+ byte_t nt_diff = 0;
+ LED_A_OFF();
+ byte_t par = 0;
+ byte_t par_mask = 0xff;
+ byte_t par_low = 0;
+ int led_on = TRUE;
+ uint8_t uid[7];
+ uint32_t cuid;
+
+ tracing = FALSE;
+ byte_t nt[4] = {0,0,0,0};
+ byte_t nt_attacked[4];
+ byte_t par_list[8] = {0,0,0,0,0,0,0,0};
+ byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
+ num_to_bytes(parameter, 4, nt_attacked);
+ int isOK = 0;
+
+ while(TRUE)
+ {
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelay(200);
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+
+ // Test if the action was cancelled
+ if(BUTTON_PRESS()) {
+ break;
+ }
+
+ if(!iso14443a_select_card(uid, NULL, &cuid)) continue;
+
+ // Transmit MIFARE_CLASSIC_AUTH
+ ReaderTransmit(mf_auth, sizeof(mf_auth));
+
+ // Receive the (16 bit) "random" nonce
+ if (!ReaderReceive(receivedAnswer)) continue;
+ memcpy(nt, receivedAnswer, 4);
+
+ // Transmit reader nonce and reader answer
+ ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar),par);
+
+ // Receive 4 bit answer
+ if (ReaderReceive(receivedAnswer))
+ {
+ if (nt_diff == 0)
+ {
+ LED_A_ON();
+ memcpy(nt_attacked, nt, 4);
+ par_mask = 0xf8;
+ par_low = par & 0x07;
+ }
+
+ if (memcmp(nt, nt_attacked, 4) != 0) continue;
+
+ led_on = !led_on;
+ if(led_on) LED_B_ON(); else LED_B_OFF();
+ par_list[nt_diff] = par;
+ ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
+
+ // Test if the information is complete
+ if (nt_diff == 0x07) {
+ isOK = 1;
+ break;
+ }
+
+ nt_diff = (nt_diff + 1) & 0x07;
+ mf_nr_ar[3] = nt_diff << 5;
+ par = par_low;
+ } else {
+ if (nt_diff == 0)
+ {
+ par++;
+ } else {
+ par = (((par >> 3) + 1) << 3) | par_low;
+ }
+ }
+ }
+
+ LogTrace(nt, 4, 0, GetParity(nt, 4), TRUE);
+ LogTrace(par_list, 8, 0, GetParity(par_list, 8), TRUE);
+ LogTrace(ks_list, 8, 0, GetParity(ks_list, 8), TRUE);
+
+ UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
+ memcpy(ack.d.asBytes + 0, uid, 4);
+ memcpy(ack.d.asBytes + 4, nt, 4);
+ memcpy(ack.d.asBytes + 8, par_list, 8);
+ memcpy(ack.d.asBytes + 16, ks_list, 8);
+
+ LED_B_ON();
+ UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+ LED_B_OFF();
+
+ // Thats it...
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LEDsoff();
+ tracing = TRUE;
+
+// DbpString("COMMAND mifare FINISHED");
+}
+
+//-----------------------------------------------------------------------------
+// Select, Authenticaate, Read an MIFARE tag.
+// read block
+//-----------------------------------------------------------------------------
+void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+{
+ // params
+ uint8_t blockNo = arg0;
+ uint8_t keyType = arg1;
+ uint64_t ui64Key = 0;
+ ui64Key = bytes_to_num(datain, 6);
+
+ // variables
+ byte_t isOK = 0;
+ byte_t dataoutbuf[16];
+ uint8_t uid[7];
+ uint32_t cuid;
+ struct Crypto1State mpcs = {0, 0};
+ struct Crypto1State *pcs;
+ pcs = &mpcs;
+
+ // clear trace
+ traceLen = 0;
+// tracing = false;
+
+ iso14443a_setup();
+
+ LED_A_ON();
+ LED_B_OFF();
+ LED_C_OFF();
+
+ while (true) {
+ if(!iso14443a_select_card(uid, NULL, &cuid)) {
+ Dbprintf("Can't select card");
+ break;
+ };
+
+ if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
+ Dbprintf("Auth error");
+ break;
+ };
+
+ if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
+ Dbprintf("Read block error");
+ break;
+ };
+
+ if(mifare_classic_halt(pcs, cuid)) {
+ Dbprintf("Halt error");
+ break;
+ };
+
+ isOK = 1;
+ break;
+ }
+
+ // ----------------------------- crypto1 destroy
+ crypto1_destroy(pcs);
+
+// DbpString("READ BLOCK FINISHED");
+
+ // add trace trailer
+ uid[0] = 0xff;
+ uid[1] = 0xff;
+ uid[2] = 0xff;
+ uid[3] = 0xff;
+ LogTrace(uid, 4, 0, 0, TRUE);
+
+ UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
+ memcpy(ack.d.asBytes, dataoutbuf, 16);
+
+ LED_B_ON();
+ UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+ LED_B_OFF();
+
+
+ // Thats it...
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LEDsoff();
+// tracing = TRUE;
+
+}
+
+//-----------------------------------------------------------------------------
+// Select, Authenticaate, Read an MIFARE tag.
+// read sector (data = 4 x 16 bytes = 64 bytes)
+//-----------------------------------------------------------------------------
+void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+{
+ // params
+ uint8_t sectorNo = arg0;
+ uint8_t keyType = arg1;
+ uint64_t ui64Key = 0;
+ ui64Key = bytes_to_num(datain, 6);
+
+ // variables
+ byte_t isOK = 0;
+ byte_t dataoutbuf[16 * 4];
+ uint8_t uid[8];
+ uint32_t cuid;
+ struct Crypto1State mpcs = {0, 0};
+ struct Crypto1State *pcs;
+ pcs = &mpcs;
+
+ // clear trace
+ traceLen = 0;
+// tracing = false;
+
+ iso14443a_setup();
+
+ LED_A_ON();
+ LED_B_OFF();
+ LED_C_OFF();
+
+ while (true) {
+ if(!iso14443a_select_card(uid, NULL, &cuid)) {
+ Dbprintf("Can't select card");
+ break;
+ };
+
+ if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
+ Dbprintf("Auth error");
+ break;
+ };
+
+ if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf + 16 * 0)) {
+ Dbprintf("Read block 0 error");
+ break;
+ };
+ if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf + 16 * 1)) {
+ Dbprintf("Read block 1 error");
+ break;
+ };
+ if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf + 16 * 2)) {
+ Dbprintf("Read block 2 error");
+ break;
+ };
+ if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf + 16 * 3)) {
+ Dbprintf("Read block 3 error");
+ break;
+ };
+
+ if(mifare_classic_halt(pcs, cuid)) {
+ Dbprintf("Halt error");
+ break;
+ };
+
+ isOK = 1;
+ break;
+ }
+
+ // ----------------------------- crypto1 destroy
+ crypto1_destroy(pcs);
+
+// DbpString("READ BLOCK FINISHED");
+
+ // add trace trailer
+ uid[0] = 0xff;
+ uid[1] = 0xff;
+ uid[2] = 0xff;
+ uid[3] = 0xff;
+ LogTrace(uid, 4, 0, 0, TRUE);
+
+ UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
+ memcpy(ack.d.asBytes, dataoutbuf, 16 * 2);
+
+ LED_B_ON();
+ UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+
+ SpinDelay(100);
+
+ memcpy(ack.d.asBytes, dataoutbuf + 16 * 2, 16 * 2);
+ UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+ LED_B_OFF();
+
+ // Thats it...
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LEDsoff();
+// tracing = TRUE;
+
+}
+
+//-----------------------------------------------------------------------------
+// Select, Authenticaate, Read an MIFARE tag.
+// read block
+//-----------------------------------------------------------------------------
+void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+{
+ // params
+ uint8_t blockNo = arg0;
+ uint8_t keyType = arg1;
+ uint64_t ui64Key = 0;
+ byte_t blockdata[16];
+
+ ui64Key = bytes_to_num(datain, 6);
+ memcpy(blockdata, datain + 10, 16);
+
+ // variables
+ byte_t isOK = 0;
+ uint8_t uid[8];
+ uint32_t cuid;
+ struct Crypto1State mpcs = {0, 0};
+ struct Crypto1State *pcs;
+ pcs = &mpcs;
+
+ // clear trace
+ traceLen = 0;
+// tracing = false;
+
+ iso14443a_setup();
+
+ LED_A_ON();
+ LED_B_OFF();
+ LED_C_OFF();
+
+ while (true) {
+ if(!iso14443a_select_card(uid, NULL, &cuid)) {
+ Dbprintf("Can't select card");
+ break;
+ };
+
+ if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
+ Dbprintf("Auth error");
+ break;
+ };
+
+ if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
+ Dbprintf("Write block error");
+ break;
+ };
+
+ if(mifare_classic_halt(pcs, cuid)) {
+ Dbprintf("Halt error");
+ break;
+ };
+
+ isOK = 1;
+ break;
+ }
+
+ // ----------------------------- crypto1 destroy
+ crypto1_destroy(pcs);
+
+// DbpString("WRITE BLOCK FINISHED");
+
+ // add trace trailer
+ uid[0] = 0xff;
+ uid[1] = 0xff;
+ uid[2] = 0xff;
+ uid[3] = 0xff;
+ LogTrace(uid, 4, 0, 0, TRUE);
+
+ UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
+
+ LED_B_ON();
+ UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+ LED_B_OFF();
+
+
+ // Thats it...
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LEDsoff();
+// tracing = TRUE;
+
+}
+
+// Return 1 if the nonce is invalid else return 0
+int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
+ return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
+ (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
+ (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
+}
+
+
+//-----------------------------------------------------------------------------
+// MIFARE nested authentication.
+//
+//-----------------------------------------------------------------------------
+void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+{
+ // params
+ uint8_t blockNo = arg0;
+ uint8_t keyType = arg1;
+ uint64_t ui64Key = 0;
+
+ ui64Key = bytes_to_num(datain, 6);
+
+ // variables
+ uint8_t targetBlockNo = blockNo + 1;
+ int rtr, i, m, len;
+ int davg, dmin, dmax;
+ uint8_t uid[8];
+ uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
+ uint8_t par_array[4];
+ nestedVector nvector[3][10];
+ int nvectorcount[3] = {10, 10, 10};
+ int ncount = 0;
+ struct Crypto1State mpcs = {0, 0};
+ struct Crypto1State *pcs;
+ pcs = &mpcs;
+ uint8_t* receivedAnswer = mifare_get_bigbufptr();
+
+ // clear trace
+ traceLen = 0;
+ tracing = false;
+
+ iso14443a_setup();
+
+ LED_A_ON();
+ LED_B_ON();
+ LED_C_OFF();
+
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ SpinDelay(200);
+
+ davg = dmax = 0;
+ dmin = 2000;
+
+ // test nonce distance
+ for (rtr = 0; rtr < 10; rtr++) {