Merge branch 'master' of https://github.com/iceman1001/proxmark3

[proxmark3-svn] / armsrc / iso14443a.c

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 2eb280e18677689ec19560b68e13411d6ed27742..8e1b7b7d692a3339f8c3b245b2b3f3b21e29c55e 100644 (file)
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -977,6 +977,15 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                        response8[0] = 0x80;
                        response8[1] = 0x80;
                        ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
                        response8[0] = 0x80;
                        response8[1] = 0x80;
                        ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);

+                       // uid not supplied then get from emulator memory
+                       if (data[0]==0) {
+                               uint16_t start = 4 * (0+12);  
+                               uint8_t emdata[8];
+                               emlGetMemBt( emdata, start, sizeof(emdata));
+                               memcpy(data, emdata, 3); //uid bytes 0-2
+                               memcpy(data+3, emdata+4, 4); //uid bytes 3-7
+                               flags |= FLAG_7B_UID_IN_DATA;
+                       }

                } break;                
                default: {
                        Dbprintf("Error: unkown tagtype (%d)",tagType);
                } break;                
                default: {
                        Dbprintf("Error: unkown tagtype (%d)",tagType);


@@ -1034,12 +1043,12 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
        // TC(1) = 0x02: CID supported, NAD not supported
        ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
 
        // TC(1) = 0x02: CID supported, NAD not supported
        ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
 

-       // Prepare GET_VERSION (different for EV-1 / NTAG)
+       // Prepare GET_VERSION (different for UL EV-1 / NTAG)

        //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7};  //EV1 48bytes VERSION.
        //uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7};  //EV1 48bytes VERSION.

-       uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
+       //uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215

        
        // Prepare CHK_TEARING
        
        // Prepare CHK_TEARING

-       uint8_t response9[] =  {0xBD,0x90,0x3f};
+       //uint8_t response9[] =  {0xBD,0x90,0x3f};

        
        #define TAG_RESPONSE_COUNT 10
        tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
        
        #define TAG_RESPONSE_COUNT 10
        tag_response_info_t responses[TAG_RESPONSE_COUNT] = {


@@ -1050,9 +1059,9 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                { .response = response3a, .response_n = sizeof(response3a) },  // Acknowledge select - cascade 2
                { .response = response5,  .response_n = sizeof(response5)  },  // Authentication answer (random nonce)
                { .response = response6,  .response_n = sizeof(response6)  },  // dummy ATS (pseudo-ATR), answer to RATS
                { .response = response3a, .response_n = sizeof(response3a) },  // Acknowledge select - cascade 2
                { .response = response5,  .response_n = sizeof(response5)  },  // Authentication answer (random nonce)
                { .response = response6,  .response_n = sizeof(response6)  },  // dummy ATS (pseudo-ATR), answer to RATS

-               { .response = response7_NTAG,  .response_n = sizeof(response7_NTAG)  },  // EV1/NTAG GET_VERSION response
-               { .response = response8,   .response_n = sizeof(response8) },  // EV1/NTAG PACK response
-               { .response = response9,   .response_n = sizeof(response9) }  // EV1/NTAG CHK_TEAR response
+               //{ .response = response7_NTAG, .response_n = sizeof(response7_NTAG)}, // EV1/NTAG GET_VERSION response
+               { .response = response8,   .response_n = sizeof(response8) }  // EV1/NTAG PACK response
+               //{ .response = response9,      .response_n = sizeof(response9)     }  // EV1/NTAG CHK_TEAR response

        };
 
        // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
        };
 
        // Allocate 512 bytes for the dynamic modulation, created when the reader queries for it


@@ -1084,9 +1093,8 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 
        // Prepare the responses of the anticollision phase
        // there will be not enough time to do this at the moment the reader sends it REQA
 
        // Prepare the responses of the anticollision phase
        // there will be not enough time to do this at the moment the reader sends it REQA

-       for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
+       for (size_t i=0; i<TAG_RESPONSE_COUNT; i++)

                prepare_allocated_tag_modulation(&responses[i]);
                prepare_allocated_tag_modulation(&responses[i]);

-       }

 
        int len = 0;
 
 
        int len = 0;
 


@@ -1105,7 +1113,6 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
        LED_A_ON();
        for(;;) {
                // Clean receive command buffer
        LED_A_ON();
        for(;;) {
                // Clean receive command buffer

-               

                if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
                        DbpString("Button press");
                        break;
                if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
                        DbpString("Button press");
                        break;


@@ -1129,33 +1136,18 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                        p_response = &responses[4]; order = 30;
                } else if(receivedCmd[0] == 0x30) {     // Received a (plain) READ
                        uint8_t block = receivedCmd[1];
                        p_response = &responses[4]; order = 30;
                } else if(receivedCmd[0] == 0x30) {     // Received a (plain) READ
                        uint8_t block = receivedCmd[1];

-                       if ( tagType == 7 ) {
-                               uint16_t start = 4 * block;
-                               
-                               /*if ( block < 4 ) {
-                                   //NTAG 215
-                                       uint8_t blockdata[50] = {
-                                       data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
-                                       data[3],data[4],data[5],data[6],
-                                       data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
-                                       0xe1,0x10,0x12,0x00,
-                                       0x03,0x00,0xfe,0x00, 
-                                       0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-                                       0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-                                       0x00,0x00,0x00,0x00,
-                                       0x00,0x00};
-                                       AppendCrc14443a(blockdata+start, 16);
-                                       EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
-                               } else {*/      
+                       // if Ultralight or NTAG (4 byte blocks)
+                       if ( tagType == 7 || tagType == 2 ) {
+                               //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+                               uint16_t start = 4 * (block+12);  

                                        uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
                                        emlGetMemBt( emdata, start, 16);
                                        AppendCrc14443a(emdata, 16);
                                        EmSendCmdEx(emdata, sizeof(emdata), false);                             
                                        uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
                                        emlGetMemBt( emdata, start, 16);
                                        AppendCrc14443a(emdata, 16);
                                        EmSendCmdEx(emdata, sizeof(emdata), false);                             

-                               //}
+                               // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below

                                p_response = NULL;
                                p_response = NULL;

-                               
-                       } else {                        
-                               EmSendCmdEx(data+(4*block),16,false);
+                       } else { // all other tags (16 byte block tags)
+                               EmSendCmdEx(data+(4*receivedCmd[1]),16,false);

                                // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
                                // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
                                p_response = NULL;
                                // Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
                                // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
                                p_response = NULL;


@@ -1163,7 +1155,8 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                } else if(receivedCmd[0] == 0x3A) {     // Received a FAST READ (ranged read)
                                
                                uint8_t emdata[MAX_FRAME_SIZE];
                } else if(receivedCmd[0] == 0x3A) {     // Received a FAST READ (ranged read)
                                
                                uint8_t emdata[MAX_FRAME_SIZE];

-                               int start =  receivedCmd[1] * 4;
+                               //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+                               int start =  (receivedCmd[1]+12) * 4; 

                                int len   = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
                                emlGetMemBt( emdata, start, len);
                                AppendCrc14443a(emdata, len);
                                int len   = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
                                emlGetMemBt( emdata, start, len);
                                AppendCrc14443a(emdata, len);


@@ -1172,13 +1165,19 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                                
                } else if(receivedCmd[0] == 0x3C && tagType == 7) {     // Received a READ SIGNATURE -- 
                                // ECC data,  taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
                                
                } else if(receivedCmd[0] == 0x3C && tagType == 7) {     // Received a READ SIGNATURE -- 
                                // ECC data,  taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc

-                               uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
-                                                                 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
-                                                                 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
-                                                                 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
-                                                                 0x00,0x00};
-                               AppendCrc14443a(data, sizeof(data)-2);
-                               EmSendCmdEx(data,sizeof(data),false);
+                               //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+                               uint16_t start = 4 * 4;
+                               uint8_t emdata[34];
+                               emlGetMemBt( emdata, start, 32);
+                               AppendCrc14443a(emdata, 32);
+                               EmSendCmdEx(emdata, sizeof(emdata), false);
+                               //uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
+                               //                                0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
+                               //                                0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
+                               //                                0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
+                               //                                0x00,0x00};
+                               //AppendCrc14443a(data, sizeof(data)-2);
+                               //EmSendCmdEx(data,sizeof(data),false);

                                p_response = NULL;                                      
                } else if (receivedCmd[0] == 0x39 && tagType == 7) {    // Received a READ COUNTER -- 
                        uint8_t index = receivedCmd[1];
                                p_response = NULL;                                      
                } else if (receivedCmd[0] == 0x39 && tagType == 7) {    // Received a READ COUNTER -- 
                        uint8_t index = receivedCmd[1];


@@ -1201,7 +1200,16 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                        p_response = NULL;
                        
                } else if(receivedCmd[0] == 0x3E && tagType == 7) {     // Received a CHECK_TEARING_EVENT -- 
                        p_response = NULL;
                        
                } else if(receivedCmd[0] == 0x3E && tagType == 7) {     // Received a CHECK_TEARING_EVENT -- 

-                               p_response = &responses[9];                             
+                       //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+                       uint8_t emdata[3];
+                       uint8_t counter=0;
+                       if (receivedCmd[1]<3) counter = receivedCmd[1];
+                       emlGetMemBt( emdata, 10+counter, 1);
+                       AppendCrc14443a(emdata, sizeof(emdata)-2);
+                       EmSendCmdEx(emdata, sizeof(emdata), false);     
+                       p_response = NULL;
+                       //p_response = &responses[9];                           
+               

                } else if(receivedCmd[0] == 0x50) {     // Received a HALT
 
                        if (tracing) {
                } else if(receivedCmd[0] == 0x50) {     // Received a HALT
 
                        if (tracing) {


@@ -1211,7 +1219,12 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) {   // Received an authentication request
                                        
                        if ( tagType == 7 ) {   // IF NTAG /EV1  0x60 == GET_VERSION, not a authentication request.
                } else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) {   // Received an authentication request
                                        
                        if ( tagType == 7 ) {   // IF NTAG /EV1  0x60 == GET_VERSION, not a authentication request.

-                               p_response = &responses[7];
+                               uint8_t emdata[10];
+                               emlGetMemBt( emdata, 0, 8 );
+                               AppendCrc14443a(emdata, sizeof(emdata)-2);
+                               EmSendCmdEx(emdata, sizeof(emdata), false);     
+                               p_response = NULL;
+                               //p_response = &responses[7];

                        } else {
                                p_response = &responses[5]; order = 7;
                        }
                        } else {
                                p_response = &responses[5]; order = 7;
                        }


@@ -1282,13 +1295,18 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
                {
                        if ( tagType == 7 ) {
                else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
                {
                        if ( tagType == 7 ) {

-                               p_response =  &responses[8]; // PACK response
+                               uint16_t start = 13; //first 4 blocks of emu are [getversion answer - check tearing - pack - 0x00]
+                               uint8_t emdata[4];
+                               emlGetMemBt( emdata, start, 2);
+                               AppendCrc14443a(emdata, 2);
+                               EmSendCmdEx(emdata, sizeof(emdata), false);
+                               p_response = NULL;
+                               //p_response =  &responses[8]; // PACK response

                                uint32_t pwd = bytes_to_num(receivedCmd+1,4);
                                
                                if ( MF_DBGLEVEL >= 3)  Dbprintf("Auth attempt: %08x", pwd);    
                        }
                                uint32_t pwd = bytes_to_num(receivedCmd+1,4);
                                
                                if ( MF_DBGLEVEL >= 3)  Dbprintf("Auth attempt: %08x", pwd);    
                        }

-               }
-               else {
+               } else {

                        // Check for ISO 14443A-4 compliant commands, look at left nibble
                        switch (receivedCmd[0]) {
                                case 0x02:
                        // Check for ISO 14443A-4 compliant commands, look at left nibble
                        switch (receivedCmd[0]) {
                                case 0x02:


@@ -2220,16 +2238,14 @@ void ReaderMifare(bool first_try)
        uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
        static uint8_t mf_nr_ar3;
 
        uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
        static uint8_t mf_nr_ar3;
 

-       uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
-       uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
+       uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
+       uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};

 
 

-       if (first_try) { 
+       if (first_try)

                iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
                iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);

-       }

        
        // free eventually allocated BigBuf memory. We want all for tracing.
        BigBuf_free();
        
        // free eventually allocated BigBuf memory. We want all for tracing.
        BigBuf_free();

-       

        clear_trace();
        set_tracing(TRUE);
 
        clear_trace();
        set_tracing(TRUE);
 


@@ -2237,7 +2253,7 @@ void ReaderMifare(bool first_try)
        uint8_t par[1] = {0};   // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
        static byte_t par_low = 0;
        bool led_on = TRUE;
        uint8_t par[1] = {0};   // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
        static byte_t par_low = 0;
        bool led_on = TRUE;

-       uint8_t uid[10]  ={0};
+       uint8_t uid[10] = {0};

        uint32_t cuid;
 
        uint32_t nt = 0;
        uint32_t cuid;
 
        uint32_t nt = 0;


@@ -2246,7 +2262,7 @@ void ReaderMifare(bool first_try)
        byte_t par_list[8] = {0x00};
        byte_t ks_list[8] = {0x00};
 
        byte_t par_list[8] = {0x00};
        byte_t ks_list[8] = {0x00};
 

-   #define PRNG_SEQUENCE_LENGTH  (1 << 16);
+       #define PRNG_SEQUENCE_LENGTH  (1 << 16);

        static uint32_t sync_time = 0;
        static int32_t sync_cycles = 0;
        int catch_up_cycles = 0;
        static uint32_t sync_time = 0;
        static int32_t sync_cycles = 0;
        int catch_up_cycles = 0;


@@ -2286,7 +2302,7 @@ void ReaderMifare(bool first_try)
        uint32_t select_time;
        uint32_t halt_time;
   
        uint32_t select_time;
        uint32_t halt_time;
   

-       for(uint16_t i = 0; TRUE; i++) {
+       for(uint16_t i = 0; TRUE; ++i) {

                
                LED_C_ON();
                WDT_HIT();
                
                LED_C_ON();
                WDT_HIT();


@@ -2436,9 +2452,8 @@ void ReaderMifare(bool first_try)
                if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {
                        catch_up_cycles = 8;    // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
        
                if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {
                        catch_up_cycles = 8;    // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
        

-                       if (nt_diff == 0) {
+                       if (nt_diff == 0)

                                par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
                                par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change

-                       }

 
                        led_on = !led_on;
                        if(led_on) LED_B_ON(); else LED_B_OFF();
 
                        led_on = !led_on;
                        if(led_on) LED_B_ON(); else LED_B_OFF();


@@ -2456,8 +2471,7 @@ void ReaderMifare(bool first_try)
                        mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
                        par[0] = par_low;
                } else {
                        mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
                        par[0] = par_low;
                } else {

-                       if (nt_diff == 0 && first_try)
-                       {
+                       if (nt_diff == 0 && first_try) {

                                par[0]++;
                                if (par[0] == 0x00) {           // tried all 256 possible parities without success. Card doesn't send NACK.
                                        isOK = -2;
                                par[0]++;
                                if (par[0] == 0x00) {           // tried all 256 possible parities without success. Card doesn't send NACK.
                                        isOK = -2;


@@ -2482,7 +2496,7 @@ void ReaderMifare(bool first_try)
                }
        }
        
                }
        }
        

-       byte_t buf[28];
+       byte_t buf[28] = {0x00};

        memcpy(buf + 0,  uid, 4);
        num_to_bytes(nt, 4, buf + 4);
        memcpy(buf + 8,  par_list, 8);
        memcpy(buf + 0,  uid, 4);
        num_to_bytes(nt, 4, buf + 4);
        memcpy(buf + 8,  par_list, 8);


@@ -2542,10 +2556,11 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
        //uint8_t rSAK[] = {0x09, 0x3f, 0xcc };  // Mifare Mini 
        uint8_t rSAK1[] = {0x04, 0xda, 0x17};
 
        //uint8_t rSAK[] = {0x09, 0x3f, 0xcc };  // Mifare Mini 
        uint8_t rSAK1[] = {0x04, 0xda, 0x17};
 

-       uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
+       //uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
+       uint8_t rAUTH_NT[] = {0x55, 0x41, 0x49, 0x92};

        uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
                
        uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
                

-       //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
+       //Here, we collect UID1,UID2,NT,AR,NR,0,0,NT2,AR2,NR2

        // This can be used in a reader-only attack.
        // (it can also be retrieved via 'hf 14a list', but hey...
        uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
        // This can be used in a reader-only attack.
        // (it can also be retrieved via 'hf 14a list', but hey...
        uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};


@@ -2620,7 +2635,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
 
        bool finished = FALSE;
 
 
        bool finished = FALSE;

-       while (!BUTTON_PRESS() && !finished) {
+       while (!BUTTON_PRESS() && !finished && !usb_poll_validate_length()) {

                WDT_HIT();
 
                // find reader field
                WDT_HIT();
 
                // find reader field


@@ -2693,8 +2708,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                break;
                        }
                        case MFEMUL_AUTH1:{
                                break;
                        }
                        case MFEMUL_AUTH1:{

-                               if( len != 8)
-                               {
+                               if( len != 8) {

                                        cardSTATE_TO_IDLE();
                                        LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
                                        break;
                                        cardSTATE_TO_IDLE();
                                        LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
                                        break;


@@ -2705,9 +2719,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
                                //Collect AR/NR
                                //if(ar_nr_collected < 2 && cardAUTHSC == 2){
 
                                //Collect AR/NR
                                //if(ar_nr_collected < 2 && cardAUTHSC == 2){

-                               if(ar_nr_collected < 2){
-                                       if(ar_nr_responses[2] != ar)
-                                       {// Avoid duplicates... probably not necessary, ar should vary. 
+                               if(ar_nr_collected < 2) {
+                                       if(ar_nr_responses[2] != ar) {
+                                               // Avoid duplicates... probably not necessary, ar should vary. 

                                                //ar_nr_responses[ar_nr_collected*5]   = 0;
                                                //ar_nr_responses[ar_nr_collected*5+1] = 0;
                                                ar_nr_responses[ar_nr_collected*5+2] = nonce;
                                                //ar_nr_responses[ar_nr_collected*5]   = 0;
                                                //ar_nr_responses[ar_nr_collected*5+1] = 0;
                                                ar_nr_responses[ar_nr_collected*5+2] = nonce;


@@ -2717,9 +2731,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                        }                                               
                                        // Interactive mode flag, means we need to send ACK
                                        if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
                                        }                                               
                                        // Interactive mode flag, means we need to send ACK
                                        if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)

-                                       {

                                                finished = true;
                                                finished = true;

-                                       }

                                }
 
                                // --- crypto
                                }
 
                                // --- crypto


@@ -2748,9 +2760,13 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
                                LED_C_ON();
                                cardSTATE = MFEMUL_WORK;
                                EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
                                LED_C_ON();
                                cardSTATE = MFEMUL_WORK;

-                               if (MF_DBGLEVEL >= 4)   Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d", 
-                                       cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
-                                       GetTickCount() - authTimer);
+                               if (MF_DBGLEVEL >= 4) {
+                                       Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d", 
+                                               cardAUTHSC, 
+                                               cardAUTHKEY == 0 ? 'A' : 'B',
+                                               GetTickCount() - authTimer
+                                       );
+                               }

                                break;
                        }
                        case MFEMUL_SELECT2:{
                                break;
                        }
                        case MFEMUL_SELECT2:{


@@ -2765,7 +2781,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
                                // select 2 card
                                if (len == 9 && 
 
                                // select 2 card
                                if (len == 9 && 

-                                               (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
+                                               (receivedCmd[0] == 0x95 &&
+                                                receivedCmd[1] == 0x70 && 
+                                                memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0) ) {

                                        EmSendCmd(rSAK, sizeof(rSAK));
                                        cuid = bytes_to_num(rUIDBCC2, 4);
                                        cardSTATE = MFEMUL_WORK;
                                        EmSendCmd(rSAK, sizeof(rSAK));
                                        cuid = bytes_to_num(rUIDBCC2, 4);
                                        cardSTATE = MFEMUL_WORK;


@@ -2792,10 +2810,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                
                                bool encrypted_data = (cardAUTHKEY != 0xFF) ;
 
                                
                                bool encrypted_data = (cardAUTHKEY != 0xFF) ;
 

-                               if(encrypted_data) {
-                                       // decrypt seqence
+                               // decrypt seqence
+                               if(encrypted_data)

                                        mf_crypto1_decrypt(pcs, receivedCmd, len);
                                        mf_crypto1_decrypt(pcs, receivedCmd, len);

-                               }

                                
                                if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
                                        authTimer = GetTickCount();
                                
                                if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
                                        authTimer = GetTickCount();


@@ -2859,9 +2876,8 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                }
                                // read block
                                if (receivedCmd[0] == 0x30) {
                                }
                                // read block
                                if (receivedCmd[0] == 0x30) {

-                                       if (MF_DBGLEVEL >= 4) {
-                                               Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
-                                       }
+                                       if (MF_DBGLEVEL >= 4) Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
+

                                        emlGetMem(response, receivedCmd[1], 1);
                                        AppendCrc14443a(response, 16);
                                        mf_crypto1_encrypt(pcs, response, 18, response_par);
                                        emlGetMem(response, receivedCmd[1], 1);
                                        AppendCrc14443a(response, 16);
                                        mf_crypto1_encrypt(pcs, response, 18, response_par);


@@ -2928,7 +2944,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                                break;
                        }
                        case MFEMUL_WRITEBL2:{
                                break;
                        }
                        case MFEMUL_WRITEBL2:{

-                               if (len == 18){
+                               if (len == 18) {

                                        mf_crypto1_decrypt(pcs, receivedCmd, len);
                                        emlSetMem(receivedCmd, cardWRBL, 1);
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
                                        mf_crypto1_decrypt(pcs, receivedCmd, len);
                                        emlSetMem(receivedCmd, cardWRBL, 1);
                                        EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));


@@ -3017,7 +3033,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                } else {
                        Dbprintf("Failed to obtain two AR/NR pairs!");
                        if(ar_nr_collected > 0 ) {
                } else {
                        Dbprintf("Failed to obtain two AR/NR pairs!");
                        if(ar_nr_collected > 0 ) {

-                               Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
+                               Dbprintf("Only got these: UID=%06x%08x, nonce=%08x, AR1=%08x, NR1=%08x",

                                                ar_nr_responses[0], // UID1
                                                ar_nr_responses[1], // UID2
                                                ar_nr_responses[2], // NT
                                                ar_nr_responses[0], // UID1
                                                ar_nr_responses[1], // UID2
                                                ar_nr_responses[2], // NT


@@ -3051,11 +3067,11 @@ void RAMFUNC SniffMifare(uint8_t param) {
        // The command (reader -> tag) that we're receiving.
        // The length of a received command will in most cases be no more than 18 bytes.
        // So 32 should be enough!
        // The command (reader -> tag) that we're receiving.
        // The length of a received command will in most cases be no more than 18 bytes.
        // So 32 should be enough!

-       uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
-       uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
+       uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE] = {0x00};
+       uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE] = {0x00};

        // The response (tag -> reader) that we're receiving.
        // The response (tag -> reader) that we're receiving.

-       uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
-       uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
+       uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE] = {0x00};
+       uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE] = {0x00};

 
        iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
 
 
        iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
 


@@ -3111,11 +3127,12 @@ void RAMFUNC SniffMifare(uint8_t param) {
                
                int register readBufDataP = data - dmaBuf;      // number of bytes we have processed so far
                int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
                
                int register readBufDataP = data - dmaBuf;      // number of bytes we have processed so far
                int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred

-               if (readBufDataP <= dmaBufDataP){                       // we are processing the same block of data which is currently being transferred
+
+               if (readBufDataP <= dmaBufDataP)                        // we are processing the same block of data which is currently being transferred

                        dataLen = dmaBufDataP - readBufDataP;   // number of bytes still to be processed
                        dataLen = dmaBufDataP - readBufDataP;   // number of bytes still to be processed

-               } else {                                                                        
+               else

                        dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
                        dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed

-               }
+

                // test for length of buffer
                if(dataLen > maxDataLen) {                                      // we are more behind than ever...
                        maxDataLen = dataLen;                                   
                // test for length of buffer
                if(dataLen > maxDataLen) {                                      // we are more behind than ever...
                        maxDataLen = dataLen;                                   


@@ -3142,10 +3159,12 @@ void RAMFUNC SniffMifare(uint8_t param) {
                
                if (sniffCounter & 0x01) {
 
                
                if (sniffCounter & 0x01) {
 

-                       if(!TagIsActive) {              // no need to try decoding tag data if the reader is sending
+                       // no need to try decoding tag data if the reader is sending
+                       if(!TagIsActive) {              

                                uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
                                if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
                                        LED_C_INV();
                                uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
                                if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
                                        LED_C_INV();

+

                                        if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
 
                                        /* And ready to receive another command. */
                                        if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
 
                                        /* And ready to receive another command. */


@@ -3157,7 +3176,8 @@ void RAMFUNC SniffMifare(uint8_t param) {
                                ReaderIsActive = (Uart.state != STATE_UNSYNCD);
                        }
                        
                                ReaderIsActive = (Uart.state != STATE_UNSYNCD);
                        }
                        

-                       if(!ReaderIsActive) {           // no need to try decoding tag data if the reader is sending
+                       // no need to try decoding tag data if the reader is sending
+                       if(!ReaderIsActive) {           

                                uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
                                if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
                                        LED_C_INV();
                                uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
                                if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
                                        LED_C_INV();


@@ -3166,6 +3186,7 @@ void RAMFUNC SniffMifare(uint8_t param) {
 
                                        // And ready to receive another response.
                                        DemodReset();
 
                                        // And ready to receive another response.
                                        DemodReset();

+                                       

                                        // And reset the Miller decoder including its (now outdated) input buffer
                                        UartInit(receivedCmd, receivedCmdPar);
                                }
                                        // And reset the Miller decoder including its (now outdated) input buffer
                                        UartInit(receivedCmd, receivedCmdPar);
                                }


@@ -3176,9 +3197,9 @@ void RAMFUNC SniffMifare(uint8_t param) {
                previous_data = *data;
                sniffCounter++;
                data++;
                previous_data = *data;
                sniffCounter++;
                data++;

-               if(data == dmaBuf + DMA_BUFFER_SIZE) {
+
+               if(data == dmaBuf + DMA_BUFFER_SIZE)

                        data = dmaBuf;
                        data = dmaBuf;

-               }

 
        } // main cycle
 
 
        } // main cycle