]>
Commit | Line | Data |
---|---|---|
8556b852 | 1 | //-----------------------------------------------------------------------------\r |
b62a5a84 | 2 | // Merlok - June 2011, 2012\r |
8556b852 M |
3 | // Gerhard de Koning Gans - May 2008\r |
4 | // Hagen Fritsch - June 2010\r | |
3fe4ff4f | 5 | // Midnitesnake - Dec 2013\r |
6 | // Andy Davies - Apr 2014\r | |
7 | // Iceman - May 2014\r | |
8556b852 M |
8 | //\r |
9 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
10 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
11 | // the license.\r | |
12 | //-----------------------------------------------------------------------------\r | |
13 | // Routines to support ISO 14443 type A.\r | |
14 | //-----------------------------------------------------------------------------\r | |
15 | \r | |
16 | #include "mifarecmd.h"\r | |
17 | #include "apps.h"\r | |
787b5bd8 | 18 | #include "util.h"\r |
0ec548dc | 19 | //#include "../client/loclass/des.h"\r |
20 | #include "des.h"\r | |
a631936e | 21 | #include "crc.h"\r |
22 | \r | |
8556b852 | 23 | //-----------------------------------------------------------------------------\r |
baeaf579 | 24 | // Select, Authenticate, Read a MIFARE tag. \r |
8556b852 M |
25 | // read block\r |
26 | //-----------------------------------------------------------------------------\r | |
27 | void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
28 | {\r | |
29 | // params\r | |
30 | uint8_t blockNo = arg0;\r | |
31 | uint8_t keyType = arg1;\r | |
32 | uint64_t ui64Key = 0;\r | |
33 | ui64Key = bytes_to_num(datain, 6);\r | |
34 | \r | |
35 | // variables\r | |
36 | byte_t isOK = 0;\r | |
37 | byte_t dataoutbuf[16];\r | |
1c611bbd | 38 | uint8_t uid[10];\r |
8556b852 M |
39 | uint32_t cuid;\r |
40 | struct Crypto1State mpcs = {0, 0};\r | |
41 | struct Crypto1State *pcs;\r | |
42 | pcs = &mpcs;\r | |
43 | \r | |
44 | // clear trace\r | |
3000dc4e | 45 | clear_trace();\r |
7bc95e2e | 46 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
47 | \r |
48 | LED_A_ON();\r | |
49 | LED_B_OFF();\r | |
50 | LED_C_OFF();\r | |
51 | \r | |
52 | while (true) {\r | |
53 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
baeaf579 | 54 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
8556b852 M |
55 | break;\r |
56 | };\r | |
57 | \r | |
58 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
baeaf579 | 59 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
8556b852 M |
60 | break;\r |
61 | };\r | |
62 | \r | |
63 | if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r | |
baeaf579 | 64 | if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r |
8556b852 M |
65 | break;\r |
66 | };\r | |
67 | \r | |
68 | if(mifare_classic_halt(pcs, cuid)) {\r | |
baeaf579 | 69 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 M |
70 | break;\r |
71 | };\r | |
72 | \r | |
73 | isOK = 1;\r | |
74 | break;\r | |
75 | }\r | |
76 | \r | |
77 | // ----------------------------- crypto1 destroy\r | |
78 | crypto1_destroy(pcs);\r | |
79 | \r | |
80 | if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r | |
81 | \r | |
8556b852 | 82 | LED_B_ON();\r |
baeaf579 | 83 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r |
8556b852 M |
84 | LED_B_OFF();\r |
85 | \r | |
a631936e | 86 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
87 | LEDsoff();\r | |
88 | }\r | |
89 | \r | |
90 | \r | |
91 | void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){\r | |
92 | \r | |
93 | byte_t isOK = 0;\r | |
94 | byte_t dataoutbuf[16] = {0x00};\r | |
95 | uint8_t uid[10] = {0x00};\r | |
96 | uint32_t cuid;\r | |
97 | \r | |
98 | LED_A_ON();\r | |
99 | LED_B_OFF();\r | |
100 | LED_C_OFF();\r | |
101 | \r | |
3000dc4e | 102 | clear_trace();\r |
a631936e | 103 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
104 | \r | |
105 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
106 | if (MF_DBGLEVEL >= MF_DBG_ERROR)\r | |
107 | Dbprintf("Can't select card");\r | |
0ec548dc | 108 | OnError(0);\r |
a631936e | 109 | return;\r |
110 | };\r | |
111 | \r | |
112 | if(mifare_ultra_auth1(cuid, dataoutbuf)){\r | |
113 | if (MF_DBGLEVEL >= MF_DBG_ERROR) \r | |
114 | Dbprintf("Authentication part1: Fail.");\r | |
0ec548dc | 115 | OnError(1);\r |
a631936e | 116 | return;\r |
117 | }\r | |
118 | \r | |
119 | isOK = 1;\r | |
120 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED)\r | |
121 | DbpString("AUTH 1 FINISHED");\r | |
122 | \r | |
123 | cmd_send(CMD_ACK,isOK,cuid,0,dataoutbuf,11);\r | |
124 | LEDsoff();\r | |
125 | }\r | |
126 | void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){\r | |
127 | \r | |
128 | uint32_t cuid = arg0;\r | |
129 | uint8_t key[16] = {0x00};\r | |
130 | byte_t isOK = 0;\r | |
131 | byte_t dataoutbuf[16] = {0x00};\r | |
132 | \r | |
133 | memcpy(key, datain, 16);\r | |
134 | \r | |
135 | LED_A_ON();\r | |
136 | LED_B_OFF();\r | |
137 | LED_C_OFF();\r | |
138 | \r | |
139 | if(mifare_ultra_auth2(cuid, key, dataoutbuf)){\r | |
140 | if (MF_DBGLEVEL >= MF_DBG_ERROR) \r | |
141 | Dbprintf("Authentication part2: Fail...");\r | |
0ec548dc | 142 | OnError(1);\r |
a631936e | 143 | return; \r |
144 | }\r | |
145 | \r | |
146 | isOK = 1;\r | |
147 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED)\r | |
148 | DbpString("AUTH 2 FINISHED");\r | |
149 | \r | |
150 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);\r | |
8556b852 M |
151 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
152 | LEDsoff();\r | |
7cc204bf | 153 | }\r |
154 | \r | |
0ec548dc | 155 | void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r |
7cc204bf | 156 | {\r |
7cc204bf | 157 | uint8_t blockNo = arg0;\r |
787b5bd8 | 158 | byte_t dataout[16] = {0x00};\r |
159 | uint8_t uid[10] = {0x00};\r | |
0ec548dc | 160 | uint8_t key[8] = {0x00};\r |
7cc204bf | 161 | uint32_t cuid;\r |
0ec548dc | 162 | bool usePwd = false;\r |
163 | \r | |
164 | usePwd = (arg1 == 1);\r | |
165 | \r | |
166 | // use password\r | |
167 | if ( usePwd )\r | |
168 | memcpy(key, datain, 8);\r | |
169 | \r | |
7cc204bf | 170 | LED_A_ON();\r |
171 | LED_B_OFF();\r | |
172 | LED_C_OFF();\r | |
173 | \r | |
3000dc4e | 174 | clear_trace();\r |
787b5bd8 | 175 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
176 | \r | |
177 | int len = iso14443a_select_card(uid, NULL, &cuid);\r | |
178 | if(!len) {\r | |
0ec548dc | 179 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r |
180 | OnError(1);\r | |
787b5bd8 | 181 | return;\r |
7cc204bf | 182 | };\r |
0ec548dc | 183 | \r |
184 | // authenticate here.\r | |
185 | if ( usePwd ) {\r | |
186 | \r | |
187 | uint8_t a[8] = { 0x01 };\r | |
188 | uint8_t b[8] = { 0x00 };\r | |
189 | uint8_t enc_b[8] = { 0x00 };\r | |
190 | uint8_t ab[16] = { 0x00 };\r | |
191 | \r | |
192 | uint8_t transKey[8] = { 0x00 };\r | |
193 | \r | |
194 | uint16_t len;\r | |
195 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r | |
196 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
197 | \r | |
198 | len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r | |
199 | if (len == 1) {\r | |
200 | if (MF_DBGLEVEL >= MF_DBG_ERROR)\r | |
201 | Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r | |
202 | OnError(1);\r | |
203 | return;\r | |
204 | }\r | |
205 | \r | |
206 | // memcpy(dataout, receivedAnswer, 11);\r | |
207 | \r | |
208 | // tag nonce.\r | |
209 | memcpy(enc_b,receivedAnswer+1,8);\r | |
210 | \r | |
211 | // decrypt nonce.\r | |
212 | des_dec(enc_b, b, key );\r | |
213 | \r | |
214 | Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x", enc_b[0],enc_b[1],enc_b[2],enc_b[3],enc_b[4],enc_b[5],enc_b[6],enc_b[7] );\r | |
215 | \r | |
216 | rol(b,8);\r | |
217 | \r | |
218 | memcpy(ab ,a,8);\r | |
219 | memcpy(ab+8,b,8);\r | |
220 | \r | |
221 | Dbprintf("AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[0],ab[1],ab[2],ab[3],ab[4],ab[5],ab[6],ab[7] );\r | |
222 | Dbprintf("AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[8],ab[9],ab[10],ab[11],ab[12],ab[13],ab[14],ab[15] );\r | |
223 | \r | |
224 | // encrypt\r | |
225 | des_enc(ab, ab, key);\r | |
226 | \r | |
227 | Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[0],ab[1],ab[2],ab[3],ab[4],ab[5],ab[6],ab[7] );\r | |
228 | Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[8],ab[9],ab[10],ab[11],ab[12],ab[13],ab[14],ab[15] );\r | |
229 | \r | |
230 | len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, ab, receivedAnswer, receivedAnswerPar, NULL);\r | |
231 | if (len == 1) {\r | |
232 | if (MF_DBGLEVEL >= MF_DBG_ERROR)\r | |
233 | Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r | |
234 | OnError(1);\r | |
235 | return;\r | |
236 | }\r | |
237 | \r | |
238 | // \r | |
239 | memcpy(transKey, receivedAnswer+1, 8);\r | |
240 | Dbprintf("TRANSACTIONKEY: %02x %02x %02x %02x %02x %02x %02x %02x", transKey[0],transKey[1],transKey[2],transKey[3],\r | |
241 | transKey[4],transKey[5],transKey[6],transKey[7] );\r | |
242 | }\r | |
243 | \r | |
787b5bd8 | 244 | len = mifare_ultra_readblock(cuid, blockNo, dataout);\r |
245 | if(len) {\r | |
246 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r | |
0ec548dc | 247 | OnError(2);\r |
787b5bd8 | 248 | return;\r |
7cc204bf | 249 | };\r |
250 | \r | |
787b5bd8 | 251 | len = mifare_ultra_halt(cuid);\r |
252 | if(len) {\r | |
253 | if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r | |
0ec548dc | 254 | OnError(3);\r |
787b5bd8 | 255 | return;\r |
7cc204bf | 256 | };\r |
257 | \r | |
787b5bd8 | 258 | cmd_send(CMD_ACK,1,0,0,dataout,16);\r |
7cc204bf | 259 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
260 | LEDsoff();\r | |
261 | }\r | |
262 | \r | |
263 | //-----------------------------------------------------------------------------\r | |
baeaf579 | 264 | // Select, Authenticate, Read a MIFARE tag. \r |
265 | // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r | |
8556b852 M |
266 | //-----------------------------------------------------------------------------\r |
267 | void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
268 | {\r | |
269 | // params\r | |
270 | uint8_t sectorNo = arg0;\r | |
271 | uint8_t keyType = arg1;\r | |
272 | uint64_t ui64Key = 0;\r | |
273 | ui64Key = bytes_to_num(datain, 6);\r | |
274 | \r | |
275 | // variables\r | |
3fe4ff4f | 276 | byte_t isOK = 0;\r |
baeaf579 | 277 | byte_t dataoutbuf[16 * 16];\r |
1c611bbd | 278 | uint8_t uid[10];\r |
8556b852 M |
279 | uint32_t cuid;\r |
280 | struct Crypto1State mpcs = {0, 0};\r | |
281 | struct Crypto1State *pcs;\r | |
282 | pcs = &mpcs;\r | |
283 | \r | |
284 | // clear trace\r | |
3000dc4e | 285 | clear_trace();\r |
8556b852 | 286 | \r |
7bc95e2e | 287 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
288 | \r |
289 | LED_A_ON();\r | |
290 | LED_B_OFF();\r | |
291 | LED_C_OFF();\r | |
292 | \r | |
baeaf579 | 293 | isOK = 1;\r |
294 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
295 | isOK = 0;\r | |
8556b852 | 296 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r |
baeaf579 | 297 | }\r |
8556b852 | 298 | \r |
baeaf579 | 299 | \r |
300 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r | |
301 | isOK = 0;\r | |
8556b852 | 302 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r |
baeaf579 | 303 | }\r |
304 | \r | |
305 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
306 | if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r | |
307 | isOK = 0;\r | |
308 | if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r | |
8556b852 | 309 | break;\r |
baeaf579 | 310 | }\r |
311 | }\r | |
8556b852 | 312 | \r |
baeaf579 | 313 | if(mifare_classic_halt(pcs, cuid)) {\r |
8556b852 | 314 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r |
8556b852 | 315 | }\r |
baeaf579 | 316 | \r |
8556b852 M |
317 | // ----------------------------- crypto1 destroy\r |
318 | crypto1_destroy(pcs);\r | |
319 | \r | |
320 | if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r | |
321 | \r | |
8556b852 | 322 | LED_B_ON();\r |
baeaf579 | 323 | cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r |
6e82300d | 324 | LED_B_OFF();\r |
8556b852 M |
325 | \r |
326 | // Thats it...\r | |
327 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
328 | LEDsoff();\r | |
7cc204bf | 329 | }\r |
330 | \r | |
787b5bd8 | 331 | void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)\r |
7cc204bf | 332 | {\r |
0ec548dc | 333 | // params\r |
334 | uint8_t sectorNo = arg0;\r | |
787b5bd8 | 335 | int Pages = arg1;\r |
336 | int count_Pages = 0;\r | |
337 | byte_t dataout[176] = {0x00};;\r | |
338 | uint8_t uid[10] = {0x00};\r | |
31d1caa5 | 339 | uint32_t cuid;\r |
7cc204bf | 340 | \r |
31d1caa5 MHS |
341 | LED_A_ON();\r |
342 | LED_B_OFF();\r | |
343 | LED_C_OFF();\r | |
7cc204bf | 344 | \r |
787b5bd8 | 345 | if (MF_DBGLEVEL >= MF_DBG_ALL) \r |
346 | Dbprintf("Pages %d",Pages);\r | |
347 | \r | |
3000dc4e | 348 | clear_trace();\r |
787b5bd8 | 349 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 350 | \r |
787b5bd8 | 351 | int len = iso14443a_select_card(uid, NULL, &cuid);\r |
352 | \r | |
353 | if (!len) {\r | |
354 | if (MF_DBGLEVEL >= MF_DBG_ERROR)\r | |
0ec548dc | 355 | Dbprintf("Can't select card (RC:%d)",len);\r |
356 | OnError(1);\r | |
787b5bd8 | 357 | return;\r |
358 | }\r | |
359 | \r | |
360 | for (int i = 0; i < Pages; i++){\r | |
361 | \r | |
362 | len = mifare_ultra_readblock(cuid, sectorNo * 4 + i, dataout + 4 * i);\r | |
363 | \r | |
364 | if (len) {\r | |
365 | if (MF_DBGLEVEL >= MF_DBG_ERROR)\r | |
366 | Dbprintf("Read block %d error",i);\r | |
0ec548dc | 367 | OnError(2);\r |
787b5bd8 | 368 | return;\r |
369 | } else {\r | |
370 | count_Pages++;\r | |
371 | }\r | |
372 | }\r | |
373 | \r | |
374 | len = mifare_ultra_halt(cuid);\r | |
375 | if (len) {\r | |
376 | if (MF_DBGLEVEL >= MF_DBG_ERROR)\r | |
377 | Dbprintf("Halt error");\r | |
0ec548dc | 378 | OnError(3);\r |
787b5bd8 | 379 | return;\r |
380 | }\r | |
381 | \r | |
382 | if (MF_DBGLEVEL >= MF_DBG_ALL) {\r | |
383 | Dbprintf("Pages read %d", count_Pages);\r | |
384 | }\r | |
7cc204bf | 385 | \r |
787b5bd8 | 386 | len = 16*4; //64 bytes\r |
387 | \r | |
388 | // Read a UL-C\r | |
389 | if (Pages == 44 && count_Pages > 16) \r | |
390 | len = 176;\r | |
7cc204bf | 391 | \r |
787b5bd8 | 392 | cmd_send(CMD_ACK, 1, 0, 0, dataout, len); \r |
31d1caa5 MHS |
393 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
394 | LEDsoff();\r | |
7cc204bf | 395 | }\r |
396 | \r | |
397 | \r | |
398 | //-----------------------------------------------------------------------------\r | |
baeaf579 | 399 | // Select, Authenticate, Write a MIFARE tag. \r |
7cc204bf | 400 | // read block\r |
8556b852 M |
401 | //-----------------------------------------------------------------------------\r |
402 | void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
403 | {\r | |
404 | // params\r | |
405 | uint8_t blockNo = arg0;\r | |
406 | uint8_t keyType = arg1;\r | |
407 | uint64_t ui64Key = 0;\r | |
408 | byte_t blockdata[16];\r | |
409 | \r | |
410 | ui64Key = bytes_to_num(datain, 6);\r | |
411 | memcpy(blockdata, datain + 10, 16);\r | |
412 | \r | |
413 | // variables\r | |
414 | byte_t isOK = 0;\r | |
1c611bbd | 415 | uint8_t uid[10];\r |
8556b852 M |
416 | uint32_t cuid;\r |
417 | struct Crypto1State mpcs = {0, 0};\r | |
418 | struct Crypto1State *pcs;\r | |
419 | pcs = &mpcs;\r | |
420 | \r | |
421 | // clear trace\r | |
3000dc4e | 422 | clear_trace();\r |
8556b852 | 423 | \r |
7bc95e2e | 424 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
425 | \r |
426 | LED_A_ON();\r | |
427 | LED_B_OFF();\r | |
428 | LED_C_OFF();\r | |
429 | \r | |
430 | while (true) {\r | |
431 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
432 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
433 | break;\r | |
434 | };\r | |
435 | \r | |
436 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
437 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r | |
438 | break;\r | |
439 | };\r | |
440 | \r | |
441 | if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r | |
442 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
443 | break;\r | |
444 | };\r | |
445 | \r | |
446 | if(mifare_classic_halt(pcs, cuid)) {\r | |
447 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
448 | break;\r | |
449 | };\r | |
450 | \r | |
451 | isOK = 1;\r | |
452 | break;\r | |
453 | }\r | |
454 | \r | |
455 | // ----------------------------- crypto1 destroy\r | |
456 | crypto1_destroy(pcs);\r | |
457 | \r | |
458 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
459 | \r | |
8556b852 | 460 | LED_B_ON();\r |
9492e0b0 | 461 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r |
6e82300d | 462 | LED_B_OFF();\r |
8556b852 M |
463 | \r |
464 | \r | |
465 | // Thats it...\r | |
466 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
467 | LEDsoff();\r | |
7cc204bf | 468 | }\r |
469 | \r | |
470 | void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)\r | |
471 | {\r | |
472 | // params\r | |
473 | uint8_t blockNo = arg0;\r | |
787b5bd8 | 474 | byte_t blockdata[16] = {0x00};\r |
7cc204bf | 475 | \r |
7cc204bf | 476 | memcpy(blockdata, datain,16);\r |
477 | \r | |
478 | // variables\r | |
479 | byte_t isOK = 0;\r | |
787b5bd8 | 480 | uint8_t uid[10] = {0x00};\r |
7cc204bf | 481 | uint32_t cuid;\r |
482 | \r | |
3000dc4e | 483 | clear_trace();\r |
7bc95e2e | 484 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 485 | \r |
486 | LED_A_ON();\r | |
487 | LED_B_OFF();\r | |
488 | LED_C_OFF();\r | |
489 | \r | |
490 | while (true) {\r | |
491 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
492 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
493 | break;\r | |
494 | };\r | |
495 | \r | |
496 | if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {\r | |
497 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
498 | break;\r | |
499 | };\r | |
500 | \r | |
501 | if(mifare_ultra_halt(cuid)) {\r | |
502 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
503 | break;\r | |
504 | };\r | |
505 | \r | |
506 | isOK = 1;\r | |
507 | break;\r | |
508 | }\r | |
509 | \r | |
510 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r | |
511 | \r | |
baeaf579 | 512 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r |
7cc204bf | 513 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
514 | LEDsoff();\r | |
7cc204bf | 515 | }\r |
516 | \r | |
517 | void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)\r | |
518 | {\r | |
baeaf579 | 519 | // params\r |
520 | uint8_t blockNo = arg0;\r | |
787b5bd8 | 521 | byte_t blockdata[4] = {0x00};\r |
baeaf579 | 522 | \r |
7cc204bf | 523 | memcpy(blockdata, datain,4);\r |
524 | \r | |
baeaf579 | 525 | // variables\r |
526 | byte_t isOK = 0;\r | |
787b5bd8 | 527 | uint8_t uid[10] = {0x00};\r |
baeaf579 | 528 | uint32_t cuid;\r |
7cc204bf | 529 | \r |
3000dc4e | 530 | clear_trace();\r |
baeaf579 | 531 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
7cc204bf | 532 | \r |
baeaf579 | 533 | LED_A_ON();\r |
534 | LED_B_OFF();\r | |
535 | LED_C_OFF();\r | |
7cc204bf | 536 | \r |
baeaf579 | 537 | while (true) {\r |
538 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
539 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
540 | break;\r | |
541 | };\r | |
7cc204bf | 542 | \r |
baeaf579 | 543 | if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {\r |
544 | if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r | |
545 | break;\r | |
546 | };\r | |
7cc204bf | 547 | \r |
baeaf579 | 548 | if(mifare_ultra_halt(cuid)) {\r |
549 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
550 | break;\r | |
551 | };\r | |
7cc204bf | 552 | \r |
baeaf579 | 553 | isOK = 1;\r |
554 | break;\r | |
555 | }\r | |
7cc204bf | 556 | \r |
baeaf579 | 557 | if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r |
7cc204bf | 558 | \r |
baeaf579 | 559 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r |
baeaf579 | 560 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
561 | LEDsoff();\r | |
7cc204bf | 562 | }\r |
563 | \r | |
564 | // Return 1 if the nonce is invalid else return 0\r | |
6a1f2d82 | 565 | int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r |
7cc204bf | 566 | return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r |
8556b852 M |
567 | (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r |
568 | (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r | |
569 | }\r | |
570 | \r | |
9492e0b0 | 571 | \r |
8556b852 M |
572 | //-----------------------------------------------------------------------------\r |
573 | // MIFARE nested authentication. \r | |
574 | // \r | |
575 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 576 | void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r |
8556b852 M |
577 | {\r |
578 | // params\r | |
9492e0b0 | 579 | uint8_t blockNo = arg0 & 0xff;\r |
580 | uint8_t keyType = (arg0 >> 8) & 0xff;\r | |
581 | uint8_t targetBlockNo = arg1 & 0xff;\r | |
582 | uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r | |
8556b852 M |
583 | uint64_t ui64Key = 0;\r |
584 | \r | |
585 | ui64Key = bytes_to_num(datain, 6);\r | |
586 | \r | |
587 | // variables\r | |
9492e0b0 | 588 | uint16_t rtr, i, j, len;\r |
589 | uint16_t davg;\r | |
590 | static uint16_t dmin, dmax;\r | |
1c611bbd | 591 | uint8_t uid[10];\r |
6a1f2d82 | 592 | uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r |
593 | uint8_t par[1];\r | |
9492e0b0 | 594 | uint32_t target_nt[2], target_ks[2];\r |
595 | \r | |
8556b852 | 596 | uint8_t par_array[4];\r |
9492e0b0 | 597 | uint16_t ncount = 0;\r |
8556b852 M |
598 | struct Crypto1State mpcs = {0, 0};\r |
599 | struct Crypto1State *pcs;\r | |
600 | pcs = &mpcs;\r | |
f71f4deb | 601 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
8556b852 | 602 | \r |
9492e0b0 | 603 | uint32_t auth1_time, auth2_time;\r |
604 | static uint16_t delta_time;\r | |
605 | \r | |
f71f4deb | 606 | // free eventually allocated BigBuf memory\r |
607 | BigBuf_free();\r | |
8556b852 | 608 | // clear trace\r |
3000dc4e MHS |
609 | clear_trace();\r |
610 | set_tracing(false);\r | |
8556b852 | 611 | \r |
7bc95e2e | 612 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
613 | \r |
614 | LED_A_ON();\r | |
8556b852 M |
615 | LED_C_OFF();\r |
616 | \r | |
8556b852 | 617 | \r |
9492e0b0 | 618 | // statistics on nonce distance\r |
619 | if (calibrate) { // for first call only. Otherwise reuse previous calibration\r | |
620 | LED_B_ON();\r | |
3fe4ff4f | 621 | WDT_HIT();\r |
8556b852 | 622 | \r |
9492e0b0 | 623 | davg = dmax = 0;\r |
624 | dmin = 2000;\r | |
625 | delta_time = 0;\r | |
8556b852 | 626 | \r |
9492e0b0 | 627 | for (rtr = 0; rtr < 17; rtr++) {\r |
8556b852 | 628 | \r |
9492e0b0 | 629 | // prepare next select. No need to power down the card.\r |
630 | if(mifare_classic_halt(pcs, cuid)) {\r | |
631 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
632 | rtr--;\r | |
633 | continue;\r | |
634 | }\r | |
635 | \r | |
636 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
637 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r | |
638 | rtr--;\r | |
639 | continue;\r | |
640 | };\r | |
641 | \r | |
642 | auth1_time = 0;\r | |
643 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
644 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
645 | rtr--;\r | |
646 | continue;\r | |
647 | };\r | |
648 | \r | |
649 | if (delta_time) {\r | |
650 | auth2_time = auth1_time + delta_time;\r | |
651 | } else {\r | |
652 | auth2_time = 0;\r | |
653 | }\r | |
654 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r | |
655 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r | |
656 | rtr--;\r | |
657 | continue;\r | |
658 | };\r | |
659 | \r | |
b19bd5d6 | 660 | nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r |
661 | for (i = 101; i < 1200; i++) {\r | |
9492e0b0 | 662 | nttmp = prng_successor(nttmp, 1);\r |
663 | if (nttmp == nt2) break;\r | |
664 | }\r | |
665 | \r | |
666 | if (i != 1200) {\r | |
667 | if (rtr != 0) {\r | |
668 | davg += i;\r | |
669 | dmin = MIN(dmin, i);\r | |
670 | dmax = MAX(dmax, i);\r | |
671 | }\r | |
672 | else {\r | |
673 | delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r | |
674 | }\r | |
675 | if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r | |
676 | }\r | |
8556b852 M |
677 | }\r |
678 | \r | |
9492e0b0 | 679 | if (rtr <= 1) return;\r |
8556b852 | 680 | \r |
9492e0b0 | 681 | davg = (davg + (rtr - 1)/2) / (rtr - 1);\r |
682 | \r | |
683 | if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);\r | |
8556b852 | 684 | \r |
9492e0b0 | 685 | dmin = davg - 2;\r |
686 | dmax = davg + 2;\r | |
687 | \r | |
688 | LED_B_OFF();\r | |
689 | \r | |
690 | }\r | |
8556b852 M |
691 | // ------------------------------------------------------------------------------------------------- \r |
692 | \r | |
693 | LED_C_ON();\r | |
694 | \r | |
695 | // get crypted nonces for target sector\r | |
9492e0b0 | 696 | for(i=0; i < 2; i++) { // look for exactly two different nonces\r |
8556b852 | 697 | \r |
9492e0b0 | 698 | target_nt[i] = 0;\r |
699 | while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r | |
8556b852 | 700 | \r |
9492e0b0 | 701 | // prepare next select. No need to power down the card.\r |
702 | if(mifare_classic_halt(pcs, cuid)) {\r | |
703 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r | |
704 | continue;\r | |
705 | }\r | |
8556b852 | 706 | \r |
9492e0b0 | 707 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r |
708 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r | |
709 | continue;\r | |
710 | };\r | |
8556b852 | 711 | \r |
9492e0b0 | 712 | auth1_time = 0;\r |
713 | if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r | |
714 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r | |
715 | continue;\r | |
716 | };\r | |
8556b852 | 717 | \r |
9492e0b0 | 718 | // nested authentication\r |
719 | auth2_time = auth1_time + delta_time;\r | |
6a1f2d82 | 720 | len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r |
9492e0b0 | 721 | if (len != 4) {\r |
722 | if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r | |
723 | continue;\r | |
724 | };\r | |
8556b852 | 725 | \r |
9492e0b0 | 726 | nt2 = bytes_to_num(receivedAnswer, 4); \r |
6a1f2d82 | 727 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r |
8556b852 | 728 | \r |
9492e0b0 | 729 | // Parity validity check\r |
730 | for (j = 0; j < 4; j++) {\r | |
6a1f2d82 | 731 | par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r |
9492e0b0 | 732 | }\r |
733 | \r | |
734 | ncount = 0;\r | |
735 | nttest = prng_successor(nt1, dmin - 1);\r | |
736 | for (j = dmin; j < dmax + 1; j++) {\r | |
737 | nttest = prng_successor(nttest, 1);\r | |
738 | ks1 = nt2 ^ nttest;\r | |
739 | \r | |
740 | if (valid_nonce(nttest, nt2, ks1, par_array)){\r | |
741 | if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r | |
742 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r | |
743 | target_nt[i] = 0;\r | |
744 | break;\r | |
745 | }\r | |
746 | target_nt[i] = nttest;\r | |
747 | target_ks[i] = ks1;\r | |
748 | ncount++;\r | |
749 | if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r | |
750 | target_nt[i] = 0;\r | |
751 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r | |
8556b852 M |
752 | break;\r |
753 | }\r | |
9492e0b0 | 754 | if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r |
8556b852 | 755 | }\r |
8556b852 | 756 | }\r |
9492e0b0 | 757 | if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r |
8556b852 M |
758 | }\r |
759 | }\r | |
760 | \r | |
761 | LED_C_OFF();\r | |
762 | \r | |
763 | // ----------------------------- crypto1 destroy\r | |
764 | crypto1_destroy(pcs);\r | |
765 | \r | |
9492e0b0 | 766 | byte_t buf[4 + 4 * 4];\r |
767 | memcpy(buf, &cuid, 4);\r | |
768 | memcpy(buf+4, &target_nt[0], 4);\r | |
769 | memcpy(buf+8, &target_ks[0], 4);\r | |
770 | memcpy(buf+12, &target_nt[1], 4);\r | |
771 | memcpy(buf+16, &target_ks[1], 4);\r | |
8556b852 M |
772 | \r |
773 | LED_B_ON();\r | |
9492e0b0 | 774 | cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r |
6e82300d | 775 | LED_B_OFF();\r |
8556b852 | 776 | \r |
9492e0b0 | 777 | if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r |
8556b852 | 778 | \r |
8556b852 M |
779 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
780 | LEDsoff();\r | |
3000dc4e | 781 | set_tracing(TRUE);\r |
8556b852 M |
782 | }\r |
783 | \r | |
784 | //-----------------------------------------------------------------------------\r | |
9492e0b0 | 785 | // MIFARE check keys. key count up to 85. \r |
8556b852 M |
786 | // \r |
787 | //-----------------------------------------------------------------------------\r | |
788 | void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r | |
789 | {\r | |
790 | // params\r | |
791 | uint8_t blockNo = arg0;\r | |
792 | uint8_t keyType = arg1;\r | |
793 | uint8_t keyCount = arg2;\r | |
794 | uint64_t ui64Key = 0;\r | |
795 | \r | |
796 | // variables\r | |
797 | int i;\r | |
798 | byte_t isOK = 0;\r | |
1c611bbd | 799 | uint8_t uid[10];\r |
8556b852 M |
800 | uint32_t cuid;\r |
801 | struct Crypto1State mpcs = {0, 0};\r | |
802 | struct Crypto1State *pcs;\r | |
803 | pcs = &mpcs;\r | |
804 | \r | |
805 | // clear debug level\r | |
806 | int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r | |
807 | MF_DBGLEVEL = MF_DBG_NONE;\r | |
808 | \r | |
809 | // clear trace\r | |
3000dc4e MHS |
810 | clear_trace();\r |
811 | set_tracing(TRUE);\r | |
8556b852 | 812 | \r |
7bc95e2e | 813 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
814 | \r |
815 | LED_A_ON();\r | |
816 | LED_B_OFF();\r | |
817 | LED_C_OFF();\r | |
818 | \r | |
8556b852 | 819 | for (i = 0; i < keyCount; i++) {\r |
9492e0b0 | 820 | if(mifare_classic_halt(pcs, cuid)) {\r |
821 | if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");\r | |
822 | }\r | |
8556b852 M |
823 | \r |
824 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
9492e0b0 | 825 | if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");\r |
8556b852 M |
826 | break;\r |
827 | };\r | |
828 | \r | |
829 | ui64Key = bytes_to_num(datain + i * 6, 6);\r | |
830 | if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r | |
831 | continue;\r | |
832 | };\r | |
833 | \r | |
834 | isOK = 1;\r | |
835 | break;\r | |
836 | }\r | |
837 | \r | |
838 | // ----------------------------- crypto1 destroy\r | |
839 | crypto1_destroy(pcs);\r | |
840 | \r | |
8556b852 | 841 | LED_B_ON();\r |
6e82300d | 842 | cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);\r |
8556b852 M |
843 | LED_B_OFF();\r |
844 | \r | |
8556b852 M |
845 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
846 | LEDsoff();\r | |
847 | \r | |
848 | // restore debug level\r | |
849 | MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r | |
850 | }\r | |
851 | \r | |
852 | //-----------------------------------------------------------------------------\r | |
853 | // MIFARE commands set debug level\r | |
854 | // \r | |
855 | //-----------------------------------------------------------------------------\r | |
856 | void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
857 | MF_DBGLEVEL = arg0;\r | |
858 | Dbprintf("Debug level: %d", MF_DBGLEVEL);\r | |
859 | }\r | |
860 | \r | |
861 | //-----------------------------------------------------------------------------\r | |
862 | // Work with emulator memory\r | |
863 | // \r | |
864 | //-----------------------------------------------------------------------------\r | |
865 | void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
866 | emlClearMem();\r | |
867 | }\r | |
868 | \r | |
869 | void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
870 | emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r | |
871 | }\r | |
872 | \r | |
873 | void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
3fe4ff4f | 874 | byte_t buf[USB_CMD_DATA_SIZE];\r |
baeaf579 | 875 | emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r |
8556b852 M |
876 | \r |
877 | LED_B_ON();\r | |
3fe4ff4f | 878 | cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r |
8556b852 M |
879 | LED_B_OFF();\r |
880 | }\r | |
881 | \r | |
882 | //-----------------------------------------------------------------------------\r | |
883 | // Load a card into the emulator memory\r | |
884 | // \r | |
885 | //-----------------------------------------------------------------------------\r | |
886 | void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
baeaf579 | 887 | uint8_t numSectors = arg0;\r |
8556b852 M |
888 | uint8_t keyType = arg1;\r |
889 | uint64_t ui64Key = 0;\r | |
890 | uint32_t cuid;\r | |
891 | struct Crypto1State mpcs = {0, 0};\r | |
892 | struct Crypto1State *pcs;\r | |
893 | pcs = &mpcs;\r | |
894 | \r | |
895 | // variables\r | |
896 | byte_t dataoutbuf[16];\r | |
ab8b654e | 897 | byte_t dataoutbuf2[16];\r |
1c611bbd | 898 | uint8_t uid[10];\r |
8556b852 M |
899 | \r |
900 | // clear trace\r | |
3000dc4e MHS |
901 | clear_trace();\r |
902 | set_tracing(false);\r | |
8556b852 | 903 | \r |
7bc95e2e | 904 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
8556b852 M |
905 | \r |
906 | LED_A_ON();\r | |
907 | LED_B_OFF();\r | |
908 | LED_C_OFF();\r | |
909 | \r | |
baeaf579 | 910 | bool isOK = true;\r |
911 | \r | |
912 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r | |
913 | isOK = false;\r | |
914 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
915 | }\r | |
8556b852 | 916 | \r |
baeaf579 | 917 | for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r |
918 | ui64Key = emlGetKey(sectorNo, keyType);\r | |
919 | if (sectorNo == 0){\r | |
920 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r | |
921 | isOK = false;\r | |
922 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r | |
8556b852 | 923 | break;\r |
baeaf579 | 924 | }\r |
925 | } else {\r | |
926 | if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r | |
927 | isOK = false;\r | |
928 | if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r | |
8556b852 | 929 | break;\r |
baeaf579 | 930 | }\r |
931 | }\r | |
932 | \r | |
933 | for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r | |
934 | if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r | |
935 | isOK = false;\r | |
936 | if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r | |
ab8b654e M |
937 | break;\r |
938 | };\r | |
baeaf579 | 939 | if (isOK) {\r |
940 | if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r | |
941 | emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
942 | } else { // sector trailer, keep the keys, set only the AC\r | |
943 | emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
944 | memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r | |
945 | emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r | |
946 | }\r | |
947 | }\r | |
8556b852 M |
948 | }\r |
949 | \r | |
baeaf579 | 950 | }\r |
951 | \r | |
952 | if(mifare_classic_halt(pcs, cuid)) {\r | |
953 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
954 | };\r | |
8556b852 M |
955 | \r |
956 | // ----------------------------- crypto1 destroy\r | |
957 | crypto1_destroy(pcs);\r | |
ab8b654e M |
958 | \r |
959 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
960 | LEDsoff();\r | |
8556b852 M |
961 | \r |
962 | if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r | |
963 | \r | |
8556b852 M |
964 | }\r |
965 | \r | |
0675f200 M |
966 | \r |
967 | //-----------------------------------------------------------------------------\r | |
968 | // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r | |
969 | // \r | |
970 | //-----------------------------------------------------------------------------\r | |
971 | void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r | |
972 | \r | |
973 | // params\r | |
974 | uint8_t needWipe = arg0;\r | |
208a0166 M |
975 | // bit 0 - need get UID\r |
976 | // bit 1 - need wupC\r | |
977 | // bit 2 - need HALT after sequence\r | |
978 | // bit 3 - need init FPGA and field before sequence\r | |
979 | // bit 4 - need reset FPGA and LED\r | |
980 | uint8_t workFlags = arg1;\r | |
0675f200 M |
981 | uint8_t blockNo = arg2;\r |
982 | \r | |
983 | // card commands\r | |
984 | uint8_t wupC1[] = { 0x40 }; \r | |
985 | uint8_t wupC2[] = { 0x43 }; \r | |
986 | uint8_t wipeC[] = { 0x41 }; \r | |
987 | \r | |
988 | // variables\r | |
989 | byte_t isOK = 0;\r | |
3fe4ff4f | 990 | uint8_t uid[10] = {0x00};\r |
991 | uint8_t d_block[18] = {0x00};\r | |
0675f200 M |
992 | uint32_t cuid;\r |
993 | \r | |
f71f4deb | 994 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
995 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
6a1f2d82 | 996 | \r |
3fe4ff4f | 997 | // reset FPGA and LED\r |
208a0166 | 998 | if (workFlags & 0x08) {\r |
208a0166 M |
999 | LED_A_ON();\r |
1000 | LED_B_OFF();\r | |
1001 | LED_C_OFF();\r | |
0675f200 | 1002 | \r |
3000dc4e MHS |
1003 | clear_trace();\r |
1004 | set_tracing(TRUE);\r | |
3fe4ff4f | 1005 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
208a0166 | 1006 | }\r |
0675f200 M |
1007 | \r |
1008 | while (true) {\r | |
3fe4ff4f | 1009 | \r |
0675f200 | 1010 | // get UID from chip\r |
208a0166 | 1011 | if (workFlags & 0x01) {\r |
0675f200 M |
1012 | if(!iso14443a_select_card(uid, NULL, &cuid)) {\r |
1013 | if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r | |
3ac59c7f | 1014 | //break;\r |
0675f200 M |
1015 | };\r |
1016 | \r | |
1017 | if(mifare_classic_halt(NULL, cuid)) {\r | |
1018 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
3ac59c7f | 1019 | //break;\r |
0675f200 M |
1020 | };\r |
1021 | };\r | |
1022 | \r | |
1023 | // reset chip\r | |
1024 | if (needWipe){\r | |
6a1f2d82 | 1025 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
1026 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
0675f200 M |
1027 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1028 | break;\r | |
1029 | };\r | |
1030 | \r | |
9492e0b0 | 1031 | ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r |
6a1f2d82 | 1032 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1033 | if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r |
1034 | break;\r | |
1035 | };\r | |
1036 | \r | |
1037 | if(mifare_classic_halt(NULL, cuid)) {\r | |
1038 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1039 | break;\r | |
1040 | };\r | |
1041 | }; \r | |
1042 | \r | |
545a1f38 | 1043 | // write block\r |
208a0166 | 1044 | if (workFlags & 0x02) {\r |
6a1f2d82 | 1045 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
1046 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
208a0166 M |
1047 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1048 | break;\r | |
1049 | };\r | |
0675f200 | 1050 | \r |
9492e0b0 | 1051 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r |
6a1f2d82 | 1052 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
208a0166 M |
1053 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r |
1054 | break;\r | |
1055 | };\r | |
1056 | }\r | |
0675f200 | 1057 | \r |
6a1f2d82 | 1058 | if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1059 | if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r |
1060 | break;\r | |
1061 | };\r | |
1062 | \r | |
1063 | memcpy(d_block, datain, 16);\r | |
1064 | AppendCrc14443a(d_block, 16);\r | |
1065 | \r | |
9492e0b0 | 1066 | ReaderTransmit(d_block, sizeof(d_block), NULL);\r |
6a1f2d82 | 1067 | if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {\r |
0675f200 M |
1068 | if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r |
1069 | break;\r | |
1070 | }; \r | |
1071 | \r | |
208a0166 M |
1072 | if (workFlags & 0x04) {\r |
1073 | if (mifare_classic_halt(NULL, cuid)) {\r | |
1074 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1075 | break;\r | |
1076 | };\r | |
1077 | }\r | |
0675f200 M |
1078 | \r |
1079 | isOK = 1;\r | |
1080 | break;\r | |
1081 | }\r | |
1082 | \r | |
0675f200 | 1083 | LED_B_ON();\r |
baeaf579 | 1084 | cmd_send(CMD_ACK,isOK,0,0,uid,4);\r |
0675f200 M |
1085 | LED_B_OFF();\r |
1086 | \r | |
545a1f38 | 1087 | if ((workFlags & 0x10) || (!isOK)) {\r |
208a0166 M |
1088 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1089 | LEDsoff();\r | |
1090 | }\r | |
0675f200 | 1091 | }\r |
545a1f38 | 1092 | \r |
baeaf579 | 1093 | \r |
545a1f38 M |
1094 | void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r |
1095 | \r | |
1096 | // params\r | |
1097 | // bit 1 - need wupC\r | |
1098 | // bit 2 - need HALT after sequence\r | |
1099 | // bit 3 - need init FPGA and field before sequence\r | |
1100 | // bit 4 - need reset FPGA and LED\r | |
1101 | uint8_t workFlags = arg0;\r | |
1102 | uint8_t blockNo = arg2;\r | |
1103 | \r | |
1104 | // card commands\r | |
1105 | uint8_t wupC1[] = { 0x40 }; \r | |
1106 | uint8_t wupC2[] = { 0x43 }; \r | |
1107 | \r | |
1108 | // variables\r | |
1109 | byte_t isOK = 0;\r | |
3fe4ff4f | 1110 | uint8_t data[18] = {0x00};\r |
545a1f38 M |
1111 | uint32_t cuid = 0;\r |
1112 | \r | |
f71f4deb | 1113 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
1114 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
545a1f38 M |
1115 | \r |
1116 | if (workFlags & 0x08) {\r | |
545a1f38 M |
1117 | LED_A_ON();\r |
1118 | LED_B_OFF();\r | |
1119 | LED_C_OFF();\r | |
1120 | \r | |
3000dc4e MHS |
1121 | clear_trace();\r |
1122 | set_tracing(TRUE);\r | |
3fe4ff4f | 1123 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
545a1f38 M |
1124 | }\r |
1125 | \r | |
1126 | while (true) {\r | |
1127 | if (workFlags & 0x02) {\r | |
7bc95e2e | 1128 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r |
6a1f2d82 | 1129 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
545a1f38 M |
1130 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r |
1131 | break;\r | |
1132 | };\r | |
1133 | \r | |
9492e0b0 | 1134 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r |
6a1f2d82 | 1135 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r |
545a1f38 M |
1136 | if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r |
1137 | break;\r | |
1138 | };\r | |
1139 | }\r | |
1140 | \r | |
1141 | // read block\r | |
6a1f2d82 | 1142 | if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r |
545a1f38 M |
1143 | if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r |
1144 | break;\r | |
1145 | };\r | |
1146 | memcpy(data, receivedAnswer, 18);\r | |
1147 | \r | |
1148 | if (workFlags & 0x04) {\r | |
1149 | if (mifare_classic_halt(NULL, cuid)) {\r | |
1150 | if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r | |
1151 | break;\r | |
1152 | };\r | |
1153 | }\r | |
1154 | \r | |
1155 | isOK = 1;\r | |
1156 | break;\r | |
1157 | }\r | |
1158 | \r | |
545a1f38 | 1159 | LED_B_ON();\r |
baeaf579 | 1160 | cmd_send(CMD_ACK,isOK,0,0,data,18);\r |
545a1f38 M |
1161 | LED_B_OFF();\r |
1162 | \r | |
1163 | if ((workFlags & 0x10) || (!isOK)) {\r | |
545a1f38 M |
1164 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r |
1165 | LEDsoff();\r | |
1166 | }\r | |
1167 | }\r | |
1168 | \r | |
3fe4ff4f | 1169 | void MifareCIdent(){\r |
1170 | \r | |
1171 | // card commands\r | |
1172 | uint8_t wupC1[] = { 0x40 }; \r | |
1173 | uint8_t wupC2[] = { 0x43 }; \r | |
1174 | \r | |
1175 | // variables\r | |
1176 | byte_t isOK = 1;\r | |
1177 | \r | |
f71f4deb | 1178 | uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r |
1179 | uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r | |
3fe4ff4f | 1180 | \r |
1181 | ReaderTransmitBitsPar(wupC1,7,0, NULL);\r | |
1182 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1183 | isOK = 0;\r | |
1184 | };\r | |
1185 | \r | |
1186 | ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r | |
1187 | if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {\r | |
1188 | isOK = 0;\r | |
1189 | };\r | |
1190 | \r | |
1191 | if (mifare_classic_halt(NULL, 0)) {\r | |
1192 | isOK = 0;\r | |
1193 | };\r | |
1194 | \r | |
1195 | cmd_send(CMD_ACK,isOK,0,0,0,0);\r | |
1196 | }\r | |
1197 | \r | |
1198 | //\r | |
1199 | // DESFIRE\r | |
1200 | //\r | |
a631936e | 1201 | \r |
1202 | void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r | |
1203 | \r | |
1204 | byte_t dataout[11] = {0x00};\r | |
1205 | uint8_t uid[10] = {0x00};\r | |
1206 | uint32_t cuid;\r | |
1207 | \r | |
3000dc4e | 1208 | clear_trace();\r |
a631936e | 1209 | iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r |
1210 | \r | |
1211 | int len = iso14443a_select_card(uid, NULL, &cuid);\r | |
1212 | if(!len) {\r | |
1213 | if (MF_DBGLEVEL >= MF_DBG_ERROR) \r | |
1214 | Dbprintf("Can't select card");\r | |
0ec548dc | 1215 | OnError(1);\r |
a631936e | 1216 | return;\r |
1217 | };\r | |
1218 | \r | |
1219 | if(mifare_desfire_des_auth1(cuid, dataout)){\r | |
1220 | if (MF_DBGLEVEL >= MF_DBG_ERROR) \r | |
1221 | Dbprintf("Authentication part1: Fail.");\r | |
0ec548dc | 1222 | OnError(4);\r |
a631936e | 1223 | return;\r |
1224 | }\r | |
1225 | \r | |
1226 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r | |
1227 | \r | |
1228 | cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r | |
1229 | }\r | |
1230 | \r | |
1231 | void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r | |
1232 | \r | |
1233 | uint32_t cuid = arg0;\r | |
1234 | uint8_t key[16] = {0x00};\r | |
1235 | byte_t isOK = 0;\r | |
1236 | byte_t dataout[12] = {0x00};\r | |
1237 | \r | |
1238 | memcpy(key, datain, 16);\r | |
1239 | \r | |
1240 | isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r | |
1241 | \r | |
1242 | if( isOK) {\r | |
1243 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r | |
1244 | Dbprintf("Authentication part2: Failed"); \r | |
0ec548dc | 1245 | OnError(4);\r |
a631936e | 1246 | return;\r |
1247 | }\r | |
1248 | \r | |
1249 | if (MF_DBGLEVEL >= MF_DBG_EXTENDED) \r | |
1250 | DbpString("AUTH 2 FINISHED");\r | |
1251 | \r | |
1252 | cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r | |
1253 | FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r | |
1254 | LEDsoff();\r | |
3000dc4e | 1255 | }\r |