cvs.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	//-----------------------------------------------------------------------------\r
	2	// Merlok - June 2011, 2012\r
	3	// Gerhard de Koning Gans - May 2008\r
	4	// Hagen Fritsch - June 2010\r
	5	// Midnitesnake - Dec 2013\r
	6	// Andy Davies - Apr 2014\r
	7	// Iceman - May 2014\r
	8	//\r
	9	// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
	10	// at your option, any later version. See the LICENSE.txt file for the text of\r
	11	// the license.\r
	12	//-----------------------------------------------------------------------------\r
	13	// Routines to support ISO 14443 type A.\r
	14	//-----------------------------------------------------------------------------\r
	15	\r
	16	#include "mifarecmd.h"\r
	17	#include "apps.h"\r
	18	#include "util.h"\r
	19	#include "crc.h"\r
	20	#include "protocols.h"\r
	21	#include "parity.h"\r
	22	\r
	23	//-----------------------------------------------------------------------------\r
	24	// Select, Authenticate, Read a MIFARE tag. \r
	25	// read block\r
	26	//-----------------------------------------------------------------------------\r
	27	void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
	28	{\r
	29	// params\r
	30	uint8_t blockNo = arg0;\r
	31	uint8_t keyType = arg1;\r
	32	uint64_t ui64Key = 0;\r
	33	ui64Key = bytes_to_num(datain, 6);\r
	34	\r
	35	// variables\r
	36	byte_t isOK = 0;\r
	37	byte_t dataoutbuf[16] = {0x00};\r
	38	uint8_t uid[10] = {0x00};\r
	39	uint32_t cuid = 0;\r
	40	struct Crypto1State mpcs = {0, 0};\r
	41	struct Crypto1State *pcs;\r
	42	pcs = &mpcs;\r
	43	\r
	44	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	45	\r
	46	clear_trace();\r
	47	set_tracing(true);\r
	48	\r
	49	LED_A_ON();\r
	50	LED_B_OFF();\r
	51	LED_C_OFF();\r
	52	\r
	53	while (true) {\r
	54	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r
	55	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	56	break;\r
	57	};\r
	58	\r
	59	if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
	60	if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
	61	break;\r
	62	};\r
	63	\r
	64	if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r
	65	if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r
	66	break;\r
	67	};\r
	68	\r
	69	if(mifare_classic_halt(pcs, cuid)) {\r
	70	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	71	break;\r
	72	};\r
	73	\r
	74	isOK = 1;\r
	75	break;\r
	76	}\r
	77	\r
	78	// ----------------------------- crypto1 destroy\r
	79	crypto1_destroy(pcs);\r
	80	\r
	81	if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r
	82	\r
	83	LED_B_ON();\r
	84	cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r
	85	LED_B_OFF();\r
	86	\r
	87	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	88	LEDsoff();\r
	89	}\r
	90	\r
	91	void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){\r
	92	\r
	93	bool turnOffField = (arg0 == 1);\r
	94	\r
	95	LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
	96	\r
	97	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	98	\r
	99	clear_trace();\r
	100	set_tracing(true);\r
	101	\r
	102	if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {\r
	103	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
	104	OnError(0);\r
	105	return;\r
	106	};\r
	107	\r
	108	if(!mifare_ultra_auth(keybytes)){\r
	109	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");\r
	110	OnError(1);\r
	111	return;\r
	112	}\r
	113	\r
	114	if (turnOffField) {\r
	115	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	116	LEDsoff();\r
	117	}\r
	118	cmd_send(CMD_ACK,1,0,0,0,0);\r
	119	}\r
	120	\r
	121	// Arg0 = BlockNo,\r
	122	// Arg1 = UsePwd bool\r
	123	// datain = PWD bytes,\r
	124	void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r
	125	{\r
	126	uint8_t blockNo = arg0;\r
	127	byte_t dataout[16] = {0x00};\r
	128	bool useKey = (arg1 == 1); //UL_C\r
	129	bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r
	130	\r
	131	LEDsoff();\r
	132	LED_A_ON();\r
	133	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	134	\r
	135	clear_trace();\r
	136	set_tracing(true);\r
	137	\r
	138	int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);\r
	139	if(!len) {\r
	140	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r
	141	OnError(1);\r
	142	return;\r
	143	}\r
	144	\r
	145	// UL-C authentication\r
	146	if ( useKey ) {\r
	147	uint8_t key[16] = {0x00};\r
	148	memcpy(key, datain, sizeof(key) );\r
	149	\r
	150	if ( !mifare_ultra_auth(key) ) {\r
	151	OnError(1);\r
	152	return;\r
	153	}\r
	154	}\r
	155	\r
	156	// UL-EV1 / NTAG authentication\r
	157	if ( usePwd ) {\r
	158	uint8_t pwd[4] = {0x00};\r
	159	memcpy(pwd, datain, 4);\r
	160	uint8_t pack[4] = {0,0,0,0};\r
	161	if (!mifare_ul_ev1_auth(pwd, pack)) {\r
	162	OnError(1);\r
	163	return;\r
	164	}\r
	165	} \r
	166	\r
	167	if( mifare_ultra_readblock(blockNo, dataout) ) {\r
	168	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r
	169	OnError(2);\r
	170	return;\r
	171	}\r
	172	\r
	173	if( mifare_ultra_halt() ) {\r
	174	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
	175	OnError(3);\r
	176	return;\r
	177	}\r
	178	\r
	179	cmd_send(CMD_ACK,1,0,0,dataout,16);\r
	180	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	181	LEDsoff();\r
	182	}\r
	183	\r
	184	//-----------------------------------------------------------------------------\r
	185	// Select, Authenticate, Read a MIFARE tag. \r
	186	// read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r
	187	//-----------------------------------------------------------------------------\r
	188	void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
	189	{\r
	190	// params\r
	191	uint8_t sectorNo = arg0;\r
	192	uint8_t keyType = arg1;\r
	193	uint64_t ui64Key = 0;\r
	194	ui64Key = bytes_to_num(datain, 6);\r
	195	\r
	196	// variables\r
	197	byte_t isOK = 0;\r
	198	byte_t dataoutbuf[16 * 16];\r
	199	uint8_t uid[10] = {0x00};\r
	200	uint32_t cuid = 0;\r
	201	struct Crypto1State mpcs = {0, 0};\r
	202	struct Crypto1State *pcs;\r
	203	pcs = &mpcs;\r
	204	\r
	205	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	206	\r
	207	clear_trace();\r
	208	set_tracing(true);\r
	209	\r
	210	LED_A_ON();\r
	211	LED_B_OFF();\r
	212	LED_C_OFF();\r
	213	\r
	214	isOK = 1;\r
	215	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r
	216	isOK = 0;\r
	217	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	218	}\r
	219	\r
	220	\r
	221	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
	222	isOK = 0;\r
	223	if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
	224	}\r
	225	\r
	226	for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
	227	if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r
	228	isOK = 0;\r
	229	if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r
	230	break;\r
	231	}\r
	232	}\r
	233	\r
	234	if(mifare_classic_halt(pcs, cuid)) {\r
	235	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	236	}\r
	237	\r
	238	// ----------------------------- crypto1 destroy\r
	239	crypto1_destroy(pcs);\r
	240	\r
	241	if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r
	242	\r
	243	LED_B_ON();\r
	244	cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r
	245	LED_B_OFF();\r
	246	\r
	247	// Thats it...\r
	248	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	249	LEDsoff();\r
	250	}\r
	251	\r
	252	// arg0 = blockNo (start)\r
	253	// arg1 = Pages (number of blocks)\r
	254	// arg2 = useKey\r
	255	// datain = KEY bytes\r
	256	void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r
	257	{\r
	258	LEDsoff();\r
	259	LED_A_ON();\r
	260	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	261	\r
	262	// free eventually allocated BigBuf memory\r
	263	BigBuf_free(); BigBuf_Clear_ext(false);\r
	264	clear_trace();\r
	265	set_tracing(true);\r
	266	\r
	267	// params\r
	268	uint8_t blockNo = arg0;\r
	269	uint16_t blocks = arg1;\r
	270	bool useKey = (arg2 == 1); //UL_C\r
	271	bool usePwd = (arg2 == 2); //UL_EV1/NTAG\r
	272	uint32_t countblocks = 0;\r
	273	uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);\r
	274	if (dataout == NULL){\r
	275	Dbprintf("out of memory");\r
	276	OnError(1);\r
	277	return;\r
	278	}\r
	279	\r
	280	int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);\r
	281	if (!len) {\r
	282	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r
	283	OnError(1);\r
	284	return;\r
	285	}\r
	286	\r
	287	// UL-C authentication\r
	288	if ( useKey ) {\r
	289	uint8_t key[16] = {0x00};\r
	290	memcpy(key, datain, sizeof(key) );\r
	291	\r
	292	if ( !mifare_ultra_auth(key) ) {\r
	293	OnError(1);\r
	294	return;\r
	295	}\r
	296	}\r
	297	\r
	298	// UL-EV1 / NTAG authentication\r
	299	if (usePwd) {\r
	300	uint8_t pwd[4] = {0x00};\r
	301	memcpy(pwd, datain, sizeof(pwd));\r
	302	uint8_t pack[4] = {0,0,0,0};\r
	303	\r
	304	if (!mifare_ul_ev1_auth(pwd, pack)){\r
	305	OnError(1);\r
	306	return; \r
	307	}\r
	308	}\r
	309	\r
	310	for (int i = 0; i < blocks; i++){\r
	311	if ((i*4) + 4 >= CARD_MEMORY_SIZE) {\r
	312	Dbprintf("Data exceeds buffer!!");\r
	313	break;\r
	314	}\r
	315	\r
	316	len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);\r
	317	\r
	318	if (len) {\r
	319	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r
	320	// if no blocks read - error out\r
	321	if (i==0){\r
	322	OnError(2);\r
	323	return;\r
	324	} else {\r
	325	//stop at last successful read block and return what we got\r
	326	break;\r
	327	}\r
	328	} else {\r
	329	countblocks++;\r
	330	}\r
	331	}\r
	332	\r
	333	len = mifare_ultra_halt();\r
	334	if (len) {\r
	335	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
	336	OnError(3);\r
	337	return;\r
	338	}\r
	339	\r
	340	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);\r
	341	\r
	342	countblocks *= 4;\r
	343	\r
	344	cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);\r
	345	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	346	LEDsoff();\r
	347	BigBuf_free();\r
	348	}\r
	349	\r
	350	//-----------------------------------------------------------------------------\r
	351	// Select, Authenticate, Write a MIFARE tag. \r
	352	// read block\r
	353	//-----------------------------------------------------------------------------\r
	354	void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
	355	{\r
	356	// params\r
	357	uint8_t blockNo = arg0;\r
	358	uint8_t keyType = arg1;\r
	359	uint64_t ui64Key = 0;\r
	360	byte_t blockdata[16] = {0x00};\r
	361	\r
	362	ui64Key = bytes_to_num(datain, 6);\r
	363	memcpy(blockdata, datain + 10, 16);\r
	364	\r
	365	// variables\r
	366	byte_t isOK = 0;\r
	367	uint8_t uid[10] = {0x00};\r
	368	uint32_t cuid = 0;\r
	369	struct Crypto1State mpcs = {0, 0};\r
	370	struct Crypto1State *pcs;\r
	371	pcs = &mpcs;\r
	372	\r
	373	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	374	\r
	375	clear_trace();\r
	376	set_tracing(true);\r
	377	\r
	378	LED_A_ON();\r
	379	LED_B_OFF();\r
	380	LED_C_OFF();\r
	381	\r
	382	while (true) {\r
	383	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r
	384	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	385	break;\r
	386	};\r
	387	\r
	388	if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
	389	if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
	390	break;\r
	391	};\r
	392	\r
	393	if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r
	394	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	395	break;\r
	396	};\r
	397	\r
	398	if(mifare_classic_halt(pcs, cuid)) {\r
	399	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	400	break;\r
	401	};\r
	402	\r
	403	isOK = 1;\r
	404	break;\r
	405	}\r
	406	\r
	407	// ----------------------------- crypto1 destroy\r
	408	crypto1_destroy(pcs);\r
	409	\r
	410	if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
	411	\r
	412	LED_B_ON();\r
	413	cmd_send(CMD_ACK,isOK,0,0,0,0);\r
	414	LED_B_OFF();\r
	415	\r
	416	\r
	417	// Thats it...\r
	418	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	419	LEDsoff();\r
	420	}\r
	421	\r
	422	/* // Command not needed but left for future testing \r
	423	void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)\r
	424	{\r
	425	uint8_t blockNo = arg0;\r
	426	byte_t blockdata[16] = {0x00};\r
	427	\r
	428	memcpy(blockdata, datain, 16);\r
	429	\r
	430	uint8_t uid[10] = {0x00};\r
	431	\r
	432	LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
	433	\r
	434	clear_trace();\r
	435	set_tracing(true);\r
	436	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	437	\r
	438	if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {\r
	439	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	440	OnError(0);\r
	441	return;\r
	442	};\r
	443	\r
	444	if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {\r
	445	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	446	OnError(0);\r
	447	return; };\r
	448	\r
	449	if(mifare_ultra_halt()) {\r
	450	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	451	OnError(0);\r
	452	return;\r
	453	};\r
	454	\r
	455	if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
	456	\r
	457	cmd_send(CMD_ACK,1,0,0,0,0);\r
	458	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	459	LEDsoff();\r
	460	}\r
	461	*/\r
	462	\r
	463	// Arg0 : Block to write to.\r
	464	// Arg1 : 0 = use no authentication.\r
	465	// 1 = use 0x1A authentication.\r
	466	// 2 = use 0x1B authentication.\r
	467	// datain : 4 first bytes is data to be written.\r
	468	// : 4/16 next bytes is authentication key.\r
	469	void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r
	470	{\r
	471	uint8_t blockNo = arg0;\r
	472	bool useKey = (arg1 == 1); //UL_C\r
	473	bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r
	474	byte_t blockdata[4] = {0x00};\r
	475	\r
	476	memcpy(blockdata, datain,4);\r
	477	\r
	478	LEDsoff();\r
	479	LED_A_ON();\r
	480	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	481	\r
	482	clear_trace();\r
	483	set_tracing(true);\r
	484	\r
	485	if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {\r
	486	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	487	OnError(0);\r
	488	return;\r
	489	};\r
	490	\r
	491	// UL-C authentication\r
	492	if ( useKey ) {\r
	493	uint8_t key[16] = {0x00}; \r
	494	memcpy(key, datain+4, sizeof(key) );\r
	495	\r
	496	if ( !mifare_ultra_auth(key) ) {\r
	497	OnError(1);\r
	498	return; \r
	499	}\r
	500	}\r
	501	\r
	502	// UL-EV1 / NTAG authentication\r
	503	if (usePwd) { \r
	504	uint8_t pwd[4] = {0x00};\r
	505	memcpy(pwd, datain+4, 4);\r
	506	uint8_t pack[4] = {0,0,0,0};\r
	507	if (!mifare_ul_ev1_auth(pwd, pack)) {\r
	508	OnError(1);\r
	509	return; \r
	510	}\r
	511	}\r
	512	\r
	513	if(mifare_ultra_writeblock(blockNo, blockdata)) {\r
	514	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	515	OnError(0);\r
	516	return;\r
	517	};\r
	518	\r
	519	if(mifare_ultra_halt()) {\r
	520	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	521	OnError(0);\r
	522	return;\r
	523	};\r
	524	\r
	525	if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
	526	\r
	527	cmd_send(CMD_ACK,1,0,0,0,0);\r
	528	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	529	LEDsoff();\r
	530	}\r
	531	\r
	532	void MifareUSetPwd(uint8_t arg0, uint8_t *datain){\r
	533	\r
	534	uint8_t pwd[16] = {0x00};\r
	535	byte_t blockdata[4] = {0x00};\r
	536	\r
	537	memcpy(pwd, datain, 16);\r
	538	\r
	539	LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
	540	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	541	\r
	542	clear_trace();\r
	543	set_tracing(true);\r
	544	\r
	545	if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {\r
	546	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	547	OnError(0);\r
	548	return;\r
	549	};\r
	550	\r
	551	blockdata[0] = pwd[7];\r
	552	blockdata[1] = pwd[6];\r
	553	blockdata[2] = pwd[5];\r
	554	blockdata[3] = pwd[4];\r
	555	if(mifare_ultra_writeblock( 44, blockdata)) {\r
	556	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	557	OnError(44);\r
	558	return;\r
	559	};\r
	560	\r
	561	blockdata[0] = pwd[3];\r
	562	blockdata[1] = pwd[2];\r
	563	blockdata[2] = pwd[1];\r
	564	blockdata[3] = pwd[0];\r
	565	if(mifare_ultra_writeblock( 45, blockdata)) {\r
	566	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	567	OnError(45);\r
	568	return;\r
	569	};\r
	570	\r
	571	blockdata[0] = pwd[15];\r
	572	blockdata[1] = pwd[14];\r
	573	blockdata[2] = pwd[13];\r
	574	blockdata[3] = pwd[12];\r
	575	if(mifare_ultra_writeblock( 46, blockdata)) {\r
	576	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	577	OnError(46);\r
	578	return;\r
	579	};\r
	580	\r
	581	blockdata[0] = pwd[11];\r
	582	blockdata[1] = pwd[10];\r
	583	blockdata[2] = pwd[9];\r
	584	blockdata[3] = pwd[8];\r
	585	if(mifare_ultra_writeblock( 47, blockdata)) {\r
	586	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	587	OnError(47);\r
	588	return;\r
	589	}; \r
	590	\r
	591	if(mifare_ultra_halt()) {\r
	592	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	593	OnError(0);\r
	594	return;\r
	595	};\r
	596	\r
	597	cmd_send(CMD_ACK,1,0,0,0,0);\r
	598	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	599	LEDsoff();\r
	600	}\r
	601	\r
	602	// Return 1 if the nonce is invalid else return 0\r
	603	int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r
	604	return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r
	605	(oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r
	606	(oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r
	607	}\r
	608	\r
	609	\r
	610	//-----------------------------------------------------------------------------\r
	611	// acquire encrypted nonces in order to perform the attack described in\r
	612	// Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened\r
	613	// Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on \r
	614	// Computer and Communications Security, 2015\r
	615	//-----------------------------------------------------------------------------\r
	616	#define AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)\r
	617	#define PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication \r
	618	\r
	619	void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)\r
	620	{\r
	621	uint64_t ui64Key = 0;\r
	622	uint8_t uid[10] = {0x00};\r
	623	uint32_t cuid = 0;\r
	624	uint8_t cascade_levels = 0;\r
	625	struct Crypto1State mpcs = {0, 0};\r
	626	struct Crypto1State *pcs;\r
	627	pcs = &mpcs;\r
	628	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r
	629	int16_t isOK = 0;\r
	630	uint8_t par_enc[1] = {0x00};\r
	631	uint8_t nt_par_enc = 0;\r
	632	uint8_t buf[USB_CMD_DATA_SIZE] = {0x00};\r
	633	uint32_t timeout = 0;\r
	634	\r
	635	uint8_t blockNo = arg0 & 0xff;\r
	636	uint8_t keyType = (arg0 >> 8) & 0xff;\r
	637	uint8_t targetBlockNo = arg1 & 0xff;\r
	638	uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
	639	ui64Key = bytes_to_num(datain, 6);\r
	640	bool initialize = flags & 0x0001;\r
	641	bool slow = flags & 0x0002;\r
	642	bool field_off = flags & 0x0004;\r
	643	\r
	644	LED_A_ON();\r
	645	LED_C_OFF();\r
	646	\r
	647	if (initialize) {\r
	648	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	649	clear_trace();\r
	650	set_tracing(true);\r
	651	}\r
	652	\r
	653	LED_C_ON();\r
	654	\r
	655	uint16_t num_nonces = 0;\r
	656	bool have_uid = false;\r
	657	for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {\r
	658	\r
	659	// Test if the action was cancelled\r
	660	if(BUTTON_PRESS()) {\r
	661	isOK = 2;\r
	662	field_off = true;\r
	663	break;\r
	664	}\r
	665	\r
	666	if (!have_uid) { // need a full select cycle to get the uid first\r
	667	iso14a_card_select_t card_info; \r
	668	if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {\r
	669	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");\r
	670	continue;\r
	671	}\r
	672	switch (card_info.uidlen) {\r
	673	case 4 : cascade_levels = 1; break;\r
	674	case 7 : cascade_levels = 2; break;\r
	675	case 10: cascade_levels = 3; break;\r
	676	default: break;\r
	677	}\r
	678	have_uid = true; \r
	679	} else { // no need for anticollision. We can directly select the card\r
	680	if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {\r
	681	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");\r
	682	continue;\r
	683	}\r
	684	}\r
	685	\r
	686	if (slow) {\r
	687	timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;\r
	688	while(GetCountSspClk() < timeout);\r
	689	}\r
	690	\r
	691	uint32_t nt1;\r
	692	if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {\r
	693	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");\r
	694	continue;\r
	695	}\r
	696	\r
	697	// nested authentication\r
	698	uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);\r
	699	if (len != 4) {\r
	700	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);\r
	701	continue;\r
	702	}\r
	703	\r
	704	// send a dummy byte as reader response in order to trigger the cards authentication timeout\r
	705	uint8_t dummy_answer = 0;\r
	706	ReaderTransmit(&dummy_answer, 1, NULL);\r
	707	timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;\r
	708	\r
	709	num_nonces++;\r
	710	if (num_nonces % 2) {\r
	711	memcpy(buf+i, receivedAnswer, 4);\r
	712	nt_par_enc = par_enc[0] & 0xf0;\r
	713	} else {\r
	714	nt_par_enc \|= par_enc[0] >> 4;\r
	715	memcpy(buf+i+4, receivedAnswer, 4);\r
	716	memcpy(buf+i+8, &nt_par_enc, 1);\r
	717	i += 9;\r
	718	}\r
	719	\r
	720	// wait for the card to become ready again\r
	721	while(GetCountSspClk() < timeout);\r
	722	\r
	723	}\r
	724	\r
	725	LED_C_OFF();\r
	726	\r
	727	crypto1_destroy(pcs);\r
	728	\r
	729	LED_B_ON();\r
	730	cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));\r
	731	LED_B_OFF();\r
	732	\r
	733	if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");\r
	734	\r
	735	if (field_off) {\r
	736	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	737	LEDsoff();\r
	738	}\r
	739	}\r
	740	\r
	741	\r
	742	//-----------------------------------------------------------------------------\r
	743	// MIFARE nested authentication. \r
	744	// \r
	745	//-----------------------------------------------------------------------------\r
	746	void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r
	747	{\r
	748	// params\r
	749	uint8_t blockNo = arg0 & 0xff;\r
	750	uint8_t keyType = (arg0 >> 8) & 0xff;\r
	751	uint8_t targetBlockNo = arg1 & 0xff;\r
	752	uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
	753	uint64_t ui64Key = 0;\r
	754	\r
	755	ui64Key = bytes_to_num(datain, 6);\r
	756	\r
	757	// variables\r
	758	uint16_t rtr, i, j, len;\r
	759	uint16_t davg = 0;\r
	760	static uint16_t dmin, dmax;\r
	761	uint8_t uid[10] = {0x00};\r
	762	uint32_t cuid = 0, nt1, nt2, nttmp, nttest, ks1;\r
	763	uint8_t par[1] = {0x00};\r
	764	uint32_t target_nt[2] = {0x00}, target_ks[2] = {0x00};\r
	765	\r
	766	uint8_t par_array[4] = {0x00};\r
	767	uint16_t ncount = 0;\r
	768	struct Crypto1State mpcs = {0, 0};\r
	769	struct Crypto1State *pcs;\r
	770	pcs = &mpcs;\r
	771	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r
	772	\r
	773	uint32_t auth1_time, auth2_time;\r
	774	static uint16_t delta_time = 0;\r
	775	\r
	776	LED_A_ON();\r
	777	LED_C_OFF();\r
	778	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	779	\r
	780	// free eventually allocated BigBuf memory\r
	781	BigBuf_free(); BigBuf_Clear_ext(false);\r
	782	\r
	783	if (calibrate) clear_trace();\r
	784	set_tracing(true);\r
	785	\r
	786	// statistics on nonce distance\r
	787	int16_t isOK = 0;\r
	788	#define NESTED_MAX_TRIES 12\r
	789	uint16_t unsuccessfull_tries = 0;\r
	790	if (calibrate) { // for first call only. Otherwise reuse previous calibration\r
	791	LED_B_ON();\r
	792	WDT_HIT();\r
	793	\r
	794	davg = dmax = 0;\r
	795	dmin = 2000;\r
	796	delta_time = 0;\r
	797	\r
	798	for (rtr = 0; rtr < 17; rtr++) {\r
	799	\r
	800	// Test if the action was cancelled\r
	801	if(BUTTON_PRESS()) {\r
	802	isOK = -2;\r
	803	break;\r
	804	}\r
	805	\r
	806	// prepare next select. No need to power down the card.\r
	807	if(mifare_classic_halt(pcs, cuid)) {\r
	808	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
	809	rtr--;\r
	810	continue;\r
	811	}\r
	812	\r
	813	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r
	814	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
	815	rtr--;\r
	816	continue;\r
	817	};\r
	818	\r
	819	auth1_time = 0;\r
	820	if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
	821	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
	822	rtr--;\r
	823	continue;\r
	824	};\r
	825	auth2_time = (delta_time) ? auth1_time + delta_time : 0;\r
	826	\r
	827	if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r
	828	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
	829	rtr--;\r
	830	continue;\r
	831	};\r
	832	\r
	833	nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r
	834	for (i = 101; i < 1200; i++) {\r
	835	nttmp = prng_successor(nttmp, 1);\r
	836	if (nttmp == nt2) break;\r
	837	}\r
	838	\r
	839	if (i != 1200) {\r
	840	if (rtr != 0) {\r
	841	davg += i;\r
	842	dmin = MIN(dmin, i);\r
	843	dmax = MAX(dmax, i);\r
	844	}\r
	845	else {\r
	846	delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r
	847	}\r
	848	if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r
	849	} else {\r
	850	unsuccessfull_tries++;\r
	851	if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)\r
	852	isOK = -3;\r
	853	}\r
	854	}\r
	855	}\r
	856	\r
	857	davg = (davg + (rtr - 1)/2) / (rtr - 1);\r
	858	\r
	859	if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);\r
	860	\r
	861	dmin = davg - 2;\r
	862	dmax = davg + 2;\r
	863	\r
	864	LED_B_OFF();\r
	865	}\r
	866	// ------------------------------------------------------------------------------------------------- \r
	867	\r
	868	LED_C_ON();\r
	869	\r
	870	// get crypted nonces for target sector\r
	871	for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r
	872	\r
	873	target_nt[i] = 0;\r
	874	while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r
	875	\r
	876	// prepare next select. No need to power down the card.\r
	877	if(mifare_classic_halt(pcs, cuid)) {\r
	878	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
	879	continue;\r
	880	}\r
	881	\r
	882	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r
	883	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
	884	continue;\r
	885	};\r
	886	\r
	887	auth1_time = 0;\r
	888	if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
	889	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
	890	continue;\r
	891	};\r
	892	\r
	893	// nested authentication\r
	894	auth2_time = auth1_time + delta_time;\r
	895	\r
	896	len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r
	897	if (len != 4) {\r
	898	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r
	899	continue;\r
	900	};\r
	901	\r
	902	nt2 = bytes_to_num(receivedAnswer, 4); \r
	903	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r
	904	\r
	905	// Parity validity check\r
	906	// for (j = 0; j < 4; j++) {\r
	907	// par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r
	908	// }\r
	909	par_array[0] = (oddparity8(receivedAnswer[0]) != ((par[0] >> (7-0)) & 0x01));\r
	910	par_array[1] = (oddparity8(receivedAnswer[1]) != ((par[0] >> (7-1)) & 0x01));\r
	911	par_array[2] = (oddparity8(receivedAnswer[2]) != ((par[0] >> (7-2)) & 0x01));\r
	912	par_array[3] = (oddparity8(receivedAnswer[3]) != ((par[0] >> (7-3)) & 0x01));\r
	913	\r
	914	ncount = 0;\r
	915	nttest = prng_successor(nt1, dmin - 1);\r
	916	for (j = dmin; j < dmax + 1; j++) {\r
	917	nttest = prng_successor(nttest, 1);\r
	918	ks1 = nt2 ^ nttest;\r
	919	\r
	920	if (valid_nonce(nttest, nt2, ks1, par_array)){\r
	921	if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r
	922	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r
	923	target_nt[i] = 0;\r
	924	break;\r
	925	}\r
	926	target_nt[i] = nttest;\r
	927	target_ks[i] = ks1;\r
	928	ncount++;\r
	929	if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r
	930	target_nt[i] = 0;\r
	931	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r
	932	break;\r
	933	}\r
	934	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r
	935	}\r
	936	}\r
	937	if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r
	938	}\r
	939	}\r
	940	\r
	941	LED_C_OFF();\r
	942	\r
	943	// ----------------------------- crypto1 destroy\r
	944	crypto1_destroy(pcs);\r
	945	\r
	946	byte_t buf[4 + 4 * 4] = {0};\r
	947	memcpy(buf, &cuid, 4);\r
	948	memcpy(buf+4, &target_nt[0], 4);\r
	949	memcpy(buf+8, &target_ks[0], 4);\r
	950	memcpy(buf+12, &target_nt[1], 4);\r
	951	memcpy(buf+16, &target_ks[1], 4);\r
	952	\r
	953	LED_B_ON();\r
	954	cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
	955	LED_B_OFF();\r
	956	\r
	957	if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r
	958	\r
	959	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	960	LEDsoff();\r
	961	set_tracing(FALSE);\r
	962	}\r
	963	\r
	964	//-----------------------------------------------------------------------------\r
	965	// MIFARE check keys. key count up to 85. \r
	966	// \r
	967	//-----------------------------------------------------------------------------\r
	968	void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) {\r
	969	uint8_t blockNo = arg0 & 0xff;\r
	970	uint8_t keyType = (arg0 >> 8) & 0xff;\r
	971	bool clearTrace = arg1;\r
	972	uint8_t keyCount = arg2;\r
	973	uint64_t ui64Key = 0;\r
	974	\r
	975	bool have_uid = FALSE;\r
	976	uint8_t cascade_levels = 0;\r
	977	uint32_t timeout = 0;\r
	978	\r
	979	int i;\r
	980	byte_t isOK = 0;\r
	981	uint8_t uid[10] = {0x00};\r
	982	uint32_t cuid = 0;\r
	983	struct Crypto1State mpcs = {0, 0};\r
	984	struct Crypto1State *pcs;\r
	985	pcs = &mpcs;\r
	986	\r
	987	// save old debuglevel, and tempory turn off dbg printing. speedissues.\r
	988	int OLD_MF_DBGLEVEL = MF_DBGLEVEL; \r
	989	MF_DBGLEVEL = MF_DBG_NONE;\r
	990	\r
	991	LEDsoff();\r
	992	LED_A_ON();\r
	993	\r
	994	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	995	\r
	996	if (clearTrace) \r
	997	clear_trace();\r
	998	\r
	999	set_tracing(TRUE);\r
	1000	\r
	1001	for (i = 0; i < keyCount; ++i) {\r
	1002	\r
	1003	//mifare_classic_halt(pcs, cuid);\r
	1004	\r
	1005	// this part is from Piwi's faster nonce collecting part in Hardnested.\r
	1006	if (!have_uid) { // need a full select cycle to get the uid first\r
	1007	iso14a_card_select_t card_info; \r
	1008	if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {\r
	1009	if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card (ALL)");\r
	1010	break;\r
	1011	}\r
	1012	switch (card_info.uidlen) {\r
	1013	case 4 : cascade_levels = 1; break;\r
	1014	case 7 : cascade_levels = 2; break;\r
	1015	case 10: cascade_levels = 3; break;\r
	1016	default: break;\r
	1017	}\r
	1018	have_uid = TRUE; \r
	1019	} else { // no need for anticollision. We can directly select the card\r
	1020	if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {\r
	1021	if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card (UID)");\r
	1022	continue;\r
	1023	}\r
	1024	}\r
	1025	\r
	1026	ui64Key = bytes_to_num(datain + i * 6, 6);\r
	1027	\r
	1028	if (mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
	1029	\r
	1030	uint8_t dummy_answer = 0;\r
	1031	ReaderTransmit(&dummy_answer, 1, NULL);\r
	1032	timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;\r
	1033	\r
	1034	// wait for the card to become ready again\r
	1035	while(GetCountSspClk() < timeout);\r
	1036	\r
	1037	continue;\r
	1038	}\r
	1039	isOK = 1;\r
	1040	break;\r
	1041	}\r
	1042	\r
	1043	LED_B_ON();\r
	1044	cmd_send(CMD_ACK, isOK, 0, 0, datain + i * 6, 6);\r
	1045	\r
	1046	// restore debug level\r
	1047	MF_DBGLEVEL = OLD_MF_DBGLEVEL; \r
	1048	\r
	1049	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1050	LEDsoff();\r
	1051	set_tracing(FALSE);\r
	1052	crypto1_destroy(pcs);\r
	1053	}\r
	1054	\r
	1055	//-----------------------------------------------------------------------------\r
	1056	// MIFARE commands set debug level\r
	1057	// \r
	1058	//-----------------------------------------------------------------------------\r
	1059	void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1060	MF_DBGLEVEL = arg0;\r
	1061	Dbprintf("Debug level: %d", MF_DBGLEVEL);\r
	1062	}\r
	1063	\r
	1064	//-----------------------------------------------------------------------------\r
	1065	// Work with emulator memory\r
	1066	// \r
	1067	// Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not\r
	1068	// involved in dealing with emulator memory. But if it is called later, it might\r
	1069	// destroy the Emulator Memory.\r
	1070	//-----------------------------------------------------------------------------\r
	1071	\r
	1072	void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1073	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r
	1074	emlClearMem();\r
	1075	}\r
	1076	\r
	1077	void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1078	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r
	1079	if (arg2==0) arg2 = 16; // backwards compat... default bytewidth\r
	1080	emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width\r
	1081	}\r
	1082	\r
	1083	void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1084	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r
	1085	byte_t buf[USB_CMD_DATA_SIZE] = {0x00};\r
	1086	emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r
	1087	\r
	1088	LED_B_ON();\r
	1089	cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r
	1090	LED_B_OFF();\r
	1091	}\r
	1092	\r
	1093	//-----------------------------------------------------------------------------\r
	1094	// Load a card into the emulator memory\r
	1095	// \r
	1096	//-----------------------------------------------------------------------------\r
	1097	void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1098	uint8_t numSectors = arg0;\r
	1099	uint8_t keyType = arg1;\r
	1100	uint64_t ui64Key = 0;\r
	1101	uint32_t cuid = 0;\r
	1102	struct Crypto1State mpcs = {0, 0};\r
	1103	struct Crypto1State *pcs;\r
	1104	pcs = &mpcs;\r
	1105	\r
	1106	// variables\r
	1107	byte_t dataoutbuf[16] = {0x00};\r
	1108	byte_t dataoutbuf2[16] = {0x00};\r
	1109	uint8_t uid[10] = {0x00};\r
	1110	\r
	1111	LED_A_ON();\r
	1112	LED_B_OFF();\r
	1113	LED_C_OFF();\r
	1114	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1115	\r
	1116	clear_trace();\r
	1117	set_tracing(TRUE);\r
	1118	\r
	1119	bool isOK = true;\r
	1120	\r
	1121	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r
	1122	isOK = false;\r
	1123	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	1124	}\r
	1125	\r
	1126	for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
	1127	ui64Key = emlGetKey(sectorNo, keyType);\r
	1128	if (sectorNo == 0){\r
	1129	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
	1130	isOK = false;\r
	1131	if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r
	1132	break;\r
	1133	}\r
	1134	} else {\r
	1135	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r
	1136	isOK = false;\r
	1137	if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r
	1138	break;\r
	1139	}\r
	1140	}\r
	1141	\r
	1142	for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
	1143	if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r
	1144	isOK = false;\r
	1145	if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r
	1146	break;\r
	1147	}\r
	1148	if (isOK) {\r
	1149	if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r
	1150	emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
	1151	} else { // sector trailer, keep the keys, set only the AC\r
	1152	emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
	1153	memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r
	1154	emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
	1155	}\r
	1156	}\r
	1157	}\r
	1158	\r
	1159	}\r
	1160	\r
	1161	if(mifare_classic_halt(pcs, cuid))\r
	1162	if (MF_DBGLEVEL >= 1)\r
	1163	Dbprintf("Halt error");\r
	1164	\r
	1165	// ----------------------------- crypto1 destroy\r
	1166	crypto1_destroy(pcs);\r
	1167	\r
	1168	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1169	LEDsoff();\r
	1170	\r
	1171	if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r
	1172	\r
	1173	set_tracing(FALSE);\r
	1174	}\r
	1175	\r
	1176	\r
	1177	//-----------------------------------------------------------------------------\r
	1178	// Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r
	1179	// \r
	1180	// PARAMS - workFlags\r
	1181	// bit 0 - need get UID\r
	1182	// bit 1 - need wupC\r
	1183	// bit 2 - need HALT after sequence\r
	1184	// bit 3 - need turn on FPGA before sequence\r
	1185	// bit 4 - need turn off FPGA\r
	1186	// bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)\r
	1187	// bit 6 - wipe tag.\r
	1188	//-----------------------------------------------------------------------------\r
	1189	// magic uid card generation 1 commands\r
	1190	uint8_t wupC1[] = { MIFARE_MAGICWUPC1 }; \r
	1191	uint8_t wupC2[] = { MIFARE_MAGICWUPC2 }; \r
	1192	uint8_t wipeC[] = { MIFARE_MAGICWIPEC }; \r
	1193	\r
	1194	void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){\r
	1195	\r
	1196	// params\r
	1197	uint8_t workFlags = arg0;\r
	1198	uint8_t blockNo = arg1;\r
	1199	\r
	1200	// variables\r
	1201	bool isOK = false; //assume we will get an error\r
	1202	uint8_t errormsg = 0x00;\r
	1203	uint8_t uid[10] = {0x00};\r
	1204	uint8_t data[18] = {0x00};\r
	1205	uint32_t cuid = 0;\r
	1206	\r
	1207	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r
	1208	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};\r
	1209	\r
	1210	if (workFlags & MAGIC_INIT) {\r
	1211	LED_A_ON();\r
	1212	LED_B_OFF();\r
	1213	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1214	clear_trace();\r
	1215	set_tracing(TRUE);\r
	1216	}\r
	1217	\r
	1218	//loop doesn't loop just breaks out if error\r
	1219	while (true) {\r
	1220	// read UID and return to client with write\r
	1221	if (workFlags & MAGIC_UID) {\r
	1222	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {\r
	1223	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
	1224	errormsg = MAGIC_UID;\r
	1225	// break;\r
	1226	}\r
	1227	\r
	1228	if ( mifare_classic_halt_ex(NULL) ) break;\r
	1229	}\r
	1230	\r
	1231	// wipe tag, fill it with zeros\r
	1232	if (workFlags & MAGIC_WIPE){\r
	1233	ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);\r
	1234	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1235	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");\r
	1236	errormsg = MAGIC_WIPE;\r
	1237	break;\r
	1238	}\r
	1239	\r
	1240	ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r
	1241	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1242	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wipeC error");\r
	1243	errormsg = MAGIC_WIPE;\r
	1244	break;\r
	1245	}\r
	1246	\r
	1247	if ( mifare_classic_halt_ex(NULL) ) break;\r
	1248	} \r
	1249	\r
	1250	// write block\r
	1251	if (workFlags & MAGIC_WUPC) {\r
	1252	ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);\r
	1253	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1254	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");\r
	1255	errormsg = MAGIC_WUPC;\r
	1256	break;\r
	1257	}\r
	1258	\r
	1259	ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
	1260	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1261	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");\r
	1262	errormsg = MAGIC_WUPC;\r
	1263	break;\r
	1264	}\r
	1265	}\r
	1266	\r
	1267	if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1268	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send command error");\r
	1269	errormsg = 4;\r
	1270	break;\r
	1271	}\r
	1272	\r
	1273	memcpy(data, datain, 16);\r
	1274	AppendCrc14443a(data, 16);\r
	1275	\r
	1276	ReaderTransmit(data, sizeof(data), NULL);\r
	1277	if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1278	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send data error");\r
	1279	errormsg = 0;\r
	1280	break;\r
	1281	} \r
	1282	\r
	1283	if (workFlags & MAGIC_OFF) \r
	1284	if ( mifare_classic_halt_ex(NULL) ) break;\r
	1285	\r
	1286	isOK = true;\r
	1287	break;\r
	1288	\r
	1289	} // end while \r
	1290	\r
	1291	if (isOK )\r
	1292	cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));\r
	1293	else\r
	1294	OnErrorMagic(errormsg);\r
	1295	\r
	1296	if (workFlags & MAGIC_OFF)\r
	1297	OnSuccessMagic();\r
	1298	}\r
	1299	\r
	1300	void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){\r
	1301	\r
	1302	uint8_t workFlags = arg0;\r
	1303	uint8_t blockNo = arg1;\r
	1304	uint8_t errormsg = 0x00;\r
	1305	bool isOK = false; //assume we will get an error\r
	1306	\r
	1307	// variables\r
	1308	uint8_t data[MAX_MIFARE_FRAME_SIZE];\r
	1309	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};\r
	1310	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};\r
	1311	\r
	1312	memset(data, 0x00, sizeof(data));\r
	1313	\r
	1314	if (workFlags & MAGIC_INIT) {\r
	1315	LED_A_ON();\r
	1316	LED_B_OFF();\r
	1317	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); \r
	1318	clear_trace();\r
	1319	set_tracing(TRUE);\r
	1320	}\r
	1321	\r
	1322	//loop doesn't loop just breaks out if error or done\r
	1323	while (true) {\r
	1324	if (workFlags & MAGIC_WUPC) {\r
	1325	ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);\r
	1326	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1327	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");\r
	1328	errormsg = MAGIC_WUPC;\r
	1329	break;\r
	1330	}\r
	1331	\r
	1332	ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
	1333	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1334	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");\r
	1335	errormsg = MAGIC_WUPC;\r
	1336	break;\r
	1337	}\r
	1338	}\r
	1339	\r
	1340	// read block \r
	1341	if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r
	1342	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");\r
	1343	errormsg = 0;\r
	1344	break;\r
	1345	}\r
	1346	\r
	1347	memcpy(data, receivedAnswer, sizeof(data));\r
	1348	\r
	1349	// send HALT\r
	1350	if (workFlags & MAGIC_HALT)\r
	1351	mifare_classic_halt_ex(NULL);\r
	1352	\r
	1353	isOK = true;\r
	1354	break;\r
	1355	}\r
	1356	// if MAGIC_DATAIN, the data stays on device side.\r
	1357	if (workFlags & MAGIC_DATAIN) {\r
	1358	if (isOK)\r
	1359	memcpy(datain, data, sizeof(data));\r
	1360	} else {\r
	1361	if (isOK) \r
	1362	cmd_send(CMD_ACK,1,0,0,data,sizeof(data)); \r
	1363	else \r
	1364	OnErrorMagic(errormsg); \r
	1365	}\r
	1366	\r
	1367	if (workFlags & MAGIC_OFF)\r
	1368	OnSuccessMagic();\r
	1369	}\r
	1370	\r
	1371	void MifareCIdent(){\r
	1372	\r
	1373	// variables\r
	1374	bool isOK = true; \r
	1375	uint8_t receivedAnswer[1] = {0x00};\r
	1376	uint8_t receivedAnswerPar[1] = {0x00};\r
	1377	\r
	1378	ReaderTransmitBitsPar(wupC1, 7, NULL, NULL);\r
	1379	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1380	isOK = false;\r
	1381	}\r
	1382	\r
	1383	ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
	1384	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1385	isOK = false;\r
	1386	}\r
	1387	\r
	1388	// removed the if, since some magic tags misbehavies and send an answer to it.\r
	1389	mifare_classic_halt(NULL, 0);\r
	1390	cmd_send(CMD_ACK,isOK,0,0,0,0);\r
	1391	}\r
	1392	\r
	1393	void OnSuccessMagic(){\r
	1394	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1395	LEDsoff();\r
	1396	set_tracing(FALSE); \r
	1397	}\r
	1398	void OnErrorMagic(uint8_t reason){\r
	1399	// ACK, ISOK, reason,0,0,0\r
	1400	cmd_send(CMD_ACK,0,reason,0,0,0);\r
	1401	OnSuccessMagic();\r
	1402	}\r
	1403	\r
	1404	void MifareCollectNonces(uint32_t arg0, uint32_t arg1){\r
	1405	}\r
	1406	\r
	1407	//\r
	1408	// DESFIRE\r
	1409	//\r
	1410	\r
	1411	void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r
	1412	\r
	1413	byte_t dataout[12] = {0x00};\r
	1414	uint8_t uid[10] = {0x00};\r
	1415	uint32_t cuid = 0;\r
	1416	\r
	1417	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1418	clear_trace();\r
	1419	set_tracing(true);\r
	1420	\r
	1421	int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);\r
	1422	if(!len) {\r
	1423	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
	1424	OnError(1);\r
	1425	return;\r
	1426	};\r
	1427	\r
	1428	if(mifare_desfire_des_auth1(cuid, dataout)){\r
	1429	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r
	1430	OnError(4);\r
	1431	return;\r
	1432	}\r
	1433	\r
	1434	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
	1435	cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r
	1436	}\r
	1437	\r
	1438	void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r
	1439	\r
	1440	uint32_t cuid = arg0;\r
	1441	uint8_t key[16] = {0x00};\r
	1442	byte_t dataout[12] = {0x00};\r
	1443	byte_t isOK = 0;\r
	1444	\r
	1445	memcpy(key, datain, 16);\r
	1446	\r
	1447	isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r
	1448	\r
	1449	if( isOK) {\r
	1450	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed"); \r
	1451	OnError(4);\r
	1452	return;\r
	1453	}\r
	1454	\r
	1455	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");\r
	1456	\r
	1457	cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r
	1458	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1459	LEDsoff();\r
	1460	}