]> cvs.zerfleddert.de Git - proxmark3-svn/blame - armsrc/mifaredesfire.c
Applied Holiman's fixes for iclass.c and CSNs
[proxmark3-svn] / armsrc / mifaredesfire.c
CommitLineData
f38a1528 1#include "mifaredesfire.h"
2
3#define MAX_APPLICATION_COUNT 28
4#define MAX_FILE_COUNT 16
a501c82b 5#define MAX_DESFIRE_FRAME_SIZE 60
f38a1528 6#define NOT_YET_AUTHENTICATED 255
a501c82b 7#define FRAME_PAYLOAD_SIZE (MAX_DESFIRE_FRAME_SIZE - 5)
8#define RECEIVE_SIZE 64
f38a1528 9
313ee67e 10// the block number for the ISO14443-4 PCB
11uint8_t pcb_blocknum = 0;
12// Deselect card by sending a s-block. the crc is precalced for speed
13static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
14
f38a1528 15//static uint8_t __msg[MAX_FRAME_SIZE] = { 0x0A, 0x00, 0x00, /* ..., */ 0x00 };
16/* PCB CID CMD PAYLOAD */
17//static uint8_t __res[MAX_FRAME_SIZE];
18
313ee67e 19bool InitDesfireCard(){
20
21 // Make sure it is off.
22// FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
23// SpinDelay(300);
24
25 byte_t cardbuf[USB_CMD_DATA_SIZE];
26 memset(cardbuf,0,sizeof(cardbuf));
27
28 iso14a_set_tracing(TRUE);
29 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
f38a1528 30
313ee67e 31 iso14a_card_select_t *card = (iso14a_card_select_t*)cardbuf;
32 int len = iso14443a_select_card(NULL,card,NULL);
f38a1528 33
313ee67e 34 if (!len) {
35 if (MF_DBGLEVEL >= 1) {
36 Dbprintf("Can't select card");
37 }
38 OnError();
39 return false;
40 }
41 return true;
42}
43
75465377 44// ARG0 flag enums
45enum {
46 NONE = 0x00,
47 INIT = 0x01,
48 DISCONNECT = 0x02,
f6c18637 49 CLEARTRACE = 0x04,
75465377 50 BAR = 0x08,
51} CmdOptions ;
52
313ee67e 53void MifareSendCommand(uint8_t arg0, uint8_t arg1, uint8_t *datain){
54
55 /* ARG0 contains flags.
56 0x01 = init card.
f6c18637 57 0x02 = Disconnect
313ee67e 58 0x03
59 */
60 uint8_t flags = arg0;
61 size_t datalen = arg1;
a501c82b 62 uint8_t resp[RECEIVE_SIZE];
313ee67e 63 memset(resp,0,sizeof(resp));
64
65 if (MF_DBGLEVEL >= 4) {
75465377 66 Dbprintf(" flags : %02X", flags);
67 Dbprintf(" len : %02X", datalen);
68 print_result(" RX : ", datain, datalen);
313ee67e 69 }
70
f6c18637 71 if ( flags & CLEARTRACE ){
72 iso14a_clear_trace();
73 }
74
75465377 75 if ( flags & INIT ){
313ee67e 76 if ( !InitDesfireCard() )
77 return;
78 }
79
80 int len = DesfireAPDU(datain, datalen, resp);
313ee67e 81 if (MF_DBGLEVEL >= 4) {
82 print_result("ERR <--: ", resp, len);
83 }
f6c18637 84
85 if ( !len ) {
313ee67e 86 OnError();
87 return;
88 }
313ee67e 89
75465377 90 // reset the pcb_blocknum,
91 pcb_blocknum = 0;
92
f6c18637 93 if ( flags & DISCONNECT ){
75465377 94 OnSuccess();
f6c18637 95 }
75465377 96
97 cmd_send(CMD_ACK,1,len,0,resp,len);
313ee67e 98}
99
100void MifareDesfireGetInformation(){
101
102 int len = 0;
103 uint8_t resp[USB_CMD_DATA_SIZE];
104 uint8_t dataout[USB_CMD_DATA_SIZE];
105 byte_t cardbuf[USB_CMD_DATA_SIZE];
f38a1528 106
107 memset(resp,0,sizeof(resp));
108 memset(dataout,0, sizeof(dataout));
313ee67e 109 memset(cardbuf,0,sizeof(cardbuf));
f38a1528 110
111 /*
112 1 = PCB 1
113 2 = cid 2
114 3 = desfire command 3
115 4-5 = crc 4 key
313ee67e 116 5-6 crc
f38a1528 117 PCB == 0x0A because sending CID byte.
313ee67e 118 CID == 0x00 first card?
f38a1528 119 */
f38a1528 120 iso14a_clear_trace();
121 iso14a_set_tracing(TRUE);
122 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
123
124 // card select - information
313ee67e 125 iso14a_card_select_t *card = (iso14a_card_select_t*)cardbuf;
f38a1528 126 byte_t isOK = iso14443a_select_card(NULL, card, NULL);
127 if (isOK != 1) {
128 if (MF_DBGLEVEL >= 1) {
129 Dbprintf("Can't select card");
130 }
131 OnError();
132 return;
133 }
134
f38a1528 135 memcpy(dataout,card->uid,7);
136
137 LED_A_ON();
138 LED_B_OFF();
139 LED_C_OFF();
140
313ee67e 141 uint8_t cmd[] = {GET_VERSION};
142 size_t cmd_len = sizeof(cmd);
143
144 len = DesfireAPDU(cmd, cmd_len, resp);
145 if ( !len ) {
f38a1528 146 print_result("ERROR <--: ", resp, len);
147 OnError();
148 return;
149 }
313ee67e 150
151 LED_A_OFF();
152 LED_B_ON();
f38a1528 153 memcpy(dataout+7,resp+3,7);
154
155 // ADDITION_FRAME 1
313ee67e 156 cmd[0] = ADDITIONAL_FRAME;
157 len = DesfireAPDU(cmd, cmd_len, resp);
158 if ( !len ) {
f38a1528 159 print_result("ERROR <--: ", resp, len);
160 OnError();
161 return;
162 }
313ee67e 163
164 LED_B_OFF();
165 LED_C_ON();
f38a1528 166 memcpy(dataout+7+7,resp+3,7);
167
168 // ADDITION_FRAME 2
313ee67e 169 len = DesfireAPDU(cmd, cmd_len, resp);
170 if ( !len ) {
f38a1528 171 print_result("ERROR <--: ", resp, len);
172 OnError();
173 return;
174 }
175
176 memcpy(dataout+7+7+7,resp+3,14);
177
f38a1528 178 cmd_send(CMD_ACK,1,0,0,dataout,sizeof(dataout));
313ee67e 179
180 // reset the pcb_blocknum,
181 pcb_blocknum = 0;
f38a1528 182 OnSuccess();
183}
184
185void MifareDES_Auth1(uint8_t mode, uint8_t algo, uint8_t keyno, uint8_t *datain){
186
f6c18637 187 int len = 0;
188 //uint8_t PICC_MASTER_KEY8[8] = { 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47};
189 uint8_t PICC_MASTER_KEY16[16] = { 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,0x4e,0x4f };
190 //uint8_t null_key_data8[8] = {0x00};
191 //uint8_t null_key_data16[16] = {0x00};
192 //uint8_t new_key_data8[8] = { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77};
193 //uint8_t new_key_data16[16] = { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF};
f38a1528 194
a501c82b 195 //uint8_t* bigbuffer = get_bigbufptr_recvrespbuf();
f6c18637 196 uint8_t resp[256] = {0x00};
197 uint8_t IV[16] = {0x00};
f38a1528 198
f6c18637 199 size_t datalen = datain[0];
200
201 uint8_t cmd[40] = {0x00};
202 uint8_t encRndB[16] = {0x00};
203 uint8_t decRndB[16] = {0x00};
204 uint8_t nonce[16] = {0x00};
205 uint8_t both[32] = {0x00};
206 uint8_t encBoth[32] = {0x00};
f38a1528 207
f6c18637 208 InitDesfireCard();
f38a1528 209
210 LED_A_ON();
211 LED_B_OFF();
212 LED_C_OFF();
213
214