]>
Commit | Line | Data |
---|---|---|
8556b852 | 1 | //-----------------------------------------------------------------------------\r |
b62a5a84 | 2 | // Merlok - June 2011, 2012\r |
8556b852 M |
3 | // Gerhard de Koning Gans - May 2008\r |
4 | // Hagen Fritsch - June 2010\r | |
3fe4ff4f | 5 | // Midnitesnake - Dec 2013\r |
6 | // Andy Davies - Apr 2014\r | |
7 | // Iceman - May 2014\r | |
8556b852 M |
8 | //\r |
9 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
10 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
11 | // the license.\r | |
12 | //-----------------------------------------------------------------------------\r | |
13 | // Routines to support ISO 14443 type A.\r | |
14 | //-----------------------------------------------------------------------------\r | |
15 | \r | |
16 | #include "mifarecmd.h"\r | |
17 | #include "apps.h"\r | |
787b5bd8 | 18 | #include "util.h"\r |
a631936e | 19 | #include "crc.h"\r |
c2731f37 | 20 | #include "protocols.h"\r |
f8ada309 | 21 | #include "parity.h"\r |
a631936e | 22 | \r |
8556b852 | 23 | //-----------------------------------------------------------------------------\r |
baeaf579 | 24 | // Select, Authenticate, Read a MIFARE tag. \r |
8556b852 M |
25 | // read block\r |
26 | //-----------------------------------------------------------------------------\r | |
27 | void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
28 | {\r | |
29 | // params\r | |
30 | uint8_t blockNo = arg0;\r | |
31 | uint8_t keyType = arg1;\r | |
32 | uint64_t ui64Key = 0;\r | |
33 | ui64Key = bytes_to_num(datain, 6);\r | |
34 | \r | |
35 | // variables\r | |
36 | byte_t isOK = 0;\r | |
d798d31c | 37 | byte_t dataoutbuf[16] = {0x00};\r |
38 | uint8_t uid[10] = {0x00};\r | |
39 | uint32_t cuid = 0;\r | |
8556b852 M |
40 | struct Crypto1State mpcs = {0, 0};\r |
41 | struct Crypto1State *pcs;\r | |
42 | pcs = &mpcs;\r | |
43 | \r | |
7bc95e2e | 44 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 | 45 | \r |
99cf19d9 | 46 | clear_trace();\r |
810f5379 | 47 | set_tracing(true);\r |
99cf19d9 | 48 | \r |
8556b852 M |
49 | LED_A_ON();\r |
50 | LED_B_OFF();\r | |
51 | LED_C_OFF();\r | |
52 | \r | |
53 | while (true) {\r | |
c188b1b9 | 54 | if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r |
baeaf579 | 55 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
8556b852 M |
56 | break;\r |
57 | };\r | |
58 | \r | |
59 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
baeaf579 | 60 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
8556b852 M |
61 | break;\r |
62 | };\r | |
63 | \r | |
64 | if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r | |
baeaf579 | 65 | if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r |
8556b852 M |
66 | break;\r |
67 | };\r | |
68 | \r | |
69 | if(mifare_classic_halt(pcs, cuid)) {\r | |
baeaf579 | 70 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 M |
71 | break;\r |
72 | };\r | |
73 | \r | |
74 | isOK = 1;\r | |
75 | break;\r | |
76 | }\r | |
77 | \r | |
78 | // ----------------------------- crypto1 destroy\r | |
79 | crypto1_destroy(pcs);\r | |
80 | \r | |
81 | if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r | |
82 | \r | |
8556b852 | 83 | LED_B_ON();\r |
baeaf579 | 84 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r |
8556b852 M |
85 | LED_B_OFF();\r |
86 | \r | |
a631936e | 87 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
88 | LEDsoff();\r | |
89 | }\r | |
90 | \r | |
4d2e4eea | 91 | void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){\r |
a631936e | 92 | \r |
4d2e4eea | 93 | bool turnOffField = (arg0 == 1);\r |
a631936e | 94 | \r |
aa60d156 | 95 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r |
99cf19d9 | 96 | \r |
a631936e | 97 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
98 | \r | |
99cf19d9 | 99 | clear_trace();\r |
810f5379 | 100 | set_tracing(true);\r |
99cf19d9 | 101 | \r |
c188b1b9 | 102 | if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {\r |
aa60d156 | 103 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r |
0ec548dc | 104 | OnError(0);\r |
a631936e | 105 | return;\r |
106 | };\r | |
107 | \r | |
e7e95088 | 108 | if(!mifare_ultra_auth(keybytes)){\r |
4d2e4eea | 109 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");\r |
0ec548dc | 110 | OnError(1);\r |
a631936e | 111 | return;\r |
112 | }\r | |
113 | \r | |
4d2e4eea | 114 | if (turnOffField) {\r |
115 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
116 | LEDsoff();\r | |
cceabb79 | 117 | }\r |
9d87eb66 | 118 | cmd_send(CMD_ACK,1,0,0,0,0);\r |
7cc204bf | 119 | }\r |
120 | \r | |
8d53ea14 | 121 | // Arg0 = BlockNo,\r |
122 | // Arg1 = UsePwd bool\r | |
75377d29 | 123 | // datain = PWD bytes,\r |
0ec548dc | 124 | void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r |
7cc204bf | 125 | {\r |
7cc204bf | 126 | uint8_t blockNo = arg0;\r |
787b5bd8 | 127 | byte_t dataout[16] = {0x00};\r |
4d2e4eea | 128 | bool useKey = (arg1 == 1); //UL_C\r |
129 | bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r | |
8d53ea14 | 130 | \r |
75377d29 | 131 | LEDsoff();\r |
132 | LED_A_ON();\r | |
787b5bd8 | 133 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
f168b263 | 134 | \r |
99cf19d9 | 135 | clear_trace();\r |
810f5379 | 136 | set_tracing(true);\r |
99cf19d9 | 137 | \r |
c188b1b9 | 138 | int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);\r |
787b5bd8 | 139 | if(!len) {\r |
aa60d156 | 140 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r |
0ec548dc | 141 | OnError(1);\r |
787b5bd8 | 142 | return;\r |
aa60d156 | 143 | }\r |
f168b263 | 144 | \r |
4d2e4eea | 145 | // UL-C authentication\r |
146 | if ( useKey ) {\r | |
8258f409 | 147 | uint8_t key[16] = {0x00};\r |
4d2e4eea | 148 | memcpy(key, datain, sizeof(key) );\r |
149 | \r | |
e7e95088 | 150 | if ( !mifare_ultra_auth(key) ) {\r |
aa60d156 | 151 | OnError(1);\r |
f168b263 | 152 | return;\r |
0ec548dc | 153 | }\r |
4d2e4eea | 154 | }\r |
f168b263 | 155 | \r |
4d2e4eea | 156 | // UL-EV1 / NTAG authentication\r |
8258f409 | 157 | if ( usePwd ) {\r |
4d2e4eea | 158 | uint8_t pwd[4] = {0x00};\r |
159 | memcpy(pwd, datain, 4);\r | |
160 | uint8_t pack[4] = {0,0,0,0};\r | |
e7e95088 | 161 | if (!mifare_ul_ev1_auth(pwd, pack)) {\r |
0ec548dc | 162 | OnError(1);\r |
f168b263 | 163 | return;\r |
062b7cb9 | 164 | }\r |
8258f409 | 165 | } \r |
f168b263 | 166 | \r |
aa60d156 | 167 | if( mifare_ultra_readblock(blockNo, dataout) ) {\r |
168 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r | |
0ec548dc | 169 | OnError(2);\r |
787b5bd8 | 170 | return;\r |
aa60d156 | 171 | }\r |
8258f409 | 172 | \r |
aa60d156 | 173 | if( mifare_ultra_halt() ) {\r |
174 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r | |
0ec548dc | 175 | OnError(3);\r |
787b5bd8 | 176 | return;\r |
aa60d156 | 177 | }\r |
8258f409 | 178 | \r |
787b5bd8 | 179 | cmd_send(CMD_ACK,1,0,0,dataout,16);\r |
7cc204bf | 180 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
181 | LEDsoff();\r | |
182 | }\r | |
e7e95088 | 183 | \r |
7cc204bf | 184 | //-----------------------------------------------------------------------------\r |
baeaf579 | 185 | // Select, Authenticate, Read a MIFARE tag. \r |
186 | // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r | |
8556b852 M |
187 | //-----------------------------------------------------------------------------\r |
188 | void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
189 | {\r | |
190 | // params\r | |
191 | uint8_t sectorNo = arg0;\r | |
192 | uint8_t keyType = arg1;\r | |
193 | uint64_t ui64Key = 0;\r | |
194 | ui64Key = bytes_to_num(datain, 6);\r | |
195 | \r | |
196 | // variables\r | |
3fe4ff4f | 197 | byte_t isOK = 0;\r |
baeaf579 | 198 | byte_t dataoutbuf[16 * 16];\r |
d798d31c | 199 | uint8_t uid[10] = {0x00};\r |
200 | uint32_t cuid = 0;\r | |
8556b852 M |
201 | struct Crypto1State mpcs = {0, 0};\r |
202 | struct Crypto1State *pcs;\r | |
203 | pcs = &mpcs;\r | |
204 | \r | |
7bc95e2e | 205 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 | 206 | \r |
99cf19d9 | 207 | clear_trace();\r |
810f5379 | 208 | set_tracing(true);\r |
209 | \r | |
8556b852 M |
210 | LED_A_ON();\r |
211 | LED_B_OFF();\r | |
212 | LED_C_OFF();\r | |
213 | \r | |
baeaf579 | 214 | isOK = 1;\r |
c188b1b9 | 215 | if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r |
baeaf579 | 216 | isOK = 0;\r |
8556b852 | 217 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
baeaf579 | 218 | }\r |
baeaf579 | 219 | \r |
e7e95088 | 220 | \r |
baeaf579 | 221 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r |
222 | isOK = 0;\r | |
8556b852 | 223 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
baeaf579 | 224 | }\r |
225 | \r | |
226 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
227 | if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r | |
228 | isOK = 0;\r | |
229 | if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r | |
8556b852 | 230 | break;\r |
baeaf579 | 231 | }\r |
232 | }\r | |
8556b852 | 233 | \r |
baeaf579 | 234 | if(mifare_classic_halt(pcs, cuid)) {\r |
8556b852 | 235 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 | 236 | }\r |
baeaf579 | 237 | \r |
8556b852 M |
238 | // ----------------------------- crypto1 destroy\r |
239 | crypto1_destroy(pcs);\r | |
240 | \r | |
241 | if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r | |
242 | \r | |
8556b852 | 243 | LED_B_ON();\r |
baeaf579 | 244 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r |
6e82300d | 245 | LED_B_OFF();\r |
8556b852 M |
246 | \r |
247 | // Thats it...\r | |
248 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
249 | LEDsoff();\r | |
7cc204bf | 250 | }\r |
251 | \r | |
8d53ea14 | 252 | // arg0 = blockNo (start)\r |
253 | // arg1 = Pages (number of blocks)\r | |
254 | // arg2 = useKey\r | |
255 | // datain = KEY bytes\r | |
256 | void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r | |
7cc204bf | 257 | {\r |
99cf19d9 | 258 | LEDsoff();\r |
259 | LED_A_ON();\r | |
260 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r | |
261 | \r | |
0a0d9a58 | 262 | // free eventually allocated BigBuf memory\r |
263 | BigBuf_free();\r | |
0a0d9a58 | 264 | clear_trace();\r |
810f5379 | 265 | set_tracing(true);\r |
266 | \r | |
0ec548dc | 267 | // params\r |
8d53ea14 | 268 | uint8_t blockNo = arg0;\r |
269 | uint16_t blocks = arg1;\r | |
4d2e4eea | 270 | bool useKey = (arg2 == 1); //UL_C\r |
271 | bool usePwd = (arg2 == 2); //UL_EV1/NTAG\r | |
e7e95088 | 272 | uint32_t countblocks = 0;\r |
0a0d9a58 | 273 | uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);\r |
274 | if (dataout == NULL){\r | |
275 | Dbprintf("out of memory");\r | |
276 | OnError(1);\r | |
277 | return;\r | |
278 | }\r | |
7cc204bf | 279 | \r |
c188b1b9 | 280 | int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);\r |
787b5bd8 | 281 | if (!len) {\r |
aa60d156 | 282 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r |
0ec548dc | 283 | OnError(1);\r |
787b5bd8 | 284 | return;\r |
285 | }\r | |
75377d29 | 286 | \r |
8258f409 | 287 | // UL-C authentication\r |
75377d29 | 288 | if ( useKey ) {\r |
289 | uint8_t key[16] = {0x00};\r | |
8258f409 | 290 | memcpy(key, datain, sizeof(key) );\r |
75377d29 | 291 | \r |
9d87eb66 | 292 | if ( !mifare_ultra_auth(key) ) {\r |
75377d29 | 293 | OnError(1);\r |
294 | return;\r | |
295 | }\r | |
75377d29 | 296 | }\r |
297 | \r | |
8258f409 | 298 | // UL-EV1 / NTAG authentication\r |
299 | if (usePwd) {\r | |
300 | uint8_t pwd[4] = {0x00};\r | |
301 | memcpy(pwd, datain, sizeof(pwd));\r | |
cceabb79 | 302 | uint8_t pack[4] = {0,0,0,0};\r |
303 | \r | |
9d87eb66 | 304 | if (!mifare_ul_ev1_auth(pwd, pack)){\r |
cceabb79 | 305 | OnError(1);\r |
cceabb79 | 306 | return; \r |
307 | }\r | |
308 | }\r | |
309 | \r | |
75377d29 | 310 | for (int i = 0; i < blocks; i++){\r |
95aeb706 | 311 | if ((i*4) + 4 >= CARD_MEMORY_SIZE) {\r |
9d87eb66 | 312 | Dbprintf("Data exceeds buffer!!");\r |
313 | break;\r | |
314 | }\r | |
8d53ea14 | 315 | \r |
e7e95088 | 316 | len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);\r |
787b5bd8 | 317 | \r |
318 | if (len) {\r | |
aa60d156 | 319 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r |
e7e95088 | 320 | // if no blocks read - error out\r |
321 | if (i==0){\r | |
9d87eb66 | 322 | OnError(2);\r |
787b5bd8 | 323 | return;\r |
e7e95088 | 324 | } else {\r |
325 | //stop at last successful read block and return what we got\r | |
326 | break;\r | |
327 | }\r | |
787b5bd8 | 328 | } else {\r |
4d2e4eea | 329 | countblocks++;\r |
787b5bd8 | 330 | }\r |
331 | }\r | |
75377d29 | 332 | \r |
4d2e4eea | 333 | len = mifare_ultra_halt();\r |
334 | if (len) {\r | |
aa60d156 | 335 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r |
0ec548dc | 336 | OnError(3);\r |
787b5bd8 | 337 | return;\r |
338 | }\r | |
7cc204bf | 339 | \r |
4d2e4eea | 340 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);\r |
7cc204bf | 341 | \r |
e7e95088 | 342 | countblocks *= 4;\r |
95aeb706 | 343 | \r |
0ce03d9a | 344 | cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);\r |
31d1caa5 MHS |
345 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
346 | LEDsoff();\r | |
46cd801c | 347 | BigBuf_free();\r |
7cc204bf | 348 | }\r |
349 | \r | |
7cc204bf | 350 | //-----------------------------------------------------------------------------\r |
baeaf579 | 351 | // Select, Authenticate, Write a MIFARE tag. \r |
7cc204bf | 352 | // read block\r |
8556b852 M |
353 | //-----------------------------------------------------------------------------\r |
354 | void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
355 | {\r | |
356 | // params\r | |
357 | uint8_t blockNo = arg0;\r | |
358 | uint8_t keyType = arg1;\r | |
359 | uint64_t ui64Key = 0;\r | |
d798d31c | 360 | byte_t blockdata[16] = {0x00};\r |
8556b852 M |
361 | \r |
362 | ui64Key = bytes_to_num(datain, 6);\r | |
363 | memcpy(blockdata, datain + 10, 16);\r | |
364 | \r | |
365 | // variables\r | |
366 | byte_t isOK = 0;\r | |
d798d31c | 367 | uint8_t uid[10] = {0x00};\r |
368 | uint32_t cuid = 0;\r | |
8556b852 M |
369 | struct Crypto1State mpcs = {0, 0};\r |
370 | struct Crypto1State *pcs;\r | |
371 | pcs = &mpcs;\r | |
372 | \r | |
7bc95e2e | 373 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 | 374 | \r |
99cf19d9 | 375 | clear_trace();\r |
810f5379 | 376 | set_tracing(true);\r |
377 | \r | |
8556b852 M |
378 | LED_A_ON();\r |
379 | LED_B_OFF();\r | |
380 | LED_C_OFF();\r | |
381 | \r | |
382 | while (true) {\r | |
c188b1b9 | 383 | if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r |
8556b852 M |
384 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
385 | break;\r | |
386 | };\r | |
387 | \r | |
388 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
389 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r | |
390 | break;\r | |
391 | };\r | |
392 | \r | |
393 | if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r | |
394 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
395 | break;\r | |
396 | };\r | |
397 | \r | |
398 | if(mifare_classic_halt(pcs, cuid)) {\r | |
399 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
400 | break;\r | |
401 | };\r | |
402 | \r | |
403 | isOK = 1;\r | |
404 | break;\r | |
405 | }\r | |
406 | \r | |
407 | // ----------------------------- crypto1 destroy\r | |
408 | crypto1_destroy(pcs);\r | |
409 | \r | |
410 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
411 | \r | |
8556b852 | 412 | LED_B_ON();\r |
9492e0b0 | 413 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r |
6e82300d | 414 | LED_B_OFF();\r |
8556b852 M |
415 | \r |
416 | \r | |
417 | // Thats it...\r | |
418 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
419 | LEDsoff();\r | |
7cc204bf | 420 | }\r |
421 | \r | |
95aeb706 | 422 | /* // Command not needed but left for future testing \r |
423 | void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)\r | |
7cc204bf | 424 | {\r |
f168b263 | 425 | uint8_t blockNo = arg0;\r |
787b5bd8 | 426 | byte_t blockdata[16] = {0x00};\r |
7cc204bf | 427 | \r |
f168b263 | 428 | memcpy(blockdata, datain, 16);\r |
429 | \r | |
787b5bd8 | 430 | uint8_t uid[10] = {0x00};\r |
7cc204bf | 431 | \r |
aa60d156 | 432 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r |
7cc204bf | 433 | \r |
aa60d156 | 434 | clear_trace();\r |
810f5379 | 435 | set_tracing(true);\r |
aa60d156 | 436 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 437 | \r |
c188b1b9 | 438 | if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {\r |
aa60d156 | 439 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
440 | OnError(0);\r | |
441 | return;\r | |
442 | };\r | |
443 | \r | |
95aeb706 | 444 | if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {\r |
aa60d156 | 445 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
446 | OnError(0);\r | |
447 | return; };\r | |
448 | \r | |
449 | if(mifare_ultra_halt()) {\r | |
450 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
451 | OnError(0);\r | |
452 | return;\r | |
453 | };\r | |
f168b263 | 454 | \r |
aa60d156 | 455 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r |
7cc204bf | 456 | \r |
aa60d156 | 457 | cmd_send(CMD_ACK,1,0,0,0,0);\r |
458 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
459 | LEDsoff();\r | |
7cc204bf | 460 | }\r |
95aeb706 | 461 | */\r |
7cc204bf | 462 | \r |
fff69a1e | 463 | // Arg0 : Block to write to.\r |
464 | // Arg1 : 0 = use no authentication.\r | |
465 | // 1 = use 0x1A authentication.\r | |
466 | // 2 = use 0x1B authentication.\r | |
467 | // datain : 4 first bytes is data to be written.\r | |
468 | // : 4/16 next bytes is authentication key.\r | |
95aeb706 | 469 | void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r |
7cc204bf | 470 | {\r |
baeaf579 | 471 | uint8_t blockNo = arg0;\r |
fff69a1e | 472 | bool useKey = (arg1 == 1); //UL_C\r |
473 | bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r | |
787b5bd8 | 474 | byte_t blockdata[4] = {0x00};\r |
7cc204bf | 475 | \r |
8258f409 | 476 | memcpy(blockdata, datain,4);\r |
aa60d156 | 477 | \r |
8d53ea14 | 478 | LEDsoff();\r |
479 | LED_A_ON();\r | |
aa60d156 | 480 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
481 | \r | |
99cf19d9 | 482 | clear_trace();\r |
810f5379 | 483 | set_tracing(true);\r |
484 | \r | |
c188b1b9 | 485 | if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {\r |
aa60d156 | 486 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
487 | OnError(0);\r | |
488 | return;\r | |
489 | };\r | |
7cc204bf | 490 | \r |
fff69a1e | 491 | // UL-C authentication\r |
492 | if ( useKey ) {\r | |
493 | uint8_t key[16] = {0x00}; \r | |
494 | memcpy(key, datain+4, sizeof(key) );\r | |
495 | \r | |
496 | if ( !mifare_ultra_auth(key) ) {\r | |
497 | OnError(1);\r | |
498 | return; \r | |
499 | }\r | |
500 | }\r | |
501 | \r | |
502 | // UL-EV1 / NTAG authentication\r | |
503 | if (usePwd) { \r | |
504 | uint8_t pwd[4] = {0x00};\r | |
505 | memcpy(pwd, datain+4, 4);\r | |
506 | uint8_t pack[4] = {0,0,0,0};\r | |
507 | if (!mifare_ul_ev1_auth(pwd, pack)) {\r | |
508 | OnError(1);\r | |
509 | return; \r | |
510 | }\r | |
511 | }\r | |
512 | \r | |
95aeb706 | 513 | if(mifare_ultra_writeblock(blockNo, blockdata)) {\r |
aa60d156 | 514 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
515 | OnError(0);\r | |
516 | return;\r | |
517 | };\r | |
518 | \r | |
519 | if(mifare_ultra_halt()) {\r | |
520 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
521 | OnError(0);\r | |
522 | return;\r | |
523 | };\r | |
524 | \r | |
525 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
526 | \r | |
527 | cmd_send(CMD_ACK,1,0,0,0,0);\r | |
528 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
529 | LEDsoff();\r | |
530 | }\r | |
531 | \r | |
532 | void MifareUSetPwd(uint8_t arg0, uint8_t *datain){\r | |
533 | \r | |
534 | uint8_t pwd[16] = {0x00};\r | |
535 | byte_t blockdata[4] = {0x00};\r | |
536 | \r | |
537 | memcpy(pwd, datain, 16);\r | |
538 | \r | |
539 | LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r | |
baeaf579 | 540 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 541 | \r |
99cf19d9 | 542 | clear_trace();\r |
810f5379 | 543 | set_tracing(true);\r |
544 | \r | |
c188b1b9 | 545 | if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {\r |
aa60d156 | 546 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
547 | OnError(0);\r | |
548 | return;\r | |
549 | };\r | |
7cc204bf | 550 | \r |
aa60d156 | 551 | blockdata[0] = pwd[7];\r |
552 | blockdata[1] = pwd[6];\r | |
553 | blockdata[2] = pwd[5];\r | |
554 | blockdata[3] = pwd[4];\r | |
95aeb706 | 555 | if(mifare_ultra_writeblock( 44, blockdata)) {\r |
aa60d156 | 556 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
557 | OnError(44);\r | |
558 | return;\r | |
559 | };\r | |
7cc204bf | 560 | \r |
aa60d156 | 561 | blockdata[0] = pwd[3];\r |
562 | blockdata[1] = pwd[2];\r | |
563 | blockdata[2] = pwd[1];\r | |
564 | blockdata[3] = pwd[0];\r | |
95aeb706 | 565 | if(mifare_ultra_writeblock( 45, blockdata)) {\r |
aa60d156 | 566 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
567 | OnError(45);\r | |
568 | return;\r | |
569 | };\r | |
7cc204bf | 570 | \r |
aa60d156 | 571 | blockdata[0] = pwd[15];\r |
572 | blockdata[1] = pwd[14];\r | |
573 | blockdata[2] = pwd[13];\r | |
574 | blockdata[3] = pwd[12];\r | |
95aeb706 | 575 | if(mifare_ultra_writeblock( 46, blockdata)) {\r |
aa60d156 | 576 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
577 | OnError(46);\r | |
578 | return;\r | |
579 | };\r | |
7cc204bf | 580 | \r |
aa60d156 | 581 | blockdata[0] = pwd[11];\r |
582 | blockdata[1] = pwd[10];\r | |
583 | blockdata[2] = pwd[9];\r | |
584 | blockdata[3] = pwd[8];\r | |
95aeb706 | 585 | if(mifare_ultra_writeblock( 47, blockdata)) {\r |
aa60d156 | 586 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r |
587 | OnError(47);\r | |
588 | return;\r | |
589 | }; \r | |
7cc204bf | 590 | \r |
aa60d156 | 591 | if(mifare_ultra_halt()) {\r |
592 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
593 | OnError(0);\r | |
594 | return;\r | |
595 | };\r | |
7cc204bf | 596 | \r |
aa60d156 | 597 | cmd_send(CMD_ACK,1,0,0,0,0);\r |
baeaf579 | 598 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
599 | LEDsoff();\r | |
7cc204bf | 600 | }\r |
601 | \r | |
602 | // Return 1 if the nonce is invalid else return 0\r | |
6a1f2d82 | 603 | int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r |
f8ada309 | 604 | return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r |
605 | (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r | |
606 | (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r | |
8556b852 M |
607 | }\r |
608 | \r | |
9492e0b0 | 609 | \r |
c188b1b9 | 610 | //-----------------------------------------------------------------------------\r |
611 | // acquire encrypted nonces in order to perform the attack described in\r | |
612 | // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened\r | |
613 | // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on \r | |
614 | // Computer and Communications Security, 2015\r | |
615 | //-----------------------------------------------------------------------------\r | |
616 | void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)\r | |
617 | {\r | |
618 | uint64_t ui64Key = 0;\r | |
d798d31c | 619 | uint8_t uid[10] = {0x00};\r |
4a71da5a | 620 | uint32_t cuid = 0;\r |
c188b1b9 | 621 | uint8_t cascade_levels = 0;\r |
622 | struct Crypto1State mpcs = {0, 0};\r | |
623 | struct Crypto1State *pcs;\r | |
624 | pcs = &mpcs;\r | |
d798d31c | 625 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r |
c188b1b9 | 626 | int16_t isOK = 0;\r |
d798d31c | 627 | uint8_t par_enc[1] = {0x00};\r |
c188b1b9 | 628 | uint8_t nt_par_enc = 0;\r |
d798d31c | 629 | uint8_t buf[USB_CMD_DATA_SIZE] = {0x00};\r |
630 | uint32_t timeout = 0;\r | |
c188b1b9 | 631 | \r |
632 | uint8_t blockNo = arg0 & 0xff;\r | |
633 | uint8_t keyType = (arg0 >> 8) & 0xff;\r | |
634 | uint8_t targetBlockNo = arg1 & 0xff;\r | |
635 | uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r | |
636 | ui64Key = bytes_to_num(datain, 6);\r | |
637 | bool initialize = flags & 0x0001;\r | |
638 | bool slow = flags & 0x0002;\r | |
639 | bool field_off = flags & 0x0004;\r | |
640 | \r | |
641 | #define AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)\r | |
642 | #define PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication \r | |
643 | \r | |
644 | LED_A_ON();\r | |
645 | LED_C_OFF();\r | |
646 | \r | |
647 | if (initialize) {\r | |
648 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r | |
649 | clear_trace();\r | |
650 | set_tracing(true);\r | |
651 | }\r | |
652 | \r | |
653 | LED_C_ON();\r | |
654 | \r | |
655 | uint16_t num_nonces = 0;\r | |
656 | bool have_uid = false;\r | |
657 | for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {\r | |
658 | \r | |
659 | // Test if the action was cancelled\r | |
660 | if(BUTTON_PRESS()) {\r | |
661 | isOK = 2;\r | |
662 | field_off = true;\r | |
663 | break;\r | |
664 | }\r | |
665 | \r | |
666 | if (!have_uid) { // need a full select cycle to get the uid first\r | |
667 | iso14a_card_select_t card_info; \r | |
668 | if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {\r | |
669 | if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");\r | |
670 | continue;\r | |
671 | }\r | |
672 | switch (card_info.uidlen) {\r | |
673 | case 4 : cascade_levels = 1; break;\r | |
674 | case 7 : cascade_levels = 2; break;\r | |
675 | case 10: cascade_levels = 3; break;\r | |
676 | default: break;\r | |
677 | }\r | |
678 | have_uid = true; \r | |
679 | } else { // no need for anticollision. We can directly select the card\r | |
680 | if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {\r | |
681 | if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");\r | |
682 | continue;\r | |
683 | }\r | |
684 | }\r | |
685 | \r | |
686 | if (slow) {\r | |
687 | timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;\r | |
688 | while(GetCountSspClk() < timeout);\r | |
689 | }\r | |
690 | \r | |
691 | uint32_t nt1;\r | |
692 | if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {\r | |
693 | if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");\r | |
694 | continue;\r | |
695 | }\r | |
696 | \r | |
697 | // nested authentication\r | |
698 | uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);\r | |
699 | if (len != 4) {\r | |
700 | if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);\r | |
701 | continue;\r | |
702 | }\r | |
703 | \r | |
704 | // send a dummy byte as reader response in order to trigger the cards authentication timeout\r | |
705 | uint8_t dummy_answer = 0;\r | |
706 | ReaderTransmit(&dummy_answer, 1, NULL);\r | |
707 | timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;\r | |
708 | \r | |
709 | num_nonces++;\r | |
710 | if (num_nonces % 2) {\r | |
711 | memcpy(buf+i, receivedAnswer, 4);\r | |
712 | nt_par_enc = par_enc[0] & 0xf0;\r | |
713 | } else {\r | |
714 | nt_par_enc |= par_enc[0] >> 4;\r | |
715 | memcpy(buf+i+4, receivedAnswer, 4);\r | |
716 | memcpy(buf+i+8, &nt_par_enc, 1);\r | |
717 | i += 9;\r | |
718 | }\r | |
719 | \r | |
720 | // wait for the card to become ready again\r | |
721 | while(GetCountSspClk() < timeout);\r | |
722 | \r | |
723 | }\r | |
724 | \r | |
725 | LED_C_OFF();\r | |
726 | \r | |
727 | crypto1_destroy(pcs);\r | |
728 | \r | |
729 | LED_B_ON();\r | |
730 | cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));\r | |
731 | LED_B_OFF();\r | |
732 | \r | |
733 | if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");\r | |
734 | \r | |
735 | if (field_off) {\r | |
736 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
737 | LEDsoff();\r | |
738 | }\r | |
739 | }\r | |
740 | \r | |
741 | \r | |
8556b852 M |
742 | //-----------------------------------------------------------------------------\r |
743 | // MIFARE nested authentication. \r | |
744 | // \r | |
745 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 746 | void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r |
8556b852 M |
747 | {\r |
748 | // params\r | |
9492e0b0 | 749 | uint8_t blockNo = arg0 & 0xff;\r |
750 | uint8_t keyType = (arg0 >> 8) & 0xff;\r | |
751 | uint8_t targetBlockNo = arg1 & 0xff;\r | |
752 | uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r | |
8556b852 M |
753 | uint64_t ui64Key = 0;\r |
754 | \r | |
755 | ui64Key = bytes_to_num(datain, 6);\r | |
756 | \r | |
757 | // variables\r | |
9492e0b0 | 758 | uint16_t rtr, i, j, len;\r |
d798d31c | 759 | uint16_t davg = 0;\r |
9492e0b0 | 760 | static uint16_t dmin, dmax;\r |
d798d31c | 761 | uint8_t uid[10] = {0x00};\r |
5ebcb867 | 762 | uint32_t cuid = 0, nt1, nt2, nttmp, nttest, ks1;\r |
d798d31c | 763 | uint8_t par[1] = {0x00};\r |
764 | uint32_t target_nt[2] = {0x00}, target_ks[2] = {0x00};\r | |
9492e0b0 | 765 | \r |
d798d31c | 766 | uint8_t par_array[4] = {0x00};\r |
9492e0b0 | 767 | uint16_t ncount = 0;\r |
8556b852 M |
768 | struct Crypto1State mpcs = {0, 0};\r |
769 | struct Crypto1State *pcs;\r | |
770 | pcs = &mpcs;\r | |
5ebcb867 | 771 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r |
8556b852 | 772 | \r |
9492e0b0 | 773 | uint32_t auth1_time, auth2_time;\r |
774 | static uint16_t delta_time;\r | |
775 | \r | |
99cf19d9 | 776 | LED_A_ON();\r |
777 | LED_C_OFF();\r | |
778 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r | |
779 | \r | |
f71f4deb | 780 | // free eventually allocated BigBuf memory\r |
781 | BigBuf_free();\r | |
99cf19d9 | 782 | \r |
b10a759f | 783 | if (calibrate) clear_trace();\r |
784 | set_tracing(true);\r | |
8556b852 | 785 | \r |
9492e0b0 | 786 | // statistics on nonce distance\r |
c830303d | 787 | int16_t isOK = 0;\r |
788 | #define NESTED_MAX_TRIES 12\r | |
789 | uint16_t unsuccessfull_tries = 0;\r | |
9492e0b0 | 790 | if (calibrate) { // for first call only. Otherwise reuse previous calibration\r |
791 | LED_B_ON();\r | |
3fe4ff4f | 792 | WDT_HIT();\r |
8556b852 | 793 | \r |
9492e0b0 | 794 | davg = dmax = 0;\r |
795 | dmin = 2000;\r | |
796 | delta_time = 0;\r | |
8556b852 | 797 | \r |
9492e0b0 | 798 | for (rtr = 0; rtr < 17; rtr++) {\r |
8556b852 | 799 | \r |
c830303d | 800 | // Test if the action was cancelled\r |
801 | if(BUTTON_PRESS()) {\r | |
802 | isOK = -2;\r | |
803 | break;\r | |
804 | }\r | |
805 | \r | |
9492e0b0 | 806 | // prepare next select. No need to power down the card.\r |
807 | if(mifare_classic_halt(pcs, cuid)) {\r | |
808 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
809 | rtr--;\r | |
810 | continue;\r | |
811 | }\r | |
812 | \r | |
c188b1b9 | 813 | if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r |
9492e0b0 | 814 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r |
815 | rtr--;\r | |
816 | continue;\r | |
817 | };\r | |
818 | \r | |
819 | auth1_time = 0;\r | |
820 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
821 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
822 | rtr--;\r | |
823 | continue;\r | |
824 | };\r | |
825 | \r | |
826 | if (delta_time) {\r | |
827 | auth2_time = auth1_time + delta_time;\r | |
828 | } else {\r | |
829 | auth2_time = 0;\r | |
830 | }\r | |
831 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r | |
832 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r | |
833 | rtr--;\r | |
834 | continue;\r | |
835 | };\r | |
836 | \r | |
b19bd5d6 | 837 | nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r |
838 | for (i = 101; i < 1200; i++) {\r | |
9492e0b0 | 839 | nttmp = prng_successor(nttmp, 1);\r |
840 | if (nttmp == nt2) break;\r | |
841 | }\r | |
842 | \r | |
843 | if (i != 1200) {\r | |
844 | if (rtr != 0) {\r | |
845 | davg += i;\r | |
846 | dmin = MIN(dmin, i);\r | |
847 | dmax = MAX(dmax, i);\r | |
848 | }\r | |
849 | else {\r | |
850 | delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r | |
851 | }\r | |
852 | if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r | |
c830303d | 853 | } else {\r |
854 | unsuccessfull_tries++;\r | |
855 | if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)\r | |
856 | isOK = -3;\r | |
857 | }\r | |
9492e0b0 | 858 | }\r |
8556b852 | 859 | }\r |
8556b852 | 860 | \r |
9492e0b0 | 861 | davg = (davg + (rtr - 1)/2) / (rtr - 1);\r |
862 | \r | |
c830303d | 863 | if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);\r |
8556b852 | 864 | \r |
9492e0b0 | 865 | dmin = davg - 2;\r |
866 | dmax = davg + 2;\r | |
867 | \r | |
868 | LED_B_OFF();\r | |
9492e0b0 | 869 | }\r |
8556b852 M |
870 | // ------------------------------------------------------------------------------------------------- \r |
871 | \r | |
872 | LED_C_ON();\r | |
873 | \r | |
874 | // get crypted nonces for target sector\r | |
c830303d | 875 | for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r |
8556b852 | 876 | \r |
9492e0b0 | 877 | target_nt[i] = 0;\r |
878 | while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r | |
8556b852 | 879 | \r |
9492e0b0 | 880 | // prepare next select. No need to power down the card.\r |
881 | if(mifare_classic_halt(pcs, cuid)) {\r | |
882 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
883 | continue;\r | |
884 | }\r | |
8556b852 | 885 | \r |
c188b1b9 | 886 | if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r |
9492e0b0 | 887 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r |
888 | continue;\r | |
889 | };\r | |
8556b852 | 890 | \r |
9492e0b0 | 891 | auth1_time = 0;\r |
892 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
893 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
894 | continue;\r | |
895 | };\r | |
8556b852 | 896 | \r |
9492e0b0 | 897 | // nested authentication\r |
898 | auth2_time = auth1_time + delta_time;\r | |
2d2f7d19 | 899 | len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r |
9492e0b0 | 900 | if (len != 4) {\r |
901 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r | |
902 | continue;\r | |
903 | };\r | |
8556b852 | 904 | \r |
9492e0b0 | 905 | nt2 = bytes_to_num(receivedAnswer, 4); \r |
6a1f2d82 | 906 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r |
8556b852 | 907 | \r |
9492e0b0 | 908 | // Parity validity check\r |
909 | for (j = 0; j < 4; j++) {\r | |
f8ada309 | 910 | par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r |
9492e0b0 | 911 | }\r |
912 | \r | |
913 | ncount = 0;\r | |
914 | nttest = prng_successor(nt1, dmin - 1);\r | |
915 | for (j = dmin; j < dmax + 1; j++) {\r | |
916 | nttest = prng_successor(nttest, 1);\r | |
917 | ks1 = nt2 ^ nttest;\r | |
918 | \r | |
919 | if (valid_nonce(nttest, nt2, ks1, par_array)){\r | |
920 | if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r | |
921 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r | |
922 | target_nt[i] = 0;\r | |
923 | break;\r | |
924 | }\r | |
925 | target_nt[i] = nttest;\r | |
926 | target_ks[i] = ks1;\r | |
927 | ncount++;\r | |
928 | if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r | |
929 | target_nt[i] = 0;\r | |
930 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r | |
8556b852 M |
931 | break;\r |
932 | }\r | |
9492e0b0 | 933 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r |
8556b852 | 934 | }\r |
8556b852 | 935 | }\r |
9492e0b0 | 936 | if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r |
8556b852 M |
937 | }\r |
938 | }\r | |
939 | \r | |
940 | LED_C_OFF();\r | |
941 | \r | |
942 | // ----------------------------- crypto1 destroy\r | |
943 | crypto1_destroy(pcs);\r | |
944 | \r | |
9492e0b0 | 945 | byte_t buf[4 + 4 * 4];\r |
946 | memcpy(buf, &cuid, 4);\r | |
947 | memcpy(buf+4, &target_nt[0], 4);\r | |
948 | memcpy(buf+8, &target_ks[0], 4);\r | |
949 | memcpy(buf+12, &target_nt[1], 4);\r | |
950 | memcpy(buf+16, &target_ks[1], 4);\r | |
8556b852 M |
951 | \r |
952 | LED_B_ON();\r | |
c830303d | 953 | cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r |
6e82300d | 954 | LED_B_OFF();\r |
8556b852 | 955 | \r |
9492e0b0 | 956 | if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r |
8556b852 | 957 | \r |
8556b852 M |
958 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
959 | LEDsoff();\r | |
5ee53a0e | 960 | set_tracing(FALSE);\r |
8556b852 M |
961 | }\r |
962 | \r | |
963 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 964 | // MIFARE check keys. key count up to 85. \r |
8556b852 M |
965 | // \r |
966 | //-----------------------------------------------------------------------------\r | |
b10a759f | 967 | void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r |
8556b852 M |
968 | {\r |
969 | // params\r | |
b10a759f | 970 | uint8_t blockNo = arg0 & 0xff;\r |
971 | uint8_t keyType = (arg0 >> 8) & 0xff;\r | |
972 | bool clearTrace = arg1;\r | |
8556b852 M |
973 | uint8_t keyCount = arg2;\r |
974 | uint64_t ui64Key = 0;\r | |
975 | \r | |
976 | // variables\r | |
977 | int i;\r | |
978 | byte_t isOK = 0;\r | |
d798d31c | 979 | uint8_t uid[10] = {0x00};\r |
980 | uint32_t cuid = 0;\r | |
8556b852 M |
981 | struct Crypto1State mpcs = {0, 0};\r |
982 | struct Crypto1State *pcs;\r | |
983 | pcs = &mpcs;\r | |
984 | \r | |
985 | // clear debug level\r | |
986 | int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r | |
987 | MF_DBGLEVEL = MF_DBG_NONE;\r | |
988 | \r | |
8556b852 M |
989 | LED_A_ON();\r |
990 | LED_B_OFF();\r | |
991 | LED_C_OFF();\r | |
99cf19d9 | 992 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
993 | \r | |
810f5379 | 994 | if (clearTrace) \r |
995 | clear_trace();\r | |
996 | \r | |
99cf19d9 | 997 | set_tracing(TRUE);\r |
8556b852 | 998 | \r |
65c2d21d | 999 | for (i = 0; i < keyCount; ++i) {\r |
1000 | if (mifare_classic_halt(pcs, cuid))\r | |
9492e0b0 | 1001 | if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r |
8556b852 | 1002 | \r |
65c2d21d | 1003 | if (!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r |
9492e0b0 | 1004 | if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r |
8556b852 | 1005 | break;\r |
65c2d21d | 1006 | }\r |
8556b852 M |
1007 | \r |
1008 | ui64Key = bytes_to_num(datain + i * 6, 6);\r | |
65c2d21d | 1009 | if (mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST))\r |
8556b852 | 1010 | continue;\r |
8556b852 M |
1011 | \r |
1012 | isOK = 1;\r | |
1013 | break;\r | |
1014 | }\r | |
8556b852 M |
1015 | crypto1_destroy(pcs);\r |
1016 | \r | |
8556b852 | 1017 | LED_B_ON();\r |
6e82300d | 1018 | cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r |
8556b852 M |
1019 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1020 | LEDsoff();\r | |
5ee53a0e | 1021 | set_tracing(FALSE);\r |
1022 | \r | |
8556b852 M |
1023 | // restore debug level\r |
1024 | MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r | |
1025 | }\r | |
1026 | \r | |
1027 | //-----------------------------------------------------------------------------\r | |
1028 | // MIFARE commands set debug level\r | |
1029 | // \r | |
1030 | //-----------------------------------------------------------------------------\r | |
1031 | void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
1032 | MF_DBGLEVEL = arg0;\r | |
1033 | Dbprintf("Debug level: %d", MF_DBGLEVEL);\r | |
1034 | }\r | |
1035 | \r | |
1036 | //-----------------------------------------------------------------------------\r | |
1037 | // Work with emulator memory\r | |
1038 | // \r | |
99cf19d9 | 1039 | // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not\r |
1040 | // involved in dealing with emulator memory. But if it is called later, it might\r | |
1041 | // destroy the Emulator Memory.\r | |
8556b852 | 1042 | //-----------------------------------------------------------------------------\r |
99cf19d9 | 1043 | \r |
8556b852 | 1044 | void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r |
99cf19d9 | 1045 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r |
8556b852 M |
1046 | emlClearMem();\r |
1047 | }\r | |
1048 | \r | |
1049 | void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
99cf19d9 | 1050 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r |
9332b857 | 1051 | if (arg2==0) arg2 = 16; // backwards compat... default bytewidth\r |
0de8e387 | 1052 | emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width\r |
8556b852 M |
1053 | }\r |
1054 | \r | |
1055 | void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
99cf19d9 | 1056 | FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r |
d798d31c | 1057 | byte_t buf[USB_CMD_DATA_SIZE] = {0x00};\r |
baeaf579 | 1058 | emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r |
8556b852 M |
1059 | \r |
1060 | LED_B_ON();\r | |
3fe4ff4f | 1061 | cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r |
8556b852 M |
1062 | LED_B_OFF();\r |
1063 | }\r | |
1064 | \r | |
1065 | //-----------------------------------------------------------------------------\r | |
1066 | // Load a card into the emulator memory\r | |
1067 | // \r | |
1068 | //-----------------------------------------------------------------------------\r | |
1069 | void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
baeaf579 | 1070 | uint8_t numSectors = arg0;\r |
8556b852 M |
1071 | uint8_t keyType = arg1;\r |
1072 | uint64_t ui64Key = 0;\r | |
d798d31c | 1073 | uint32_t cuid = 0;\r |
8556b852 M |
1074 | struct Crypto1State mpcs = {0, 0};\r |
1075 | struct Crypto1State *pcs;\r | |
1076 | pcs = &mpcs;\r | |
1077 | \r | |
1078 | // variables\r | |
d798d31c | 1079 | byte_t dataoutbuf[16] = {0x00};\r |
1080 | byte_t dataoutbuf2[16] = {0x00};\r | |
1081 | uint8_t uid[10] = {0x00};\r | |
8556b852 | 1082 | \r |
8556b852 M |
1083 | LED_A_ON();\r |
1084 | LED_B_OFF();\r | |
1085 | LED_C_OFF();\r | |
99cf19d9 | 1086 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
1087 | \r | |
1088 | clear_trace();\r | |
5ee53a0e | 1089 | set_tracing(TRUE);\r |
8556b852 | 1090 | \r |
baeaf579 | 1091 | bool isOK = true;\r |
1092 | \r | |
c188b1b9 | 1093 | if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r |
baeaf579 | 1094 | isOK = false;\r |
1095 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
1096 | }\r | |
8556b852 | 1097 | \r |
baeaf579 | 1098 | for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r |
1099 | ui64Key = emlGetKey(sectorNo, keyType);\r | |
1100 | if (sectorNo == 0){\r | |
1101 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r | |
1102 | isOK = false;\r | |
1103 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r | |
8556b852 | 1104 | break;\r |
baeaf579 | 1105 | }\r |
1106 | } else {\r | |
1107 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r | |
1108 | isOK = false;\r | |
1109 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r | |
8556b852 | 1110 | break;\r |
baeaf579 | 1111 | }\r |
1112 | }\r | |
1113 | \r | |
1114 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
1115 | if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r | |
1116 | isOK = false;\r | |
1117 | if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r | |
ab8b654e | 1118 | break;\r |
d798d31c | 1119 | }\r |
baeaf579 | 1120 | if (isOK) {\r |
1121 | if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r | |
1122 | emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
1123 | } else { // sector trailer, keep the keys, set only the AC\r | |
1124 | emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
1125 | memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r | |
1126 | emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
1127 | }\r | |
1128 | }\r | |
8556b852 M |
1129 | }\r |
1130 | \r | |
baeaf579 | 1131 | }\r |
1132 | \r | |
d798d31c | 1133 | if(mifare_classic_halt(pcs, cuid))\r |
1134 | if (MF_DBGLEVEL >= 1)\r | |
1135 | Dbprintf("Halt error");\r | |
8556b852 M |
1136 | \r |
1137 | // ----------------------------- crypto1 destroy\r | |
1138 | crypto1_destroy(pcs);\r | |
ab8b654e M |
1139 | \r |
1140 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1141 | LEDsoff();\r | |
8556b852 M |
1142 | \r |
1143 | if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r | |
1144 | \r | |
5ee53a0e | 1145 | set_tracing(FALSE);\r |
8556b852 M |
1146 | }\r |
1147 | \r | |
0675f200 M |
1148 | \r |
1149 | //-----------------------------------------------------------------------------\r | |
1150 | // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r | |
1151 | // \r | |
c2731f37 | 1152 | // PARAMS - workFlags\r |
1153 | // bit 0 - need get UID\r | |
1154 | // bit 1 - need wupC\r | |
1155 | // bit 2 - need HALT after sequence\r | |
1156 | // bit 3 - need turn on FPGA before sequence\r | |
1157 | // bit 4 - need turn off FPGA\r | |
1158 | // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)\r | |
1159 | // bit 6 - wipe tag.\r | |
0675f200 | 1160 | //-----------------------------------------------------------------------------\r |
c2731f37 | 1161 | // magic uid card generation 1 commands\r |
1162 | uint8_t wupC1[] = { MIFARE_MAGICWUPC1 }; \r | |
1163 | uint8_t wupC2[] = { MIFARE_MAGICWUPC2 }; \r | |
1164 | uint8_t wipeC[] = { MIFARE_MAGICWIPEC }; \r | |
1165 | \r | |
1166 | void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){\r | |
0675f200 | 1167 | \r |
c2731f37 | 1168 | // params\r |
1169 | uint8_t workFlags = arg0;\r | |
1170 | uint8_t blockNo = arg1;\r | |
0675f200 | 1171 | \r |
0675f200 | 1172 | // variables\r |
6a18e46f | 1173 | bool isOK = false; //assume we will get an error\r |
1174 | uint8_t errormsg = 0x00;\r | |
3fe4ff4f | 1175 | uint8_t uid[10] = {0x00};\r |
c2731f37 | 1176 | uint8_t data[18] = {0x00};\r |
d798d31c | 1177 | uint32_t cuid = 0;\r |
0675f200 | 1178 | \r |
6a18e46f | 1179 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r |
1180 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};\r | |
6a1f2d82 | 1181 | \r |
c2731f37 | 1182 | if (workFlags & MAGIC_INIT) {\r |
208a0166 M |
1183 | LED_A_ON();\r |
1184 | LED_B_OFF();\r | |
99cf19d9 | 1185 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
3000dc4e MHS |
1186 | clear_trace();\r |
1187 | set_tracing(TRUE);\r | |
208a0166 | 1188 | }\r |
0675f200 | 1189 | \r |
6a18e46f | 1190 | //loop doesn't loop just breaks out if error\r |
1191 | while (true) {\r | |
1192 | // read UID and return to client with write\r | |
1193 | if (workFlags & MAGIC_UID) {\r | |
1194 | if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r | |
1195 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r | |
1196 | errormsg = MAGIC_UID;\r | |
1197 | // break;\r | |
1198 | }\r | |
1199 | \r | |
1200 | if ( mifare_classic_halt_ex(NULL) ) break;\r | |
9332b857 | 1201 | }\r |
0675f200 | 1202 | \r |
6a18e46f | 1203 | // wipe tag, fill it with zeros\r |
1204 | if (workFlags & MAGIC_WIPE){\r | |
1205 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r | |
1206 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1207 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");\r | |
1208 | errormsg = MAGIC_WIPE;\r | |
1209 | break;\r | |
1210 | }\r | |
0675f200 | 1211 | \r |
6a18e46f | 1212 | ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r |
1213 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1214 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wipeC error");\r | |
1215 | errormsg = MAGIC_WIPE;\r | |
1216 | break;\r | |
1217 | }\r | |
0675f200 | 1218 | \r |
6a18e46f | 1219 | if ( mifare_classic_halt_ex(NULL) ) break;\r |
1220 | } \r | |
0675f200 | 1221 | \r |
6a18e46f | 1222 | // write block\r |
1223 | if (workFlags & MAGIC_WUPC) {\r | |
1224 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r | |
1225 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1226 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");\r | |
1227 | errormsg = MAGIC_WUPC;\r | |
1228 | break;\r | |
1229 | }\r | |
1230 | \r | |
1231 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r | |
1232 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1233 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");\r | |
1234 | errormsg = MAGIC_WUPC;\r | |
1235 | break;\r | |
1236 | }\r | |
9332b857 | 1237 | }\r |
c2731f37 | 1238 | \r |
6a18e46f | 1239 | if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r |
1240 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send command error");\r | |
1241 | errormsg = 4;\r | |
1242 | break;\r | |
1243 | }\r | |
0675f200 | 1244 | \r |
6a18e46f | 1245 | memcpy(data, datain, 16);\r |
1246 | AppendCrc14443a(data, 16);\r | |
0675f200 | 1247 | \r |
6a18e46f | 1248 | ReaderTransmit(data, sizeof(data), NULL);\r |
1249 | if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r | |
1250 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send data error");\r | |
1251 | errormsg = 0;\r | |
1252 | break;\r | |
1253 | } \r | |
0675f200 | 1254 | \r |
6a18e46f | 1255 | if (workFlags & MAGIC_OFF) \r |
1256 | if ( mifare_classic_halt_ex(NULL) ) break;\r | |
1257 | \r | |
1258 | isOK = true;\r | |
1259 | break;\r | |
1260 | \r | |
1261 | } // end while \r | |
1262 | \r | |
1263 | if (isOK )\r | |
1264 | cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));\r | |
1265 | else\r | |
1266 | OnErrorMagic(errormsg);\r | |
0675f200 | 1267 | \r |
c2731f37 | 1268 | if (workFlags & MAGIC_OFF)\r |
1269 | OnSuccessMagic();\r | |
0675f200 | 1270 | }\r |
545a1f38 | 1271 | \r |
c2731f37 | 1272 | void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){\r |
1273 | \r | |
545a1f38 | 1274 | uint8_t workFlags = arg0;\r |
c2731f37 | 1275 | uint8_t blockNo = arg1;\r |
6a18e46f | 1276 | uint8_t errormsg = 0x00;\r |
1277 | bool isOK = false; //assume we will get an error\r | |
1278 | \r | |
545a1f38 | 1279 | // variables\r |
c2731f37 | 1280 | uint8_t data[MAX_MIFARE_FRAME_SIZE];\r |
6a18e46f | 1281 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r |
1282 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};\r | |
545a1f38 | 1283 | \r |
c2731f37 | 1284 | memset(data, 0x00, sizeof(data));\r |
1285 | \r | |
1286 | if (workFlags & MAGIC_INIT) {\r | |
545a1f38 M |
1287 | LED_A_ON();\r |
1288 | LED_B_OFF();\r | |
c2731f37 | 1289 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); \r |
3000dc4e MHS |
1290 | clear_trace();\r |
1291 | set_tracing(TRUE);\r | |
545a1f38 M |
1292 | }\r |
1293 | \r | |
6a18e46f | 1294 | //loop doesn't loop just breaks out if error or done\r |
1295 | while (true) {\r | |
1296 | if (workFlags & MAGIC_WUPC) {\r | |
1297 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r | |
1298 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1299 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");\r | |
1300 | errormsg = MAGIC_WUPC;\r | |
1301 | break;\r | |
1302 | }\r | |
545a1f38 | 1303 | \r |
6a18e46f | 1304 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r |
1305 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1306 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");\r | |
1307 | errormsg = MAGIC_WUPC;\r | |
1308 | break;\r | |
1309 | }\r | |
9332b857 | 1310 | }\r |
c2731f37 | 1311 | \r |
6a18e46f | 1312 | // read block \r |
1313 | if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r | |
1314 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");\r | |
1315 | errormsg = 0;\r | |
1316 | break;\r | |
1317 | }\r | |
1318 | \r | |
1319 | memcpy(data, receivedAnswer, sizeof(data));\r | |
1320 | \r | |
1321 | // send HALT\r | |
1322 | if (workFlags & MAGIC_HALT) {\r | |
1323 | mifare_classic_halt_ex(NULL);\r | |
1324 | break;\r | |
1325 | }\r | |
1326 | isOK = true;\r | |
1327 | break;\r | |
9332b857 | 1328 | }\r |
c2731f37 | 1329 | // if MAGIC_DATAIN, the data stays on device side.\r |
6a18e46f | 1330 | if (workFlags & MAGIC_DATAIN) {\r |
1331 | if (isOK)\r | |
1332 | memcpy(datain, data, sizeof(data));\r | |
1333 | } else {\r | |
1334 | if (isOK) \r | |
1335 | cmd_send(CMD_ACK,1,0,0,data,sizeof(data)); \r | |
1336 | else \r | |
1337 | OnErrorMagic(errormsg); \r | |
1338 | }\r | |
c2731f37 | 1339 | \r |
c2731f37 | 1340 | if (workFlags & MAGIC_OFF)\r |
1341 | OnSuccessMagic();\r | |
545a1f38 M |
1342 | }\r |
1343 | \r | |
3fe4ff4f | 1344 | void MifareCIdent(){\r |
3fe4ff4f | 1345 | \r |
1346 | // variables\r | |
9332b857 | 1347 | bool isOK = true; \r |
d798d31c | 1348 | uint8_t receivedAnswer[1] = {0x00};\r |
1349 | uint8_t receivedAnswerPar[1] = {0x00};\r | |
3fe4ff4f | 1350 | \r |
1351 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r | |
1352 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
9332b857 | 1353 | isOK = false;\r |
1354 | }\r | |
3fe4ff4f | 1355 | \r |
1356 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r | |
1357 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
9332b857 | 1358 | isOK = false;\r |
1359 | }\r | |
3fe4ff4f | 1360 | \r |
acd7ccdb | 1361 | // removed the if, since some magic tags misbehavies and send an answer to it.\r |
1362 | mifare_classic_halt(NULL, 0);\r | |
3fe4ff4f | 1363 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r |
1364 | }\r | |
1365 | \r | |
c2731f37 | 1366 | void OnSuccessMagic(){\r |
add0504d | 1367 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1368 | LEDsoff();\r | |
c2731f37 | 1369 | set_tracing(FALSE); \r |
1370 | }\r | |
1371 | void OnErrorMagic(uint8_t reason){\r | |
1372 | // ACK, ISOK, reason,0,0,0\r | |
1373 | cmd_send(CMD_ACK,0,reason,0,0,0);\r | |
1374 | OnSuccessMagic();\r | |
1375 | }\r | |
1376 | \r | |
1377 | void MifareCollectNonces(uint32_t arg0, uint32_t arg1){\r | |
add0504d | 1378 | }\r |
1379 | \r | |
1380 | //\r | |
3fe4ff4f | 1381 | // DESFIRE\r |
1382 | //\r | |
a631936e | 1383 | \r |
1384 | void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r | |
1385 | \r | |
4a71da5a | 1386 | byte_t dataout[12] = {0x00};\r |
a631936e | 1387 | uint8_t uid[10] = {0x00};\r |
d798d31c | 1388 | uint32_t cuid = 0;\r |
a631936e | 1389 | \r |
a631936e | 1390 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
99cf19d9 | 1391 | clear_trace();\r |
810f5379 | 1392 | set_tracing(true);\r |
a631936e | 1393 | \r |
c188b1b9 | 1394 | int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);\r |
a631936e | 1395 | if(!len) {\r |
aa60d156 | 1396 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r |
0ec548dc | 1397 | OnError(1);\r |
a631936e | 1398 | return;\r |
1399 | };\r | |
1400 | \r | |
1401 | if(mifare_desfire_des_auth1(cuid, dataout)){\r | |
aa60d156 | 1402 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r |
0ec548dc | 1403 | OnError(4);\r |
a631936e | 1404 | return;\r |
1405 | }\r | |
1406 | \r | |
1407 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r | |
a631936e | 1408 | cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r |
1409 | }\r | |
1410 | \r | |
1411 | void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r | |
1412 | \r | |
1413 | uint32_t cuid = arg0;\r | |
1414 | uint8_t key[16] = {0x00};\r | |
a631936e | 1415 | byte_t dataout[12] = {0x00};\r |
aa60d156 | 1416 | byte_t isOK = 0;\r |
a631936e | 1417 | \r |
1418 | memcpy(key, datain, 16);\r | |
1419 | \r | |
1420 | isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r | |
1421 | \r | |
1422 | if( isOK) {\r | |
aa60d156 | 1423 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed"); \r |
0ec548dc | 1424 | OnError(4);\r |
a631936e | 1425 | return;\r |
1426 | }\r | |
1427 | \r | |
aa60d156 | 1428 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");\r |
a631936e | 1429 | \r |
1430 | cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r | |
1431 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1432 | LEDsoff();\r | |
ce432659 | 1433 | } |