cleaned up MF UL_C auth code device side.
case CMD_MIFAREU_READBL:
MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
break;
- case CMD_MIFAREUC_AUTH1:
- MifareUC_Auth1(c->arg[0],c->d.asBytes);
- break;
- case CMD_MIFAREUC_AUTH2:
- MifareUC_Auth2(c->arg[0],c->d.asBytes);
+ case CMD_MIFAREUC_AUTH:
+ MifareUC_Auth(c->arg[0],c->d.asBytes);
break;
case CMD_MIFAREU_READCARD:
case CMD_MIFAREUC_READCARD:
int32_t dist_nt(uint32_t nt1, uint32_t nt2);
void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
-void MifareUC_Auth1(uint8_t arg0, uint8_t *datain);
-void MifareUC_Auth2(uint8_t arg0, uint8_t *datain);
+void MifareUC_Auth(uint8_t arg0, uint8_t *datain);
void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain);
void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
#include "apps.h"\r
#include "util.h"\r
\r
-#include "des.h"\r
#include "crc.h"\r
\r
// the block number for the ISO14443-4 PCB\r
LEDsoff();\r
}\r
\r
-void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){\r
+void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){\r
\r
- byte_t dataoutbuf[16] = {0x00};\r
- uint8_t uid[10] = {0x00};\r
- uint32_t cuid = 0x00;\r
+ bool turnOffField = (arg0 == 1);\r
\r
LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
- \r
clear_trace();\r
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
\r
- if(!iso14443a_select_card(uid, NULL, &cuid)) {\r
+ if(!iso14443a_select_card(NULL, NULL, NULL)) {\r
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
OnError(0);\r
return;\r
};\r
\r
- if(mifare_ultra_auth1(dataoutbuf)){\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r
+ if(mifare_ultra_auth(keybytes) == 1){\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");\r
OnError(1);\r
return;\r
}\r
+ cmd_send(CMD_ACK,1,0,0,0,0);\r
\r
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
- \r
- cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);\r
- LEDsoff();\r
-}\r
-void MifareUC_Auth2(uint8_t arg0, uint8_t *datain){\r
-\r
- uint8_t key[16] = {0x00};\r
- byte_t dataoutbuf[16] = {0x00};\r
- \r
- memcpy(key, datain, 16);\r
- \r
- LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
- \r
- if(mifare_ultra_auth2(key, dataoutbuf)){\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");\r
- OnError(1);\r
- return; \r
- }\r
- \r
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");\r
- \r
- cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);\r
- if (arg0) {\r
+ if (turnOffField) {\r
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
LEDsoff();\r
}\r
{\r
uint8_t blockNo = arg0;\r
byte_t dataout[16] = {0x00};\r
- uint8_t uid[10] = {0x00};\r
- uint8_t key[16] = {0x00};\r
- bool usePwd = (arg1 == 1);\r
+ bool useKey = (arg1 == 1); //UL_C\r
+ bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r
\r
LEDsoff();\r
LED_A_ON();\r
clear_trace();\r
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
\r
- int len = iso14443a_select_card(uid, NULL, NULL);\r
+ int len = iso14443a_select_card(NULL, NULL, NULL);\r
if(!len) {\r
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r
OnError(1);\r
return;\r
}\r
\r
- // authenticate here.\r
- if ( usePwd ) {\r
-\r
- memcpy(key, datain, 16);\r
-\r
- // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );\r
- // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );\r
-\r
- uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };\r
- uint8_t random_b[8] = {0x00};\r
- uint8_t enc_random_b[8] = {0x00};\r
- uint8_t rnd_ab[16] = {0x00};\r
- uint8_t IV[8] = {0x00};\r
-\r
- uint16_t len;\r
- uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
+ // UL-C authentication\r
+ if ( useKey ) {\r
+ uint8_t key[16] = {0x00};\r
+ memcpy(key, datain, sizeof(key) );\r
\r
- len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r
- if (len != 11) {\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
+ if ( mifare_ultra_auth(key) == 1 ) {\r
OnError(1);\r
return;\r
}\r
- \r
- // tag nonce.\r
- memcpy(enc_random_b,receivedAnswer+1,8);\r
-\r
- // decrypt nonce.\r
- tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );\r
- rol(random_b,8);\r
- memcpy(rnd_ab ,random_a,8);\r
- memcpy(rnd_ab+8,random_b,8);\r
-\r
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
- Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
- enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],\r
- enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);\r
- \r
- Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
- random_b[0],random_b[1],random_b[2],random_b[3],\r
- random_b[4],random_b[5],random_b[6],random_b[7]);\r
-\r
- Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
- rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],\r
- rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
- \r
- Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
- rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],\r
- rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );\r
- }\r
- \r
- // encrypt out, in, length, key, iv\r
- tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);\r
+ }\r
\r
- len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);\r
- if (len != 11) {\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
+ // UL-EV1 / NTAG authentication\r
+ if ( usePwd ) {\r
+ uint8_t pwd[4] = {0x00};\r
+ memcpy(pwd, datain, 4);\r
+ uint8_t pack[4] = {0,0,0,0};\r
+ if (mifare_ul_ev1_auth(pwd, pack) == 1) {\r
OnError(1);\r
return;\r
}\r
+ } \r
\r
- uint8_t enc_resp[8] = { 0 };\r
- uint8_t resp_random_a[8] = { 0 };\r
- memcpy(enc_resp, receivedAnswer+1, 8);\r
- \r
- // decrypt out, in, length, key, iv \r
- tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);\r
- if ( memcmp(resp_random_a, random_a, 8) != 0 )\r
- Dbprintf("failed authentication");\r
-\r
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
- Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", \r
- rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],\r
- rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
-\r
- Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",\r
- rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],\r
- rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);\r
-\r
- Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",\r
- random_a[0],random_a[1],random_a[2],random_a[3],\r
- random_a[4],random_a[5],random_a[6],random_a[7]);\r
- \r
- Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",\r
- resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],\r
- resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);\r
- }\r
- }\r
- \r
if( mifare_ultra_readblock(blockNo, dataout) ) {\r
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r
OnError(2);\r
return;\r
}\r
- \r
+\r
if( mifare_ultra_halt() ) {\r
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
OnError(3);\r
return;\r
}\r
- \r
- cmd_send(CMD_ACK,1,0,0,dataout,16);\r
+\r
+ cmd_send(CMD_ACK,1,0,0,dataout,16);\r
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
LEDsoff();\r
}\r
return;\r
}\r
\r
- // authenticate\r
+ // UL-C authentication\r
if ( useKey ) {\r
uint8_t key[16] = {0x00};\r
- memcpy(key, datain, 16);\r
-\r
- uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };\r
- uint8_t random_b[8] = {0x00};\r
- uint8_t enc_random_b[8] = {0x00};\r
- uint8_t rnd_ab[16] = {0x00};\r
- uint8_t IV[8] = {0x00};\r
-\r
- uint16_t len2;\r
- uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
-\r
- len2 = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r
- if (len2 != 11) {\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
- OnError(1);\r
- return;\r
- }\r
-\r
- // tag nonce.\r
- memcpy(enc_random_b,receivedAnswer+1,8);\r
-\r
- // decrypt nonce.\r
- tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );\r
- rol(random_b,8);\r
- memcpy(rnd_ab ,random_a,8);\r
- memcpy(rnd_ab+8,random_b,8);\r
+ memcpy(key, datain, sizeof(key) );\r
\r
- // encrypt out, in, length, key, iv\r
- tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);\r
-\r
- len2 = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);\r
- if (len2 != 11) {\r
+ if ( mifare_ultra_auth(key) == 1 ) {\r
OnError(1);\r
return;\r
}\r
-\r
- uint8_t enc_resp[8] = { 0 };\r
- uint8_t resp_random_a[8] = { 0 };\r
- memcpy(enc_resp, receivedAnswer+1, 8);\r
-\r
- // decrypt out, in, length, key, iv \r
- tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);\r
- if ( memcmp(resp_random_a, random_a, 8) != 0 )\r
- Dbprintf("failed authentication"); \r
}\r
\r
- if (usePwd) { //ev1 or ntag auth\r
- uint8_t Pwd[4] = {0x00};\r
- memcpy(Pwd, datain, 4);\r
+ // UL-EV1 / NTAG authentication\r
+ if (usePwd) {\r
+ uint8_t pwd[4] = {0x00};\r
+ memcpy(pwd, datain, sizeof(pwd));\r
uint8_t pack[4] = {0,0,0,0};\r
\r
- if (mifare_ul_ev1_auth(Pwd, pack)){\r
+ if (mifare_ul_ev1_auth(pwd, pack) == 1){\r
OnError(1);\r
- Dbprintf("failed authentication");\r
return; \r
}\r
}\r
{\r
uint8_t blockNo = arg0;\r
byte_t blockdata[4] = {0x00};\r
- \r
- memcpy(blockdata, datain,4);\r
\r
- uint8_t uid[10] = {0x00};\r
+ memcpy(blockdata, datain,4);\r
\r
- LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
+ LEDsoff();\r
+ LED_A_ON();\r
clear_trace();\r
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
\r
- if(!iso14443a_select_card(uid, NULL, NULL)) {\r
+ if(!iso14443a_select_card(NULL, NULL, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
OnError(0);\r
return;\r
\r
int len = iso14443a_select_card(uid, NULL, &cuid);\r
if(!len) {\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) \r
- Dbprintf("Can't select card");\r
- //OnError(1);\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
+ OnError(1);\r
return;\r
};\r
\r
if(mifare_desfire_des_auth1(cuid, dataout)){\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) \r
- Dbprintf("Authentication part1: Fail.");\r
- //OnError(4);\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r
+ OnError(4);\r
return;\r
}\r
\r
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
- \r
cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r
}\r
\r
#include "iso14443a.h"\r
#include "crapto1.h"\r
#include "mifareutil.h"\r
+#include "des.h"\r
\r
int MF_DBGLEVEL = MF_DBG_ALL;\r
\r
return len;\r
}\r
\r
+int mifare_sendcmd_short_mfuev1auth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)\r
+{\r
+ uint8_t dcmd[7];\r
+ int len; \r
+ dcmd[0] = cmd;\r
+ memcpy(dcmd+1,data,4);\r
+ AppendCrc14443a(dcmd, 5);\r
+ \r
+ ReaderTransmit(dcmd, sizeof(dcmd), timing);\r
+ len = ReaderReceive(answer, answer_parity);\r
+ if(!len) {\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed. Card timeout.");\r
+ len = ReaderReceive(answer,answer_parity);\r
+ }\r
+ if(len==1) {\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("NAK - Authentication failed.");\r
+ return 1;\r
+ }\r
+ return len;\r
+}\r
+\r
int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)\r
{\r
uint8_t dcmd[4], ecmd[4];\r
}\r
\r
// mifare ultralight commands\r
-int mifare_ul_ev1_auth(uint8_t *key, uint8_t *pack){\r
+int mifare_ul_ev1_auth(uint8_t *keybytes, uint8_t *pack){\r
\r
uint16_t len;\r
- uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
- \r
- len = mifare_sendcmd_short_mfucauth(NULL, 0, 0x1B, key, receivedAnswer, receivedAnswerPar, NULL);\r
+ uint8_t resp[4];\r
+ uint8_t respPar[1];\r
+ uint8_t key[4] = {0x00};\r
+ memcpy(key, keybytes, 4);\r
+\r
+ Dbprintf("EV1 Auth : %02x%02x%02x%02x", key[0], key[1], key[2], key[3]);\r
+ len = mifare_sendcmd_short_mfuev1auth(NULL, 0, 0x1B, key, resp, respPar, NULL);\r
if (len != 4) {\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", receivedAnswer[0], len);\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", resp[0], len);\r
+ OnError(1);\r
return 1;\r
}\r
- \r
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
- Dbprintf("Auth Resp: %02x%02x%02x%02x",\r
- receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3]);\r
- }\r
- memcpy(pack, receivedAnswer, 4);\r
+\r
+ if (MF_DBGLEVEL >= MF_DBG_EXTENDED)\r
+ Dbprintf("Auth Resp: %02x%02x%02x%02x", resp[0],resp[1],resp[2],resp[3]);\r
+\r
+ memcpy(pack, resp, 4);\r
return 0;\r
}\r
\r
-int mifare_ultra_auth1(uint8_t *blockData){\r
+int mifare_ultra_auth(uint8_t *keybytes){\r
+\r
+ /// 3des2k\r
+\r
+ uint8_t random_a[8] = {1,1,1,1,1,1,1,1};\r
+ uint8_t random_b[8] = {0x00};\r
+ uint8_t enc_random_b[8] = {0x00};\r
+ uint8_t rnd_ab[16] = {0x00};\r
+ uint8_t IV[8] = {0x00};\r
+ uint8_t key[16] = {0x00};\r
+ memcpy(key, keybytes, 16);\r
\r
uint16_t len;\r
- uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
- \r
- len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r
+ uint8_t resp[19] = {0x00};\r
+ uint8_t respPar[3] = {0,0,0};\r
+\r
+ // REQUEST AUTHENTICATION\r
+ len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, resp, respPar ,NULL);\r
if (len != 11) {\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);\r
+ OnError(1);\r
return 1;\r
}\r
\r
+ // tag nonce.\r
+ memcpy(enc_random_b,resp+1,8);\r
+\r
+ // decrypt nonce.\r
+ tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );\r
+ rol(random_b,8);\r
+ memcpy(rnd_ab ,random_a,8);\r
+ memcpy(rnd_ab+8,random_b,8);\r
+\r
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
- Dbprintf("Auth1 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",\r
- receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],\r
- receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],\r
- receivedAnswer[10]);\r
- }\r
- memcpy(blockData, receivedAnswer, 11);\r
- return 0;\r
-}\r
+ Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
+ enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);\r
\r
-int mifare_ultra_auth2(uint8_t *key, uint8_t *blockData){\r
+ Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",\r
+ random_b[0],random_b[1],random_b[2],random_b[3],random_b[4],random_b[5],random_b[6],random_b[7]);\r
\r
- uint16_t len;\r
- uint8_t receivedAnswer[MAX_FRAME_SIZE];\r
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];\r
- \r
- len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, key, receivedAnswer, receivedAnswerPar, NULL);\r
+ Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
+ rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
+\r
+ Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",\r
+ rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );\r
+ }\r
+\r
+ // encrypt out, in, length, key, iv\r
+ tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);\r
+\r
+ len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, resp, respPar, NULL);\r
if (len != 11) {\r
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);\r
+ OnError(1);\r
return 1;\r
}\r
- \r
+\r
+ uint8_t enc_resp[8] = { 0,0,0,0,0,0,0,0 };\r
+ uint8_t resp_random_a[8] = { 0,0,0,0,0,0,0,0 };\r
+ memcpy(enc_resp, resp+1, 8);\r
+\r
+ // decrypt out, in, length, key, iv \r
+ tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);\r
+ if ( memcmp(resp_random_a, random_a, 8) != 0 ) {\r
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("failed authentication");\r
+ return 1;\r
+ }\r
+\r
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {\r
- Dbprintf("Auth2 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",\r
- receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],\r
- receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],\r
- receivedAnswer[10]);\r
+ Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", \r
+ rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],\r
+ rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);\r
+\r
+ Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",\r
+ rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],\r
+ rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);\r
+\r
+ Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",\r
+ random_a[0],random_a[1],random_a[2],random_a[3],\r
+ random_a[4],random_a[5],random_a[6],random_a[7]);\r
+\r
+ Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",\r
+ resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],\r
+ resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);\r
}\r
- memcpy(blockData, receivedAnswer, 11);\r
return 0;\r
}\r
\r
return 0;\r
}\r
\r
-\r
-\r
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) \r
{\r
// variables\r
int mifare_sendcmd_short_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);\r
\r
int mifare_sendcmd_short_mfucauth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);\r
+int mifare_sendcmd_short_mfuev1auth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);\r
int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);\r
\r
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested);\r
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing);\r
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);\r
int mifare_ul_ev1_auth(uint8_t *key, uint8_t *pack);\r
-int mifare_ultra_auth1(uint8_t *blockData);\r
-int mifare_ultra_auth2(uint8_t *key, uint8_t *blockData);\r
+int mifare_ultra_auth(uint8_t *key);\r
int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData);\r
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);\r
int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData);\r
{ 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF } // 11 22 33
};
-#define KEYS_PWD_COUNT 8
+#define KEYS_PWD_COUNT 10
uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = {
{0xFF,0xFF,0xFF,0xFF}, // PACK 0x00,0x00 -- factory default
+
{0x4A,0xF8,0x4B,0x19}, // PACK 0xE5,0xBE -- italian bus (sniffed)
{0x33,0x6B,0xA1,0x19}, // PACK 0x9c,0x2d -- italian bus (sniffed)
{0xFF,0x90,0x6C,0xB2}, // PACK 0x12,0x9e -- italian bus (sniffed)
+ {0x46,0x1c,0xA3,0x19}, // PACK 0xE9,0x5A -- italian bus (sniffed)
+ {0x35,0x1C,0xD0,0x19}, // PACK 0x9A,0x5a -- italian bus (sniffed)
+
{0x05,0x22,0xE6,0xB4}, // PACK 0x80,0x80 -- Amiiboo (sniffed) pikachu-b UID:
{0x7E,0x22,0xE6,0xB4}, // PACK 0x80,0x80 -- AMiiboo (sniffed)
{0x02,0xE1,0xEE,0x36}, // PACK 0x80,0x80 -- AMiiboo (sniffed) sonic UID: 04d257 7ae33e8027
static int CmdHelp(const char *Cmd);
-char* getProductTypeStr( uint8_t id){
+char *getProductTypeStr( uint8_t id){
static char buf[20];
char *retStr = buf;
switch(id) {
case 3:
- sprintf(retStr, "0x%02X %s", id, "(Ultralight)");
+ sprintf(retStr, "%02X %s", id, "(Ultralight)");
break;
case 4:
- sprintf(retStr, "0x%02X %s", id, "(NTAG)");
+ sprintf(retStr, "%02X %s", id, "(NTAG)");
break;
default:
- sprintf(retStr, "0x%02X %s", id, "(unknown)");
+ sprintf(retStr, "%02X %s", id, "(unknown)");
break;
}
return buf;
the LSBit is set to '0' if the size is exactly 2^n
and set to '1' if the storage size is between 2^n and 2^(n+1).
*/
-char* getUlev1CardSizeStr( uint8_t fsize ){
+char *getUlev1CardSizeStr( uint8_t fsize ){
static char buf[40];
char *retStr = buf;
uint8_t cmd[] = {ISO14443A_CMD_READBLOCK, page};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if ( len == -1 )
- ul_switch_off_field();
return len;
}
memcpy(cmd+2, data, datalen);
uint8_t response[1] = {0xff};
- int len = ul_send_cmd_raw(cmd, 2+datalen, response, sizeof(response));
- if ( len == -1 )
- ul_switch_off_field();
+ ul_send_cmd_raw(cmd, 2+datalen, response, sizeof(response));
// ACK
if ( response[0] == 0x0a ) return 0;
// NACK
uint8_t cmd[] = {MIFARE_ULC_AUTH_1, 0x00};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), nonce, nonceLength);
- if ( len == -1 )
- ul_switch_off_field();
return len;
}
+static int ulc_authentication( uint8_t *key, bool switch_off_field ){
+
+ UsbCommand c = {CMD_MIFAREUC_AUTH, {switch_off_field}};
+ memcpy(c.d.asBytes, key, 16);
+ SendCommand(&c);
+ UsbCommand resp;
+ if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) return -1;
+ if ( resp.arg[0] == 1 ) return 0;
+
+ return -2;
+}
+
static int ulev1_requestAuthentication( uint8_t *pwd, uint8_t *pack, uint16_t packLength ){
uint8_t cmd[] = {MIFARE_ULEV1_AUTH, pwd[0], pwd[1], pwd[2], pwd[3]};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), pack, packLength);
- if ( len == -1)
- ul_switch_off_field();
return len;
}
uint8_t cmd[] = {MIFARE_ULEV1_VERSION};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if ( len == -1 )
- ul_switch_off_field();
return len;
}
// uint8_t cmd[] = {MIFARE_ULEV1_FASTREAD, startblock, endblock};
// if ( !ul_send_cmd_raw(cmd, sizeof(cmd), response)){
- // ul_switch_off_field();
// return -1;
// }
// return 0;
uint8_t cmd[] = {MIFARE_ULEV1_READ_CNT, counter};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if (len == -1)
- ul_switch_off_field();
return len;
}
uint8_t cmd[] = {MIFARE_ULEV1_CHECKTEAR, counter};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if (len == -1)
- ul_switch_off_field();
return len;
}
uint8_t cmd[] = {MIFARE_ULEV1_READSIG, 0x00};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if (len == -1)
- ul_switch_off_field();
return len;
}
static int ul_print_default( uint8_t *data){
uint8_t uid[7];
-
uid[0] = data[0];
uid[1] = data[1];
uid[2] = data[2];
status = ul_select(&card);
if ( status < 1 ){
- PrintAndLog("Error: couldn't select");
+ PrintAndLog("iso14443a card select failed");
ul_switch_off_field();
return UL_ERROR;
}
if ( card.uid[0] != 0x05) {
len = ulev1_getVersion(version, sizeof(version));
- if (len > -1) ul_switch_off_field(); //if -1 it is already off
+ ul_switch_off_field();
switch (len) {
case 0x0A: {
ul_switch_off_field();
return UL_ERROR;
}
- uint8_t nonce1[11] = {0x00};
- status = ulc_requestAuthentication(nonce1, sizeof(nonce1));
+ uint8_t nonce[11] = {0x00};
+ status = ulc_requestAuthentication(nonce, sizeof(nonce));
tagtype = ( status > 0 ) ? UL_C : UL;
- if (status != -1) ul_switch_off_field();
+ ul_switch_off_field();
}
} else {
// Infinition MY-D tests Exam high nibble
if ( hasAuthKey ) {
if ((tagtype & UL_C)) {
- ul_switch_off_field();
//will select card automatically
- if (try3DesAuthentication(authenticationkey, false) != 1) {
+ if (ulc_authentication(authenticationkey, false) != 0) {
ul_switch_off_field();
PrintAndLog("Error: Authentication Failed UL-C");
return 0;
} else {
len = ulev1_requestAuthentication(authenticationkey, pack, sizeof(pack));
if (len < 1) {
- if (!len) ul_switch_off_field();
+ ul_switch_off_field();
PrintAndLog("Error: Authentication Failed UL-EV1/NTAG");
return 0;
}
// read pages 0,1,2,4 (should read 4pages)
status = ul_read(0, data, sizeof(data));
if ( status == -1 ){
+ ul_switch_off_field();
PrintAndLog("Error: tag didn't answer to READ");
return status;
}
uint8_t ulc_deskey[16] = {0x00};
status = ul_read(0x2C, ulc_deskey, sizeof(ulc_deskey));
if ( status == -1 ){
+ ul_switch_off_field();
PrintAndLog("Error: tag didn't answer to READ magic");
return status;
}
if ( hasAuthKey ) return 1;
PrintAndLog("Trying some default 3des keys");
- ul_switch_off_field(); //will select again in try3DesAuth...
for (uint8_t i = 0; i < KEYS_3DES_COUNT; ++i ){
key = default_3des_keys[i];
- if (try3DesAuthentication(key, true) == 1){
+ if (ulc_authentication(key, true) == 0){
PrintAndLog("Found default 3des key: "); //%s", sprint_hex(key,16));
uint8_t keySwap[16];
memcpy(keySwap, SwapEndian64(key,16,8), 16);
ulc_print_3deskey(keySwap);
+ ul_switch_off_field();
return 1;
}
}
+ ul_switch_off_field();
return 1; //return even if key not found (UL_C is done)
}
}
status = ulev1_readSignature( ulev1_signature, sizeof(ulev1_signature));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to READ SIGNATURE");
+ ul_switch_off_field();
return status;
}
ulev1_print_signature( ulev1_signature, sizeof(ulev1_signature));
status = ul_read(startconfigblock, ulev1_conf, sizeof(ulev1_conf));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to READ EV1");
+ ul_switch_off_field();
return status;
}
// save AUTHENTICATION LIMITS for later:
status = ulev1_getVersion(version, sizeof(version));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to GETVERSION");
+ ul_switch_off_field();
return status;
}
ulev1_print_version(version);
// if we called info with key, just return
- if ( hasAuthKey ) return 1;
+ if ( hasAuthKey ) {
+ ul_switch_off_field();
+ return 1;
+ }
// AUTHLIMIT, (number of failed authentications)
// 0 = limitless.
}
}
}
- if (len > -1) ul_switch_off_field();
}
}
errors = param_gethex(tempStr, 0, key, dataLen);
else
errors = true;
-
- if (!errors)
- memcpy(key, data, dataLen/2);
cmdp += 2;
hasPwd = true;
}
// add keys
- if (hasPwd && dataLen == 32){ //UL_C
- memcpy(data + Pages*4, key, 16);
+ if (hasPwd){ //UL_C
+ memcpy(data + Pages*4, key, dataLen/2);
Pages += 4;
}
- //TODO add key MEM location for other tags
for (i = 0; i < Pages; ++i) {
if ( i < 3 ) {
return 0;
}
+/*
// Needed to Authenticate to Ultralight C tags
void rol (uint8_t *data, const size_t len){
uint8_t first = data[0];
}
data[len-1] = first;
}
+*/
//-------------------------------------------------------------------------------
// Ultralight C Methods
//Change key to user defined one
if (cmdp == 'k' || cmdp == 'K'){
keyNo = param_get8(Cmd, 1);
- if(keyNo > 6)
+ if(keyNo > KEYS_3DES_COUNT)
errors = true;
}
}
uint8_t *key = default_3des_keys[keyNo];
- if (try3DesAuthentication(key, true) > 0)
+ if (ulc_authentication(key, true) == 0)
PrintAndLog("Authentication successful. 3des key: %s",sprint_hex(key, 16));
else
PrintAndLog("Authentication failed");
return 0;
}
-int try3DesAuthentication( uint8_t *key, bool switch_off_field ){
-
- //uint32_t cuid = 0;
-
- des3_context ctx = { 0 };
-
- uint8_t random_a[8] = { 1,1,1,1,1,1,1,1 };
- uint8_t random_b[8] = { 0 };
- uint8_t enc_random_b[8] = { 0 };
- uint8_t rnd_ab[16] = { 0 };
- uint8_t iv[8] = { 0 };
-
- UsbCommand c = {CMD_MIFAREUC_AUTH1, {0x00}};
- SendCommand(&c);
- UsbCommand resp;
- if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) return -1;
- if ( !(resp.arg[0] & 0xff) ) return -2;
-
- //cuid = resp.arg[1];
- memcpy(enc_random_b,resp.d.asBytes+1,8);
-
- des3_set2key_dec(&ctx, key);
- // context, mode, length, IV, input, output
- des3_crypt_cbc( &ctx, DES_DECRYPT, sizeof(random_b), iv , enc_random_b , random_b);
-
- rol(random_b,8);
- memcpy(rnd_ab ,random_a,8);
- memcpy(rnd_ab+8,random_b,8);
-
- des3_set2key_enc(&ctx, key);
- // context, mode, length, IV, input, output
- des3_crypt_cbc(&ctx, DES_ENCRYPT, sizeof(rnd_ab), enc_random_b, rnd_ab, rnd_ab);
-
- //Auth2
- c.cmd = CMD_MIFAREUC_AUTH2;
- c.arg[0] = switch_off_field;
- memcpy(c.d.asBytes, rnd_ab, 16);
- SendCommand(&c);
-
- if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500)) return -1;
- if ( !(resp.arg[0] & 0xff)) return -2;
-
- uint8_t enc_resp[8] = { 0 };
- uint8_t resp_random_a[8] = { 0 };
- memcpy(enc_resp, resp.d.asBytes+1, 8);
-
- des3_set2key_dec(&ctx, key);
- // context, mode, length, IV, input, output
- des3_crypt_cbc( &ctx, DES_DECRYPT, 8, enc_random_b, enc_resp, resp_random_a);
-
- if ( !memcmp(resp_random_a, random_a, 8))
- return 1;
- return 0;
-
- //PrintAndLog(" RndA :%s", sprint_hex(random_a, 8));
- //PrintAndLog(" enc(RndB) :%s", sprint_hex(enc_random_b, 8));
- //PrintAndLog(" RndB :%s", sprint_hex(random_b, 8));
- //PrintAndLog(" A+B :%s", sprint_hex(random_a_and_b, 16));
- //PrintAndLog(" enc(A+B) :%s", sprint_hex(random_a_and_b, 16));
- //PrintAndLog(" enc(RndA') :%s", sprint_hex(data2+1, 8));
-}
-
/**
A test function to validate that the polarssl-function works the same
was as the openssl-implementation.
hasPwd = TRUE;
}
}
- //uint8_t *key2 = SwapEndian64(key, 16, 8);
//Read Block
UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};
projects / proxmark3-svn / commitdiff