cvs.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	//-----------------------------------------------------------------------------\r
	2	// Merlok - June 2011, 2012\r
	3	// Gerhard de Koning Gans - May 2008\r
	4	// Hagen Fritsch - June 2010\r
	5	// Midnitesnake - Dec 2013\r
	6	// Andy Davies - Apr 2014\r
	7	// Iceman - May 2014\r
	8	//\r
	9	// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
	10	// at your option, any later version. See the LICENSE.txt file for the text of\r
	11	// the license.\r
	12	//-----------------------------------------------------------------------------\r
	13	// Routines to support ISO 14443 type A.\r
	14	//-----------------------------------------------------------------------------\r
	15	\r
	16	#include "mifarecmd.h"\r
	17	\r
	18	#include "apps.h"\r
	19	#include "util.h"\r
	20	#include "parity.h"\r
	21	#include "crc.h"\r
	22	\r
	23	// the block number for the ISO14443-4 PCB\r
	24	static uint8_t pcb_blocknum = 0;\r
	25	// Deselect card by sending a s-block. the crc is precalced for speed\r
	26	static uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};\r
	27	\r
	28	//-----------------------------------------------------------------------------\r
	29	// Select, Authenticate, Read a MIFARE tag.\r
	30	// read block\r
	31	//-----------------------------------------------------------------------------\r
	32	void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
	33	{\r
	34	// params\r
	35	uint8_t blockNo = arg0;\r
	36	uint8_t keyType = arg1;\r
	37	uint64_t ui64Key = 0;\r
	38	ui64Key = bytes_to_num(datain, 6);\r
	39	\r
	40	// variables\r
	41	byte_t isOK = 0;\r
	42	byte_t dataoutbuf[16];\r
	43	uint8_t uid[10];\r
	44	uint32_t cuid;\r
	45	struct Crypto1State mpcs = {0, 0};\r
	46	struct Crypto1State *pcs;\r
	47	pcs = &mpcs;\r
	48	\r
	49	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	50	\r
	51	clear_trace();\r
	52	\r
	53	LED_A_ON();\r
	54	LED_B_OFF();\r
	55	LED_C_OFF();\r
	56	\r
	57	while (true) {\r
	58	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
	59	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	60	break;\r
	61	};\r
	62	\r
	63	if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
	64	if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
	65	break;\r
	66	};\r
	67	\r
	68	if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {\r
	69	if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");\r
	70	break;\r
	71	};\r
	72	\r
	73	if(mifare_classic_halt(pcs, cuid)) {\r
	74	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	75	break;\r
	76	};\r
	77	\r
	78	isOK = 1;\r
	79	break;\r
	80	}\r
	81	\r
	82	// ----------------------------- crypto1 destroy\r
	83	crypto1_destroy(pcs);\r
	84	\r
	85	if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");\r
	86	\r
	87	LED_B_ON();\r
	88	cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);\r
	89	LED_B_OFF();\r
	90	\r
	91	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	92	LEDsoff();\r
	93	}\r
	94	\r
	95	void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){\r
	96	\r
	97	bool turnOffField = (arg0 == 1);\r
	98	\r
	99	LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
	100	\r
	101	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	102	\r
	103	clear_trace();\r
	104	\r
	105	if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {\r
	106	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
	107	OnError(0);\r
	108	return;\r
	109	};\r
	110	\r
	111	if(!mifare_ultra_auth(keybytes)){\r
	112	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");\r
	113	OnError(1);\r
	114	return;\r
	115	}\r
	116	\r
	117	if (turnOffField) {\r
	118	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	119	LEDsoff();\r
	120	}\r
	121	cmd_send(CMD_ACK,1,0,0,0,0);\r
	122	}\r
	123	\r
	124	// Arg0 = BlockNo,\r
	125	// Arg1 = UsePwd bool\r
	126	// datain = PWD bytes,\r
	127	void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r
	128	{\r
	129	uint8_t blockNo = arg0;\r
	130	byte_t dataout[16] = {0x00};\r
	131	bool useKey = (arg1 == 1); //UL_C\r
	132	bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r
	133	\r
	134	LEDsoff();\r
	135	LED_A_ON();\r
	136	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	137	\r
	138	clear_trace();\r
	139	\r
	140	int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);\r
	141	if(!len) {\r
	142	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);\r
	143	OnError(1);\r
	144	return;\r
	145	}\r
	146	\r
	147	// UL-C authentication\r
	148	if ( useKey ) {\r
	149	uint8_t key[16] = {0x00};\r
	150	memcpy(key, datain, sizeof(key) );\r
	151	\r
	152	if ( !mifare_ultra_auth(key) ) {\r
	153	OnError(1);\r
	154	return;\r
	155	}\r
	156	}\r
	157	\r
	158	// UL-EV1 / NTAG authentication\r
	159	if ( usePwd ) {\r
	160	uint8_t pwd[4] = {0x00};\r
	161	memcpy(pwd, datain, 4);\r
	162	uint8_t pack[4] = {0,0,0,0};\r
	163	if (!mifare_ul_ev1_auth(pwd, pack)) {\r
	164	OnError(1);\r
	165	return;\r
	166	}\r
	167	}\r
	168	\r
	169	if( mifare_ultra_readblock(blockNo, dataout) ) {\r
	170	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");\r
	171	OnError(2);\r
	172	return;\r
	173	}\r
	174	\r
	175	if( mifare_ultra_halt() ) {\r
	176	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
	177	OnError(3);\r
	178	return;\r
	179	}\r
	180	\r
	181	cmd_send(CMD_ACK,1,0,0,dataout,16);\r
	182	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	183	LEDsoff();\r
	184	}\r
	185	\r
	186	//-----------------------------------------------------------------------------\r
	187	// Select, Authenticate, Read a MIFARE tag.\r
	188	// read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)\r
	189	//-----------------------------------------------------------------------------\r
	190	void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
	191	{\r
	192	// params\r
	193	uint8_t sectorNo = arg0;\r
	194	uint8_t keyType = arg1;\r
	195	uint64_t ui64Key = 0;\r
	196	ui64Key = bytes_to_num(datain, 6);\r
	197	\r
	198	// variables\r
	199	byte_t isOK = 0;\r
	200	byte_t dataoutbuf[16 * 16];\r
	201	uint8_t uid[10];\r
	202	uint32_t cuid;\r
	203	struct Crypto1State mpcs = {0, 0};\r
	204	struct Crypto1State *pcs;\r
	205	pcs = &mpcs;\r
	206	\r
	207	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	208	\r
	209	clear_trace();\r
	210	\r
	211	LED_A_ON();\r
	212	LED_B_OFF();\r
	213	LED_C_OFF();\r
	214	\r
	215	isOK = 1;\r
	216	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
	217	isOK = 0;\r
	218	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	219	}\r
	220	\r
	221	\r
	222	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
	223	isOK = 0;\r
	224	if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
	225	}\r
	226	\r
	227	for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
	228	if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {\r
	229	isOK = 0;\r
	230	if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);\r
	231	break;\r
	232	}\r
	233	}\r
	234	\r
	235	if(mifare_classic_halt(pcs, cuid)) {\r
	236	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	237	}\r
	238	\r
	239	// ----------------------------- crypto1 destroy\r
	240	crypto1_destroy(pcs);\r
	241	\r
	242	if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");\r
	243	\r
	244	LED_B_ON();\r
	245	cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));\r
	246	LED_B_OFF();\r
	247	\r
	248	// Thats it...\r
	249	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	250	LEDsoff();\r
	251	}\r
	252	\r
	253	// arg0 = blockNo (start)\r
	254	// arg1 = Pages (number of blocks)\r
	255	// arg2 = useKey\r
	256	// datain = KEY bytes\r
	257	void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r
	258	{\r
	259	LEDsoff();\r
	260	LED_A_ON();\r
	261	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	262	\r
	263	// free eventually allocated BigBuf memory\r
	264	BigBuf_free();\r
	265	clear_trace();\r
	266	\r
	267	// params\r
	268	uint8_t blockNo = arg0;\r
	269	uint16_t blocks = arg1;\r
	270	bool useKey = (arg2 == 1); //UL_C\r
	271	bool usePwd = (arg2 == 2); //UL_EV1/NTAG\r
	272	uint32_t countblocks = 0;\r
	273	uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);\r
	274	if (dataout == NULL){\r
	275	Dbprintf("out of memory");\r
	276	OnError(1);\r
	277	return;\r
	278	}\r
	279	\r
	280	int len = iso14443a_select_card(NULL, NULL, NULL, true, 0, true);\r
	281	if (!len) {\r
	282	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);\r
	283	OnError(1);\r
	284	return;\r
	285	}\r
	286	\r
	287	// UL-C authentication\r
	288	if ( useKey ) {\r
	289	uint8_t key[16] = {0x00};\r
	290	memcpy(key, datain, sizeof(key) );\r
	291	\r
	292	if ( !mifare_ultra_auth(key) ) {\r
	293	OnError(1);\r
	294	return;\r
	295	}\r
	296	}\r
	297	\r
	298	// UL-EV1 / NTAG authentication\r
	299	if (usePwd) {\r
	300	uint8_t pwd[4] = {0x00};\r
	301	memcpy(pwd, datain, sizeof(pwd));\r
	302	uint8_t pack[4] = {0,0,0,0};\r
	303	\r
	304	if (!mifare_ul_ev1_auth(pwd, pack)){\r
	305	OnError(1);\r
	306	return;\r
	307	}\r
	308	}\r
	309	\r
	310	for (int i = 0; i < blocks; i++){\r
	311	if ((i*4) + 4 >= CARD_MEMORY_SIZE) {\r
	312	Dbprintf("Data exceeds buffer!!");\r
	313	break;\r
	314	}\r
	315	\r
	316	len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);\r
	317	\r
	318	if (len) {\r
	319	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);\r
	320	// if no blocks read - error out\r
	321	if (i==0){\r
	322	OnError(2);\r
	323	return;\r
	324	} else {\r
	325	//stop at last successful read block and return what we got\r
	326	break;\r
	327	}\r
	328	} else {\r
	329	countblocks++;\r
	330	}\r
	331	}\r
	332	\r
	333	len = mifare_ultra_halt();\r
	334	if (len) {\r
	335	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");\r
	336	OnError(3);\r
	337	return;\r
	338	}\r
	339	\r
	340	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);\r
	341	\r
	342	countblocks *= 4;\r
	343	\r
	344	cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);\r
	345	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	346	LEDsoff();\r
	347	BigBuf_free();\r
	348	}\r
	349	\r
	350	//-----------------------------------------------------------------------------\r
	351	// Select, Authenticate, Write a MIFARE tag.\r
	352	// read block\r
	353	//-----------------------------------------------------------------------------\r
	354	void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)\r
	355	{\r
	356	// params\r
	357	uint8_t blockNo = arg0;\r
	358	uint8_t keyType = arg1;\r
	359	uint64_t ui64Key = 0;\r
	360	byte_t blockdata[16];\r
	361	\r
	362	ui64Key = bytes_to_num(datain, 6);\r
	363	memcpy(blockdata, datain + 10, 16);\r
	364	\r
	365	// variables\r
	366	byte_t isOK = 0;\r
	367	uint8_t uid[10];\r
	368	uint32_t cuid;\r
	369	struct Crypto1State mpcs = {0, 0};\r
	370	struct Crypto1State *pcs;\r
	371	pcs = &mpcs;\r
	372	\r
	373	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	374	\r
	375	clear_trace();\r
	376	\r
	377	LED_A_ON();\r
	378	LED_B_OFF();\r
	379	LED_C_OFF();\r
	380	\r
	381	while (true) {\r
	382	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
	383	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	384	break;\r
	385	};\r
	386	\r
	387	if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
	388	if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
	389	break;\r
	390	};\r
	391	\r
	392	if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {\r
	393	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	394	break;\r
	395	};\r
	396	\r
	397	if(mifare_classic_halt(pcs, cuid)) {\r
	398	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	399	break;\r
	400	};\r
	401	\r
	402	isOK = 1;\r
	403	break;\r
	404	}\r
	405	\r
	406	// ----------------------------- crypto1 destroy\r
	407	crypto1_destroy(pcs);\r
	408	\r
	409	if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
	410	\r
	411	LED_B_ON();\r
	412	cmd_send(CMD_ACK,isOK,0,0,0,0);\r
	413	LED_B_OFF();\r
	414	\r
	415	\r
	416	// Thats it...\r
	417	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	418	LEDsoff();\r
	419	}\r
	420	\r
	421	/* // Command not needed but left for future testing\r
	422	void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)\r
	423	{\r
	424	uint8_t blockNo = arg0;\r
	425	byte_t blockdata[16] = {0x00};\r
	426	\r
	427	memcpy(blockdata, datain, 16);\r
	428	\r
	429	uint8_t uid[10] = {0x00};\r
	430	\r
	431	LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
	432	\r
	433	clear_trace();\r
	434	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	435	\r
	436	if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {\r
	437	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	438	OnError(0);\r
	439	return;\r
	440	};\r
	441	\r
	442	if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {\r
	443	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	444	OnError(0);\r
	445	return; };\r
	446	\r
	447	if(mifare_ultra_halt()) {\r
	448	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	449	OnError(0);\r
	450	return;\r
	451	};\r
	452	\r
	453	if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
	454	\r
	455	cmd_send(CMD_ACK,1,0,0,0,0);\r
	456	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	457	LEDsoff();\r
	458	}\r
	459	*/\r
	460	\r
	461	// Arg0 : Block to write to.\r
	462	// Arg1 : 0 = use no authentication.\r
	463	// 1 = use 0x1A authentication.\r
	464	// 2 = use 0x1B authentication.\r
	465	// datain : 4 first bytes is data to be written.\r
	466	// : 4/16 next bytes is authentication key.\r
	467	void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)\r
	468	{\r
	469	uint8_t blockNo = arg0;\r
	470	bool useKey = (arg1 == 1); //UL_C\r
	471	bool usePwd = (arg1 == 2); //UL_EV1/NTAG\r
	472	byte_t blockdata[4] = {0x00};\r
	473	\r
	474	memcpy(blockdata, datain,4);\r
	475	\r
	476	LEDsoff();\r
	477	LED_A_ON();\r
	478	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	479	\r
	480	clear_trace();\r
	481	\r
	482	if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {\r
	483	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	484	OnError(0);\r
	485	return;\r
	486	};\r
	487	\r
	488	// UL-C authentication\r
	489	if ( useKey ) {\r
	490	uint8_t key[16] = {0x00};\r
	491	memcpy(key, datain+4, sizeof(key) );\r
	492	\r
	493	if ( !mifare_ultra_auth(key) ) {\r
	494	OnError(1);\r
	495	return;\r
	496	}\r
	497	}\r
	498	\r
	499	// UL-EV1 / NTAG authentication\r
	500	if (usePwd) {\r
	501	uint8_t pwd[4] = {0x00};\r
	502	memcpy(pwd, datain+4, 4);\r
	503	uint8_t pack[4] = {0,0,0,0};\r
	504	if (!mifare_ul_ev1_auth(pwd, pack)) {\r
	505	OnError(1);\r
	506	return;\r
	507	}\r
	508	}\r
	509	\r
	510	if(mifare_ultra_writeblock(blockNo, blockdata)) {\r
	511	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	512	OnError(0);\r
	513	return;\r
	514	};\r
	515	\r
	516	if(mifare_ultra_halt()) {\r
	517	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	518	OnError(0);\r
	519	return;\r
	520	};\r
	521	\r
	522	if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");\r
	523	\r
	524	cmd_send(CMD_ACK,1,0,0,0,0);\r
	525	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	526	LEDsoff();\r
	527	}\r
	528	\r
	529	void MifareUSetPwd(uint8_t arg0, uint8_t *datain){\r
	530	\r
	531	uint8_t pwd[16] = {0x00};\r
	532	byte_t blockdata[4] = {0x00};\r
	533	\r
	534	memcpy(pwd, datain, 16);\r
	535	\r
	536	LED_A_ON(); LED_B_OFF(); LED_C_OFF();\r
	537	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	538	\r
	539	clear_trace();\r
	540	\r
	541	if(!iso14443a_select_card(NULL, NULL, NULL, true, 0, true)) {\r
	542	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	543	OnError(0);\r
	544	return;\r
	545	};\r
	546	\r
	547	blockdata[0] = pwd[7];\r
	548	blockdata[1] = pwd[6];\r
	549	blockdata[2] = pwd[5];\r
	550	blockdata[3] = pwd[4];\r
	551	if(mifare_ultra_writeblock( 44, blockdata)) {\r
	552	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	553	OnError(44);\r
	554	return;\r
	555	};\r
	556	\r
	557	blockdata[0] = pwd[3];\r
	558	blockdata[1] = pwd[2];\r
	559	blockdata[2] = pwd[1];\r
	560	blockdata[3] = pwd[0];\r
	561	if(mifare_ultra_writeblock( 45, blockdata)) {\r
	562	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	563	OnError(45);\r
	564	return;\r
	565	};\r
	566	\r
	567	blockdata[0] = pwd[15];\r
	568	blockdata[1] = pwd[14];\r
	569	blockdata[2] = pwd[13];\r
	570	blockdata[3] = pwd[12];\r
	571	if(mifare_ultra_writeblock( 46, blockdata)) {\r
	572	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	573	OnError(46);\r
	574	return;\r
	575	};\r
	576	\r
	577	blockdata[0] = pwd[11];\r
	578	blockdata[1] = pwd[10];\r
	579	blockdata[2] = pwd[9];\r
	580	blockdata[3] = pwd[8];\r
	581	if(mifare_ultra_writeblock( 47, blockdata)) {\r
	582	if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");\r
	583	OnError(47);\r
	584	return;\r
	585	};\r
	586	\r
	587	if(mifare_ultra_halt()) {\r
	588	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	589	OnError(0);\r
	590	return;\r
	591	};\r
	592	\r
	593	cmd_send(CMD_ACK,1,0,0,0,0);\r
	594	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	595	LEDsoff();\r
	596	}\r
	597	\r
	598	// Return 1 if the nonce is invalid else return 0\r
	599	int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {\r
	600	return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \\r
	601	(oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \\r
	602	(oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;\r
	603	}\r
	604	\r
	605	\r
	606	//-----------------------------------------------------------------------------\r
	607	// acquire encrypted nonces in order to perform the attack described in\r
	608	// Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened\r
	609	// Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on\r
	610	// Computer and Communications Security, 2015\r
	611	//-----------------------------------------------------------------------------\r
	612	void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)\r
	613	{\r
	614	uint64_t ui64Key = 0;\r
	615	uint8_t uid[10];\r
	616	uint32_t cuid;\r
	617	uint8_t cascade_levels = 0;\r
	618	struct Crypto1State mpcs = {0, 0};\r
	619	struct Crypto1State *pcs;\r
	620	pcs = &mpcs;\r
	621	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
	622	int16_t isOK = 0;\r
	623	uint8_t par_enc[1];\r
	624	uint8_t nt_par_enc = 0;\r
	625	uint8_t buf[USB_CMD_DATA_SIZE];\r
	626	uint32_t timeout;\r
	627	\r
	628	uint8_t blockNo = arg0 & 0xff;\r
	629	uint8_t keyType = (arg0 >> 8) & 0xff;\r
	630	uint8_t targetBlockNo = arg1 & 0xff;\r
	631	uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
	632	ui64Key = bytes_to_num(datain, 6);\r
	633	bool initialize = flags & 0x0001;\r
	634	bool slow = flags & 0x0002;\r
	635	bool field_off = flags & 0x0004;\r
	636	\r
	637	LED_A_ON();\r
	638	LED_C_OFF();\r
	639	\r
	640	if (initialize) {\r
	641	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	642	clear_trace();\r
	643	set_tracing(true);\r
	644	}\r
	645	\r
	646	LED_C_ON();\r
	647	\r
	648	uint16_t num_nonces = 0;\r
	649	bool have_uid = false;\r
	650	for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {\r
	651	\r
	652	// Test if the action was cancelled\r
	653	if(BUTTON_PRESS()) {\r
	654	isOK = 2;\r
	655	field_off = true;\r
	656	break;\r
	657	}\r
	658	\r
	659	if (!have_uid) { // need a full select cycle to get the uid first\r
	660	iso14a_card_select_t card_info;\r
	661	if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {\r
	662	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");\r
	663	continue;\r
	664	}\r
	665	switch (card_info.uidlen) {\r
	666	case 4 : cascade_levels = 1; break;\r
	667	case 7 : cascade_levels = 2; break;\r
	668	case 10: cascade_levels = 3; break;\r
	669	default: break;\r
	670	}\r
	671	have_uid = true;\r
	672	} else { // no need for anticollision. We can directly select the card\r
	673	if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels, true)) {\r
	674	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");\r
	675	continue;\r
	676	}\r
	677	}\r
	678	\r
	679	if (slow) {\r
	680	timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;\r
	681	while(GetCountSspClk() < timeout);\r
	682	}\r
	683	\r
	684	uint32_t nt1;\r
	685	if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {\r
	686	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");\r
	687	continue;\r
	688	}\r
	689	\r
	690	// nested authentication\r
	691	uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);\r
	692	if (len != 4) {\r
	693	if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);\r
	694	continue;\r
	695	}\r
	696	\r
	697	// send a dummy byte as reader response in order to trigger the cards authentication timeout\r
	698	uint8_t dummy_answer = 0;\r
	699	ReaderTransmit(&dummy_answer, 1, NULL);\r
	700	timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;\r
	701	\r
	702	num_nonces++;\r
	703	if (num_nonces % 2) {\r
	704	memcpy(buf+i, receivedAnswer, 4);\r
	705	nt_par_enc = par_enc[0] & 0xf0;\r
	706	} else {\r
	707	nt_par_enc \|= par_enc[0] >> 4;\r
	708	memcpy(buf+i+4, receivedAnswer, 4);\r
	709	memcpy(buf+i+8, &nt_par_enc, 1);\r
	710	i += 9;\r
	711	}\r
	712	\r
	713	// wait for the card to become ready again\r
	714	while(GetCountSspClk() < timeout);\r
	715	\r
	716	}\r
	717	\r
	718	LED_C_OFF();\r
	719	\r
	720	crypto1_destroy(pcs);\r
	721	\r
	722	LED_B_ON();\r
	723	cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));\r
	724	LED_B_OFF();\r
	725	\r
	726	if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");\r
	727	\r
	728	if (field_off) {\r
	729	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	730	LEDsoff();\r
	731	}\r
	732	}\r
	733	\r
	734	\r
	735	//-----------------------------------------------------------------------------\r
	736	// MIFARE nested authentication.\r
	737	//\r
	738	//-----------------------------------------------------------------------------\r
	739	void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r
	740	{\r
	741	// params\r
	742	uint8_t blockNo = arg0 & 0xff;\r
	743	uint8_t keyType = (arg0 >> 8) & 0xff;\r
	744	uint8_t targetBlockNo = arg1 & 0xff;\r
	745	uint8_t targetKeyType = (arg1 >> 8) & 0xff;\r
	746	uint64_t ui64Key = 0;\r
	747	\r
	748	ui64Key = bytes_to_num(datain, 6);\r
	749	\r
	750	// variables\r
	751	uint16_t rtr, i, j, len;\r
	752	uint16_t davg;\r
	753	static uint16_t dmin, dmax;\r
	754	uint8_t uid[10];\r
	755	uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;\r
	756	uint8_t par[1];\r
	757	uint32_t target_nt[2], target_ks[2];\r
	758	\r
	759	uint8_t par_array[4];\r
	760	uint16_t ncount = 0;\r
	761	struct Crypto1State mpcs = {0, 0};\r
	762	struct Crypto1State *pcs;\r
	763	pcs = &mpcs;\r
	764	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
	765	\r
	766	uint32_t auth1_time, auth2_time;\r
	767	static uint16_t delta_time;\r
	768	\r
	769	LED_A_ON();\r
	770	LED_C_OFF();\r
	771	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	772	\r
	773	// free eventually allocated BigBuf memory\r
	774	BigBuf_free();\r
	775	\r
	776	if (calibrate) clear_trace();\r
	777	set_tracing(true);\r
	778	\r
	779	// statistics on nonce distance\r
	780	int16_t isOK = 0;\r
	781	#define NESTED_MAX_TRIES 12\r
	782	uint16_t unsuccessfull_tries = 0;\r
	783	if (calibrate) { // for first call only. Otherwise reuse previous calibration\r
	784	LED_B_ON();\r
	785	WDT_HIT();\r
	786	\r
	787	davg = dmax = 0;\r
	788	dmin = 2000;\r
	789	delta_time = 0;\r
	790	\r
	791	for (rtr = 0; rtr < 17; rtr++) {\r
	792	\r
	793	// Test if the action was cancelled\r
	794	if(BUTTON_PRESS()) {\r
	795	isOK = -2;\r
	796	break;\r
	797	}\r
	798	\r
	799	// prepare next select. No need to power down the card.\r
	800	if(mifare_classic_halt(pcs, cuid)) {\r
	801	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
	802	rtr--;\r
	803	continue;\r
	804	}\r
	805	\r
	806	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
	807	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
	808	rtr--;\r
	809	continue;\r
	810	};\r
	811	\r
	812	auth1_time = 0;\r
	813	if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
	814	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
	815	rtr--;\r
	816	continue;\r
	817	};\r
	818	\r
	819	if (delta_time) {\r
	820	auth2_time = auth1_time + delta_time;\r
	821	} else {\r
	822	auth2_time = 0;\r
	823	}\r
	824	if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r
	825	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
	826	rtr--;\r
	827	continue;\r
	828	};\r
	829	\r
	830	nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160\r
	831	for (i = 101; i < 1200; i++) {\r
	832	nttmp = prng_successor(nttmp, 1);\r
	833	if (nttmp == nt2) break;\r
	834	}\r
	835	\r
	836	if (i != 1200) {\r
	837	if (rtr != 0) {\r
	838	davg += i;\r
	839	dmin = MIN(dmin, i);\r
	840	dmax = MAX(dmax, i);\r
	841	}\r
	842	else {\r
	843	delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing\r
	844	}\r
	845	if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);\r
	846	} else {\r
	847	unsuccessfull_tries++;\r
	848	if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)\r
	849	isOK = -3;\r
	850	}\r
	851	}\r
	852	}\r
	853	\r
	854	davg = (davg + (rtr - 1)/2) / (rtr - 1);\r
	855	\r
	856	if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);\r
	857	\r
	858	dmin = davg - 2;\r
	859	dmax = davg + 2;\r
	860	\r
	861	LED_B_OFF();\r
	862	\r
	863	}\r
	864	// -------------------------------------------------------------------------------------------------\r
	865	\r
	866	LED_C_ON();\r
	867	\r
	868	// get crypted nonces for target sector\r
	869	for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r
	870	\r
	871	target_nt[i] = 0;\r
	872	while(target_nt[i] == 0) { // continue until we have an unambiguous nonce\r
	873	\r
	874	// prepare next select. No need to power down the card.\r
	875	if(mifare_classic_halt(pcs, cuid)) {\r
	876	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
	877	continue;\r
	878	}\r
	879	\r
	880	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
	881	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
	882	continue;\r
	883	};\r
	884	\r
	885	auth1_time = 0;\r
	886	if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
	887	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
	888	continue;\r
	889	};\r
	890	\r
	891	// nested authentication\r
	892	auth2_time = auth1_time + delta_time;\r
	893	len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);\r
	894	if (len != 4) {\r
	895	if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);\r
	896	continue;\r
	897	};\r
	898	\r
	899	nt2 = bytes_to_num(receivedAnswer, 4);\r
	900	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);\r
	901	\r
	902	// Parity validity check\r
	903	for (j = 0; j < 4; j++) {\r
	904	par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));\r
	905	}\r
	906	\r
	907	ncount = 0;\r
	908	nttest = prng_successor(nt1, dmin - 1);\r
	909	for (j = dmin; j < dmax + 1; j++) {\r
	910	nttest = prng_successor(nttest, 1);\r
	911	ks1 = nt2 ^ nttest;\r
	912	\r
	913	if (valid_nonce(nttest, nt2, ks1, par_array)){\r
	914	if (ncount > 0) { // we are only interested in disambiguous nonces, try again\r
	915	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);\r
	916	target_nt[i] = 0;\r
	917	break;\r
	918	}\r
	919	target_nt[i] = nttest;\r
	920	target_ks[i] = ks1;\r
	921	ncount++;\r
	922	if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces\r
	923	target_nt[i] = 0;\r
	924	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);\r
	925	break;\r
	926	}\r
	927	if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);\r
	928	}\r
	929	}\r
	930	if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);\r
	931	}\r
	932	}\r
	933	\r
	934	LED_C_OFF();\r
	935	\r
	936	// ----------------------------- crypto1 destroy\r
	937	crypto1_destroy(pcs);\r
	938	\r
	939	byte_t buf[4 + 4 * 4];\r
	940	memcpy(buf, &cuid, 4);\r
	941	memcpy(buf+4, &target_nt[0], 4);\r
	942	memcpy(buf+8, &target_ks[0], 4);\r
	943	memcpy(buf+12, &target_nt[1], 4);\r
	944	memcpy(buf+16, &target_ks[1], 4);\r
	945	\r
	946	LED_B_ON();\r
	947	cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
	948	LED_B_OFF();\r
	949	\r
	950	if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");\r
	951	\r
	952	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	953	LEDsoff();\r
	954	}\r
	955	\r
	956	//-----------------------------------------------------------------------------\r
	957	// MIFARE check keys. key count up to 85.\r
	958	//\r
	959	//-----------------------------------------------------------------------------\r
	960	void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r
	961	{\r
	962	uint8_t blockNo = arg0 & 0xff;\r
	963	uint8_t keyType = (arg0 >> 8) & 0xff;\r
	964	bool clearTrace = arg1 & 0x01;\r
	965	bool multisectorCheck = arg1 & 0x02;\r
	966	uint8_t set14aTimeout = (arg1 >> 8) & 0xff;\r
	967	uint8_t keyCount = arg2;\r
	968	\r
	969	// clear debug level\r
	970	int OLD_MF_DBGLEVEL = MF_DBGLEVEL;\r
	971	MF_DBGLEVEL = MF_DBG_NONE;\r
	972	\r
	973	LED_A_ON();\r
	974	LED_B_OFF();\r
	975	LED_C_OFF();\r
	976	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	977	\r
	978	if (clearTrace) clear_trace();\r
	979	set_tracing(true);\r
	980	\r
	981	if (set14aTimeout){\r
	982	iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe\r
	983	}\r
	984	\r
	985	if (multisectorCheck) {\r
	986	TKeyIndex keyIndex = {{0}};\r
	987	uint8_t sectorCnt = blockNo;\r
	988	int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex);\r
	989	\r
	990	LED_B_ON();\r
	991	if (res >= 0) {\r
	992	cmd_send(CMD_ACK, 1, 0, 0, keyIndex, 80);\r
	993	} else {\r
	994	cmd_send(CMD_ACK, 0, 0, 0, NULL, 0);\r
	995	}\r
	996	LED_B_OFF();\r
	997	} else { \r
	998	int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL);\r
	999	\r
	1000	LED_B_ON();\r
	1001	if (res > 0) {\r
	1002	cmd_send(CMD_ACK, 1, 0, 0, datain + (res - 1) * 6, 6);\r
	1003	} else {\r
	1004	cmd_send(CMD_ACK, 0, 0, 0, NULL, 0);\r
	1005	}\r
	1006	LED_B_OFF();\r
	1007	}\r
	1008	\r
	1009	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1010	LEDsoff();\r
	1011	\r
	1012	// restore debug level\r
	1013	MF_DBGLEVEL = OLD_MF_DBGLEVEL;\r
	1014	}\r
	1015	\r
	1016	//-----------------------------------------------------------------------------\r
	1017	// MIFARE commands set debug level\r
	1018	//\r
	1019	//-----------------------------------------------------------------------------\r
	1020	void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1021	MF_DBGLEVEL = arg0;\r
	1022	Dbprintf("Debug level: %d", MF_DBGLEVEL);\r
	1023	}\r
	1024	\r
	1025	//-----------------------------------------------------------------------------\r
	1026	// Work with emulator memory\r
	1027	//\r
	1028	// Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not\r
	1029	// involved in dealing with emulator memory. But if it is called later, it might\r
	1030	// destroy the Emulator Memory.\r
	1031	//-----------------------------------------------------------------------------\r
	1032	\r
	1033	void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1034	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r
	1035	emlClearMem();\r
	1036	}\r
	1037	\r
	1038	void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1039	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r
	1040	emlSetMem(datain, arg0, arg1); // data, block num, blocks count\r
	1041	}\r
	1042	\r
	1043	void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1044	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);\r
	1045	byte_t buf[USB_CMD_DATA_SIZE];\r
	1046	emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)\r
	1047	\r
	1048	LED_B_ON();\r
	1049	cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);\r
	1050	LED_B_OFF();\r
	1051	}\r
	1052	\r
	1053	//-----------------------------------------------------------------------------\r
	1054	// Load a card into the emulator memory\r
	1055	//\r
	1056	//-----------------------------------------------------------------------------\r
	1057	void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1058	uint8_t numSectors = arg0;\r
	1059	uint8_t keyType = arg1;\r
	1060	uint64_t ui64Key = 0;\r
	1061	uint32_t cuid;\r
	1062	struct Crypto1State mpcs = {0, 0};\r
	1063	struct Crypto1State *pcs;\r
	1064	pcs = &mpcs;\r
	1065	\r
	1066	// variables\r
	1067	byte_t dataoutbuf[16];\r
	1068	byte_t dataoutbuf2[16];\r
	1069	uint8_t uid[10];\r
	1070	\r
	1071	LED_A_ON();\r
	1072	LED_B_OFF();\r
	1073	LED_C_OFF();\r
	1074	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1075	\r
	1076	clear_trace();\r
	1077	set_tracing(false);\r
	1078	\r
	1079	bool isOK = true;\r
	1080	\r
	1081	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
	1082	isOK = false;\r
	1083	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	1084	}\r
	1085	\r
	1086	for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
	1087	ui64Key = emlGetKey(sectorNo, keyType);\r
	1088	if (sectorNo == 0){\r
	1089	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
	1090	isOK = false;\r
	1091	if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r
	1092	break;\r
	1093	}\r
	1094	} else {\r
	1095	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r
	1096	isOK = false;\r
	1097	if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r
	1098	break;\r
	1099	}\r
	1100	}\r
	1101	\r
	1102	for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {\r
	1103	if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {\r
	1104	isOK = false;\r
	1105	if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);\r
	1106	break;\r
	1107	};\r
	1108	if (isOK) {\r
	1109	if (blockNo < NumBlocksPerSector(sectorNo) - 1) {\r
	1110	emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
	1111	} else { // sector trailer, keep the keys, set only the AC\r
	1112	emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
	1113	memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);\r
	1114	emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);\r
	1115	}\r
	1116	}\r
	1117	}\r
	1118	\r
	1119	}\r
	1120	\r
	1121	if(mifare_classic_halt(pcs, cuid)) {\r
	1122	if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");\r
	1123	};\r
	1124	\r
	1125	// ----------------------------- crypto1 destroy\r
	1126	crypto1_destroy(pcs);\r
	1127	\r
	1128	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1129	LEDsoff();\r
	1130	\r
	1131	if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");\r
	1132	\r
	1133	}\r
	1134	\r
	1135	\r
	1136	//-----------------------------------------------------------------------------\r
	1137	// Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)\r
	1138	//\r
	1139	//-----------------------------------------------------------------------------\r
	1140	\r
	1141	static bool isBlockTrailer(int blockN) {\r
	1142	if (blockN >= 0 && blockN < 128) {\r
	1143	return ((blockN & 0x03) == 0x03);\r
	1144	}\r
	1145	if (blockN >= 128 && blockN <= 256) {\r
	1146	return ((blockN & 0x0F) == 0x0F);\r
	1147	}\r
	1148	return FALSE;\r
	1149	}\r
	1150	\r
	1151	void MifareCWipe(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1152	// var\r
	1153	byte_t isOK = 0;\r
	1154	uint32_t numBlocks = arg0;\r
	1155	// cmdParams:\r
	1156	// bit 0 - wipe gen1a\r
	1157	// bit 1 - fill card with default data\r
	1158	// bit 2 - gen1a = 0, gen1b = 1\r
	1159	uint8_t cmdParams = arg1;\r
	1160	bool needWipe = cmdParams & 0x01;\r
	1161	bool needFill = cmdParams & 0x02;\r
	1162	bool gen1b = cmdParams & 0x04;\r
	1163	\r
	1164	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
	1165	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
	1166	\r
	1167	uint8_t block0[16] = {0x01, 0x02, 0x03, 0x04, 0x04, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0xAF};\r
	1168	uint8_t block1[16] = {0x00};\r
	1169	uint8_t blockK[16] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x08, 0x77, 0x8F, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};\r
	1170	uint8_t d_block[18] = {0x00};\r
	1171	\r
	1172	// card commands\r
	1173	uint8_t wupC1[] = { 0x40 };\r
	1174	uint8_t wupC2[] = { 0x43 };\r
	1175	uint8_t wipeC[] = { 0x41 };\r
	1176	\r
	1177	// iso14443 setup\r
	1178	LED_A_ON();\r
	1179	LED_B_OFF();\r
	1180	LED_C_OFF();\r
	1181	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1182	\r
	1183	// tracing\r
	1184	clear_trace();\r
	1185	set_tracing(true);\r
	1186	\r
	1187	while (true){\r
	1188	// wipe\r
	1189	if (needWipe){\r
	1190	ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
	1191	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1192	if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
	1193	break;\r
	1194	};\r
	1195	\r
	1196	ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r
	1197	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1198	if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r
	1199	break;\r
	1200	};\r
	1201	\r
	1202	if(mifare_classic_halt(NULL, 0)) {\r
	1203	if (MF_DBGLEVEL > 2) Dbprintf("Halt error");\r
	1204	};\r
	1205	};\r
	1206	\r
	1207	// put default data\r
	1208	if (needFill){\r
	1209	// select commands\r
	1210	ReaderTransmitBitsPar(wupC1, 7, 0, NULL);\r
	1211	\r
	1212	// gen1b magic tag : do no issue wupC2 and don't expect 0x0a response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)\r
	1213	if (!gen1b) { \r
	1214	\r
	1215	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1216	if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
	1217	break;\r
	1218	};\r
	1219	\r
	1220	ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
	1221	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1222	if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
	1223	break;\r
	1224	};\r
	1225	}\r
	1226	\r
	1227	// send blocks command\r
	1228	for (int blockNo = 0; blockNo < numBlocks; blockNo++) {\r
	1229	if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1230	if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r
	1231	break;\r
	1232	};\r
	1233	\r
	1234	// check type of block and add crc\r
	1235	if (!isBlockTrailer(blockNo)){\r
	1236	memcpy(d_block, block1, 16);\r
	1237	} else {\r
	1238	memcpy(d_block, blockK, 16);\r
	1239	}\r
	1240	if (blockNo == 0) {\r
	1241	memcpy(d_block, block0, 16);\r
	1242	}\r
	1243	AppendCrc14443a(d_block, 16);\r
	1244	\r
	1245	// send write command\r
	1246	ReaderTransmit(d_block, sizeof(d_block), NULL);\r
	1247	if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1248	if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r
	1249	break;\r
	1250	};\r
	1251	}\r
	1252	\r
	1253	// halt\r
	1254	// do no issue halt command for gen1b \r
	1255	if (!gen1b) {\r
	1256	if (mifare_classic_halt(NULL, 0)) {\r
	1257	if (MF_DBGLEVEL > 2) Dbprintf("Halt error");\r
	1258	break;\r
	1259	}\r
	1260	}\r
	1261	}\r
	1262	break;\r
	1263	} \r
	1264	\r
	1265	// send USB response\r
	1266	LED_B_ON();\r
	1267	cmd_send(CMD_ACK,isOK,0,0,NULL,0);\r
	1268	LED_B_OFF();\r
	1269	\r
	1270	// reset fpga\r
	1271	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1272	LEDsoff();\r
	1273	\r
	1274	return;\r
	1275	}\r
	1276	\r
	1277	void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1278	\r
	1279	// params\r
	1280	uint8_t needWipe = arg0;\r
	1281	// bit 0 - need get UID\r
	1282	// bit 1 - need wupC\r
	1283	// bit 2 - need HALT after sequence\r
	1284	// bit 3 - need init FPGA and field before sequence\r
	1285	// bit 4 - need reset FPGA and LED\r
	1286	// bit 6 - gen1b backdoor type\r
	1287	uint8_t workFlags = arg1;\r
	1288	uint8_t blockNo = arg2;\r
	1289	\r
	1290	// card commands\r
	1291	uint8_t wupC1[] = { 0x40 };\r
	1292	uint8_t wupC2[] = { 0x43 };\r
	1293	uint8_t wipeC[] = { 0x41 };\r
	1294	\r
	1295	// variables\r
	1296	byte_t isOK = 0;\r
	1297	uint8_t uid[10] = {0x00};\r
	1298	uint8_t d_block[18] = {0x00};\r
	1299	uint32_t cuid;\r
	1300	\r
	1301	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
	1302	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
	1303	\r
	1304	// reset FPGA and LED\r
	1305	if (workFlags & 0x08) {\r
	1306	LED_A_ON();\r
	1307	LED_B_OFF();\r
	1308	LED_C_OFF();\r
	1309	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1310	\r
	1311	clear_trace();\r
	1312	set_tracing(true);\r
	1313	}\r
	1314	\r
	1315	while (true) {\r
	1316	\r
	1317	// get UID from chip\r
	1318	if (workFlags & 0x01) {\r
	1319	if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
	1320	if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");\r
	1321	// Continue, if we set wrong UID or wrong UID checksum or some ATQA or SAK we will can't select card. But we need to write block 0 to make card work.\r
	1322	//break;\r
	1323	};\r
	1324	\r
	1325	if(mifare_classic_halt(NULL, cuid)) {\r
	1326	if (MF_DBGLEVEL > 2) Dbprintf("Halt error");\r
	1327	// Continue, some magic tags misbehavies and send an answer to it.\r
	1328	// break;\r
	1329	};\r
	1330	};\r
	1331	\r
	1332	// reset chip\r
	1333	// Wipe command don't work with gen1b\r
	1334	if (needWipe && !(workFlags & 0x40)){\r
	1335	ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
	1336	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1337	if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
	1338	break;\r
	1339	};\r
	1340	\r
	1341	ReaderTransmit(wipeC, sizeof(wipeC), NULL);\r
	1342	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1343	if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");\r
	1344	break;\r
	1345	};\r
	1346	\r
	1347	if(mifare_classic_halt(NULL, 0)) {\r
	1348	if (MF_DBGLEVEL > 2) Dbprintf("Halt error");\r
	1349	// Continue, some magic tags misbehavies and send an answer to it.\r
	1350	// break;\r
	1351	};\r
	1352	};\r
	1353	\r
	1354	// write block\r
	1355	if (workFlags & 0x02) {\r
	1356	ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
	1357	\r
	1358	// gen1b magic tag : do no issue wupC2 and don't expect 0x0a response after SELECT_UID (after getting UID from chip in 'hf mf csetuid' command)\r
	1359	if (!(workFlags & 0x40)) {\r
	1360	\r
	1361	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1362	if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
	1363	break;\r
	1364	};\r
	1365	\r
	1366	ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
	1367	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1368	if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
	1369	break;\r
	1370	};\r
	1371	}\r
	1372	}\r
	1373	\r
	1374	if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1375	if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");\r
	1376	break;\r
	1377	};\r
	1378	\r
	1379	memcpy(d_block, datain, 16);\r
	1380	AppendCrc14443a(d_block, 16);\r
	1381	\r
	1382	ReaderTransmit(d_block, sizeof(d_block), NULL);\r
	1383	if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1384	if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");\r
	1385	break;\r
	1386	};\r
	1387	\r
	1388	if (workFlags & 0x04) {\r
	1389	// do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)\r
	1390	if (!(workFlags & 0x40)) {\r
	1391	if (mifare_classic_halt(NULL, 0)) {\r
	1392	if (MF_DBGLEVEL > 2) Dbprintf("Halt error");\r
	1393	// Continue, some magic tags misbehavies and send an answer to it.\r
	1394	// break;\r
	1395	}\r
	1396	}\r
	1397	}\r
	1398	\r
	1399	isOK = 1;\r
	1400	break;\r
	1401	}\r
	1402	\r
	1403	LED_B_ON();\r
	1404	cmd_send(CMD_ACK,isOK,0,0,uid,4);\r
	1405	LED_B_OFF();\r
	1406	\r
	1407	if ((workFlags & 0x10) \|\| (!isOK)) {\r
	1408	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1409	LEDsoff();\r
	1410	}\r
	1411	}\r
	1412	\r
	1413	\r
	1414	void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){\r
	1415	\r
	1416	// params\r
	1417	// bit 1 - need wupC\r
	1418	// bit 2 - need HALT after sequence\r
	1419	// bit 3 - need init FPGA and field before sequence\r
	1420	// bit 4 - need reset FPGA and LED\r
	1421	// bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)\r
	1422	// bit 6 - gen1b backdoor type\r
	1423	uint8_t workFlags = arg0;\r
	1424	uint8_t blockNo = arg2;\r
	1425	\r
	1426	// card commands\r
	1427	uint8_t wupC1[] = { 0x40 };\r
	1428	uint8_t wupC2[] = { 0x43 };\r
	1429	\r
	1430	// variables\r
	1431	byte_t isOK = 0;\r
	1432	uint8_t data[18] = {0x00};\r
	1433	uint32_t cuid = 0;\r
	1434	\r
	1435	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
	1436	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
	1437	\r
	1438	if (workFlags & 0x08) {\r
	1439	LED_A_ON();\r
	1440	LED_B_OFF();\r
	1441	LED_C_OFF();\r
	1442	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1443	\r
	1444	clear_trace();\r
	1445	set_tracing(true);\r
	1446	}\r
	1447	\r
	1448	while (true) {\r
	1449	if (workFlags & 0x02) {\r
	1450	ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
	1451	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1452	if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");\r
	1453	break;\r
	1454	};\r
	1455	// do no issue for gen1b magic tag\r
	1456	if (!(workFlags & 0x40)) {\r
	1457	ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
	1458	if(!ReaderReceive(receivedAnswer, receivedAnswerPar) \|\| (receivedAnswer[0] != 0x0a)) {\r
	1459	if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");\r
	1460	break;\r
	1461	};\r
	1462	}\r
	1463	}\r
	1464	\r
	1465	// read block\r
	1466	if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {\r
	1467	if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");\r
	1468	break;\r
	1469	};\r
	1470	memcpy(data, receivedAnswer, 18);\r
	1471	\r
	1472	if (workFlags & 0x04) {\r
	1473	// do no issue halt command for gen1b magic tag (#db# halt error. response len: 1)\r
	1474	if (!(workFlags & 0x40)) {\r
	1475	if (mifare_classic_halt(NULL, cuid)) {\r
	1476	if (MF_DBGLEVEL > 1) Dbprintf("Halt error");\r
	1477	// Continue, some magic tags misbehavies and send an answer to it.\r
	1478	// break;\r
	1479	}\r
	1480	}\r
	1481	}\r
	1482	\r
	1483	isOK = 1;\r
	1484	break;\r
	1485	}\r
	1486	\r
	1487	LED_B_ON();\r
	1488	if (workFlags & 0x20) {\r
	1489	if (isOK)\r
	1490	memcpy(datain, data, 18);\r
	1491	}\r
	1492	else\r
	1493	cmd_send(CMD_ACK,isOK,0,0,data,18);\r
	1494	LED_B_OFF();\r
	1495	\r
	1496	if ((workFlags & 0x10) \|\| (!isOK)) {\r
	1497	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1498	LEDsoff();\r
	1499	}\r
	1500	}\r
	1501	\r
	1502	void MifareCIdent(){\r
	1503	\r
	1504	// card commands\r
	1505	uint8_t wupC1[] = { 0x40 };\r
	1506	uint8_t wupC2[] = { 0x43 };\r
	1507	\r
	1508	// variables\r
	1509	byte_t isOK = 0;\r
	1510	\r
	1511	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
	1512	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];\r
	1513	\r
	1514	LED_A_ON();\r
	1515	LED_B_OFF();\r
	1516	LED_C_OFF();\r
	1517	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1518	\r
	1519	clear_trace();\r
	1520	set_tracing(true); \r
	1521	\r
	1522	ReaderTransmitBitsPar(wupC1,7,0, NULL);\r
	1523	if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == 0x0a)) {\r
	1524	isOK = 2;\r
	1525	\r
	1526	ReaderTransmit(wupC2, sizeof(wupC2), NULL);\r
	1527	if(ReaderReceive(receivedAnswer, receivedAnswerPar) && (receivedAnswer[0] == 0x0a)) {\r
	1528	isOK = 1;\r
	1529	};\r
	1530	};\r
	1531	\r
	1532	// From iceman1001: removed the if, since some magic tags misbehavies and send an answer to it.\r
	1533	mifare_classic_halt(NULL, 0);\r
	1534	\r
	1535	LED_B_ON();\r
	1536	cmd_send(CMD_ACK,isOK,0,0,0,0);\r
	1537	LED_B_OFF();\r
	1538	\r
	1539	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1540	LEDsoff(); \r
	1541	}\r
	1542	\r
	1543	//\r
	1544	// DESFIRE\r
	1545	//\r
	1546	\r
	1547	void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){\r
	1548	\r
	1549	byte_t dataout[11] = {0x00};\r
	1550	uint8_t uid[10] = {0x00};\r
	1551	uint32_t cuid;\r
	1552	\r
	1553	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
	1554	clear_trace();\r
	1555	\r
	1556	int len = iso14443a_select_card(uid, NULL, &cuid, true, 0, true);\r
	1557	if(!len) {\r
	1558	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");\r
	1559	OnError(1);\r
	1560	return;\r
	1561	};\r
	1562	\r
	1563	if(mifare_desfire_des_auth1(cuid, dataout)){\r
	1564	if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");\r
	1565	OnError(4);\r
	1566	return;\r
	1567	}\r
	1568	\r
	1569	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");\r
	1570	cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));\r
	1571	}\r
	1572	\r
	1573	void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){\r
	1574	\r
	1575	uint32_t cuid = arg0;\r
	1576	uint8_t key[16] = {0x00};\r
	1577	byte_t isOK = 0;\r
	1578	byte_t dataout[12] = {0x00};\r
	1579	\r
	1580	memcpy(key, datain, 16);\r
	1581	\r
	1582	isOK = mifare_desfire_des_auth2(cuid, key, dataout);\r
	1583	\r
	1584	if( isOK) {\r
	1585	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");\r
	1586	OnError(4);\r
	1587	return;\r
	1588	}\r
	1589	\r
	1590	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");\r
	1591	\r
	1592	cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));\r
	1593	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1594	LEDsoff();\r
	1595	}\r
	1596	\r
	1597	void OnSuccess(){\r
	1598	pcb_blocknum = 0;\r
	1599	ReaderTransmit(deselect_cmd, 3 , NULL);\r
	1600	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1601	LEDsoff();\r
	1602	}\r
	1603	\r
	1604	void OnError(uint8_t reason){\r
	1605	pcb_blocknum = 0;\r
	1606	ReaderTransmit(deselect_cmd, 3 , NULL);\r
	1607	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
	1608	cmd_send(CMD_ACK,0,reason,0,0,0);\r
	1609	LEDsoff();\r
	1610	}\r