]>
Commit | Line | Data |
---|---|---|
20f9a2a1 | 1 | //-----------------------------------------------------------------------------\r |
b62a5a84 | 2 | // Merlok, May 2011, 2012\r |
8f51ddb0 | 3 | // Many authors, whom made it possible\r |
20f9a2a1 M |
4 | //\r |
5 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
6 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
7 | // the license.\r | |
8 | //-----------------------------------------------------------------------------\r | |
8f51ddb0 | 9 | // Work with mifare cards.\r |
20f9a2a1 M |
10 | //-----------------------------------------------------------------------------\r |
11 | \r | |
f38a1528 | 12 | #include "../include/proxmark3.h"\r |
20f9a2a1 M |
13 | #include "apps.h"\r |
14 | #include "util.h"\r | |
15 | #include "string.h"\r | |
16 | \r | |
f38a1528 | 17 | #include "../common/iso14443crc.h"\r |
20f9a2a1 M |
18 | #include "iso14443a.h"\r |
19 | #include "crapto1.h"\r | |
20 | #include "mifareutil.h"\r | |
21 | \r | |
f397b5cc M |
22 | int MF_DBGLEVEL = MF_DBG_ALL;\r |
23 | \r | |
8f51ddb0 | 24 | // memory management\r |
a501c82b | 25 | uint8_t* get_bigbufptr_recvrespbuf(void) {\r |
26 | return (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);\r | |
8f51ddb0 | 27 | }\r |
a501c82b | 28 | uint8_t* get_bigbufptr_recvcmdbuf(void) {\r |
8f51ddb0 M |
29 | return (((uint8_t *)BigBuf) + RECV_CMD_OFFSET); \r |
30 | }\r | |
a501c82b | 31 | uint8_t* get_bigbufptr_emlcardmem(void) {\r |
32 | return (((uint8_t *)BigBuf) + CARD_MEMORY_OFFSET);\r | |
8f51ddb0 M |
33 | }\r |
34 | \r | |
35 | // crypto1 helpers\r | |
36 | void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len){\r | |
37 | uint8_t bt = 0;\r | |
38 | int i;\r | |
39 | \r | |
40 | if (len != 1) {\r | |
41 | for (i = 0; i < len; i++)\r | |
42 | data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];\r | |
43 | } else {\r | |
44 | bt = 0;\r | |
45 | for (i = 0; i < 4; i++)\r | |
46 | bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data[0], i)) << i;\r | |
47 | \r | |
48 | data[0] = bt;\r | |
49 | }\r | |
50 | return;\r | |
51 | }\r | |
52 | \r | |
a501c82b | 53 | void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, uint16_t len, uint8_t *par) {\r |
8f51ddb0 M |
54 | uint8_t bt = 0;\r |
55 | int i;\r | |
a501c82b | 56 | par[0] = 0;\r |
57 | \r | |
8f51ddb0 M |
58 | for (i = 0; i < len; i++) {\r |
59 | bt = data[i];\r | |
60 | data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];\r | |
a501c82b | 61 | if((i&0x0007) == 0) \r |
62 | par[i>>3] = 0;\r | |
63 | par[i>>3] |= (((filter(pcs->odd) ^ oddparity(bt)) & 0x01)<<(7-(i&0x0007)));\r | |
8f51ddb0 M |
64 | } \r |
65 | return;\r | |
66 | }\r | |
67 | \r | |
68 | uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data) {\r | |
69 | uint8_t bt = 0;\r | |
70 | int i;\r | |
71 | \r | |
72 | for (i = 0; i < 4; i++)\r | |
73 | bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data, i)) << i;\r | |
74 | \r | |
75 | return bt;\r | |
20f9a2a1 M |
76 | }\r |
77 | \r | |
8f51ddb0 | 78 | // send commands\r |
a501c82b | 79 | int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)\r |
f89c7050 | 80 | {\r |
a501c82b | 81 | return mifare_sendcmd_shortex(pcs, crypted, cmd, data, answer, answer_parity, timing); |
981bd429 | 82 | } |
83 | ||
a501c82b | 84 | int mifare_sendcmd_short_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t* data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing) |
981bd429 | 85 | { |
a501c82b | 86 | uint8_t dcmd[8]; |
87 | dcmd[0] = cmd; | |
88 | memcpy(dcmd+1,data,5);\r | |
89 | ||
981bd429 | 90 | AppendCrc14443a(dcmd, 6); |
981bd429 | 91 | ReaderTransmit(dcmd, sizeof(dcmd), NULL); |
a501c82b | 92 | int len = ReaderReceive(answer, answer_parity); |
f38a1528 | 93 | if(!len) { |
981bd429 | 94 | if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout."); |
95 | return 2; | |
f38a1528 | 96 | }\r |
97 | return len;\r | |
98 | }\r | |
99 | \r | |
a501c82b | 100 | int mifare_sendcmd_short_mfucauth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)\r |
f38a1528 | 101 | {\r |
102 | uint8_t dcmd[19];\r | |
103 | int len; \r | |
104 | dcmd[0] = cmd;\r | |
105 | memcpy(dcmd+1,data,16);\r | |
106 | AppendCrc14443a(dcmd, 17);\r | |
107 | \r | |
108 | ReaderTransmit(dcmd, sizeof(dcmd), timing);\r | |
a501c82b | 109 | len = ReaderReceive(answer, answer_parity);\r |
f38a1528 | 110 | if(!len) {\r |
111 | if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");\r | |
a501c82b | 112 | len = ReaderReceive(answer,answer_parity);\r |
f38a1528 | 113 | }\r |
114 | if(len==1) {\r | |
115 | if (MF_DBGLEVEL >= 1) Dbprintf("NAK - Authentication failed.");\r | |
116 | return 1;\r | |
981bd429 | 117 | } |
118 | return len; | |
119 | } | |
120 | ||
a501c82b | 121 | int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing) |
981bd429 | 122 | { |
123 | uint8_t dcmd[4], ecmd[4]; | |
a501c82b | 124 | uint16_t pos, res;\r |
125 | uint8_t par[1]; // 1 Byte parity is enough here\r | |
20f9a2a1 M |
126 | dcmd[0] = cmd;\r |
127 | dcmd[1] = data;\r | |
128 | AppendCrc14443a(dcmd, 2);\r | |
129 | \r | |
130 | memcpy(ecmd, dcmd, sizeof(dcmd));\r | |
131 | \r | |
132 | if (crypted) {\r | |
a501c82b | 133 | par[0] = 0;\r |
20f9a2a1 M |
134 | for (pos = 0; pos < 4; pos++)\r |
135 | {\r | |
136 | ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];\r | |
a501c82b | 137 | par[0] |= (((filter(pcs->odd) ^ oddparity(dcmd[pos])) & 0x01) << (7-pos));\r |
20f9a2a1 M |
138 | } \r |
139 | \r | |
9492e0b0 | 140 | ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);\r |
20f9a2a1 M |
141 | \r |
142 | } else {\r | |
9492e0b0 | 143 | ReaderTransmit(dcmd, sizeof(dcmd), timing);\r |
20f9a2a1 M |
144 | }\r |
145 | \r | |
a501c82b | 146 | int len = ReaderReceive(answer, par);\r |
f89c7050 | 147 | \r |
a501c82b | 148 | if (answer_parity) *answer_parity = par[0];\r |
20f9a2a1 | 149 | \r |
4abe4f58 | 150 | if (crypted == CRYPT_ALL) {\r |
20f9a2a1 M |
151 | if (len == 1) {\r |
152 | res = 0;\r | |
153 | for (pos = 0; pos < 4; pos++)\r | |
154 | res |= (crypto1_bit(pcs, 0, 0) ^ BIT(answer[0], pos)) << pos;\r | |
155 | \r | |
156 | answer[0] = res;\r | |
157 | \r | |
158 | } else {\r | |
159 | for (pos = 0; pos < len; pos++)\r | |
160 | {\r | |
161 | answer[pos] = crypto1_byte(pcs, 0x00, 0) ^ answer[pos];\r | |
162 | }\r | |
163 | }\r | |
164 | }\r | |
165 | \r | |
166 | return len;\r | |
167 | }\r | |
168 | \r | |
8f51ddb0 | 169 | // mifare commands\r |
a501c82b | 170 | int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested) \r |
f89c7050 | 171 | {\r |
9492e0b0 | 172 | return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL);\r |
f89c7050 M |
173 | }\r |
174 | \r | |
a501c82b | 175 | int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing) \r |
20f9a2a1 M |
176 | {\r |
177 | // variables\r | |
4abe4f58 | 178 | int len; \r |
20f9a2a1 M |
179 | uint32_t pos;\r |
180 | uint8_t tmp4[4];\r | |
a501c82b | 181 | uint8_t par[1] = {0x00};\r |
182 | byte_t nr[4];\r | |
20f9a2a1 M |
183 | uint32_t nt, ntpp; // Supplied tag nonce\r |
184 | \r | |
185 | uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };\r | |
a501c82b | 186 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r |
187 | uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
20f9a2a1 | 188 | \r |
4abe4f58 | 189 | // Transmit MIFARE_CLASSIC_AUTH\r |
a501c82b | 190 | len = mifare_sendcmd_short(pcs, isNested, 0x60 + (keyType & 0x01), blockNo, receivedAnswer, receivedAnswerPar, timing);\r |
191 | if (MF_DBGLEVEL >= 4) Dbprintf("rand tag nonce len: %x", len); \r | |
4abe4f58 | 192 | if (len != 4) return 1;\r |
20f9a2a1 | 193 | \r |
a501c82b | 194 | // "random" reader nonce:\r |
195 | nr[0] = 0x55;\r | |
196 | nr[1] = 0x41;\r | |
197 | nr[2] = 0x49;\r | |
198 | nr[3] = 0x92; \r | |
20f9a2a1 M |
199 | \r |
200 | // Save the tag nonce (nt)\r | |
201 | nt = bytes_to_num(receivedAnswer, 4);\r | |
20f9a2a1 M |
202 | \r |
203 | // ----------------------------- crypto1 create\r | |
4abe4f58 M |
204 | if (isNested)\r |
205 | crypto1_destroy(pcs);\r | |
206 | \r | |
207 | // Init cipher with key\r | |
20f9a2a1 M |
208 | crypto1_create(pcs, ui64Key);\r |
209 | \r | |
4abe4f58 M |
210 | if (isNested == AUTH_NESTED) {\r |
211 | // decrypt nt with help of new key \r | |
212 | nt = crypto1_word(pcs, nt ^ uid, 1) ^ nt;\r | |
213 | } else {\r | |
214 | // Load (plain) uid^nt into the cipher\r | |
215 | crypto1_word(pcs, nt ^ uid, 0);\r | |
216 | }\r | |
217 | \r | |
218 | // some statistic\r | |
f397b5cc | 219 | if (!ntptr && (MF_DBGLEVEL >= 3))\r |
f89c7050 M |
220 | Dbprintf("auth uid: %08x nt: %08x", uid, nt); \r |
221 | \r | |
222 | // save Nt\r | |
223 | if (ntptr)\r | |
224 | *ntptr = nt;\r | |
20f9a2a1 | 225 | \r |
4abe4f58 | 226 | // Generate (encrypted) nr+parity by loading it into the cipher (Nr)\r |
a501c82b | 227 | par[0] = 0;\r |
4abe4f58 M |
228 | for (pos = 0; pos < 4; pos++)\r |
229 | {\r | |
a501c82b | 230 | mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];\r |
231 | par[0] |= (((filter(pcs->odd) ^ oddparity(nr[pos])) & 0x01) << (7-pos));\r | |
4abe4f58 | 232 | } \r |
20f9a2a1 | 233 | \r |
4abe4f58 M |
234 | // Skip 32 bits in pseudo random generator\r |
235 | nt = prng_successor(nt,32);\r | |
20f9a2a1 M |
236 | \r |
237 | // ar+parity\r | |
4abe4f58 M |
238 | for (pos = 4; pos < 8; pos++)\r |
239 | {\r | |
20f9a2a1 | 240 | nt = prng_successor(nt,8);\r |
4abe4f58 | 241 | mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);\r |
a501c82b | 242 | par[0] |= (((filter(pcs->odd) ^ oddparity(nt & 0xff)) & 0x01) << (7-pos));\r |
4abe4f58 | 243 | } \r |
20f9a2a1 | 244 | \r |
4abe4f58 | 245 | // Transmit reader nonce and reader answer\r |
9492e0b0 | 246 | ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);\r |
20f9a2a1 | 247 | \r |
a501c82b | 248 | // Receive 4 byte tag answer\r |
249 | len = ReaderReceive(receivedAnswer, receivedAnswerPar);\r | |
4abe4f58 M |
250 | if (!len)\r |
251 | {\r | |
f397b5cc | 252 | if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");\r |
20f9a2a1 | 253 | return 2;\r |
4abe4f58 | 254 | }\r |
20f9a2a1 | 255 | \r |
4abe4f58 | 256 | memcpy(tmp4, receivedAnswer, 4);\r |
20f9a2a1 M |
257 | ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);\r |
258 | \r | |
259 | if (ntpp != bytes_to_num(tmp4, 4)) {\r | |
f397b5cc | 260 | if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response.");\r |
20f9a2a1 M |
261 | return 3;\r |
262 | }\r | |
263 | \r | |
264 | return 0;\r | |
265 | }\r | |
266 | \r | |
267 | int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) \r | |
268 | {\r | |
269 | // variables\r | |
4abe4f58 | 270 | int len; \r |
20f9a2a1 M |
271 | uint8_t bt[2];\r |
272 | \r | |
a501c82b | 273 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r |
274 | uint8_t* receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
20f9a2a1 | 275 | \r |
4abe4f58 | 276 | // command MIFARE_CLASSIC_READBLOCK\r |
a501c82b | 277 | len = mifare_sendcmd_short(pcs, 1, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL);\r |
20f9a2a1 | 278 | if (len == 1) {\r |
f397b5cc | 279 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]); \r |
20f9a2a1 M |
280 | return 1;\r |
281 | }\r | |
282 | if (len != 18) {\r | |
f397b5cc | 283 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: card timeout. len: %x", len); \r |
20f9a2a1 M |
284 | return 2;\r |
285 | }\r | |
286 | \r | |
287 | memcpy(bt, receivedAnswer + 16, 2);\r | |
4abe4f58 | 288 | AppendCrc14443a(receivedAnswer, 16);\r |
20f9a2a1 | 289 | if (bt[0] != receivedAnswer[16] || bt[1] != receivedAnswer[17]) {\r |
f397b5cc | 290 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd CRC response error."); \r |
20f9a2a1 M |
291 | return 3;\r |
292 | }\r | |
293 | \r | |
294 | memcpy(blockData, receivedAnswer, 16);\r | |
981bd429 | 295 | return 0; |
f38a1528 | 296 | }\r |
297 | \r | |
298 | int mifare_ultra_auth1(uint32_t uid, uint8_t *blockData){\r | |
299 | // variables\r | |
a501c82b | 300 | uint16_t len;\r |
f38a1528 | 301 | \r |
a501c82b | 302 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r |
303 | uint8_t* receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
f38a1528 | 304 | \r |
305 | // command MIFARE_CLASSIC_READBLOCK\r | |
a501c82b | 306 | len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);\r |
f38a1528 | 307 | if (len == 1) {\r |
308 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r | |
309 | return 1;\r | |
310 | }\r | |
311 | if (len == 11) {\r | |
312 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth1 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",\r | |
313 | receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],\r | |
314 | receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],\r | |
315 | receivedAnswer[10]);\r | |
316 | memcpy(blockData, receivedAnswer, 11);\r | |
a501c82b | 317 | return 0;\r |
f38a1528 | 318 | }\r |
319 | //else something went wrong???\r | |
320 | return 1;\r | |
321 | }\r | |
322 | \r | |
323 | int mifare_ultra_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){\r | |
324 | // variables\r | |
a501c82b | 325 | uint16_t len;\r |
f38a1528 | 326 | \r |
a501c82b | 327 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r |
328 | uint8_t* receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
f38a1528 | 329 | \r |
330 | // command MIFARE_CLASSIC_READBLOCK\r | |
a501c82b | 331 | len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, key, receivedAnswer, receivedAnswerPar, NULL);\r |
f38a1528 | 332 | if (len == 1) {\r |
333 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);\r | |
334 | return 1;\r | |
335 | }\r | |
336 | if (len == 11){\r | |
337 | if (MF_DBGLEVEL >= 1) Dbprintf("Auth2 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",\r | |
338 | receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],\r | |
339 | receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],\r | |
340 | receivedAnswer[10]);\r | |
341 | memcpy(blockData, receivedAnswer, 11);\r | |
342 | return 0;\r | |
343 | }\r | |
344 | //something went wrong?\r | |
345 | return 1;\r | |
981bd429 | 346 | } |
347 | ||
348 | int mifare_ultra_readblock(uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
349 | { | |
350 | // variables | |
a501c82b | 351 | uint16_t len; |
981bd429 | 352 | uint8_t bt[2]; |
353 | ||
a501c82b | 354 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf(); |
355 | uint8_t* receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
356 | \r | |
981bd429 | 357 | |
358 | // command MIFARE_CLASSIC_READBLOCK | |
a501c82b | 359 | len = mifare_sendcmd_short(NULL, 1, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL); |
981bd429 | 360 | if (len == 1) { |
361 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]); | |
362 | return 1; | |
363 | } | |
364 | if (len != 18) { | |
365 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: card timeout. len: %x", len); | |
366 | return 2; | |
367 | } | |
368 | ||
369 | memcpy(bt, receivedAnswer + 16, 2); | |
370 | AppendCrc14443a(receivedAnswer, 16); | |
371 | if (bt[0] != receivedAnswer[16] || bt[1] != receivedAnswer[17]) { | |
372 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd CRC response error."); | |
373 | return 3; | |
374 | } | |
375 | ||
376 | memcpy(blockData, receivedAnswer, 14); | |
377 | return 0; | |
378 | } | |
379 | ||
380 | ||
381 | int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
382 | { | |
383 | // variables | |
a501c82b | 384 | uint16_t len, i; \r |
20f9a2a1 | 385 | uint32_t pos;\r |
a501c82b | 386 | uint8_t par[3] = {0x00};\r |
4abe4f58 | 387 | byte_t res;\r |
20f9a2a1 M |
388 | \r |
389 | uint8_t d_block[18], d_block_enc[18];\r | |
a501c82b | 390 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r |
391 | uint8_t* receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
20f9a2a1 | 392 | \r |
4abe4f58 | 393 | // command MIFARE_CLASSIC_WRITEBLOCK\r |
a501c82b | 394 | len = mifare_sendcmd_short(pcs, 1, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL);\r |
20f9a2a1 M |
395 | \r |
396 | if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK\r | |
f397b5cc | 397 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Error: %02x", receivedAnswer[0]); \r |
20f9a2a1 M |
398 | return 1;\r |
399 | }\r | |
400 | \r | |
401 | memcpy(d_block, blockData, 16);\r | |
402 | AppendCrc14443a(d_block, 16);\r | |
403 | \r | |
404 | // crypto\r | |
4abe4f58 M |
405 | for (pos = 0; pos < 18; pos++)\r |
406 | {\r | |
407 | d_block_enc[pos] = crypto1_byte(pcs, 0x00, 0) ^ d_block[pos];\r | |
a501c82b | 408 | par[pos>>3] |= (((filter(pcs->odd) ^ oddparity(d_block[pos])) & 0x01) << (7 - (pos&0x0007)));\r |
4abe4f58 | 409 | } \r |
20f9a2a1 | 410 | \r |
9492e0b0 | 411 | ReaderTransmitPar(d_block_enc, sizeof(d_block_enc), par, NULL);\r |
20f9a2a1 | 412 | \r |
4abe4f58 | 413 | // Receive the response\r |
a501c82b | 414 | len = ReaderReceive(receivedAnswer, receivedAnswerPar); \r |
20f9a2a1 M |
415 | \r |
416 | res = 0;\r | |
417 | for (i = 0; i < 4; i++)\r | |
418 | res |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedAnswer[0], i)) << i;\r | |
419 | \r | |
420 | if ((len != 1) || (res != 0x0A)) {\r | |
f397b5cc | 421 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd send data2 Error: %02x", res); \r |
20f9a2a1 M |
422 | return 2;\r |
423 | }\r | |
424 | \r | |
981bd429 | 425 | return 0; |
426 | } | |
427 | ||
428 | int mifare_ultra_writeblock(uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
429 | { | |
a501c82b | 430 | // variables |
431 | uint16_t len; | |
432 | uint8_t par[3] = {0}; // enough for 18 parity bits | |
433 | ||
434 | uint8_t d_block[18]; | |
435 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r | |
436 | uint8_t* receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE; | |
437 | ||
438 | // command MIFARE_CLASSIC_WRITEBLOCK | |
439 | len = mifare_sendcmd_short(NULL, true, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL); | |
981bd429 | 440 | |
a501c82b | 441 | if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK |
442 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Addr Error: %02x", receivedAnswer[0]); | |
443 | return 1; | |
444 | } | |
981bd429 | 445 | |
446 | memset(d_block,'\0',18); | |
447 | memcpy(d_block, blockData, 16); | |
a501c82b | 448 | AppendCrc14443a(d_block, 16); |
981bd429 | 449 | |
450 | ReaderTransmitPar(d_block, sizeof(d_block), par, NULL); | |
a501c82b | 451 | \r |
452 | // Receive the response | |
453 | len = ReaderReceive(receivedAnswer, receivedAnswerPar); | |
981bd429 | 454 | |
455 | if ((len != 1) || (receivedAnswer[0] != 0x0A)) { // 0x0a - ACK | |
a501c82b | 456 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Data Error: %02x %d", receivedAnswer[0],len); |
457 | return 2; | |
458 | } | |
981bd429 | 459 | |
a501c82b | 460 | return 0; |
981bd429 | 461 | } |
462 | ||
463 | int mifare_ultra_special_writeblock(uint32_t uid, uint8_t blockNo, uint8_t *blockData) | |
464 | { | |
a501c82b | 465 | uint16_t len; |
466 | \r | |
467 | uint8_t d_block[8]; | |
468 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r | |
469 | uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE; | |
981bd429 | 470 | |
a501c82b | 471 | // command MIFARE_CLASSIC_WRITEBLOCK |
981bd429 | 472 | memset(d_block,'\0',8); |
473 | d_block[0]= blockNo; | |
474 | memcpy(d_block+1,blockData,4); | |
475 | AppendCrc14443a(d_block, 6); | |
476 | ||
477 | //i know the data send here is correct | |
a501c82b | 478 | len = mifare_sendcmd_short_special(NULL, 1, 0xA2, d_block, receivedAnswer, receivedAnswerPar, NULL); |
981bd429 | 479 | |
a501c82b | 480 | if (receivedAnswer[0] != 0x0A) { // 0x0a - ACK |
481 | if (MF_DBGLEVEL >= 1) Dbprintf("Cmd Send Error: %02x %d", receivedAnswer[0],len); | |
482 | return 1; | |
483 | } | |
484 | return 0; | |
981bd429 | 485 | } |
486 | ||
487 | int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid) | |
488 | { | |
a501c82b | 489 | uint16_t len; \r |
490 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r | |
491 | uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
20f9a2a1 | 492 | \r |
a501c82b | 493 | len = mifare_sendcmd_short(pcs, pcs == NULL ? false:true, 0x50, 0x00, receivedAnswer, receivedAnswerPar, NULL);\r |
4abe4f58 | 494 | if (len != 0) {\r |
f397b5cc | 495 | if (MF_DBGLEVEL >= 1) Dbprintf("halt error. response len: %x", len); \r |
20f9a2a1 M |
496 | return 1;\r |
497 | }\r | |
498 | \r | |
981bd429 | 499 | return 0; |
500 | } | |
501 | ||
502 | int mifare_ultra_halt(uint32_t uid) | |
503 | { | |
a501c82b | 504 | uint16_t len; \r |
505 | uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();\r | |
506 | uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;\r | |
981bd429 | 507 | |
a501c82b | 508 | len = mifare_sendcmd_short(NULL, true, 0x50, 0x00, receivedAnswer, receivedAnswerPar, NULL); |
981bd429 | 509 | if (len != 0) { |
510 | if (MF_DBGLEVEL >= 1) Dbprintf("halt error. response len: %x", len); | |
511 | return 1; | |
512 | } | |
513 | ||
514 | return 0; | |
515 | } | |
516 | ||
baeaf579 | 517 | \r |
518 | // Mifare Memory Structure: up to 32 Sectors with 4 blocks each (1k and 2k cards),\r | |
519 | // plus evtl. 8 sectors with 16 blocks each (4k cards)\r | |
520 | uint8_t NumBlocksPerSector(uint8_t sectorNo) \r | |
521 | {\r | |
522 | if (sectorNo < 32) \r | |
523 | return 4;\r | |
524 | else\r | |
525 | return 16;\r | |
526 | }\r | |
527 | \r | |
528 | uint8_t FirstBlockOfSector(uint8_t sectorNo) \r | |
529 | {\r | |
530 | if (sectorNo < 32)\r | |
531 | return sectorNo * 4;\r | |
532 | else\r | |
533 | return 32*4 + (sectorNo - 32) * 16;\r | |
534 | \r | |
535 | }\r | |
536 | \r | |
537 | \r | |
981bd429 | 538 | // work with emulator memory |
539 | void emlSetMem(uint8_t *data, int blockNum, int blocksCount) { | |
a501c82b | 540 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
8f51ddb0 M |
541 | memcpy(emCARD + blockNum * 16, data, blocksCount * 16);\r |
542 | }\r | |
543 | \r | |
544 | void emlGetMem(uint8_t *data, int blockNum, int blocksCount) {\r | |
a501c82b | 545 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
8f51ddb0 M |
546 | memcpy(data, emCARD + blockNum * 16, blocksCount * 16);\r |
547 | }\r | |
548 | \r | |
549 | void emlGetMemBt(uint8_t *data, int bytePtr, int byteCount) {\r | |
a501c82b | 550 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
8f51ddb0 M |
551 | memcpy(data, emCARD + bytePtr, byteCount);\r |
552 | }\r | |
553 | \r | |
0014cb46 | 554 | int emlCheckValBl(int blockNum) {\r |
a501c82b | 555 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
0014cb46 M |
556 | uint8_t* data = emCARD + blockNum * 16;\r |
557 | \r | |
558 | if ((data[0] != (data[4] ^ 0xff)) || (data[0] != data[8]) ||\r | |
559 | (data[1] != (data[5] ^ 0xff)) || (data[1] != data[9]) ||\r | |
560 | (data[2] != (data[6] ^ 0xff)) || (data[2] != data[10]) ||\r | |
561 | (data[3] != (data[7] ^ 0xff)) || (data[3] != data[11]) ||\r | |
562 | (data[12] != (data[13] ^ 0xff)) || (data[12] != data[14]) ||\r | |
563 | (data[12] != (data[15] ^ 0xff))\r | |
564 | ) \r | |
565 | return 1;\r | |
566 | return 0;\r | |
567 | }\r | |
568 | \r | |
569 | int emlGetValBl(uint32_t *blReg, uint8_t *blBlock, int blockNum) {\r | |
a501c82b | 570 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
0014cb46 M |
571 | uint8_t* data = emCARD + blockNum * 16;\r |
572 | \r | |
573 | if (emlCheckValBl(blockNum)) {\r | |
574 | return 1;\r | |
575 | }\r | |
576 | \r | |
577 | memcpy(blReg, data, 4);\r | |
a501c82b | 578 | *blBlock = data[12]; \r |
0014cb46 M |
579 | return 0;\r |
580 | }\r | |
581 | \r | |
582 | int emlSetValBl(uint32_t blReg, uint8_t blBlock, int blockNum) {\r | |
a501c82b | 583 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
0014cb46 M |
584 | uint8_t* data = emCARD + blockNum * 16;\r |
585 | \r | |
586 | memcpy(data + 0, &blReg, 4);\r | |
587 | memcpy(data + 8, &blReg, 4);\r | |
588 | blReg = blReg ^ 0xffffffff;\r | |
589 | memcpy(data + 4, &blReg, 4);\r | |
590 | \r | |
591 | data[12] = blBlock;\r | |
592 | data[13] = blBlock ^ 0xff;\r | |
593 | data[14] = blBlock;\r | |
594 | data[15] = blBlock ^ 0xff;\r | |
595 | \r | |
596 | return 0;\r | |
597 | }\r | |
598 | \r | |
8556b852 M |
599 | uint64_t emlGetKey(int sectorNum, int keyType) {\r |
600 | uint8_t key[6];\r | |
a501c82b | 601 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
8556b852 | 602 | \r |
baeaf579 | 603 | memcpy(key, emCARD + 16 * (FirstBlockOfSector(sectorNum) + NumBlocksPerSector(sectorNum) - 1) + keyType * 10, 6);\r |
8556b852 M |
604 | return bytes_to_num(key, 6);\r |
605 | }\r | |
606 | \r | |
8f51ddb0 | 607 | void emlClearMem(void) {\r |
aea4d766 | 608 | int b;\r |
8f51ddb0 M |
609 | \r |
610 | const uint8_t trailer[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07, 0x80, 0x69, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};\r | |
8f51ddb0 | 611 | const uint8_t uid[] = {0xe6, 0x84, 0x87, 0xf3, 0x16, 0x88, 0x04, 0x00, 0x46, 0x8e, 0x45, 0x55, 0x4d, 0x70, 0x41, 0x04};\r |
a501c82b | 612 | uint8_t* emCARD = get_bigbufptr_emlcardmem();\r |
aea4d766 | 613 | \r |
a501c82b | 614 | memset(emCARD, 0, CARD_MEMORY_SIZE);\r |
aea4d766 | 615 | \r |
616 | // fill sectors trailer data\r | |
617 | for(b = 3; b < 256; b<127?(b+=4):(b+=16)) {\r | |
618 | emlSetMem((uint8_t *)trailer, b , 1);\r | |
619 | } \r | |
8f51ddb0 M |
620 | \r |
621 | // uid\r | |
622 | emlSetMem((uint8_t *)uid, 0, 1);\r | |
623 | return;\r | |
624 | }\r |