseconds counter
        GetDeltaCountUS();
        while (true) {


@@ -2093,7 +2071,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                if (cardSTATE == MFEMUL_NOFIELD) {
                        vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
                        if (vHf > MF_MINFIELDV) {
                if (cardSTATE == MFEMUL_NOFIELD) {
                        vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
                        if (vHf > MF_MINFIELDV) {

-                               cardSTATE = MFEMUL_IDLE;
+                               cardSTATE_TO_IDLE();

                                LED_A_ON();
                        }
                } 
                                LED_A_ON();
                        }
                } 


@@ -2108,7 +2086,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                        if(res) break;
                }
                
                        if(res) break;
                }
                

-               nextCycleTimeout = 0;
+               //nextCycleTimeout = 0;

                
 //             if (len) Dbprintf("len:%d cmd: %02x %02x %02x %02x", len, receivedCmd[0], receivedCmd[1], receivedCmd[2], receivedCmd[3]);
 
                
 //             if (len) Dbprintf("len:%d cmd: %02x %02x %02x %02x", len, receivedCmd[0], receivedCmd[1], receivedCmd[2], receivedCmd[3]);
 


@@ -2141,6 +2119,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                // select all
                                if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
                                        EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));
                                // select all
                                if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
                                        EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1));

+                                       break;

                                }
 
                                // select card
                                }
 
                                // select card


@@ -2154,17 +2133,20 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                        cuid = bytes_to_num(rUIDBCC1, 4);
                                        if (!_7BUID) {
                                                cardSTATE = MFEMUL_WORK;
                                        cuid = bytes_to_num(rUIDBCC1, 4);
                                        if (!_7BUID) {
                                                cardSTATE = MFEMUL_WORK;

+                                               LED_B_ON();
+                                               if (MF_DBGLEVEL >= 4)   Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);
+                                               break;

                                        } else {
                                                cardSTATE = MFEMUL_SELECT2;
                                                break;
                                        }
                                        } else {
                                                cardSTATE = MFEMUL_SELECT2;
                                                break;
                                        }

-                                       LED_B_ON();
-                                       if (MF_DBGLEVEL >= 4)   Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer);

                                }
                                
                                break;
                        }
                        case MFEMUL_SELECT2:{
                                }
                                
                                break;
                        }
                        case MFEMUL_SELECT2:{

+                               if (!len) break;
+                       

                                if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
                                        EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
                                        break;
                                if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) {
                                        EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2));
                                        break;


@@ -2178,24 +2160,25 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                        cuid = bytes_to_num(rUIDBCC2, 4);
                                        cardSTATE = MFEMUL_WORK;
                                        LED_B_ON();
                                        cuid = bytes_to_num(rUIDBCC2, 4);
                                        cardSTATE = MFEMUL_WORK;
                                        LED_B_ON();

-                                       Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
+                                       if (MF_DBGLEVEL >= 4)   Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);

                                        break;
                                }
                                        break;
                                }

-                               // TODO: goto work state - i guess there is a command
-                               break;
+                               
+                               // i guess there is a command). go into the work state.
+                               if (len != 4) break;
+                               cardSTATE = MFEMUL_WORK;
+                               goto lbWORK;

                        }
                        case MFEMUL_AUTH1:{
                                if (len == 8) {
                                        // --- crypto
                        }
                        case MFEMUL_AUTH1:{
                                if (len == 8) {
                                        // --- crypto

-                                       rn_enc = bytes_to_num(receivedCmd, 4);
-                                       cardRn = rn_enc ^ crypto1_word(pcs, rn_enc , 1);
+                                       //rn_enc = bytes_to_num(receivedCmd, 4);
+                                       //cardRn = rn_enc ^ crypto1_word(pcs, rn_enc , 1);

                                        cardRr = bytes_to_num(&receivedCmd[4], 4) ^ crypto1_word(pcs, 0, 0);
                                        // test if auth OK
                                        if (cardRr != prng_successor(nonce, 64)){
                                        cardRr = bytes_to_num(&receivedCmd[4], 4) ^ crypto1_word(pcs, 0, 0);
                                        // test if auth OK
                                        if (cardRr != prng_successor(nonce, 64)){

-                                               Dbprintf("AUTH FAILED. cardRr=%08x, suc=%08x", cardRr, prng_successor(nonce, 64));
-                                               cardSTATE = MFEMUL_IDLE;
-                                               LED_B_OFF();
-                                               LED_C_OFF();
+                                               if (MF_DBGLEVEL >= 4)   Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x", cardRr, prng_successor(nonce, 64));
+                                               cardSTATE_TO_IDLE();

                                                break;
                                        }
                                        ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);
                                                break;
                                        }
                                        ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0);


@@ -2204,22 +2187,18 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                        EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
                                        cardSTATE = MFEMUL_AUTH2;
                                } else {
                                        EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
                                        cardSTATE = MFEMUL_AUTH2;
                                } else {

-                                       cardSTATE = MFEMUL_IDLE;
-                                       LED_B_OFF();
-                                       LED_C_OFF();
+                                       cardSTATE_TO_IDLE();

                                }
                                if (cardSTATE != MFEMUL_AUTH2) break;
                        }
                        case MFEMUL_AUTH2:{
                                }
                                if (cardSTATE != MFEMUL_AUTH2) break;
                        }
                        case MFEMUL_AUTH2:{

-                               // test auth info here...
-

                                LED_C_ON();
                                cardSTATE = MFEMUL_WORK;
                                LED_C_ON();
                                cardSTATE = MFEMUL_WORK;

-                               Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer);
+                               if (MF_DBGLEVEL >= 4)   Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer);

                                break;
                        }
                        case MFEMUL_WORK:{
                                break;
                        }
                        case MFEMUL_WORK:{

-                               if (len == 0) break;
+lbWORK:        if (len == 0) break;

                                
                                if (cardAUTHKEY == 0xff) {
                                        // first authentication
                                
                                if (cardAUTHKEY == 0xff) {
                                        // first authentication


@@ -2241,7 +2220,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 //                                             LogTrace(NULL, 0, GetDeltaCountUS(), 0, true);
 
                                                cardSTATE = MFEMUL_AUTH1;
 //                                             LogTrace(NULL, 0, GetDeltaCountUS(), 0, true);
 
                                                cardSTATE = MFEMUL_AUTH1;

-                                               nextCycleTimeout = 10;
+                                               //nextCycleTimeout = 10;

                                                break;
                                        }
                                } else {
                                                break;
                                        }
                                } else {


@@ -2263,7 +2242,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                                // --- crypto
 
                                                cardSTATE = MFEMUL_AUTH1;
                                                // --- crypto
 
                                                cardSTATE = MFEMUL_AUTH1;

-                                               nextCycleTimeout = 10;
+                                               //nextCycleTimeout = 10;

                                                break;
                                        }
                                }
                                                break;
                                        }
                                }


@@ -2301,18 +2280,56 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                                break;
                                        }
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
                                                break;
                                        }
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));

-                                       nextCycleTimeout = 50;
+                                       //nextCycleTimeout = 50;

                                        cardSTATE = MFEMUL_WRITEBL2;
                                        cardWRBL = receivedCmd[1];
                                        break;
                                }
                        
                                        cardSTATE = MFEMUL_WRITEBL2;
                                        cardWRBL = receivedCmd[1];
                                        break;
                                }
                        

+                               // works with cardINTREG
+                               
+                               // increment, decrement, restore
+                               if (len == 4 && (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2)) {
+                                       if (receivedCmd[1] >= 16 * 4 || 
+                                                       receivedCmd[1] / 4 != cardAUTHSC || 
+                                                       emlCheckValBl(receivedCmd[1])) {
+                                               EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
+                                               break;
+                                       }
+                                       EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
+                                       if (receivedCmd[0] == 0xC1)
+                                               cardSTATE = MFEMUL_INTREG_INC;
+                                       if (receivedCmd[0] == 0xC0)
+                                               cardSTATE = MFEMUL_INTREG_DEC;
+                                       if (receivedCmd[0] == 0xC2)
+                                               cardSTATE = MFEMUL_INTREG_REST;
+                                       cardWRBL = receivedCmd[1];
+                                       
+                                       break;
+                               }
+                               
+
+                               // transfer
+                               if (len == 4 && receivedCmd[0] == 0xB0) {
+                                       if (receivedCmd[1] >= 16 * 4 || receivedCmd[1] / 4 != cardAUTHSC) {
+                                               EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
+                                               break;
+                                       }
+                                       
+                                       if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
+                                               EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
+                                       else
+                                               EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
+                                               
+                                       break;
+                               }
+

                                // halt
                                if (len == 4 && (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00)) {
                                // halt
                                if (len == 4 && (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00)) {

-                                       cardSTATE = MFEMUL_HALTED;

                                        LED_B_OFF();
                                        LED_C_OFF();
                                        LED_B_OFF();
                                        LED_C_OFF();

-                                       Dbprintf("--> HALTED. Selected time: %d ms",  GetTickCount() - selTimer);
+                                       cardSTATE = MFEMUL_HALTED;
+                                       if (MF_DBGLEVEL >= 4)   Dbprintf("--> HALTED. Selected time: %d ms",  GetTickCount() - selTimer);

                                        break;
                                }
                                
                                        break;
                                }
                                


@@ -2333,11 +2350,45 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                        cardSTATE = MFEMUL_WORK;
                                        break;
                                } else {
                                        cardSTATE = MFEMUL_WORK;
                                        break;
                                } else {

-                                       cardSTATE = MFEMUL_IDLE;
-                                       LED_B_OFF();
-                                       LED_C_OFF();
+                                       cardSTATE_TO_IDLE();
+                                       break;
+                               }
+                               break;
+                       }
+                       
+                       case MFEMUL_INTREG_INC:{
+                               mf_crypto1_decrypt(pcs, receivedCmd, len);
+                               memcpy(&ans, receivedCmd, 4);
+                               if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
+                                       EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
+                                       cardSTATE_TO_IDLE();

                                        break;
                                }
                                        break;
                                }

+                               cardINTREG = cardINTREG + ans;
+                               cardSTATE = MFEMUL_WORK;
+                               break;
+                       }
+                       case MFEMUL_INTREG_DEC:{
+                               mf_crypto1_decrypt(pcs, receivedCmd, len);
+                               memcpy(&ans, receivedCmd, 4);
+                               if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
+                                       EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
+                                       cardSTATE_TO_IDLE();
+                                       break;
+                               }
+                               cardINTREG = cardINTREG - ans;
+                               cardSTATE = MFEMUL_WORK;
+                               break;
+                       }
+                       case MFEMUL_INTREG_REST:{
+                               mf_crypto1_decrypt(pcs, receivedCmd, len);
+                               memcpy(&ans, receivedCmd, 4);
+                               if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) {
+                                       EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
+                                       cardSTATE_TO_IDLE();
+                                       break;
+                               }
+                               cardSTATE = MFEMUL_WORK;

                                break;
                        }
                
                                break;
                        }
                


@@ -2352,5 +2403,5 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        memset(rAUTH_NT, 0x44, 4);
        LogTrace(rAUTH_NT, 4, 0, 0, TRUE);
 
        memset(rAUTH_NT, 0x44, 4);
        LogTrace(rAUTH_NT, 4, 0, 0, TRUE);
 

-       DbpString("Emulator stopped.");
+       if (MF_DBGLEVEL >= 1)   Dbprintf("Emulator stopped. Tracing: %d  trace length: %d ",    tracing, traceLen);

 }
 }