From e98572a1e2dde603f31cc06f330c6abd295139de Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 7 Oct 2015 23:00:46 +0200
Subject: [PATCH] I just merged @marshmellow's branch "iclass"  and that was a
 lot of new functionality. *great work*

Things like the ICLASS, tryDecryptWord,

--
My other stuff like default keys, some new Mifare EV1 commands 0x40, 0x43 for the logging annotation,  start of the T55x7 configblock helper functionality (ripped from Adam Lauries RFIdler code)
Changes to the PCF7931 functions written,  which has a lousy input check..
---
 CHANGELOG.md                       |   14 +-
 README.txt                         |   65 +-
 armsrc/LCD.c                       |    2 +-
 armsrc/appmain.c                   |   21 +
 armsrc/apps.h                      |   12 +
 armsrc/iclass.c                    |  276 +++---
 armsrc/iso14443a.c                 |   29 +-
 armsrc/lfops.c                     |  257 +++++
 client/cmdhf14a.c                  |    2 +-
 client/cmdhf14b.c                  |    4 +
 client/cmdhficlass.c               | 1468 +++++++++++++++++++++++-----
 client/cmdhficlass.h               |   21 +-
 client/cmdhfmf.c                   |   12 +-
 client/cmdhfmf.h                   |    4 +-
 client/cmdhfmfdes.c                |    1 -
 client/cmdhfmfu.c                  |    2 +-
 client/cmdlf.c                     |    8 +-
 client/cmdlfpcf7931.c              |  140 ++-
 client/cmdlfpcf7931.h              |   13 +-
 client/cmdlft55xx.c                |    8 +-
 client/cmdlft55xx.h                |   15 +-
 client/default_keys.dic            |    4 +-
 client/loclass/cipher.c            |   21 +
 client/loclass/cipher.h            |    2 +
 client/lualibs/commands.lua        |    8 +-
 client/lualibs/mf_default_keys.lua |    6 +
 client/mifarehost.c                |   20 +
 client/mifarehost.h                |    1 +
 client/nonce2key/nonce2key.c       |    2 +-
 client/util.c                      |   21 +
 client/util.h                      |    1 +
 common/protocols.c                 |   64 +-
 common/protocols.h                 |    7 +
 include/usb_cmd.h                  |    9 +-
 34 files changed, 2053 insertions(+), 487 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9e8e2ac..e619d89e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,8 +3,18 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+  --trying to fix "hf 14b" command to be able to read CALYPSO card.	 (iceman)
+  --trying to fix "t55x7" read with password bug. (iceman)
+  --
 
 ### Added
+- `hf mf eload u` added an ultralight/ntag option. (marshmellow)
+- `hf iclass managekeys` to save, load and manage iclass keys.  (adjusted most commands to accept a loaded key in memory) (marshmellow)
+- `hf iclass readblk` to select, authenticate, and read 1 block from an iclass card (marshmellow)
+- `hf iclass writeblk` to select, authenticate, and write 1 block to an iclass card (or picopass) (marshmellow + others)
+- `hf iclass clone` to take a saved dump file and clone selected blocks to a new tag (marshmellow + others)
+- `hf iclass calcnewkey` - to calculate the div_key change to change a key - (experimental) (marshmellow + others)
+- `hf iclass encryptblk` - to encrypt a data block hex to prep for writing that block (marshmellow)
 - ISO14443a stand-alone operation with ARM CFLAG="WITH_ISO14443a_StandAlone". This code can read & emulate two banks of 14a tag UIDs and write to "magic" cards  (Craig Young) 
 - AWID26 command context added as 'lf awid' containing realtime demodulation as well as cloning/simulation based on tag numbers (Craig Young)
 - Added 'hw status'. This command makes the ARM print out some runtime information. (holiman) 
@@ -12,8 +22,9 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Added `data hex2bin` and `data bin2hex` for command line conversion between binary and hexadecimal (holiman)
 
 ### Changed																		
+- changed `lf config t <threshold>` to be 0 - 128 and will trigger on + or - threshold value (marshmellow) 
+- `hf iclass dump` cli options - can now dump AA1 and AA2 with different keys in one run (does not go to muliple pages for the larger tags yet)
 - Revised workflow for StandAloneMode14a (Craig Young)
-- Changed lf config's `threshold` to a graph (signed) metric and it will trigger on + or - value set to. (example: set to 50 and recording would begin at first graphed value of >= 50 or <= -50) (marshmellow)
 - EPA functions (`hf epa`) now support both ISO 14443-A and 14443-B cards (frederikmoellers)
 - 'hw version' only talks to ARM at startup, after that the info is cached. (pwpiwi)
 
@@ -26,7 +37,6 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Added compression of fpga config and data, *BOOTROM REFLASH REQUIRED* (piwi)
 - Implemented better detection of mifare-tags that are not vulnerable to classic attacks (`hf mf mifare`, `hf mf nested`) (piwi)
 
-
 ### Added
 - Add `hf 14b reader` to find and print general info about known 14b tags (marshmellow)
 - Add `hf 14b info` to find and print full info about std 14b tags and sri tags (using 14b raw commands in the client)  (marshmellow)
diff --git a/README.txt b/README.txt
index 2acd55a1..2bab1bcd 100644
--- a/README.txt
+++ b/README.txt
@@ -1,24 +1,32 @@
-The iceman fork.
-
+The iceman fork
+---------------
 NOTICE:
 
 The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3
 
+NEWS: 
+
+::THIS FORK IS HIGHLY EXPERIMENTAL::
 
-NEWS:      
 
 Whats in this fork?  I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch. 
 Among the stuff is
 
 	* Jonor's hf 14a raw timing patch
 	* Piwi's updates. (usually gets into the master)
+	* Piwi's "topaz" branch (not merged)
 	* Holiman's iclass, (usually gets into the master)
-	* Marshmellow's LF fixes
+	* Marshmellow's fixes (usually gets into the master)
 	* Midnitesnake's Ultralight,  Ultralight-c enhancements
 	* Izsh's lf peak modification / iir-filtering
 	* Aspers's tips and tricks from inside the PM3-gui-tool, settings.xml and other stuff.
 	* My own desfire, Ultralight extras, LF T55xx enhancements, bugs fixes (filelength, hf mf commands ), TNP3xxx lua scripts,  Awid26,  skidata scripts (will come)
 	* other obscure patches like for the sammy-mode,  (offline you know), tagidentifications, defaultkeys. 
+	* Minor textual changes here and there.
+	* Simulation of Ultralight/Ntag.
+	* Marshmellow's and my "RevEng" addon for the client.  Ref: http://reveng.sourceforge.net/
+	* Someone's alterantive bruteforce Mifare changes.. (you need the two other exe to make it work)
+	* 
 	
 Give me a hint, and I'll see if I can't merge in the stuff you have. 
 
@@ -28,6 +36,7 @@ PM3 GUI:
 
 I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*	
 
+
 	  
 DEVELOPMENT:
 
@@ -78,10 +87,54 @@ Solution
 	
 
 An old Qt4 version makefile is found here: http://www.icesql.se/proxmark3/code/linuxmakefile.txt  but this one doesn't have all new files in it. So I don't recommend it.
+							   
+
+January 2015, Sweden
+iceman at host iuse.se
+
 
 The Proxmark 3 is available for purchase (assembled and tested) from the
 following locations:
 
+   * http://proxmark3.com/
+   * http://www.xfpga.com/
 
-January 2015, Sweden
-iceman at host iuse.se
+Most of the ultra-low-volume contract assemblers could put
+something like this together with a reasonable yield. A run of around
+a dozen units is probably cost-effective. The BOM includes (possibly-
+outdated) component pricing, and everything is available from Digikey
+and the usual distributors.
+
+If you've never assembled a modern circuit board by hand, then this is
+not a good place to start. Some of the components (e.g. the crystals)
+must not be assembled with a soldering iron, and require hot air.
+
+The schematics are included; the component values given are not
+necessarily correct for all situations, but it should be possible to do
+nearly anything you would want with appropriate population options.
+
+The printed circuit board artwork is also available, as Gerbers and an
+Excellon drill file.
+
+
+LICENSING:
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+
+Jonathan Westhues
+user jwesthues, at host cq.cx
+
+May 2007, Cambridge MA
diff --git a/armsrc/LCD.c b/armsrc/LCD.c
index 87be5e3a..65d64ac9 100644
--- a/armsrc/LCD.c
+++ b/armsrc/LCD.c
@@ -6,7 +6,7 @@
 // LCD code
 //-----------------------------------------------------------------------------
 
-#include "../include/proxmark3.h"
+#include "proxmark3.h"
 #include "apps.h"
 #include "LCD.h"
 #include "fonts.h"
diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 8c4b45f5..6ef18bc8 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -992,6 +992,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
 			ReadPCF7931();
 			cmd_send(CMD_ACK,0,0,0,0,0);
 			break;
+		case CMD_PCF7931_WRITE:
+			WritePCF7931(c->d.asDwords[0],c->d.asDwords[1],c->d.asDwords[2],c->d.asDwords[3],c->d.asDwords[4],c->d.asDwords[5],c->d.asDwords[6], c->d.asDwords[9], c->d.asDwords[7]-128,c->d.asDwords[8]-128, c->arg[0], c->arg[1], c->arg[2]);
+			break;
 		case CMD_EM4X_READ_WORD:
 			EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
 			break;
@@ -1212,6 +1215,24 @@ void UsbPacketReceived(uint8_t *packet, int len)
 	case CMD_ICLASS_EML_MEMSET:
 			emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
 			break;
+		case CMD_ICLASS_WRITEBLOCK:
+			iClass_WriteBlock(c->arg[0], c->d.asBytes);
+			break;
+		case CMD_ICLASS_READCHECK:  // auth step 1
+			iClass_ReadCheck(c->arg[0], c->arg[1]);
+			break;
+		case CMD_ICLASS_READBLOCK:
+			iClass_ReadBlk(c->arg[0]);
+			break;
+		case CMD_ICLASS_AUTHENTICATION: //check
+			iClass_Authentication(c->d.asBytes);
+			break;
+		case CMD_ICLASS_DUMP:
+			iClass_Dump(c->arg[0], c->arg[1]);
+			break;
+		case CMD_ICLASS_CLONE:
+			iClass_Clone(c->arg[0], c->arg[1], c->d.asBytes);
+			break;
 #endif
 
 		case CMD_BUFF_CLEAR:
diff --git a/armsrc/apps.h b/armsrc/apps.h
index b4cab979..f88e6e91 100644
--- a/armsrc/apps.h
+++ b/armsrc/apps.h
@@ -94,6 +94,11 @@ int DemodPCF7931(uint8_t **outBlocks);
 int IsBlock0PCF7931(uint8_t *Block);
 int IsBlock1PCF7931(uint8_t *Block);
 void ReadPCF7931();
+void SendCmdPCF7931(uint32_t * tab);
+bool AddBytePCF7931(uint8_t byte, uint32_t * tab, int32_t l, int32_t p);
+bool AddBitPCF7931(bool b, uint32_t * tab, int32_t l, int32_t p);
+bool AddPatternPCF7931(uint32_t a, uint32_t b, uint32_t c, uint32_t * tab);
+void WritePCF7931(uint8_t pass1, uint8_t pass2, uint8_t pass3, uint8_t pass4, uint8_t pass5, uint8_t pass6, uint8_t pass7, uint16_t init_delay, int32_t l, int32_t p, uint8_t address, uint8_t byte, uint8_t data);
 void EM4xReadWord(uint8_t Address, uint32_t Pwd, uint8_t PwdMode);
 void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode);
 
@@ -190,6 +195,13 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
 void ReaderIClass(uint8_t arg0);
 void ReaderIClass_Replay(uint8_t arg0,uint8_t *MAC);
 void IClass_iso14443A_GetPublic(uint8_t arg0);
+void iClass_Authentication(uint8_t *MAC);
+void iClass_WriteBlock(uint8_t blockNo, uint8_t *data);
+void iClass_ReadBlk(uint8_t blockNo);
+bool iClass_ReadBlock(uint8_t blockNo, uint8_t *readdata);
+void iClass_Dump(uint8_t blockno, uint8_t numblks);
+void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data);
+void iClass_ReadCheck(uint8_t	blockNo, uint8_t keyType);
 
 void CopyViKingtoT55x7(uint32_t block1,uint32_t block2);
 // hitag2.h
diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index 38b52533..9046d51b 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -1601,16 +1601,16 @@ void setupIclassReader()
 
 }
 
-size_t sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, uint8_t expected_size, uint8_t retries)
+bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, uint8_t expected_size, uint8_t retries)
 {
 	while(retries-- > 0)
 	{
 		ReaderTransmitIClass(command, cmdsize);
 		if(expected_size == ReaderReceiveIClass(resp)){
-			return 0;
+			return true;
 		}
 	}
-	return 1;//Error
+	return false;//Error
 }
 
 /**
@@ -1620,14 +1620,17 @@ size_t sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t*
  *         1 = Got CSN
  *         2 = Got CSN and CC
  */
-uint8_t handshakeIclassTag(uint8_t *card_data)
+uint8_t handshakeIclassTag_ext(uint8_t *card_data, bool use_credit_key)
 {
 	static uint8_t act_all[]     = { 0x0a };
-	static uint8_t identify[]    = { 0x0c };
+	//static uint8_t identify[]    = { 0x0c };
+	static uint8_t identify[]    = { 0x0c, 0x00, 0x73, 0x33 };
 	static uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
-
-
-	static uint8_t readcheck_cc[]= { 0x88, 0x02,};
+	static uint8_t readcheck_cc[]= { 0x88, 0x02 };
+	if (use_credit_key)
+		readcheck_cc[0] = 0x18;
+	else
+		readcheck_cc[0] = 0x88;
 
 	uint8_t resp[ICLASS_BUFFER_SIZE];
 
@@ -1668,6 +1671,9 @@ uint8_t handshakeIclassTag(uint8_t *card_data)
 
 	return read_status;
 }
+uint8_t handshakeIclassTag(uint8_t *card_data){
+	return handshakeIclassTag_ext(card_data, false);
+}
 
 
 // Reader iClass Anticollission
@@ -1687,6 +1693,9 @@ void ReaderIClass(uint8_t arg0) {
 	uint8_t result_status = 0;
     bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;
 	bool try_once = arg0 & FLAG_ICLASS_READER_ONE_TRY;
+	bool use_credit_key = false;
+	if (arg0 & FLAG_ICLASS_READER_CEDITKEY)
+		use_credit_key = true;
 	set_tracing(TRUE);
     setupIclassReader();
 
@@ -1701,7 +1710,7 @@ void ReaderIClass(uint8_t arg0) {
 		}
 		WDT_HIT();
 
-		read_status = handshakeIclassTag(card_data);
+		read_status = handshakeIclassTag_ext(card_data, use_credit_key);
 
 		if(read_status == 0) continue;
 		if(read_status == 1) result_status = FLAG_ICLASS_READER_CSN;
@@ -1715,11 +1724,10 @@ void ReaderIClass(uint8_t arg0) {
 		if(arg0 & FLAG_ICLASS_READER_CONF)
 		{
 			if(sendCmdGetResponseWithRetries(readConf, sizeof(readConf),card_data+8, 10, 10))
-			{
-				Dbprintf("Failed to dump config block");
-			}else
 			{
 				result_status |= FLAG_ICLASS_READER_CONF;
+			} else {
+				Dbprintf("Failed to dump config block");
 			}
 		}
 
@@ -1727,10 +1735,9 @@ void ReaderIClass(uint8_t arg0) {
 		if(arg0 & FLAG_ICLASS_READER_AA){
 			if(sendCmdGetResponseWithRetries(readAA, sizeof(readAA),card_data+(8*4), 10, 10))
 			{
-//				Dbprintf("Failed to dump AA block");
-			}else
-			{
 				result_status |= FLAG_ICLASS_READER_AA;
+			} else {
+				//Dbprintf("Failed to dump AA block");
 			}
 		}
 
@@ -1814,7 +1821,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 				//for now replay captured auth (as cc not updated)
 				memcpy(check+5,MAC,4);
 
-		if(sendCmdGetResponseWithRetries(check, sizeof(check),resp, 4, 5))
+		if(!sendCmdGetResponseWithRetries(check, sizeof(check),resp, 4, 5))
 		{
 				  Dbprintf("Error: Authentication Fail!");
 			continue;
@@ -1826,7 +1833,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 				read[2] = crc >> 8;
 				read[3] = crc & 0xff;
 
-		if(sendCmdGetResponseWithRetries(read, sizeof(read),resp, 10, 10))
+		if(!sendCmdGetResponseWithRetries(read, sizeof(read),resp, 10, 10))
 		{
 			Dbprintf("Dump config (block 1) failed");
 			continue;
@@ -1853,7 +1860,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 				    read[2] = crc >> 8;
 				    read[3] = crc & 0xff;
 
-			if(!sendCmdGetResponseWithRetries(read, sizeof(read), resp, 10, 10))
+			if(sendCmdGetResponseWithRetries(read, sizeof(read), resp, 10, 10))
 			{
 				         Dbprintf("     %02x: %02x %02x %02x %02x %02x %02x %02x %02x",
 						 block, resp[0], resp[1], resp[2],
@@ -1904,130 +1911,129 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 	LED_A_OFF();
 }
 
-//2. Create Read method (cut-down from above) based off responses from 1. 
-//   Since we have the MAC could continue to use replay function.
-//3. Create Write method
-/*
-void IClass_iso14443A_write(uint8_t arg0, uint8_t blockNo, uint8_t *data, uint8_t *MAC) {
-	uint8_t act_all[]     = { 0x0a };
-	uint8_t identify[]    = { 0x0c };
-	uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
-	uint8_t readcheck_cc[]= { 0x88, 0x02 };
-	uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
-	uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
-	uint8_t write[]       = { 0x87, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
-	
-    uint16_t crc = 0;
-	
-	uint8_t* resp = (((uint8_t *)BigBuf) + 3560);
-
-	// Reset trace buffer
-	memset(trace, 0x44, RECV_CMD_OFFSET);
-	traceLen = 0;
-
-	// Setup SSC
-	FpgaSetupSsc();
-	// Start from off (no field generated)
-	// Signal field is off with the appropriate LED
-	LED_D_OFF();
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-	SpinDelay(200);
+void iClass_ReadCheck(uint8_t	blockNo, uint8_t keyType) {
+	uint8_t readcheck[] = { keyType, blockNo };
+	uint8_t resp[] = {0,0,0,0,0,0,0,0};
+	size_t isOK = 0;
+	isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 6);
+	cmd_send(CMD_ACK,isOK,0,0,0,0);
+}
 
-	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+void iClass_Authentication(uint8_t *MAC) {
+	uint8_t check[] = { ICLASS_CMD_CHECK, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+	uint8_t resp[ICLASS_BUFFER_SIZE];
+	memcpy(check+5,MAC,4);
+	bool isOK;
+	isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, 4, 6);
+	cmd_send(CMD_ACK,isOK,0,0,0,0);
+}
+bool iClass_ReadBlock(uint8_t blockNo, uint8_t *readdata) {
+	uint8_t readcmd[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockNo, 0x00, 0x00}; //0x88, 0x00 // can i use 0C?
+	char bl = blockNo;
+	uint16_t rdCrc = iclass_crc16(&bl, 1);
+	readcmd[2] = rdCrc >> 8;
+	readcmd[3] = rdCrc & 0xff;
+	uint8_t resp[] = {0,0,0,0,0,0,0,0,0,0};
+	bool isOK = false;
+
+	//readcmd[1] = blockNo;
+	isOK = sendCmdGetResponseWithRetries(readcmd, sizeof(readcmd), resp, 10, 10);
+	memcpy(readdata, resp, sizeof(resp));
+
+	return isOK;
+}
 
-	// Now give it time to spin up.
-	// Signal field is on with the appropriate LED
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
-	SpinDelay(200);
+void iClass_ReadBlk(uint8_t blockno) {
+	uint8_t readblockdata[] = {0,0,0,0,0,0,0,0,0,0};
+	bool isOK = false;
+	isOK = iClass_ReadBlock(blockno, readblockdata);
+	cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);
+}
 
-	LED_A_ON();
+void iClass_Dump(uint8_t blockno, uint8_t numblks) {
+	uint8_t readblockdata[] = {0,0,0,0,0,0,0,0,0,0};
+	bool isOK = false;
+	uint8_t blkCnt = 0;
 
-	for(int i=0;i<1;i++) {
-	
-		if(traceLen > TRACE_SIZE) {
-			DbpString("Trace full");
+	BigBuf_free();
+	uint8_t *dataout = BigBuf_malloc(255*8);
+	if (dataout == NULL){
+		Dbprintf("out of memory");
+		OnError(1);
+		return;
+	}
+	memset(dataout,0xFF,255*8);
+
+	for (;blkCnt < numblks; blkCnt++) {
+		isOK = iClass_ReadBlock(blockno+blkCnt, readblockdata);
+		if (!isOK || (readblockdata[0] == 0xBB || readblockdata[7] == 0xBB || readblockdata[2] == 0xBB)) { //try again
+			isOK = iClass_ReadBlock(blockno+blkCnt, readblockdata);
+			if (!isOK) {
+				Dbprintf("Block %02X failed to read", blkCnt+blockno);
 			break;
 		}
-		
-		if (BUTTON_PRESS()) break;
-
-		// Send act_all
-		ReaderTransmitIClass(act_all, 1);
-		// Card present?
-		if(ReaderReceiveIClass(resp)) {
-			ReaderTransmitIClass(identify, 1);
-			if(ReaderReceiveIClass(resp) == 10) {
-				// Select card          
-				memcpy(&select[1],resp,8);
-				ReaderTransmitIClass(select, sizeof(select));
-
-				if(ReaderReceiveIClass(resp) == 10) {
-					Dbprintf("     Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
-					resp[0], resp[1], resp[2],
-					resp[3], resp[4], resp[5],
-					resp[6], resp[7]);
-				}
-				// Card selected
-				Dbprintf("Readcheck on Sector 2");
-				ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
-				if(ReaderReceiveIClass(resp) == 8) {
-				   Dbprintf("     CC: %02x %02x %02x %02x %02x %02x %02x %02x",
-					resp[0], resp[1], resp[2],
-					resp[3], resp[4], resp[5],
-					resp[6], resp[7]);
-				}else return;
-				Dbprintf("Authenticate");
-				//for now replay captured auth (as cc not updated)
-				memcpy(check+5,MAC,4);
-				Dbprintf("     AA: %02x %02x %02x %02x",
-					check[5], check[6], check[7],check[8]);
-				ReaderTransmitIClass(check, sizeof(check));
-				if(ReaderReceiveIClass(resp) == 4) {
-				   Dbprintf("     AR: %02x %02x %02x %02x",
-					resp[0], resp[1], resp[2],resp[3]);
+		}
+		memcpy(dataout+(blkCnt*8),readblockdata,8);
+	}
+	//return pointer to dump memory in arg3
+	cmd_send(CMD_ACK,isOK,blkCnt,BigBuf_max_traceLen(),0,0);
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
+	BigBuf_free();
+}
+
+bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) {
+	uint8_t write[] = { ICLASS_CMD_UPDATE, blockNo, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+	//uint8_t readblockdata[10];
+	//write[1] = blockNo;
+	memcpy(write+2, data, 12); // data + mac
+	uint8_t resp[] = {0,0,0,0,0,0,0,0,0,0};
+	bool isOK;
+	isOK = sendCmdGetResponseWithRetries(write,sizeof(write),resp,sizeof(resp),10);
+	if (isOK) {
+		//Dbprintf("WriteResp: %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X",resp[0],resp[1],resp[2],resp[3],resp[4],resp[5],resp[6],resp[7],resp[8],resp[9]);
+		if (memcmp(write+2,resp,8)) {
+			//error try again
+			isOK = sendCmdGetResponseWithRetries(write,sizeof(write),resp,sizeof(resp),10);
+		}
+	}
+	return isOK;
+}
+
+void iClass_WriteBlock(uint8_t blockNo, uint8_t *data) {
+	bool isOK = iClass_WriteBlock_ext(blockNo, data);
+	if (isOK){
+		Dbprintf("Write block [%02x] successful",blockNo);
 				}else {
-				  Dbprintf("Error: Authentication Fail!");
-				  return;
-				}
-				Dbprintf("Write Block");
-				
-				//read configuration for max block number
-				read_success=false;
-				read[1]=1;
-				uint8_t *blockno=&read[1];
-				crc = iclass_crc16((char *)blockno,1);
-				read[2] = crc >> 8;
-				read[3] = crc & 0xff;
-				while(!read_success){
-				      ReaderTransmitIClass(read, sizeof(read));
-				      if(ReaderReceiveIClass(resp) == 10) {
-					 read_success=true;
-					 mem=resp[5];
-					 memory.k16= (mem & 0x80);
-					 memory.book= (mem & 0x20);
-					 memory.k2= (mem & 0x8);
-					 memory.lockauth= (mem & 0x2);
-					 memory.keyaccess= (mem & 0x1);
+		Dbprintf("Write block [%02x] failed",blockNo);		
+	}
+	cmd_send(CMD_ACK,isOK,0,0,0,0);	
+}
 
-				      }
-				}
-				if (memory.k16){
-				  cardsize=255;
-				}else cardsize=32;
-				//check card_size
-				
-				memcpy(write+1,blockNo,1);
-				memcpy(write+2,data,8);
-				memcpy(write+10,mac,4);
-				while(!send_success){
-				  ReaderTransmitIClass(write, sizeof(write));
-				  if(ReaderReceiveIClass(resp) == 10) {
-				    write_success=true;
-				}
-			}//
+void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
+	int i;
+	int written = 0;
+	int total_block = (endblock - startblock) + 1;
+	for (i = 0; i < total_block;i++){
+		// block number
+		if (iClass_WriteBlock_ext(i+startblock, data+(i*12))){
+			Dbprintf("Write block [%02x] successful",i + startblock);
+			written++;
+		} else {
+			if (iClass_WriteBlock_ext(i+startblock, data+(i*12))){
+				Dbprintf("Write block [%02x] successful",i + startblock);
+				written++;
+			} else {
+				Dbprintf("Write block [%02x] failed",i + startblock);
+			}
 		}
-		WDT_HIT();
 	}
-	
-	LED_A_OFF();
-}*/
+	if (written == total_block)
+		Dbprintf("Clone complete");
+	else
+		Dbprintf("Clone incomplete");   
+
+	cmd_send(CMD_ACK,1,0,0,0,0);
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
+}
diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index a723f502..71f000d0 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -947,10 +947,10 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 	uint8_t sak;
 					
 	// PACK response to PWD AUTH for EV1/NTAG
-	uint8_t response8[4];
+	uint8_t response8[4] =  {0,0,0,0};
 	
 	// The first response contains the ATQA (note: bytes are transmitted in reverse order).
-	uint8_t response1[2];
+	uint8_t response1[2] =  {0,0};
 	
 	switch (tagType) {
 		case 1: { // MIFARE Classic
@@ -1299,7 +1299,8 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 			if ( tagType == 7 ) {
 				p_response =  &responses[8]; // PACK response
 				uint32_t pwd = bytes_to_num(receivedCmd+1,4);
-				Dbprintf("Auth attempt: %08x", pwd);	
+				
+				if ( MF_DBGLEVEL >= 3)  Dbprintf("Auth attempt: %08x", pwd);	
 			}
 		}
 		else {
@@ -2206,28 +2207,6 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 	return(-99999); // either nt1 or nt2 are invalid nonces
 }
 
-int32_t dist_nt_ex32(uint32_t nt1, uint32_t nt2, bool *result) {
-
-	uint16_t i;
-	uint32_t nttmp1, nttmp2;
-
-	if (nt1 == nt2) return 0;
-
-	nttmp1 = nt1;
-	nttmp2 = nt2;
-	
-	*result = true;
-	for (i = 1; i < 0xFFFFFFFF; i++) {
-		nttmp1 = prng_successor(nttmp1, 1);
-		if (nttmp1 == nt2) return i;
-			
-		nttmp2 = prng_successor(nttmp2, 1);
-			if (nttmp2 == nt1) return -i;
-		}
-	
-	*result = false;
-	return(-99999); // either nt1 or nt2 are invalid nonces
-}
 
 //-----------------------------------------------------------------------------
 // Recover several bits of the cypher stream. This implements (first stages of)
diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 8feaa6ae..74086d36 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -2125,3 +2125,260 @@ void CopyViKingtoT55x7(uint32_t block1,uint32_t block2)
     DbpString("DONE!");
 }
 
+
+#define T0_PCF 8 //period for the pcf7931 in us
+
+/* Write on a byte of a PCF7931 tag
+ * @param address : address of the block to write
+   @param byte : address of the byte to write
+    @param data : data to write
+ */
+void WritePCF7931(uint8_t pass1, uint8_t pass2, uint8_t pass3, uint8_t pass4, uint8_t pass5, uint8_t pass6, uint8_t pass7, uint16_t init_delay, int32_t l, int32_t p, uint8_t address, uint8_t byte, uint8_t data)
+{
+
+	uint32_t tab[1024]={0}; // data times frame
+	uint32_t u = 0;
+	uint8_t parity = 0;
+	bool comp = 0;
+
+
+	//BUILD OF THE DATA FRAME
+
+	//alimentation of the tag (time for initializing)
+	AddPatternPCF7931(init_delay, 0, 8192/2*T0_PCF, tab);
+
+	//PMC
+	Dbprintf("Initialization delay : %d us", init_delay);
+	AddPatternPCF7931(8192/2*T0_PCF + 319*T0_PCF+70, 3*T0_PCF, 29*T0_PCF, tab);
+
+	Dbprintf("Offsets : %d us on the low pulses width, %d us on the low pulses positions", l, p);
+
+	//password indication bit
+	AddBitPCF7931(1, tab, l, p);
+
+
+	//password (on 56 bits)
+	Dbprintf("Password (LSB first on each byte) : %02x %02x %02x %02x %02x %02x %02x", pass1,pass2,pass3,pass4,pass5,pass6,pass7);
+	AddBytePCF7931(pass1, tab, l, p);
+	AddBytePCF7931(pass2, tab, l, p);
+	AddBytePCF7931(pass3, tab, l, p);
+	AddBytePCF7931(pass4, tab, l, p);
+	AddBytePCF7931(pass5, tab, l, p);
+	AddBytePCF7931(pass6, tab, l, p);
+	AddBytePCF7931(pass7, tab, l, p);
+
+
+	//programming mode (0 or 1)
+	AddBitPCF7931(0, tab, l, p);
+
+	//block adress on 6 bits
+	Dbprintf("Block address : %02x", address);
+	for (u=0; u<6; u++)
+	{
+		if (address&(1<<u)) {	// bit 1
+			 parity++;
+			 AddBitPCF7931(1, tab, l, p);
+		} else{					// bit 0
+			 AddBitPCF7931(0, tab, l, p);
+		}
+	}
+
+	//byte address on 4 bits
+	Dbprintf("Byte address : %02x", byte);
+	for (u=0; u<4; u++)
+	{
+		if (byte&(1<<u)) {	// bit 1
+			 parity++;
+			 AddBitPCF7931(1, tab, l, p);
+		} else{				// bit 0
+			 AddBitPCF7931(0, tab, l, p);
+		}
+	}
+
+	//data on 8 bits
+	Dbprintf("Data : %02x", data);
+	for (u=0; u<8; u++)
+	{
+		if (data&(1<<u)) {	// bit 1
+			 parity++;
+			 AddBitPCF7931(1, tab, l, p);
+		} else{				//bit 0
+			 AddBitPCF7931(0, tab, l, p);
+		}
+	}
+
+
+	//parity bit
+	if((parity%2)==0){
+	 	AddBitPCF7931(0, tab, l, p); //even parity
+	}else{
+		AddBitPCF7931(1, tab, l, p);//odd parity
+	}
+
+	//time access memory
+	AddPatternPCF7931(5120+2680, 0, 0, tab);
+
+	//conversion of the scale time
+	for(u=0;u<500;u++){
+		tab[u]=(tab[u] * 3)/2;
+	}
+
+
+	//compennsation of the counter reload
+	while (!comp){
+		comp = 1;
+		for(u=0;tab[u]!=0;u++){
+			if(tab[u] > 0xFFFF){
+			  tab[u] -= 0xFFFF;
+			  comp = 0;
+			}
+		}
+	}
+
+	SendCmdPCF7931(tab);
+}
+
+
+
+/* Send a trame to a PCF7931 tags
+ * @param tab : array of the data frame
+ */
+
+void SendCmdPCF7931(uint32_t * tab){
+	uint16_t u=0;
+	uint16_t tempo=0;
+
+	Dbprintf("SENDING DATA FRAME...");
+
+	FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
+
+	FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
+
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU );
+
+	LED_A_ON();
+
+	// steal this pin from the SSP and use it to control the modulation
+	AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
+	AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
+
+	//initialization of the timer
+	AT91C_BASE_PMC->PMC_PCER |= (0x1 << 12) | (0x1 << 13) | (0x1 << 14);
+	AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE;
+	AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable
+	AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK;  //clock at 48/32 MHz
+	AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;
+	AT91C_BASE_TCB->TCB_BCR = 1;
+
+
+	tempo = AT91C_BASE_TC0->TC_CV;
+	for(u=0;tab[u]!= 0;u+=3){
+
+
+		// modulate antenna
+		HIGH(GPIO_SSC_DOUT);
+		while(tempo !=  tab[u]){
+			tempo = AT91C_BASE_TC0->TC_CV;
+		}
+
+		// stop modulating antenna
+		LOW(GPIO_SSC_DOUT);
+		while(tempo !=  tab[u+1]){
+			tempo = AT91C_BASE_TC0->TC_CV;
+		}
+
+
+		// modulate antenna
+		HIGH(GPIO_SSC_DOUT);
+		while(tempo !=  tab[u+2]){
+			tempo = AT91C_BASE_TC0->TC_CV;
+		}
+
+
+	}
+
+	LED_A_OFF();
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelay(200);
+
+
+	AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable
+	DbpString("FINISH !");
+	DbpString("(Could be usefull to send the same trame many times)");
+	LED(0xFFFF, 1000);
+}
+
+
+/* Add a byte for building the data frame of PCF7931 tags 
+ * @param b : byte to add
+ * @param tab : array of the data frame
+ * @param l : offset on low pulse width
+ * @param p : offset on low pulse positioning
+ */
+
+bool AddBytePCF7931(uint8_t byte, uint32_t * tab, int32_t l, int32_t p){
+
+	uint32_t u;
+	for (u=0; u<8; u++)
+	{
+		if (byte&(1<<u)) {	//bit à 1
+			if(AddBitPCF7931(1, tab, l, p)==1)return 1;
+		} else { //bit à 0
+			if(AddBitPCF7931(0, tab, l, p)==1)return 1;
+		}
+	}
+
+	return 0;
+}
+
+/* Add a bits for building the data frame of PCF7931 tags 
+ * @param b : bit to add
+ * @param tab : array of the data frame
+ * @param l : offset on low pulse width
+ * @param p : offset on low pulse positioning
+ */
+bool AddBitPCF7931(bool b, uint32_t * tab, int32_t l, int32_t p){
+	uint8_t u = 0;
+
+	for(u=0;tab[u]!=0;u+=3){} //we put the cursor at the last value of the array
+	
+
+	if(b==1){	//add a bit 1
+		if(u==0) tab[u] = 34*T0_PCF+p;
+		else 	 tab[u] = 34*T0_PCF+tab[u-1]+p;
+
+		tab[u+1] = 6*T0_PCF+tab[u]+l;
+		tab[u+2] = 88*T0_PCF+tab[u+1]-l-p;
+		return 0;
+	}else{ 		//add a bit 0
+
+		if(u==0) tab[u] = 98*T0_PCF+p;
+		else  	 tab[u] = 98*T0_PCF+tab[u-1]+p;
+
+		tab[u+1] = 6*T0_PCF+tab[u]+l;
+		tab[u+2] = 24*T0_PCF+tab[u+1]-l-p;
+		return 0;
+	}
+
+	
+	return 1;
+}
+
+/* Add a custom pattern in the data frame
+ * @param a : delay of the first high pulse
+ * @param b : delay of the low pulse
+ * @param c : delay of the last high pulse
+ * @param tab : array of the data frame
+ */
+bool AddPatternPCF7931(uint32_t a, uint32_t b, uint32_t c, uint32_t * tab){
+	uint32_t u = 0;
+	for(u=0;tab[u]!=0;u+=3){} //we put the cursor at the last value of the array
+
+	if(u==0) tab[u] = a;
+	else tab[u] = a + tab[u-1];
+
+	tab[u+1] = b+tab[u];
+	tab[u+2] = c+tab[u+1];
+
+	return 0;
+}
\ No newline at end of file
diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c
index 8a6e6afd..c85fadda 100644
--- a/client/cmdhf14a.c
+++ b/client/cmdhf14a.c
@@ -602,7 +602,7 @@ int CmdHF14ACmdRaw(const char *cmd) {
 	uint32_t temp;
 
     if (strlen(cmd)<2) {
-        PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-a] [-t] <milliseconds> [-b] <number of bits>  <0A 0B 0C ... hex>");
+        PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-a] [-T] [-t] <milliseconds> [-b] <number of bits>  <0A 0B 0C ... hex>");
         PrintAndLog("       -r    do not read response");
         PrintAndLog("       -c    calculate and append CRC");
         PrintAndLog("       -p    leave the signal field ON after receive");
diff --git a/client/cmdhf14b.c b/client/cmdhf14b.c
index d9e56693..7b67f8c2 100644
--- a/client/cmdhf14b.c
+++ b/client/cmdhf14b.c
@@ -73,10 +73,14 @@ int CmdSrix4kRead(const char *Cmd)
 }
 
 int rawClose(void){
+	UsbCommand resp;
 	UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
 	clearCommandBuffer();
 	SendCommand(&c);
+	if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 	return 0;	
+	}
+	return 0;
 }
 
 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
diff --git a/client/cmdhficlass.c b/client/cmdhficlass.c
index e8ba68f1..f17f96ca 100644
--- a/client/cmdhficlass.c
+++ b/client/cmdhficlass.c
@@ -31,11 +31,29 @@
 #include "loclass/fileutils.h"
 #include "protocols.h"
 #include "usb_cmd.h"
+#include "cmdhfmfu.h"
+
+#define llX PRIx64
 
 static int CmdHelp(const char *Cmd);
 
-int xorbits_8(uint8_t val)
-{
+#define ICLASS_KEYS_MAX 8
+static uint8_t iClass_Key_Table[ICLASS_KEYS_MAX][8] = {
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 },
+		{ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }
+};
+
+typedef struct iclass_block {
+    uint8_t d[8];
+} iclass_block_t;
+
+int xorbits_8(uint8_t val) {
 	uint8_t res = val ^ (val >> 1); //1st pass
 	res = res ^ (res >> 1); 		// 2nd pass
 	res = res ^ (res >> 2); 		// 3rd pass
@@ -43,20 +61,18 @@ int xorbits_8(uint8_t val)
 	return res & 1;
 }
 
-int CmdHFiClassList(const char *Cmd)
-{
+int CmdHFiClassList(const char *Cmd) {
 	PrintAndLog("Deprecated command, use 'hf list iclass' instead");
 	return 0;
 }
 
-int CmdHFiClassSnoop(const char *Cmd)
-{
+int CmdHFiClassSnoop(const char *Cmd) {
 	UsbCommand c = {CMD_SNOOP_ICLASS};
 	SendCommand(&c);
 	return 0;
 }
-int usage_hf_iclass_sim()
-{
+
+int usage_hf_iclass_sim(void) {
 	PrintAndLog("Usage:  hf iclass sim <option> [CSN]");
 	PrintAndLog("        options");
 	PrintAndLog("                0 <CSN> simulate the given CSN");
@@ -71,8 +87,7 @@ int usage_hf_iclass_sim()
 }
 
 #define NUM_CSNS 15
-int CmdHFiClassSim(const char *Cmd)
-{
+int CmdHFiClassSim(const char *Cmd) {
 	uint8_t simType = 0;
 	uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 
@@ -165,15 +180,15 @@ int CmdHFiClassSim(const char *Cmd)
 	return 0;
 }
 
-int HFiClassReader(const char *Cmd, bool loop, bool verbose)
-{
+int HFiClassReader(const char *Cmd, bool loop, bool verbose) {
 	bool tagFound = false;
 	UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN|
 					FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_AA}};
-	if (!loop) c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
-	SendCommand(&c);
+	// loop in client not device - else on windows have a communication error
+	c.arg[0] |= FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY;
 	UsbCommand resp;
 	while(!ukbhit()){
+		SendCommand(&c);
 		if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
 			uint8_t readStatus    = resp.arg[0] & 0xff;
 			uint8_t *data = resp.d.asBytes;
@@ -200,16 +215,13 @@ int HFiClassReader(const char *Cmd, bool loop, bool verbose)
 		if (!loop) break;
 	}
 	return 0;
-
 }
 
-int CmdHFiClassReader(const char *Cmd)
-{
+int CmdHFiClassReader(const char *Cmd) {
 	return HFiClassReader(Cmd, true, true);
 }
 
-int CmdHFiClassReader_Replay(const char *Cmd)
-{
+int CmdHFiClassReader_Replay(const char *Cmd) {
 	uint8_t readerType = 0;
 	uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
 
@@ -231,181 +243,22 @@ int CmdHFiClassReader_Replay(const char *Cmd)
 	return 0;
 }
 
-int CmdHFiClassReader_Dump(const char *Cmd)
-{
-	uint8_t readerType = 0;
-	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
-	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	//uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	uint8_t keytable[128] = {0};
-	int elite = 0;
-	uint8_t *used_key;
-	int i;
-	if (strlen(Cmd)<1)
-	{
-		PrintAndLog("Usage:  hf iclass dump <Key> [e]");
-		PrintAndLog("        Key    - A 16 byte master key");
-		PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
-		PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
-		PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
-		PrintAndLog("        sample: hf iclass dump 0011223344556677");
-
-
-		return 0;
-	}
-
-	if (param_gethex(Cmd, 0, KEY, 16))
-	{
-		PrintAndLog("KEY must include 16 HEX symbols");
-		return 1;
-	}
-
-	if (param_getchar(Cmd, 1) == 'e')
-	{
-		PrintAndLog("Elite switch on");
-		elite = 1;
-
-		//calc h2
-		hash2(KEY, keytable);
-		printarr_human_readable("keytable", keytable, 128);
-
-	}
-
-	UsbCommand resp;
-	uint8_t key_sel[8] = {0};
-	uint8_t key_sel_p[8] = { 0 };
-
-	UsbCommand c = {CMD_READER_ICLASS, {0}};
-	c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE| FLAG_ICLASS_READER_CC;
+int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
+	UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
+	memcpy(c.d.asBytes, data, blocksCount * 16);
 	SendCommand(&c);
-
-
-
-	if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
-	{
-		PrintAndLog("Command execute timeout");
-		return 0;
-	}
-
-	uint8_t isOK    = resp.arg[0] & 0xff;
-	uint8_t * data  = resp.d.asBytes;
-
-	memcpy(CSN,data,8);
-	memcpy(CCNR,data+16,8);
-
-	PrintAndLog("isOk:%02x", isOK);
-
-	if(isOK > 0)
-	{
-		PrintAndLog("CSN: %s",sprint_hex(CSN,8));
-	}
-	if(isOK <= 1){
-		PrintAndLog("Failed to obtain CC! Aborting");
-		return 0;
-	}
-	//Status 2 or higher
-
-	if(elite)
-	{
-		//Get the key index (hash1)
-		uint8_t key_index[8] = {0};
-
-		hash1(CSN, key_index);
-		printvar("hash1", key_index,8);
-		for(i = 0; i < 8 ; i++)
-			key_sel[i] = keytable[key_index[i]] & 0xFF;
-		PrintAndLog("Pre-fortified 'permuted' HS key that would be needed by an iclass reader to talk to above CSN:");
-		printvar("k_sel", key_sel,8);
-		//Permute from iclass format to standard format
-		permutekey_rev(key_sel,key_sel_p);
-		used_key = key_sel_p;
-	}else{
-		used_key = KEY;
-	}
-
-	PrintAndLog("Pre-fortified key that would be needed by the OmniKey reader to talk to above CSN:");
-	printvar("Used key",used_key,8);
-	diversifyKey(CSN,used_key, div_key);
-	PrintAndLog("Hash0, a.k.a diversified key, that is computed using Ksel and stored in the card (Block 3):");
-	printvar("Div key", div_key, 8);
-	printvar("CC_NR:",CCNR,12);
-	doMAC(CCNR,div_key, MAC);
-	printvar("MAC", MAC, 4);
-
-	uint8_t iclass_data[32000] = {0};
-	uint32_t iclass_datalen = 0;
-	uint32_t iclass_blocksFailed = 0;//Set to 1 if dump was incomplete
-
-	UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
-	memcpy(d.d.asBytes, MAC, 4);
-	clearCommandBuffer();
-	SendCommand(&d);
-	PrintAndLog("Waiting for device to dump data. Press button on device and key on keyboard to abort...");
-	while (true) {
-		printf(".");
-		if (ukbhit()) {
-			getchar();
-			printf("\naborted via keyboard!\n");
-			break;
-		}
-		if(WaitForResponseTimeout(CMD_ACK,&resp,4500))
-		{
-			uint32_t dataLength = resp.arg[0];
-			iclass_blocksFailed |= resp.arg[1];
-			if(dataLength > 0)
-			{
-				PrintAndLog("Got %d bytes data (total so far %d)" ,dataLength,iclass_datalen);
-				memcpy(iclass_data+iclass_datalen, resp.d.asBytes,dataLength);
-				iclass_datalen += dataLength;
-			}else
-			{//Last transfer, datalength 0 means the dump is finished
-				PrintAndLog("Dumped %d bytes of data from tag. ", iclass_datalen);
-				if(iclass_blocksFailed)
-				{
-					PrintAndLog("OBS! Some blocks failed to be dumped correctly!");
-				}
-				if(iclass_datalen > 0)
-				{
-					char filename[100] = {0};
-					//create a preferred filename
-					snprintf(filename, 100,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
-							 CSN[0],CSN[1],CSN[2],CSN[3],
-							CSN[4],CSN[5],CSN[6],CSN[7]);
-					//Place the div_key in block 3
-					memcpy(iclass_data+(3*8), div_key, 8);
-					saveFile(filename,"bin",iclass_data, iclass_datalen );
-				}
-				//Aaaand we're finished
-				return 0;
-			}
-		}
-	}
-
-
 	return 0;
 }
 
-int hf_iclass_eload_usage()
-{
+int hf_iclass_eload_usage(void) {
 	PrintAndLog("Loads iclass tag-dump into emulator memory on device");
 	PrintAndLog("Usage:  hf iclass eload f <filename>");
 	PrintAndLog("");
 	PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
 	return 0;
-
 }
 
-int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
-	UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
-	memcpy(c.d.asBytes, data, blocksCount * 16);
-	SendCommand(&c);
-	return 0;
-}
-int CmdHFiClassELoad(const char *Cmd)
-{
+int CmdHFiClassELoad(const char *Cmd) {
 
 	char opt = param_getchar(Cmd, 0);
 	if (strlen(Cmd)<1 || opt == 'h')
@@ -462,23 +315,7 @@ int CmdHFiClassELoad(const char *Cmd)
 	return 0;
 }
 
-int usage_hf_iclass_decrypt()
-{
-	PrintAndLog("Usage: hf iclass decrypt f <tagdump> o ");
-	PrintAndLog("");
-	PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
-	PrintAndLog("in the working directory. The file should be 16 bytes binary data");
-	PrintAndLog("");
-	PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
-	PrintAndLog("");
-	PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
-	PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
-	PrintAndLog("which is defined by the configuration block.");
-	return 1;
-}
-
-int readKeyfile(const char *filename, size_t len, uint8_t* buffer)
-{
+static int readKeyfile(const char *filename, size_t len, uint8_t* buffer) {
 	FILE *f = fopen(filename, "rb");
 	if(!f) {
 		PrintAndLog("Failed to read from file '%s'", filename);
@@ -502,8 +339,21 @@ int readKeyfile(const char *filename, size_t len, uint8_t* buffer)
 	return 0;
 }
 
-int CmdHFiClassDecrypt(const char *Cmd)
-{
+int usage_hf_iclass_decrypt(void) {
+	PrintAndLog("Usage: hf iclass decrypt f <tagdump>");
+	PrintAndLog("");
+	PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
+	PrintAndLog("in the working directory. The file should be 16 bytes binary data");
+	PrintAndLog("");
+	PrintAndLog("example: hf iclass decrypt f tagdump_12312342343.bin");
+	PrintAndLog("");
+	PrintAndLog("OBS! This is pretty stupid implementation, it tries to decrypt every block after block 6. ");
+	PrintAndLog("Correct behaviour would be to decrypt only the application areas where the key is valid,");
+	PrintAndLog("which is defined by the configuration block.");
+	return 1;
+}
+
+int CmdHFiClassDecrypt(const char *Cmd) {
 	uint8_t key[16] = { 0 };
 	if(readKeyfile("iclass_decryptionkey.bin", 16, key))
 	{
@@ -560,85 +410,763 @@ int CmdHFiClassDecrypt(const char *Cmd)
 	return 0;
 }
 
-int CmdHFiClass_iso14443A_write(const char *Cmd)
-{
-	uint8_t readerType = 0;
-	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
-	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+int usage_hf_iclass_encrypt(void) {
+	PrintAndLog("Usage: hf iclass encrypt <BlockData>");
+	PrintAndLog("");
+	PrintAndLog("OBS! In order to use this function, the file 'iclass_decryptionkey.bin' must reside");
+	PrintAndLog("in the working directory. The file should be 16 bytes binary data");
+	PrintAndLog("");
+	PrintAndLog("example: hf iclass encrypt 0102030405060708");
+	PrintAndLog("");
+	return 0;
+}
+
+static int iClassEncryptBlkData(uint8_t *blkData) {
+	uint8_t key[16] = { 0 };
+	if(readKeyfile("iclass_decryptionkey.bin", 16, key))
+	{
+		usage_hf_iclass_encrypt();
+		return 1;
+	}
+	PrintAndLog("Decryption file found... ");
 
-	uint8_t blockNo=0;
-	uint8_t bldata[8]={0};
+	uint8_t encryptedData[16];
+	uint8_t *encrypted = encryptedData;
+	des3_context ctx = { DES_DECRYPT ,{ 0 } };
+	des3_set2key_enc( &ctx, key);
+	
+	des3_crypt_ecb(&ctx, blkData,encrypted);
+	//printvar("decrypted block", decrypted, 8);
+	memcpy(blkData,encrypted,8);
+
+	return 1;
+}
 
-	if (strlen(Cmd)<3)
+int CmdHFiClassEncryptBlk(const char *Cmd) {
+	uint8_t blkData[8] = {0};
+	char opt = param_getchar(Cmd, 0);
+	if (strlen(Cmd)<1 || opt == 'h')
+		return usage_hf_iclass_encrypt();
+
+	//get the bytes to encrypt
+	if (param_gethex(Cmd, 0, blkData, 16))
 	{
-		PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
-		PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
+		PrintAndLog("BlockData must include 16 HEX symbols");
 		return 0;
 	}
+	if (!iClassEncryptBlkData(blkData)) return 0;
 
-	if (param_gethex(Cmd, 0, KEY, 16))
+	printvar("encrypted block", blkData, 8);
+	return 1;
+}
+
+void Calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t MAC[4]) {
+	uint8_t WB[9];
+	WB[0] = blockno;
+	memcpy(WB + 1,data,8);
+	doMAC_N(WB,sizeof(WB),div_key,MAC);
+	//printf("Cal wb mac block [%02x][%02x%02x%02x%02x%02x%02x%02x%02x] : MAC [%02x%02x%02x%02x]",WB[0],WB[1],WB[2],WB[3],WB[4],WB[5],WB[6],WB[7],WB[8],MAC[0],MAC[1],MAC[2],MAC[3]);
+}
+
+static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool use_credit_key, bool verbose) {
+	UsbCommand resp;
+
+	UsbCommand c = {CMD_READER_ICLASS, {0}};
+	c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_CC | FLAG_ICLASS_READER_ONE_TRY;
+	if (use_credit_key)
+		c.arg[0] |= FLAG_ICLASS_READER_CEDITKEY;
+
+	clearCommandBuffer();
+	SendCommand(&c);
+	if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
 	{
-		PrintAndLog("KEY must include 16 HEX symbols");
-		return 1;
+		PrintAndLog("Command execute timeout");
+		return false;
 	}
 
-	blockNo = param_get8(Cmd, 1);
-	if (blockNo>32)
+	uint8_t isOK = resp.arg[0] & 0xff;
+	uint8_t *data = resp.d.asBytes;
+
+	memcpy(CSN,data,8);
+	if (CCNR!=NULL)memcpy(CCNR,data+16,8);
+	if(isOK > 0)
 	{
-		PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
-		return 1;
+		if (verbose) PrintAndLog("CSN: %s",sprint_hex(CSN,8));
+	}
+	if(isOK <= 1){
+		PrintAndLog("Failed to obtain CC! Aborting");
+		return false;
 	}
-	if (param_gethex(Cmd, 2, bldata, 8))
+	return true;	
+}
+
+static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool verbose) {
+	uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+
+	if (!select_only(CSN, CCNR, use_credit_key, verbose))
+		return false;
+
+	//get div_key
+	HFiClassCalcDivKey(CSN, KEY, div_key, elite);
+
+	doMAC(CCNR, div_key, MAC);
+	UsbCommand resp;
+	UsbCommand d = {CMD_ICLASS_AUTHENTICATION, {0}};
+	memcpy(d.d.asBytes, MAC, 4);
+	clearCommandBuffer();
+	SendCommand(&d);
+	if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
 	{
-		PrintAndLog("Block data must include 8 HEX symbols");
-		return 1;
+		PrintAndLog("Auth Command execute timeout");
+		return false;
+	}
+		uint8_t isOK    = resp.arg[0] & 0xff;
+	if (!isOK) {
+		PrintAndLog("Authentication error");
+		return false;
 	}
+	return true;
+}
 
-	UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
-	SendCommand(&c);
+int usage_hf_iclass_dump(void) {
+	PrintAndLog("Usage:  hf iclass dump f <fileName> k <Key> c <CreditKey> e\n");
+	PrintAndLog("Options:");
+	PrintAndLog("  f <filename> : specify a filename to save dump to");
+	PrintAndLog("  k <Key>      : *Access Key as 16 hex symbols or 1 hex to select key from memory");
+	PrintAndLog("  c <CreditKey>: Credit Key as 16 hex symbols or 1 hex to select key from memory");
+	PrintAndLog("  e            : If 'e' is specified, the key is interpreted as the 16 byte");
+	PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
+	PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
+	PrintAndLog("  NOTE: * = required");
+  PrintAndLog("Samples:");
+	PrintAndLog("  hf iclass dump k 001122334455667B");
+	PrintAndLog("  hf iclass dump k AAAAAAAAAAAAAAAA c 001122334455667B");
+	PrintAndLog("  hf iclass dump k AAAAAAAAAAAAAAAA e");
+	return 0;
+}
+
+int CmdHFiClassReader_Dump(const char *Cmd) {
+
+	uint8_t MAC[4] = {0x00,0x00,0x00,0x00};
+	uint8_t div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t c_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t blockno = 0;
+	uint8_t numblks = 0;
+	uint8_t maxBlk = 31;
+	uint8_t app_areas = 1;
+	uint8_t kb = 2;
+	uint8_t KEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t CreditKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t keyNbr = 0;
+	uint8_t dataLen = 0;
+	uint8_t fileNameLen = 0;
+	char filename[FILE_PATH_SIZE]={0};
+	char tempStr[50] = {0};
+	bool have_debit_key = false;
+	bool have_credit_key = false;
+	bool use_credit_key = false;
+	bool elite = false;
+	bool errors = false;
+	uint8_t cmdp = 0;
+
+	while(param_getchar(Cmd, cmdp) != 0x00)
+	{
+		switch(param_getchar(Cmd, cmdp))
+		{
+		case 'h':
+		case 'H':
+			return usage_hf_iclass_dump();
+		case 'c':
+		case 'C':
+			have_credit_key = true;
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) {
+				errors = param_gethex(tempStr, 0, CreditKEY, dataLen);
+			} else if (dataLen == 1) {
+				keyNbr = param_get8(Cmd, cmdp+1);
+				if (keyNbr <= ICLASS_KEYS_MAX) {
+					memcpy(CreditKEY, iClass_Key_Table[keyNbr], 8);
+				} else {
+					PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+					errors = true;
+				}
+			} else {
+				PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'e':
+		case 'E':
+			elite = true;
+			cmdp++;
+			break;
+		case 'f':
+		case 'F':
+			fileNameLen = param_getstr(Cmd, cmdp+1, filename); 
+			if (fileNameLen < 1) {
+				PrintAndLog("No filename found after f");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'k':
+		case 'K':
+			have_debit_key = true;
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) { 
+				errors = param_gethex(tempStr, 0, KEY, dataLen);
+			} else if (dataLen == 1) {
+				keyNbr = param_get8(Cmd, cmdp+1);
+				if (keyNbr <= ICLASS_KEYS_MAX) {
+					memcpy(KEY, iClass_Key_Table[keyNbr], 8);
+				} else {
+					PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+					errors = true;
+				}
+			} else {
+				PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		default:
+			PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+			errors = true;
+			break;
+		}
+		if(errors) return usage_hf_iclass_dump();
+	}
+
+	if (cmdp < 2) return usage_hf_iclass_dump();
+	// if no debit key given try credit key on AA1 (not for iclass but for some picopass this will work)
+	if (!have_debit_key && have_credit_key) use_credit_key = true;
+
+	//get config and first 3 blocks
+	UsbCommand c = {CMD_READER_ICLASS, {FLAG_ICLASS_READER_CSN |
+					FLAG_ICLASS_READER_CONF | FLAG_ICLASS_READER_ONLY_ONCE | FLAG_ICLASS_READER_ONE_TRY}};
 	UsbCommand resp;
+	uint8_t tag_data[255*8];
 
-	if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
-		uint8_t isOK    = resp.arg[0] & 0xff;
+	clearCommandBuffer();
+	SendCommand(&c);
+	if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
+		PrintAndLog("Command execute timeout");
+		ul_switch_off_field();
+		return 0;
+	}
+	uint8_t readStatus = resp.arg[0] & 0xff;
 		uint8_t * data  = resp.d.asBytes;
 
-		memcpy(CSN,data,8);
-		memcpy(CCNR,data+8,8);
-		PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
-		PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
-		PrintAndLog("isOk:%02x", isOK);
-	} else {
-		PrintAndLog("Command execute timeout");
+	if(readStatus == 0){
+		PrintAndLog("No tag found...");
+		ul_switch_off_field();
+	return 0;
+}
+	if( readStatus & (FLAG_ICLASS_READER_CSN|FLAG_ICLASS_READER_CONF|FLAG_ICLASS_READER_CC)){
+		memcpy(tag_data, data, 8*3);
+		blockno+=2; // 2 to force re-read of block 2 later. (seems to respond differently..)
+		numblks = data[8];
+		getMemConfig(data[13], data[12], &maxBlk, &app_areas, &kb);
+		// large memory - not able to dump pages currently
+		if (numblks > maxBlk) numblks = maxBlk;
+	}
+	ul_switch_off_field();
+	// authenticate debit key and get div_key - later store in dump block 3
+	if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
+		//try twice - for some reason it sometimes fails the first time...
+		if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, false)){
+			ul_switch_off_field();
+			return 0;
+		}
 	}
+	
+	// begin dump
+	UsbCommand w = {CMD_ICLASS_DUMP, {blockno, numblks-blockno+1}};
+	clearCommandBuffer();
+	SendCommand(&w);
+	if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
+		PrintAndLog("Command execute time-out 1");
+		ul_switch_off_field();
+		return 1;
+	}
+	uint32_t blocksRead = resp.arg[1];
+	uint8_t isOK = resp.arg[0] & 0xff;
+	if (!isOK && !blocksRead) {
+		PrintAndLog("Read Block Failed");
+		ul_switch_off_field();
+		return 0;
+	}
+	uint32_t startindex = resp.arg[2];
+	if (blocksRead*8 > sizeof(tag_data)-(blockno*8)) {
+		PrintAndLog("Data exceeded Buffer size!");
+		blocksRead = (sizeof(tag_data)/8) - blockno;
+	}
+	// response ok - now get bigbuf content of the dump
+	GetFromBigBuf(tag_data+(blockno*8), blocksRead*8, startindex);
+	WaitForResponse(CMD_ACK,NULL);
+	size_t gotBytes = blocksRead*8 + blockno*8;
+
+	// try AA2
+	if (have_credit_key) {
+		//turn off hf field before authenticating with different key
+		ul_switch_off_field();
+		memset(MAC,0,4);
+		// AA2 authenticate credit key and git c_div_key - later store in dump block 4
+		if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
+			//try twice - for some reason it sometimes fails the first time...
+			if (!select_and_auth(CreditKEY, MAC, c_div_key, true, false, false)){
+				ul_switch_off_field();
+				return 0;
+			}
+		}
+		// do we still need to read more block?  (aa2 enabled?)
+		if (maxBlk > blockno+numblks+1) {
+			// setup dump and start
+			w.arg[0] = blockno + blocksRead;
+			w.arg[1] = maxBlk - (blockno + blocksRead);
+			clearCommandBuffer();
+			SendCommand(&w);
+			if (!WaitForResponseTimeout(CMD_ACK, &resp, 4500)) {
+				PrintAndLog("Command execute timeout 2");
+				ul_switch_off_field();
+				return 0;
+			}
+			uint8_t isOK = resp.arg[0] & 0xff;
+			blocksRead = resp.arg[1];
+			if (!isOK && !blocksRead) {
+				PrintAndLog("Read Block Failed 2");
+				ul_switch_off_field();
+				return 0;
+			}		
 
-	diversifyKey(CSN,KEY, div_key);
+			startindex = resp.arg[2];
+			if (blocksRead*8 > sizeof(tag_data)-gotBytes) {
+				PrintAndLog("Data exceeded Buffer size!");
+				blocksRead = (sizeof(tag_data) - gotBytes)/8;
+			}
+			// get dumped data from bigbuf
+			GetFromBigBuf(tag_data+gotBytes, blocksRead*8, startindex);
+			WaitForResponse(CMD_ACK,NULL);
 
-	PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
-	doMAC(CCNR, div_key, MAC);
+			gotBytes += blocksRead*8;			
+		} else { //field is still on - turn it off...
+			ul_switch_off_field();
+		}
+	}
 
-	UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
-	memcpy(c2.d.asBytes, bldata, 8);
-	memcpy(c2.d.asBytes+8, MAC, 4);
-	SendCommand(&c2);
+	// add diversified keys to dump
+	if (have_debit_key) memcpy(tag_data+(3*8),div_key,8);
+	if (have_credit_key) memcpy(tag_data+(4*8),c_div_key,8);
+	// print the dump
+	printf("CSN   |00| %02X %02X %02X %02X %02X %02X %02X %02X |\n",tag_data[0],tag_data[1],tag_data[2]
+		  ,tag_data[3],tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
+	printIclassDumpContents(tag_data, 1, (gotBytes/8)-1, gotBytes-8);
+
+	if (filename[0] == 0){
+		snprintf(filename, FILE_PATH_SIZE,"iclass_tagdump-%02x%02x%02x%02x%02x%02x%02x%02x",
+		    tag_data[0],tag_data[1],tag_data[2],tag_data[3],
+		    tag_data[4],tag_data[5],tag_data[6],tag_data[7]);
+	}
 
-	if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
-		uint8_t isOK    = resp.arg[0] & 0xff;
-		uint8_t * data  = resp.d.asBytes;
+	// save the dump to .bin file
+	PrintAndLog("Saving dump file - %d blocks read", gotBytes/8);
+	saveFile(filename, "bin", tag_data, gotBytes);
+	return 1;
+}
 
-		if (isOK)
-			PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
-		else
-			PrintAndLog("isOk:%02x", isOK);
-	} else {
+static int WriteBlock(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool verbose) {
+	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
+	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, verbose))
+		return 0;
+
+	UsbCommand resp;
+
+	Calc_wb_mac(blockno,bldata,div_key,MAC);
+	UsbCommand w = {CMD_ICLASS_WRITEBLOCK, {blockno}};
+	memcpy(w.d.asBytes, bldata, 8);
+	memcpy(w.d.asBytes + 8, MAC, 4);
+	
+	clearCommandBuffer();
+	SendCommand(&w);
+	if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
+	{
+		PrintAndLog("Write Command execute timeout");
+		return 0;
+	}
+	uint8_t isOK = resp.arg[0] & 0xff;
+	if (!isOK) {
+		PrintAndLog("Write Block Failed");
+		return 0;
+	}
+	PrintAndLog("Write Block Successful");
+	return 1;
+}
+
+int usage_hf_iclass_writeblock(void) {
+	PrintAndLog("Options:");
+  PrintAndLog("  b <Block> : The block number as 2 hex symbols");
+  PrintAndLog("  d <data>  : Set the Data to write as 16 hex symbols");
+	PrintAndLog("  k <Key>   : Access Key as 16 hex symbols or 1 hex to select key from memory");
+  PrintAndLog("  c         : If 'c' is specified, the key set is assumed to be the credit key\n");
+  PrintAndLog("  e         : If 'e' is specified, elite computations applied to key");
+  PrintAndLog("Samples:");
+	PrintAndLog("  hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA k 001122334455667B");
+	PrintAndLog("  hf iclass writeblk b 1B d AAAAAAAAAAAAAAAA k 001122334455667B c");
+	PrintAndLog("  hf iclass writeblk b 0A d AAAAAAAAAAAAAAAA n 0");
+	return 0;
+}
+
+int CmdHFiClass_WriteBlock(const char *Cmd) {
+	uint8_t blockno=0;
+	uint8_t bldata[8]={0,0,0,0,0,0,0,0};
+	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t keyNbr = 0;
+	uint8_t dataLen = 0;
+	char tempStr[50] = {0};
+	bool use_credit_key = false;
+	bool elite = false;
+	bool errors = false;
+	uint8_t cmdp = 0;
+	while(param_getchar(Cmd, cmdp) != 0x00)
+	{
+		switch(param_getchar(Cmd, cmdp))
+		{
+		case 'h':
+		case 'H':
+			return usage_hf_iclass_writeblock();
+		case 'b':
+		case 'B':
+			if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
+				PrintAndLog("Block No must include 2 HEX symbols\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'c':
+		case 'C':
+			use_credit_key = true;
+			cmdp++;
+			break;
+		case 'd':
+		case 'D':
+			if (param_gethex(Cmd, cmdp+1, bldata, 16))
+			{
+				PrintAndLog("KEY must include 16 HEX symbols\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'e':
+		case 'E':
+			elite = true;
+			cmdp++;
+			break;
+		case 'k':
+		case 'K':
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) { 
+				errors = param_gethex(tempStr, 0, KEY, dataLen);
+			} else if (dataLen == 1) {
+				keyNbr = param_get8(Cmd, cmdp+1);
+				if (keyNbr <= ICLASS_KEYS_MAX) {
+					memcpy(KEY, iClass_Key_Table[keyNbr], 8);
+				} else {
+					PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+					errors = true;
+				}
+			} else {
+				PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		default:
+			PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+			errors = true;
+			break;
+		}
+		if(errors) return usage_hf_iclass_writeblock();
+	}
+
+	if (cmdp < 6) return usage_hf_iclass_writeblock();
+	int ans = WriteBlock(blockno, bldata, KEY, use_credit_key, elite, true);
+	ul_switch_off_field();
+	return ans;
+}
+
+int usage_hf_iclass_clone(void) {
+	PrintAndLog("Usage:  hf iclass clone f <tagfile.bin> b <first block> l <last block> k <KEY> e c");
+	PrintAndLog("Options:");
+	PrintAndLog("  f <filename>: specify a filename to clone from");
+	PrintAndLog("  b <Block>   : The first block to clone as 2 hex symbols");
+	PrintAndLog("  l <Last Blk>: Set the Data to write as 16 hex symbols");
+	PrintAndLog("  k <Key>     : Access Key as 16 hex symbols or 1 hex to select key from memory");
+	PrintAndLog("  c           : If 'c' is specified, the key set is assumed to be the credit key\n");
+	PrintAndLog("  e           : If 'e' is specified, elite computations applied to key");
+	PrintAndLog("Samples:");
+	PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 06 l 1A k 1122334455667788 e");
+	PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 05 l 19 k 0");
+	PrintAndLog("  hf iclass clone f iclass_tagdump-121345.bin b 06 l 19 k 0 e");
+	return -1;
+}
+
+int CmdHFiClassCloneTag(const char *Cmd) {
+	char filename[FILE_PATH_SIZE];
+	char tempStr[50]={0};
+	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t keyNbr = 0;
+	uint8_t fileNameLen = 0;
+	uint8_t startblock = 0;
+	uint8_t endblock = 0;
+	uint8_t dataLen = 0;
+	bool use_credit_key = false;
+	bool elite = false;
+	bool errors = false;
+	uint8_t cmdp = 0;
+	while(param_getchar(Cmd, cmdp) != 0x00)
+	{
+		switch(param_getchar(Cmd, cmdp))
+		{
+		case 'h':
+		case 'H':
+			return usage_hf_iclass_clone();
+		case 'b':
+		case 'B':
+			if (param_gethex(Cmd, cmdp+1, &startblock, 2)) {
+				PrintAndLog("Start Block No must include 2 HEX symbols\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'c':
+		case 'C':
+			use_credit_key = true;
+			cmdp++;
+			break;
+		case 'e':
+		case 'E':
+			elite = true;
+			cmdp++;
+			break;
+		case 'f':
+		case 'F':
+			fileNameLen = param_getstr(Cmd, cmdp+1, filename); 
+			if (fileNameLen < 1) {
+				PrintAndLog("No filename found after f");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'k':
+		case 'K':
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) { 
+				errors = param_gethex(tempStr, 0, KEY, dataLen);
+			} else if (dataLen == 1) {
+				keyNbr = param_get8(Cmd, cmdp+1);
+				if (keyNbr <= ICLASS_KEYS_MAX) {
+					memcpy(KEY, iClass_Key_Table[keyNbr], 8);
+				} else {
+					PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+					errors = true;
+				}
+			} else {
+				PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'l':
+		case 'L':
+			if (param_gethex(Cmd, cmdp+1, &endblock, 2)) {
+				PrintAndLog("Start Block No must include 2 HEX symbols\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		default:
+			PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+			errors = true;
+			break;
+		}
+		if(errors) return usage_hf_iclass_clone();
+	}
+
+	if (cmdp < 8) return usage_hf_iclass_clone();
+
+	FILE *f;
+
+	iclass_block_t tag_data[USB_CMD_DATA_SIZE/12];
+
+	if ((endblock-startblock+1)*12 > USB_CMD_DATA_SIZE) {
+		PrintAndLog("Trying to write too many blocks at once.  Max: %d", USB_CMD_DATA_SIZE/8);
+	}
+	// file handling and reading
+	f = fopen(filename,"rb");
+	if(!f) {
+		PrintAndLog("Failed to read from file '%s'", filename);
+		return 1;
+	}
+
+	if (startblock<5) {
+		PrintAndLog("You cannot write key blocks this way. yet... make your start block > 4");
+		return 0;
+	}
+	// now read data from the file from block 6 --- 19
+	// ok we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data
+	// then copy to usbcommand->asbytes; the max is 32 - 6 = 24 block 12 bytes each block 288 bytes then we can only accept to clone 21 blocks at the time,
+	// else we have to create a share memory
+	int i;
+	fseek(f,startblock*8,SEEK_SET);
+	fread(tag_data,sizeof(iclass_block_t),endblock - startblock + 1,f);
+
+	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
+	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+
+	if (!select_and_auth(KEY, MAC, div_key, use_credit_key, elite, true))
+		return 0;
+
+	UsbCommand w = {CMD_ICLASS_CLONE,{startblock,endblock}};
+	uint8_t *ptr;
+	// calculate all mac for every the block we will write
+	for (i = startblock; i <= endblock; i++){
+	    Calc_wb_mac(i,tag_data[i - startblock].d,div_key,MAC);
+	    // usb command d start pointer = d + (i - 6) * 12
+	    // memcpy(pointer,tag_data[i - 6],8) 8 bytes
+	    // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes;
+	    // next one
+	    ptr = w.d.asBytes + (i - startblock) * 12;
+	    memcpy(ptr, &(tag_data[i - startblock].d[0]), 8);
+	    memcpy(ptr + 8,MAC, 4);
+	}
+	uint8_t p[12];
+	for (i = 0; i <= endblock - startblock;i++){
+	    memcpy(p,w.d.asBytes + (i * 12),12);
+	    printf("Block |%02x|",i + startblock);
+	    printf(" %02x%02x%02x%02x%02x%02x%02x%02x |",p[0],p[1],p[2],p[3],p[4],p[5],p[6],p[7]);
+	    printf(" MAC |%02x%02x%02x%02x|\n",p[8],p[9],p[10],p[11]);
+	}
+	UsbCommand resp;
+	SendCommand(&w);
+	if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
+	{
+		PrintAndLog("Command execute timeout");
+		return 0;
+	}
+	return 1;
+}
+
+static int ReadBlock(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool verbose) {
+	uint8_t MAC[4]={0x00,0x00,0x00,0x00};
+	uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+
+	if (!select_and_auth(KEY, MAC, div_key, (keyType==0x18), elite, verbose))
+		return 0;
+
+	UsbCommand resp;
+	UsbCommand w = {CMD_ICLASS_READBLOCK, {blockno}};
+	clearCommandBuffer();
+	SendCommand(&w);
+	if (!WaitForResponseTimeout(CMD_ACK,&resp,4500))
+	{
 		PrintAndLog("Command execute timeout");
+		return 0;
 	}
+	uint8_t isOK = resp.arg[0] & 0xff;
+	if (!isOK) {
+		PrintAndLog("Read Block Failed");
+		return 0;
+	}
+	//data read is stored in: resp.d.asBytes[0-15]
+	if (verbose) PrintAndLog("Block %02X: %s\n",blockno, sprint_hex(resp.d.asBytes,8));
+	return 1;
+}
+
+int usage_hf_iclass_readblock(void) {
+	PrintAndLog("Usage:  hf iclass readblk b <Block> k <Key> c e\n");
+	PrintAndLog("Options:");
+  PrintAndLog("  b <Block> : The block number as 2 hex symbols");
+	PrintAndLog("  k <Key>   : Access Key as 16 hex symbols or 1 hex to select key from memory");
+  PrintAndLog("  c         : If 'c' is specified, the key set is assumed to be the credit key\n");
+  PrintAndLog("  e         : If 'e' is specified, elite computations applied to key");
+  PrintAndLog("Samples:");
+	PrintAndLog("  hf iclass readblk b 06 k 0011223344556677");
+	PrintAndLog("  hf iclass readblk b 1B k 0011223344556677 c");
+	PrintAndLog("  hf iclass readblk b 0A k 0");
 	return 0;
 }
-int CmdHFiClass_loclass(const char *Cmd)
-{
+
+int CmdHFiClass_ReadBlock(const char *Cmd) {
+	uint8_t blockno=0;
+	uint8_t keyType = 0x88; //debit key
+	uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t keyNbr = 0;
+	uint8_t dataLen = 0;
+	char tempStr[50] = {0};
+	bool elite = false;
+	bool errors = false;
+	uint8_t cmdp = 0;
+	while(param_getchar(Cmd, cmdp) != 0x00)
+	{
+		switch(param_getchar(Cmd, cmdp))
+		{
+		case 'h':
+		case 'H':
+			return usage_hf_iclass_readblock();
+		case 'b':
+		case 'B':
+			if (param_gethex(Cmd, cmdp+1, &blockno, 2)) {
+				PrintAndLog("Block No must include 2 HEX symbols\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'c':
+		case 'C':
+			keyType = 0x18;
+			cmdp++;
+			break;
+		case 'e':
+		case 'E':
+			elite = true;
+			cmdp++;
+			break;
+		case 'k':
+		case 'K':
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) { 
+				errors = param_gethex(tempStr, 0, KEY, dataLen);
+			} else if (dataLen == 1) {
+				keyNbr = param_get8(Cmd, cmdp+1);
+				if (keyNbr <= ICLASS_KEYS_MAX) {
+					memcpy(KEY, iClass_Key_Table[keyNbr], 8);
+				} else {
+					PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+					errors = true;
+				}
+			} else {
+				PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		default:
+			PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+			errors = true;
+			break;
+		}
+		if(errors) return usage_hf_iclass_readblock();
+	}
+
+	if (cmdp < 4) return usage_hf_iclass_readblock();
+
+	return ReadBlock(KEY, blockno, keyType, elite, true);
+}
+
+int CmdHFiClass_loclass(const char *Cmd) {
 	char opt = param_getchar(Cmd, 0);
 
 	if (strlen(Cmd)<1 || opt == 'h') {
@@ -683,19 +1211,435 @@ int CmdHFiClass_loclass(const char *Cmd)
 	return 0;
 }
 
+void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize) {
+	uint8_t blockdata[8];
+	uint8_t mem_config;
+	memcpy(&mem_config, iclass_dump + 13,1);
+	uint8_t maxmemcount;
+	uint8_t filemaxblock = filesize / 8;
+	if (mem_config & 0x80)
+		maxmemcount = 255;
+	else
+		maxmemcount = 31;
+	//PrintAndLog	("endblock: %d, filesize: %d, maxmemcount: %d, filemaxblock: %d", endblock,filesize, maxmemcount, filemaxblock);
+
+	if (startblock == 0)
+		startblock = 6;
+	if ((endblock > maxmemcount) || (endblock == 0))
+		endblock = maxmemcount;
+	if (endblock > filemaxblock)
+		endblock = filemaxblock;
+	int i = startblock;
+	int j;
+	while (i <= endblock){
+		printf("Block |%02X| ",i);
+		memcpy(blockdata,iclass_dump + (i * 8),8);
+		for (j = 0;j < 8;j++)
+			printf("%02X ",blockdata[j]);
+		printf("|\n");
+		i++;
+	}
+}
+
+int usage_hf_iclass_readtagfile() {
+	PrintAndLog("Usage: hf iclass readtagfile <filename> [startblock] [endblock]");
+	return 1;
+}
+
+int CmdHFiClassReadTagFile(const char *Cmd) {
+	int startblock = 0;
+	int endblock = 0;
+	char tempnum[5];
+	FILE *f;
+	char filename[FILE_PATH_SIZE];
+	if (param_getstr(Cmd, 0, filename) < 1)
+		return usage_hf_iclass_readtagfile();
+	if (param_getstr(Cmd,1,(char *)&tempnum) < 1)
+		startblock = 0;
+	else
+		sscanf(tempnum,"%d",&startblock);
+
+	if (param_getstr(Cmd,2,(char *)&tempnum) < 1)
+		endblock = 0;
+	else
+		sscanf(tempnum,"%d",&endblock);
+	// file handling and reading
+	f = fopen(filename,"rb");
+	if(!f) {
+		PrintAndLog("Failed to read from file '%s'", filename);
+		return 1;
+	}
+	fseek(f, 0, SEEK_END);
+	long fsize = ftell(f);
+	fseek(f, 0, SEEK_SET);
+
+	uint8_t *dump = malloc(fsize);
+
+
+	size_t bytes_read = fread(dump, 1, fsize, f);
+	fclose(f);
+	uint8_t *csn = dump;
+	printf("CSN   [00] | %02X %02X %02X %02X %02X %02X %02X %02X |\n",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
+	//    printIclassDumpInfo(dump);
+	printIclassDumpContents(dump,startblock,endblock,bytes_read);
+	free(dump);
+	return 0;
+}
+
+/*
+uint64_t xorcheck(uint64_t sdiv,uint64_t hdiv) {
+	uint64_t new_div = 0x00;
+	new_div ^= sdiv;
+	new_div ^= hdiv;
+	return new_div;
+}
+
+uint64_t hexarray_to_uint64(uint8_t *key) {
+	char temp[17];
+	uint64_t uint_key;
+	for (int i = 0;i < 8;i++)
+		sprintf(&temp[(i *2)],"%02X",key[i]);
+	temp[16] = '\0';
+	if (sscanf(temp,"%016"llX,&uint_key) < 1)
+		return 0;
+	return uint_key;
+}
+*/
+void HFiClassCalcDivKey(uint8_t	*CSN, uint8_t	*KEY, uint8_t *div_key, bool elite){
+	uint8_t keytable[128] = {0};
+	uint8_t key_index[8] = {0};
+	if (elite) {
+		uint8_t key_sel[8] = { 0 };
+		uint8_t key_sel_p[8] = { 0 };
+		hash2(KEY, keytable);
+		hash1(CSN, key_index);
+		for(uint8_t i = 0; i < 8 ; i++)
+			key_sel[i] = keytable[key_index[i]] & 0xFF;
+
+		//Permute from iclass format to standard format
+		permutekey_rev(key_sel, key_sel_p);
+		diversifyKey(CSN, key_sel_p, div_key);	
+	} else {
+		diversifyKey(CSN, KEY, div_key);
+	}		
+}
+
+//when told CSN, oldkey, newkey, if new key is elite (elite), and if old key was elite (oldElite)
+//calculate and return xor_div_key (ready for a key write command)
+//print all div_keys if verbose
+static void HFiClassCalcNewKey(uint8_t *CSN, uint8_t *OLDKEY, uint8_t *NEWKEY, uint8_t *xor_div_key, bool elite, bool oldElite, bool verbose){
+	uint8_t old_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t new_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	//get old div key
+	HFiClassCalcDivKey(CSN, OLDKEY, old_div_key, oldElite);
+	//get new div key
+	HFiClassCalcDivKey(CSN, NEWKEY, new_div_key, elite);
+	
+	for (uint8_t i = 0; i < sizeof(old_div_key); i++){
+		xor_div_key[i] = old_div_key[i] ^ new_div_key[i];
+	}
+	if (verbose) {
+		printf("Old Div Key : %s\n",sprint_hex(old_div_key,8));
+		printf("New Div Key : %s\n",sprint_hex(new_div_key,8));
+		printf("Xor Div Key : %s\n",sprint_hex(xor_div_key,8));		
+	}
+}
+
+int usage_hf_iclass_calc_newkey(void) {
+	PrintAndLog("HELP :  Manage iClass Keys in client memory:\n");
+	PrintAndLog("Usage:  hf iclass calc_newkey o <Old key> n <New key> s [csn] e");
+	PrintAndLog("  Options:");
+	PrintAndLog("  o <oldkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
+	PrintAndLog("  n <newkey> : *specify a key as 16 hex symbols or a key number as 1 symbol");
+	PrintAndLog("  s <csn>    : specify a card Serial number to diversify the key (if omitted will attempt to read a csn)");
+	PrintAndLog("  e          : specify new key as elite calc");
+	PrintAndLog("  ee         : specify old and new key as elite calc");
+	PrintAndLog("Samples:");
+	PrintAndLog(" e key to e key given csn : hf iclass calcnewkey o 1122334455667788 n 2233445566778899 s deadbeafdeadbeaf ee");
+	PrintAndLog(" std key to e key read csn: hf iclass calcnewkey o 1122334455667788 n 2233445566778899 e");
+	PrintAndLog(" std to std read csn      : hf iclass calcnewkey o 1122334455667788 n 2233445566778899");
+	PrintAndLog("NOTE: * = required\n");
+
+	return 1;
+}
+
+int CmdHFiClassCalcNewKey(const char *Cmd) {
+	uint8_t OLDKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t NEWKEY[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t xor_div_key[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t CSN[8] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t CCNR[12] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
+	uint8_t keyNbr = 0;
+	uint8_t dataLen = 0;
+	char tempStr[50] = {0};
+	bool givenCSN = false;
+	bool oldElite = false;
+	bool elite = false;
+	bool errors = false;
+	uint8_t cmdp = 0;
+	while(param_getchar(Cmd, cmdp) != 0x00)
+	{
+		switch(param_getchar(Cmd, cmdp))
+		{
+		case 'h':
+		case 'H':
+			return usage_hf_iclass_calc_newkey();
+		case 'e':
+		case 'E':
+			dataLen = param_getstr(Cmd, cmdp, tempStr);
+			if (dataLen==2)
+				oldElite = true;
+			elite = true;
+			cmdp++;
+			break;
+		case 'n':
+		case 'N':
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) { 
+				errors = param_gethex(tempStr, 0, NEWKEY, dataLen);
+			} else if (dataLen == 1) {
+				keyNbr = param_get8(Cmd, cmdp+1);
+				if (keyNbr <= ICLASS_KEYS_MAX) {
+					memcpy(NEWKEY, iClass_Key_Table[keyNbr], 8);
+				} else {
+					PrintAndLog("\nERROR: NewKey Nbr is invalid\n");
+					errors = true;
+				}
+			} else {
+				PrintAndLog("\nERROR: NewKey is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'o':
+		case 'O':
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) { 
+				errors = param_gethex(tempStr, 0, OLDKEY, dataLen);
+			} else if (dataLen == 1) {
+				keyNbr = param_get8(Cmd, cmdp+1);
+				if (keyNbr <= ICLASS_KEYS_MAX) {
+					memcpy(OLDKEY, iClass_Key_Table[keyNbr], 8);
+				} else {
+					PrintAndLog("\nERROR: Credit KeyNbr is invalid\n");
+					errors = true;
+				}
+			} else {
+				PrintAndLog("\nERROR: Credit Key is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 's':
+		case 'S':
+			givenCSN = true;
+			if (param_gethex(Cmd, cmdp+1, CSN, 16))
+				return usage_hf_iclass_calc_newkey();
+			cmdp += 2;
+			break;
+		default:
+			PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+			errors = true;
+			break;
+		}
+		if(errors) return usage_hf_iclass_calc_newkey();
+	}
+
+	if (cmdp < 4) return usage_hf_iclass_calc_newkey();
+
+	if (!givenCSN)
+		if (!select_only(CSN, CCNR, false, true))
+			return 0;
+	
+	HFiClassCalcNewKey(CSN, OLDKEY, NEWKEY, xor_div_key, elite, oldElite, true);
+	return 0;
+}
+
+static int loadKeys(char *filename) {
+	FILE *f;
+	f = fopen(filename,"rb");
+	if(!f) {
+		PrintAndLog("Failed to read from file '%s'", filename);
+		return 0;
+	}
+	fseek(f, 0, SEEK_END);
+	long fsize = ftell(f);
+	fseek(f, 0, SEEK_SET);
+
+	uint8_t *dump = malloc(fsize);
+
+	size_t bytes_read = fread(dump, 1, fsize, f);
+	fclose(f);
+	if (bytes_read > ICLASS_KEYS_MAX * 8){
+		PrintAndLog("File is too long to load - bytes: %u", bytes_read);
+		free(dump);
+		return 0;
+	}
+	uint8_t i = 0;
+	for (; i < bytes_read/8; i++){
+		memcpy(iClass_Key_Table[i],dump+(i*8),8);
+	}
+	free(dump);
+	PrintAndLog("%u keys loaded", i);
+	return 1;
+}
+
+static int saveKeys(char *filename) {
+	FILE *f;
+	f = fopen(filename,"wb");
+	if (f == NULL) {
+		printf("error opening file %s\n",filename);
+		return 0;
+	}
+	for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
+		if (fwrite(iClass_Key_Table[i],8,1,f) != 1){
+			PrintAndLog("save key failed to write to file: %s", filename);
+			break;
+		}
+	}
+	fclose(f);
+	return 0;
+}
+
+static int printKeys(void) {
+	PrintAndLog("");
+	for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++){
+		PrintAndLog("%u: %s",i,sprint_hex(iClass_Key_Table[i],8));
+	}
+	PrintAndLog("");	
+	return 0;
+}
+
+int usage_hf_iclass_managekeys(void) {
+	PrintAndLog("HELP :  Manage iClass Keys in client memory:\n");
+	PrintAndLog("Usage:  hf iclass managekeys n [keynbr] k [key] f [filename] s l p\n");
+	PrintAndLog("  Options:");
+	PrintAndLog("  n <keynbr>  : specify the keyNbr to set in memory");
+	PrintAndLog("  k <key>     : set a key in memory");
+	PrintAndLog("  f <filename>: specify a filename to use with load or save operations");
+	PrintAndLog("  s           : save keys in memory to file specified by filename");
+	PrintAndLog("  l           : load keys to memory from file specified by filename");
+	PrintAndLog("  p           : print keys loaded into memory\n");
+	PrintAndLog("Samples:");
+	PrintAndLog(" set key      : hf iclass managekeys n 0 k 1122334455667788");
+	PrintAndLog(" save key file: hf iclass managekeys f mykeys.bin s");
+	PrintAndLog(" load key file: hf iclass managekeys f mykeys.bin l");
+	PrintAndLog(" print keys   : hf iclass managekeys p\n");
+	return 0;
+}
+
+int CmdHFiClassManageKeys(const char *Cmd) {
+	uint8_t keyNbr = 0;
+	uint8_t dataLen = 0;
+	uint8_t KEY[8] = {0};
+	char filename[FILE_PATH_SIZE];
+	uint8_t fileNameLen = 0;
+	bool errors = false;
+	uint8_t operation = 0;
+	char tempStr[20];
+	uint8_t cmdp = 0;
+
+	while(param_getchar(Cmd, cmdp) != 0x00)
+	{
+		switch(param_getchar(Cmd, cmdp))
+		{
+		case 'h':
+		case 'H':
+			return usage_hf_iclass_managekeys();
+		case 'f':
+		case 'F':
+			fileNameLen = param_getstr(Cmd, cmdp+1, filename); 
+			if (fileNameLen < 1) {
+				PrintAndLog("No filename found after f");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'n':
+		case 'N':
+			keyNbr = param_get8(Cmd, cmdp+1);
+			if (keyNbr < 0) {
+				PrintAndLog("Wrong block number");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'k':
+		case 'K':
+			operation += 3; //set key 
+			dataLen = param_getstr(Cmd, cmdp+1, tempStr);
+			if (dataLen == 16) { //ul-c or ev1/ntag key length
+				errors = param_gethex(tempStr, 0, KEY, dataLen);
+			} else {
+				PrintAndLog("\nERROR: Key is incorrect length\n");
+				errors = true;
+			}
+			cmdp += 2;
+			break;
+		case 'p':
+		case 'P':
+			operation += 4; //print keys in memory
+			cmdp++;
+			break;
+		case 'l':
+		case 'L':
+			operation += 5; //load keys from file
+			cmdp++;
+			break;
+		case 's':
+		case 'S':
+			operation += 6; //save keys to file
+			cmdp++;
+			break;
+		default:
+			PrintAndLog("Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
+			errors = true;
+			break;
+		}
+		if(errors) return usage_hf_iclass_managekeys();
+	}
+	if (operation == 0){
+		PrintAndLog("no operation specified (load, save, or print)\n");
+		return usage_hf_iclass_managekeys();
+	}
+	if (operation > 6){
+		PrintAndLog("Too many operations specified\n");
+		return usage_hf_iclass_managekeys();
+	}
+	if (operation > 4 && fileNameLen == 0){
+		PrintAndLog("You must enter a filename when loading or saving\n");
+		return usage_hf_iclass_managekeys();
+	}
+
+	switch (operation){
+		case 3: memcpy(iClass_Key_Table[keyNbr], KEY, 8); return 1;
+		case 4: return printKeys();
+		case 5: return loadKeys(filename);
+		case 6: return saveKeys(filename);
+		break;
+	}
+	return 0;
+}
+
 static command_t CommandTable[] = 
 {
 	{"help",	CmdHelp,			1,	"This help"},
-	{"list",	CmdHFiClassList,	0,	"[Deprecated] List iClass history"},
-	{"snoop",	CmdHFiClassSnoop,	0,	"Eavesdrop iClass communication"},
-	{"sim",	CmdHFiClassSim,		0,	"Simulate iClass tag"},
+	{"calcnewkey",  CmdHFiClassCalcNewKey,      	1,	"[options..] Calc Diversified keys (blocks 3 & 4) to write new keys"},
+	{"clone",       CmdHFiClassCloneTag,        	0,	"[options..] Authenticate and Clone from iClass bin file"},
+	{"decrypt",     CmdHFiClassDecrypt,         	1,	"[f <fname>] Decrypt tagdump" },
+	{"dump",        CmdHFiClassReader_Dump,     	0,	"[options..] Authenticate and Dump iClass tag's AA1"},
+	{"eload",       CmdHFiClassELoad,           	0,	"[f <fname>] (experimental) Load data into iClass emulator memory"},
+	{"encryptblk",  CmdHFiClassEncryptBlk,      	1,	"<BlockData> Encrypt given block data"},
+	{"list",        CmdHFiClassList,            	0,	"            (Deprecated) List iClass history"},
+	{"loclass",     CmdHFiClass_loclass,        	1,	"[options..] Use loclass to perform bruteforce of reader attack dump"},
+	{"managekeys",  CmdHFiClassManageKeys,      	1,	"[options..] Manage the keys to use with iClass"},
+	{"readblk",     CmdHFiClass_ReadBlock,      	0,	"[options..] Authenticate and Read iClass block"},
 	{"reader",CmdHFiClassReader,	0,	"Read an iClass tag"},
-	{"replay",CmdHFiClassReader_Replay,	0,	"Read an iClass tag via Reply Attack"},
-	{"dump",	CmdHFiClassReader_Dump,	0,		"Authenticate and Dump iClass tag"},
-//	{"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
-	{"loclass",	CmdHFiClass_loclass,	1,	"Use loclass to perform bruteforce of reader attack dump"},
-	{"eload",   CmdHFiClassELoad,    0,     "[experimental] Load data into iclass emulator memory"},
-	{"decrypt", CmdHFiClassDecrypt,  1,     "Decrypt tagdump" },
+	{"readtagfile", CmdHFiClassReadTagFile,     	1,	"[options..] Display Content from tagfile"},
+	{"replay",      CmdHFiClassReader_Replay,   	0,	"<mac>       Read an iClass tag via Reply Attack"},
+	{"sim",         CmdHFiClassSim,             	0,	"[options..] Simulate iClass tag"},
+	{"snoop",       CmdHFiClassSnoop,           	0,	"            Eavesdrop iClass communication"},
+	{"writeblk",    CmdHFiClass_WriteBlock,     	0,	"[options..] Authenticate and Write iClass block"},
 	{NULL, NULL, 0, NULL}
 };
 
diff --git a/client/cmdhficlass.h b/client/cmdhficlass.h
index 30c6a8a7..9a3adf50 100644
--- a/client/cmdhficlass.h
+++ b/client/cmdhficlass.h
@@ -14,11 +14,26 @@
 
 int CmdHFiClass(const char *Cmd);
 
-int CmdHFiClassSnoop(const char *Cmd);
-int CmdHFiClassSim(const char *Cmd);
+int CmdHFiClassCalcNewKey(const char *Cmd);
+int CmdHFiClassCloneTag(const char *Cmd);
+int CmdHFiClassDecrypt(const char *Cmd);
+int CmdHFiClassEncryptBlk(const char *Cmd);
+int CmdHFiClassELoad(const char *Cmd);
 int CmdHFiClassList(const char *Cmd);
 int HFiClassReader(const char *Cmd, bool loop, bool verbose);
 int CmdHFiClassReader(const char *Cmd);
+int CmdHFiClassReader_Dump(const char *Cmd);
 int CmdHFiClassReader_Replay(const char *Cmd);
-
+int CmdHFiClassReadKeyFile(const char *filename);
+int CmdHFiClassReadTagFile(const char *Cmd);
+int CmdHFiClass_ReadBlock(const char *Cmd);
+int CmdHFiClass_TestMac(const char *Cmd);
+int CmdHFiClassManageKeys(const char *Cmd);
+int CmdHFiClass_loclass(const char *Cmd);
+int CmdHFiClassSnoop(const char *Cmd);
+int CmdHFiClassSim(const char *Cmd);
+int CmdHFiClassWriteKeyFile(const char *Cmd);
+int CmdHFiClass_WriteBlock(const char *Cmd);
+void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t endblock, size_t filesize);
+void HFiClassCalcDivKey(uint8_t	*CSN, uint8_t	*KEY, uint8_t *div_key, bool elite);
 #endif
diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 76fd1b7e..ab7d913e 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -1230,8 +1230,8 @@ int CmdHF14AMfELoad(const char *Cmd)
 		case '\0': numBlocks = 16*4; break;
 		case '2' : numBlocks = 32*4; break;
 		case '4' : numBlocks = 256; break;
-		case 'U' : // fall through
-		case 'u' : numBlocks = 255; blockWidth = 8; break;
+		case 'U' : // fall through  ,  NTAG 215 has 135blocks a 540 bytes.
+		case 'u' : numBlocks = 135; blockWidth = 8; break;
 		default:  {
 			numBlocks = 16*4;
 			nameParamNo = 0;
@@ -1980,6 +1980,13 @@ int CmdHF14AMfSniff(const char *Cmd){
 	return 0;
 }
 
+//needs nt, ar, at, Data to decrypt
+int CmdDecryptTraceCmds(const char *Cmd){
+	uint8_t data[50];
+	int len = 0;
+	param_gethex_ex(Cmd,3,data,&len);
+	return tryDecryptWord(param_get32ex(Cmd,0,0,16),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),data,len/2);
+}
 
 static command_t CommandTable[] =
 {
@@ -2008,6 +2015,7 @@ static command_t CommandTable[] =
   {"cgetsc",	CmdHF14AMfCGetSc,		0, "Read sector - Magic Chinese card"},
   {"cload",		CmdHF14AMfCLoad,		0, "Load dump into magic Chinese card"},
   {"csave",		CmdHF14AMfCSave,		0, "Save dump from magic Chinese card into file or emulator"},
+  {"decrypt",   CmdDecryptTraceCmds,    1, "[nt] [ar_enc] [at_enc] [data] - to decrypt snoop or trace"},
   {NULL, NULL, 0, NULL}
 };
 
diff --git a/client/cmdhfmf.h b/client/cmdhfmf.h
index 45ba7cb1..19adbe30 100644
--- a/client/cmdhfmf.h
+++ b/client/cmdhfmf.h
@@ -16,11 +16,11 @@
 #include <string.h>
 #include <ctype.h>
 #include "proxmark3.h"
-#include "../common/iso14443crc.h"
+#include "iso14443crc.h"
 #include "data.h"
 #include "ui.h"
 #include "cmdparser.h"
-#include "../include/common.h"
+#include "common.h"
 #include "util.h"
 #include "mifarehost.h"
 
diff --git a/client/cmdhfmfdes.c b/client/cmdhfmfdes.c
index 516b41bd..fd06791f 100644
--- a/client/cmdhfmfdes.c
+++ b/client/cmdhfmfdes.c
@@ -12,7 +12,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
-//#include <openssl/des.h>
 #include "loclass/des.h"
 #include "cmdmain.h"
 #include "proxmark3.h"
diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c
index aec95e79..5bb9a91e 100644
--- a/client/cmdhfmfu.c
+++ b/client/cmdhfmfu.c
@@ -1924,7 +1924,7 @@ static command_t CommandTable[] =
 	{"dump",	CmdHF14AMfUDump,	0, "Dump Ultralight / Ultralight-C / NTAG tag to binary file"},
 	{"rdbl",	CmdHF14AMfURdBl,	0, "Read block"},
 	{"wrbl",	CmdHF14AMfUWrBl,	0, "Write block"},
-	{"eload",	CmdHF14AMfuELoad,	0, "Load from file emulator dump"},
+	{"eload",	CmdHF14AMfuELoad,	0, "<not implemented> Load from file emulator dump"},
 	{"cauth",	CmdHF14AMfucAuth,	0, "Authentication    - Ultralight C"},
 	{"setpwd",	CmdHF14AMfucSetPwd, 1, "Set 3des password - Ultralight-C"},
 	{"setuid",	CmdHF14AMfucSetUid, 1, "Set UID - MAGIC tags only"},
diff --git a/client/cmdlf.c b/client/cmdlf.c
index db08310a..c67f34a8 100644
--- a/client/cmdlf.c
+++ b/client/cmdlf.c
@@ -85,7 +85,9 @@ int CmdLFCommandRead(const char *Cmd)
 	if(errors) return usage_lf_cmdread();
 	
 	UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
+	
 	sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char*)(&c.d.asBytes),(char*)(&dummy+1));
+	
 	// in case they specified 'h'
 	strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
 
@@ -1212,7 +1214,7 @@ static command_t CommandTable[] =
   {"pcf7931",     CmdLFPCF7931,       1, "{ PCF7931 RFIDs... }"},
   {"ti",          CmdLFTI,            1, "{ TI RFIDs... }"},
   {"t55xx",       CmdLFT55XX,         1, "{ T55X7 RFIDs... }"},
-{"viking",      CmdLFViking,        1, "{ Viking RFIDs... }"},
+  {"viking",      CmdLFViking,        1, "{ Viking RFIDs... }"},
   {"config",      CmdLFSetConfig,     0, "Set config for LF sampling, bit/sample, decimation, frequency"},
  
   {"cmdread",     CmdLFCommandRead,   0, "<off period> <'0' period> <'1' period> <command> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"},
@@ -1220,9 +1222,9 @@ static command_t CommandTable[] =
   {"indalademod", CmdIndalaDemod,     1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
   {"indalaclone", CmdIndalaClone,     0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
   {"read",        CmdLFRead,          0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"},
-  {"search",      CmdLFfind,          1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t- 'u' to search for unknown tags"},
+  {"search",      CmdLFfind,          1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t-- 'u' to search for unknown tags"},
   {"sim",         CmdLFSim,           0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
-  {"simask",      CmdLFaskSim,        0, "[clock] [invert <1|0>] [manchester/raw <'m'|'r'>] [msg separator 's'] [d <hexdata>] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"},
+  {"simask",      CmdLFaskSim,        0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d <hexdata>] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"},
   {"simfsk",      CmdLFfskSim,        0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] \n\t\t-- Simulate LF FSK tag from demodbuffer or input"},
   {"simpsk",      CmdLFpskSim,        0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] \n\t\t-- Simulate LF PSK tag from demodbuffer or input"},
   {"simbidir",    CmdLFSimBidir,      0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
diff --git a/client/cmdlfpcf7931.c b/client/cmdlfpcf7931.c
index 0d8fb93d..9a40dcd8 100644
--- a/client/cmdlfpcf7931.c
+++ b/client/cmdlfpcf7931.c
@@ -1,13 +1,13 @@
 //-----------------------------------------------------------------------------
 // Copyright (C) 2012 Chalk <chalk.secu at gmail.com>
-//
+//               2015 Dake <thomas.cayrou at gmail.com>
+
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
 // the license.
 //-----------------------------------------------------------------------------
 // Low frequency PCF7931 commands
 //-----------------------------------------------------------------------------
-
 #include <stdio.h>
 #include <string.h>
 #include "proxmark3.h"
@@ -21,30 +21,144 @@
 
 static int CmdHelp(const char *Cmd);
 
+struct pcf7931_config configPcf = {{0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF},17500,{0,0}};
+
+int usage_pcf7931_read()
+{
+	PrintAndLog("Usage: lf pcf7931 read [h] ");
+	PrintAndLog("This command tries to read a PCF7931 tag.");
+	PrintAndLog("Options:        ");
+	PrintAndLog("       h             This help");
+	PrintAndLog("Examples:");
+	PrintAndLog("      lf pcf7931 read");
+	return 0;
+}
+
 int CmdLFPCF7931Read(const char *Cmd)
 {
-  UsbCommand c = {CMD_PCF7931_READ};
-  SendCommand(&c);
-  UsbCommand resp;
-  WaitForResponse(CMD_ACK,&resp);
+	uint8_t cmdp = 0;
+	
+	if (param_getchar(Cmd, cmdp) == 'H' ||  param_getchar(Cmd, cmdp) == 'h')
+		return usage_pcf7931_read();
+	
+	UsbCommand c = {CMD_PCF7931_READ};
+	clearCommandBuffer();
+	SendCommand(&c);
+	UsbCommand resp;
+	WaitForResponse(CMD_ACK,&resp);
+	return 0;
+}
+
+int CmdLFPCF7931Config(const char *Cmd)
+{ 
+  int res = 0;
+  // res = sscanf(Cmd, 
+			// "%02x %02x %hu %hu %hu %hu %hu %hhu %hd %hd", 
+			// &configPcf.password[0], 
+			// &configPcf.password[1], 
+			// &configPcf.password[2], 
+			// &configPcf.password[3], 
+			// &configPcf.password[4], 
+			// &configPcf.password[5], 
+			// &configPcf.password[6], 
+			// &configPcf.init_delay, 
+			// &configPcf.offset[0], 
+			// &configPcf.offset[1]);
+
+  if (res >= 7 || res < 1){
+      if(res == 7) configPcf.init_delay = 17500; //default value
+      
+      if(res<=8){
+        configPcf.offset[0] = 0; //default value
+        configPcf.offset[1] = 0; //default value
+      }
+     
+      if(res < 1){
+         PrintAndLog("Usage: <password byte 1 (in hex, lsb first)> <password byte 2  (in hex, lsb first)> [...] <password byte 7  (in hex, lsb first)> <tag initialization delay (in us)> <optional : offset on the low pulses width (in us)> <optional : offset on the low pulses position (in us)>");
+         PrintAndLog("The time offsets could be usefull to correct slew rate generated by the antenna.");
+      }
+
+      PrintAndLog("Current configuration :");
+      PrintAndLog("Password (LSB first on each byte) : %02x %02x %02x %02x %02x %02x %02x", configPcf.password[0], configPcf.password[1], configPcf.password[2], configPcf.password[3], configPcf.password[4], configPcf.password[5], configPcf.password[6]);
+      PrintAndLog("Tag initialization delay : %d us", configPcf.init_delay);
+      PrintAndLog("Offsets : %d us on the low pulses width, %d us on the low pulses positions", configPcf.offset[0], configPcf.offset[1]);
+
+      return 0;
+  }
+
+  //default values
+  configPcf.password[0] = 0xFF;  
+  configPcf.password[1] = 0xFF;  
+  configPcf.password[2] = 0xFF;  
+  configPcf.password[3] = 0xFF;  
+  configPcf.password[4] = 0xFF;  
+  configPcf.password[5] = 0xFF;  
+  configPcf.password[6] = 0xFF;
+
+  configPcf.init_delay = 17500;
+  configPcf.offset[0] = 0; 
+  configPcf.offset[1] = 0; 
+
+  PrintAndLog("Incorrect format");
+  PrintAndLog("Examples of right usage : lf pcf7931 config 11 22 33 44 55 66 77 20000");
+  PrintAndLog("                          lf pcf7931 config FF FF FF FF FF FF FF 17500 -10 30");
+  return 0;
+}
+
+int CmdLFPCF7931Write(const char *Cmd)
+{
+  UsbCommand c = {CMD_PCF7931_WRITE};
+
+  int res = 0;
+  res = sscanf(Cmd, "%" SCNu64 " %" SCNu64 " %" SCNu64 , &c.arg[0], &c.arg[1], &c.arg[2]);
+
+  if(res < 1) {
+	PrintAndLog("Please specify the block address in hex");
+	return 1;
+  }
+  if (res == 1){ 
+	PrintAndLog("Please specify the byte address in hex");
+	return 2;
+  }
+  if(res == 2) {
+	PrintAndLog("Please specify the data in hex (1 byte)");
+	return 3;
+  }
+  if(res == 3) {
+
+	memcpy(c.d.asDwords, configPcf.password, 7);
+	
+    c.d.asDwords[7] = (configPcf.offset[0]+128);
+    c.d.asDwords[8] = (configPcf.offset[1]+128);
+    c.d.asDwords[9] = configPcf.init_delay;
+
+	clearCommandBuffer();
+    SendCommand(&c);
+    return 0;
+  }
+
+  PrintAndLog("INCORRECT FORMAT");
   return 0;
 }
 
+
 static command_t CommandTable[] = 
 {
-  {"help", CmdHelp, 1, "This help"},
-  {"read", CmdLFPCF7931Read, 1, "Read content of a PCF7931 transponder"},
-  {NULL, NULL, 0, NULL}
+	{"help", 	CmdHelp,			1, "This help"},
+	{"read", 	CmdLFPCF7931Read,	1, "Read content of a PCF7931 transponder"},
+	{"write",	CmdLFPCF7931Write,	1, "Write data on a PCF7931 transponder. Usage : lf pcf7931 write <bloc address> <byte address> <data>"},
+	{"config",	CmdLFPCF7931Config, 1, "Configure the password, the tags initialization delay and time offsets (optional)"},
+	{NULL, NULL, 0, NULL}
 };
 
 int CmdLFPCF7931(const char *Cmd)
 {
-  CmdsParse(CommandTable, Cmd);
-  return 0;
+	CmdsParse(CommandTable, Cmd);
+	return 0;
 }
 
 int CmdHelp(const char *Cmd)
 {
-  CmdsHelp(CommandTable);
-  return 0;
+	CmdsHelp(CommandTable);
+	return 0;
 }
diff --git a/client/cmdlfpcf7931.h b/client/cmdlfpcf7931.h
index ed60bc91..78eaff5d 100644
--- a/client/cmdlfpcf7931.h
+++ b/client/cmdlfpcf7931.h
@@ -1,6 +1,7 @@
 //-----------------------------------------------------------------------------
 // Copyright (C) 2012 Chalk <chalk.secu at gmail.com>
-//
+//				 2015 Dake <thomas.cayrou at gmail.com>
+
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
 // the license.
@@ -11,8 +12,18 @@
 #ifndef CMDLFPCF7931_H__
 #define CMDLFPCF7931_H__
 
+struct pcf7931_config{
+	uint8_t password[7];
+	uint16_t init_delay;
+	int16_t offset[2];
+};
+
 int CmdLFPCF7931(const char *Cmd);
 
 int CmdLFPCF7931Read(const char *Cmd);
 
+int CmdLFPCF7931Write(const char *Cmd);
+
+int CmdLFPCF7931Config(const char *Cmd);
+
 #endif
diff --git a/client/cmdlft55xx.c b/client/cmdlft55xx.c
index 5dc5bbee..3611cd4f 100644
--- a/client/cmdlft55xx.c
+++ b/client/cmdlft55xx.c
@@ -37,7 +37,7 @@ int usage_t55xx_config(){
 	PrintAndLog("Options:        ");
 	PrintAndLog("       h                        This help");
 	PrintAndLog("       b <8|16|32|40|50|64|100|128>     Set bitrate");
-	PrintAndLog("       d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa>  Set demodulation FSK / ASK / PSK / NZ / Biphase / Biphase A");
+	PrintAndLog("       d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa>  Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");
 	PrintAndLog("       i [1]                            Invert data signal, defaults to normal");
 	PrintAndLog("       o [offset]                       Set offset, where data should start decode in bitstream");
 	PrintAndLog("");
@@ -1059,6 +1059,12 @@ char * GetSelectedModulationStr( uint8_t id){
 	return buf;
 }
 
+void t55x7_create_config_block( int tagtype ){
+	//switch?
+	
+	
+}
+
 /*
 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 	
diff --git a/client/cmdlft55xx.h b/client/cmdlft55xx.h
index 37895fe8..d8e516e8 100644
--- a/client/cmdlft55xx.h
+++ b/client/cmdlft55xx.h
@@ -20,13 +20,14 @@
 // FDXB requires data inversion and BiPhase 57 is simply BipHase 50 inverted, so we can either do it using the modulation scheme or the inversion flag
 // we've done both below to prove that it works either way, and the modulation value for BiPhase 50 in the Atmel data sheet of binary "10001" (17) is a typo,
 // and it should actually be "10000" (16)
-// #define T55X7_FDXB_CONFIG_BLOCK         903F8080      // emulate fdx-b - xtended mode, BiPhase ('57), data rate 32, 4 data blocks
-#define T55X7_FDXB_CONFIG_BLOCK         0x903F0082      // emulate fdx-b - xtended mode, BiPhase ('50), invert data, data rate 32, 4 data blocks
-#define T55X7_HID_26_CONFIG_BLOCK       0x00107060      // hid 26 bit - compat mode, FSK2a, data rate 50, 3 data blocks
-#define T55X7_INDALA_64_CONFIG_BLOCK    0x00081040      // emulate indala 64 bit - compat mode, PSK1, psk carrier FC * 2, data rate 32, maxblock 2
-#define T55X7_INDALA_224_CONFIG_BLOCK   0x000810E0      // emulate indala 224 bit - compat mode, PSK1, psk carrier FC * 2, data rate 32, maxblock 7
-#define T55X7_GUARDPROXII_CONFIG_BLOCK	0x00150060		// bitrate 64pcb, Direct modulation, Biphase, 3 data blocks
-#define T55X7_VIKING_CONFIG_BLOCK		0x00088040		// compat mode, data rate 32, Manchester, 2 data blocks
+// #define T55X7_FDXB_CONFIG_BLOCK         903F8080  // emulate fdx-b - xtended mode, BiPhase ('57), data rate 32, 4 data blocks
+#define T55X7_FDXB_CONFIG_BLOCK         0x903F0082  // emulate fdx-b - xtended mode, BiPhase ('50), invert data, data rate 32, 4 data blocks
+#define T55X7_HID_26_CONFIG_BLOCK       0x00107060  // hid 26 bit - compat mode, FSK2a, data rate 50, 3 data blocks
+#define T55X7_INDALA_64_CONFIG_BLOCK    0x00081040  // emulate indala 64 bit - compat mode, PSK1, psk carrier FC * 2, data rate 32, maxblock 2
+#define T55X7_INDALA_224_CONFIG_BLOCK   0x000810E0  // emulate indala 224 bit - compat mode, PSK1, psk carrier FC * 2, data rate 32, maxblock 7
+#define T55X7_GUARDPROXII_CONFIG_BLOCK	0x00150060	// bitrate 64pcb, Direct modulation, Biphase, 3 data blocks
+#define T55X7_VIKING_CONFIG_BLOCK		0x00088040	// compat mode, data rate 32, Manchester, 2 data blocks
+#define T55X7_NORALYS_CONFIG_BLOCK		0x00088C6A	// compat mode,   (NORALYS - KCP3000)
 #define T55X7_bin 0b0010
 
 
diff --git a/client/default_keys.dic b/client/default_keys.dic
index 520317bf..5c21d6ac 100644
--- a/client/default_keys.dic
+++ b/client/default_keys.dic
@@ -91,4 +91,6 @@ fc0001877bf7,--RKFÖstgötaTrafikenKeyA
 314B49474956,--VIGIK1KeyA
 564c505f4d41,--VIGIK1KeyB
 f4a9ef2afc6d,--BCARD KeyB
-a9f953def0a3,--
\ No newline at end of file
+a9f953def0a3,--
+75ccb59c9bed,-- mystery KeyA Mifare 1k EV1 (S50) Sector 17!
+4b791bea7bcc,-- mystery KeyB Mifare 1k EV1 (S50) Sector 17!
\ No newline at end of file
diff --git a/client/loclass/cipher.c b/client/loclass/cipher.c
index 7d3950b1..6333b4b0 100644
--- a/client/loclass/cipher.c
+++ b/client/loclass/cipher.c
@@ -241,6 +241,27 @@ void doMAC(uint8_t *cc_nr_p, uint8_t *div_key_p, uint8_t mac[4])
 	//free(cc_nr);
     return;
 }
+void doMAC_N(uint8_t *address_data_p, uint8_t address_data_size, uint8_t *div_key_p, uint8_t mac[4])
+{
+	uint8_t *address_data;
+	uint8_t div_key[8];
+	address_data = (uint8_t*) malloc(address_data_size);
+
+	memcpy(address_data, address_data_p, address_data_size);
+	memcpy(div_key, div_key_p, 8);
+
+	reverse_arraybytes(address_data, address_data_size);
+	BitstreamIn bitstream = {address_data, address_data_size * 8, 0};
+	uint8_t dest []= {0,0,0,0,0,0,0,0};
+	BitstreamOut out = { dest, sizeof(dest)*8, 0 };
+	MAC(div_key, bitstream, out);
+	//The output MAC must also be reversed
+	reverse_arraybytes(dest, sizeof(dest));
+	memcpy(mac, dest, 4);
+	free(address_data);
+	return;
+}
+
 #ifndef ON_DEVICE
 int testMAC()
 {
diff --git a/client/loclass/cipher.h b/client/loclass/cipher.h
index bdea9432..7afdb524 100644
--- a/client/loclass/cipher.h
+++ b/client/loclass/cipher.h
@@ -42,6 +42,8 @@
 #include <stdint.h>
 
 void doMAC(uint8_t *cc_nr_p, uint8_t *div_key_p, uint8_t mac[4]);
+void doMAC_N(uint8_t *address_data_p,uint8_t address_data_size, uint8_t *div_key_p, uint8_t mac[4]);
+
 #ifndef ON_DEVICE
 int testMAC();
 #endif
diff --git a/client/lualibs/commands.lua b/client/lualibs/commands.lua
index ae0568f8..97b40d98 100644
--- a/client/lualibs/commands.lua
+++ b/client/lualibs/commands.lua
@@ -91,11 +91,17 @@ local _commands = {
 	CMD_EPA_PACE_COLLECT_NONCE =                                         0x038A,
 	CMD_EPA_PACE_REPLAY =                                                0x038B,
 
+	CMD_ICLASS_READCHECK =                                               0x038F,
+	CMD_ICLASS_CLONE =                                                   0x0390,
+	CMD_ICLASS_DUMP =                                                    0x0391,
 	CMD_SNOOP_ICLASS =                                                   0x0392,
 	CMD_SIMULATE_TAG_ICLASS =                                            0x0393,
 	CMD_READER_ICLASS =                                                  0x0394,
 	CMD_READER_ICLASS_REPLAY =											 0x0395,
-	CMD_ICLASS_ISO14443A_WRITE =										 0x0397,
+	CMD_ICLASS_READBLOCK =                                               0x0396,
+	CMD_ICLASS_WRITEBLOCK =                                              0x0397,
+	CMD_ICLASS_EML_MEMSET =                                              0x0398,
+	CMD_ICLASS_AUTHENTICATION =                                          0x0399,
 
 	--// For measurements of the antenna tuning
 	CMD_MEASURE_ANTENNA_TUNING =                                         0x0400,
diff --git a/client/lualibs/mf_default_keys.lua b/client/lualibs/mf_default_keys.lua
index 804d4a84..006d2e6f 100644
--- a/client/lualibs/mf_default_keys.lua
+++ b/client/lualibs/mf_default_keys.lua
@@ -181,6 +181,12 @@ local _keys = {
 	 --[[	 
 	 --]]
 	 'a9f953def0a3',
+	 
+	 --[[
+	 mystery Key A and B for Mifare 1k EV1 (S50) Sector 17!
+	 --]]
+	'75ccb59c9bed',
+	'4b791bea7bcc',
 }
 
 ---
diff --git a/client/mifarehost.c b/client/mifarehost.c
index d3f4a4cd..830b61cd 100644
--- a/client/mifarehost.c
+++ b/client/mifarehost.c
@@ -630,3 +630,23 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
 
 	return 0;
 }
+
+int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len){
+	/*
+	uint32_t nt;      // tag challenge
+	uint32_t ar_enc;  // encrypted reader response
+	uint32_t at_enc;  // encrypted tag response
+	*/
+	if (traceCrypto1) {
+		crypto1_destroy(traceCrypto1);
+	}
+	ks2 = ar_enc ^ prng_successor(nt, 64);
+	ks3 = at_enc ^ prng_successor(nt, 96);
+	traceCrypto1 = lfsr_recovery64(ks2, ks3);
+
+	mf_crypto1_decrypt(traceCrypto1, data, len, 0);
+
+	PrintAndLog("Decrypted data: [%s]", sprint_hex(data,len) );
+	crypto1_destroy(traceCrypto1);
+	return 0;
+}
diff --git a/client/mifarehost.h b/client/mifarehost.h
index e2903ff8..49991d66 100644
--- a/client/mifarehost.h
+++ b/client/mifarehost.h
@@ -68,3 +68,4 @@ int isBlockEmpty(int blockN);
 int isBlockTrailer(int blockN);
 int loadTraceCard(uint8_t *tuid);
 int saveTraceCard(void);
+int tryDecryptWord(uint32_t nt, uint32_t ar_enc, uint32_t at_enc, uint8_t *data, int len);
diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c
index c013c85d..b7ab7c32 100644
--- a/client/nonce2key/nonce2key.c
+++ b/client/nonce2key/nonce2key.c
@@ -288,4 +288,4 @@ int tryMfk64(uint64_t myuid, uint8_t *data, uint8_t *outputkey ){
 	crypto1_destroy(revstate);
 	crypto1_destroy(pcs);
 	return 0;
-}
+}
\ No newline at end of file
diff --git a/client/util.c b/client/util.c
index 797a9392..4a3b7476 100644
--- a/client/util.c
+++ b/client/util.c
@@ -333,7 +333,28 @@ int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt)
 
 	return 0;
 }
+int param_gethex_ex(const char *line, int paramnum, uint8_t * data, int *hexcnt)
+{
+	int bg, en, temp, i;
+
+	//if (hexcnt % 2)
+	//	return 1;
+	
+	if (param_getptr(line, &bg, &en, paramnum)) return 1;
+
+	*hexcnt = en - bg + 1;
+	if (*hexcnt % 2) //error if not complete hex bytes
+		return 1;
 
+	for(i = 0; i < *hexcnt; i += 2) {
+		if (!(isxdigit(line[bg + i]) && isxdigit(line[bg + i + 1])) )	return 1;
+		
+		sscanf((char[]){line[bg + i], line[bg + i + 1], 0}, "%X", &temp);
+		data[i / 2] = temp & 0xff;
+	}	
+
+	return 0;
+}
 int param_getstr(const char *line, int paramnum, char * str)
 {
 	int bg, en;
diff --git a/client/util.h b/client/util.h
index 8a749ccb..a9ae8313 100644
--- a/client/util.h
+++ b/client/util.h
@@ -55,6 +55,7 @@ uint64_t param_get64ex(const char *line, int paramnum, int deflt, int base);
 uint8_t param_getdec(const char *line, int paramnum, uint8_t *destination);
 uint8_t param_isdec(const char *line, int paramnum);
 int param_gethex(const char *line, int paramnum, uint8_t * data, int hexcnt);
+int param_gethex_ex(const char *line, int paramnum, uint8_t * data, int *hexcnt);
 int param_getstr(const char *line, int paramnum, char * str);
 
  int hextobinarray( char *target,  char *source);
diff --git a/common/protocols.c b/common/protocols.c
index aa80491b..0a523da3 100644
--- a/common/protocols.c
+++ b/common/protocols.c
@@ -11,13 +11,13 @@
 
 
 typedef struct {
-	uint8_t app_limit;
-	uint8_t otp[2];
-	uint8_t block_writelock;
-	uint8_t chip_config;
-	uint8_t mem_config;
-	uint8_t eas;
-	uint8_t fuses;
+	uint8_t app_limit;      //[8]
+	uint8_t otp[2];         //[9-10]
+	uint8_t block_writelock;//[11]
+	uint8_t chip_config;    //[12]
+	uint8_t mem_config;     //[13]
+	uint8_t eas;            //[14]
+	uint8_t fuses;          //[15]
 }picopass_conf_block;
 
 
@@ -74,24 +74,54 @@ void fuse_config(const picopass_hdr *hdr)
 	if( isset( fuses, FUSE_RA)) prnt("	RA: Read access enabled");
 	else prnt("	RA: Read access not enabled");
 }
-void mem_config(const picopass_hdr *hdr)
-{
-	uint8_t mem = hdr->conf.mem_config;
-	if( isset (mem, 0x80)) prnt("	Mem: 16KBits (255 * 8 bytes)");
-	else prnt("	Mem: 2 KBits ( 32 * 8 bytes)");
 
+void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t *app_areas, uint8_t *kb) {
+	// mem-bit 5, mem-bit 7, chip-bit 4: defines chip type
+	if(isset(chip_cfg, 0x10) && notset(mem_cfg, 0x80) && notset(mem_cfg, 0x20)) {
+		*kb = 2;
+		*app_areas = 2;
+		*max_blk = 31;
+	} else if(isset(chip_cfg, 0x10) && isset(mem_cfg, 0x80) && notset(mem_cfg, 0x20)) {
+		*kb = 16;
+		*app_areas = 2;
+		*max_blk = 255; //16kb
+	} else if(notset(chip_cfg, 0x10) && notset(mem_cfg, 0x80) && notset(mem_cfg, 0x20)) {
+		*kb = 16;
+		*app_areas = 16;
+		*max_blk = 255; //16kb
+	} else if(isset(chip_cfg, 0x10) && isset(mem_cfg, 0x80) && isset(mem_cfg, 0x20)) {
+		*kb = 32;
+		*app_areas = 3;
+		*max_blk = 255; //16kb
+	} else if(notset(chip_cfg, 0x10) && notset(mem_cfg, 0x80) && isset(mem_cfg, 0x20)) {
+		*kb = 32;
+		*app_areas = 17;
+		*max_blk = 255; //16kb
+	} else {
+		*kb = 32;
+		*app_areas = 2;
+		*max_blk = 255;
+	}
 }
-void applimit_config(const picopass_hdr *hdr)
+
+void mem_app_config(const picopass_hdr *hdr)
 {
+	uint8_t mem = hdr->conf.mem_config;
+	uint8_t chip = hdr->conf.chip_config;
 	uint8_t applimit = hdr->conf.app_limit;
-	prnt("	AA1: blocks 6-%d", applimit);
-	prnt("	AA2: blocks %d-", (applimit+1));
+	if (applimit < 6) applimit = 26;
+	uint8_t kb = 2;
+	uint8_t app_areas = 2;
+	uint8_t max_blk = 31;
+	getMemConfig(mem, chip, &max_blk, &app_areas, &kb);
+	prnt("  Mem: %u KBits/%u App Areas (%u * 8 bytes) [%02X]", kb, app_areas, max_blk, mem);
+	prnt("	AA1: blocks 06-%02X", applimit);
+	prnt("	AA2: blocks %02X-%02X", applimit+1, max_blk);
 }
 void print_picopass_info(const picopass_hdr *hdr)
 {
 	fuse_config(hdr);
-	mem_config(hdr);
-	applimit_config(hdr);
+	mem_app_config(hdr);
 }
 void printIclassDumpInfo(uint8_t* iclass_dump)
 {
diff --git a/common/protocols.h b/common/protocols.h
index 2de52b4d..e676cbfe 100644
--- a/common/protocols.h
+++ b/common/protocols.h
@@ -148,6 +148,10 @@ ISO 7816-4 Basic interindustry commands. For command APDU's.
 #define MIFARE_CMD_RESTORE      0xC2
 #define MIFARE_CMD_TRANSFER     0xB0
 
+#define MIFARE_EV1_PERSONAL_UID 0x40
+#define MIFARE_EV1_SETMODE		0x43
+
+
 #define MIFARE_ULC_WRITE        0xA2
 //#define MIFARE_ULC__COMP_WRITE  0xA0
 #define MIFARE_ULC_AUTH_1       0x1A
@@ -162,6 +166,8 @@ ISO 7816-4 Basic interindustry commands. For command APDU's.
 #define MIFARE_ULEV1_CHECKTEAR	0x3E
 #define MIFARE_ULEV1_VCSL		0x4B
 
+
+
 /**
 06 00 = INITIATE
 0E xx = SELECT ID (xx = Chip-ID)
@@ -259,5 +265,6 @@ ISO 7816-4 Basic interindustry commands. For command APDU's.
 //	6x xx = ERROR
 	
 void printIclassDumpInfo(uint8_t* iclass_dump);
+void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t *app_areas, uint8_t *kb);
 
 #endif // PROTOCOLS_H
diff --git a/include/usb_cmd.h b/include/usb_cmd.h
index 96e5e5a2..4a6704c6 100644
--- a/include/usb_cmd.h
+++ b/include/usb_cmd.h
@@ -87,6 +87,7 @@ typedef struct{
 #define CMD_T55XX_WRITE_BLOCK                                             0x0215
 #define CMD_T55XX_READ_TRACE                                              0x0216
 #define CMD_PCF7931_READ                                                  0x0217
+#define CMD_PCF7931_WRITE                                                 0x0223
 #define CMD_EM4X_READ_WORD                                                0x0218
 #define CMD_EM4X_WRITE_WORD                                               0x0219
 #define CMD_IO_DEMOD_FSK                                                  0x021A
@@ -133,12 +134,17 @@ typedef struct{
 #define CMD_EPA_PACE_COLLECT_NONCE                                        0x038A
 #define CMD_EPA_PACE_REPLAY                                               0x038B
 
+#define CMD_ICLASS_READCHECK                                              0x038F
+#define CMD_ICLASS_CLONE                                                  0x0390
+#define CMD_ICLASS_DUMP                                                   0x0391
 #define CMD_SNOOP_ICLASS                                                  0x0392
 #define CMD_SIMULATE_TAG_ICLASS                                           0x0393
 #define CMD_READER_ICLASS                                                 0x0394
 #define CMD_READER_ICLASS_REPLAY                                          0x0395
-#define CMD_ICLASS_ISO14443A_WRITE										  0x0397
+#define CMD_ICLASS_READBLOCK                                              0x0396
+#define CMD_ICLASS_WRITEBLOCK                                             0x0397
 #define CMD_ICLASS_EML_MEMSET                                             0x0398
+#define CMD_ICLASS_AUTHENTICATION                                         0x0399
 
 // For measurements of the antenna tuning
 #define CMD_MEASURE_ANTENNA_TUNING                                        0x0400
@@ -211,6 +217,7 @@ typedef struct{
 #define FLAG_ICLASS_READER_CONF		0x08
 #define FLAG_ICLASS_READER_AA		0x10
 #define FLAG_ICLASS_READER_ONE_TRY      0x20
+#define FLAG_ICLASS_READER_CEDITKEY     0x40
 
 
 
-- 
2.39.2