1 #include "mifaredesfire.h"
3 #define MAX_APPLICATION_COUNT 28
4 #define MAX_FILE_COUNT 16
5 #define MAX_DESFIRE_FRAME_SIZE 60
6 #define NOT_YET_AUTHENTICATED 255
7 #define FRAME_PAYLOAD_SIZE (MAX_DESFIRE_FRAME_SIZE - 5)
8 #define RECEIVE_SIZE 64
10 // the block number for the ISO14443-4 PCB
11 uint8_t pcb_blocknum
= 0;
12 // Deselect card by sending a s-block. the crc is precalced for speed
13 static uint8_t deselect_cmd
[] = {0xc2,0xe0,0xb4};
15 //static uint8_t __msg[MAX_FRAME_SIZE] = { 0x0A, 0x00, 0x00, /* ..., */ 0x00 };
16 /* PCB CID CMD PAYLOAD */
17 //static uint8_t __res[MAX_FRAME_SIZE];
19 bool InitDesfireCard(){
21 // Make sure it is off.
22 // FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
25 byte_t cardbuf
[USB_CMD_DATA_SIZE
];
26 memset(cardbuf
,0,sizeof(cardbuf
));
28 iso14a_set_tracing(TRUE
);
29 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
31 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)cardbuf
;
32 int len
= iso14443a_select_card(NULL
,card
,NULL
);
35 if (MF_DBGLEVEL
>= 1) {
36 Dbprintf("Can't select card");
53 void MifareSendCommand(uint8_t arg0
, uint8_t arg1
, uint8_t *datain
){
55 /* ARG0 contains flags.
61 size_t datalen
= arg1
;
62 uint8_t resp
[RECEIVE_SIZE
];
63 memset(resp
,0,sizeof(resp
));
65 if (MF_DBGLEVEL
>= 4) {
66 Dbprintf(" flags : %02X", flags
);
67 Dbprintf(" len : %02X", datalen
);
68 print_result(" RX : ", datain
, datalen
);
71 if ( flags
& CLEARTRACE
){
76 if ( !InitDesfireCard() )
80 int len
= DesfireAPDU(datain
, datalen
, resp
);
81 if (MF_DBGLEVEL
>= 4) {
82 print_result("ERR <--: ", resp
, len
);
90 // reset the pcb_blocknum,
93 if ( flags
& DISCONNECT
){
97 cmd_send(CMD_ACK
,1,len
,0,resp
,len
);
100 void MifareDesfireGetInformation(){
103 uint8_t resp
[USB_CMD_DATA_SIZE
];
104 uint8_t dataout
[USB_CMD_DATA_SIZE
];
105 byte_t cardbuf
[USB_CMD_DATA_SIZE
];
107 memset(resp
,0,sizeof(resp
));
108 memset(dataout
,0, sizeof(dataout
));
109 memset(cardbuf
,0,sizeof(cardbuf
));
114 3 = desfire command 3
117 PCB == 0x0A because sending CID byte.
118 CID == 0x00 first card?
120 iso14a_clear_trace();
121 iso14a_set_tracing(TRUE
);
122 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
124 // card select - information
125 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)cardbuf
;
126 byte_t isOK
= iso14443a_select_card(NULL
, card
, NULL
);
128 if (MF_DBGLEVEL
>= 1) {
129 Dbprintf("Can't select card");
135 memcpy(dataout
,card
->uid
,7);
141 uint8_t cmd
[] = {GET_VERSION
};
142 size_t cmd_len
= sizeof(cmd
);
144 len
= DesfireAPDU(cmd
, cmd_len
, resp
);
146 print_result("ERROR <--: ", resp
, len
);
153 memcpy(dataout
+7,resp
+3,7);
156 cmd
[0] = ADDITIONAL_FRAME
;
157 len
= DesfireAPDU(cmd
, cmd_len
, resp
);
159 print_result("ERROR <--: ", resp
, len
);
166 memcpy(dataout
+7+7,resp
+3,7);
169 len
= DesfireAPDU(cmd
, cmd_len
, resp
);
171 print_result("ERROR <--: ", resp
, len
);
176 memcpy(dataout
+7+7+7,resp
+3,14);
178 cmd_send(CMD_ACK
,1,0,0,dataout
,sizeof(dataout
));
180 // reset the pcb_blocknum,
185 void MifareDES_Auth1(uint8_t mode
, uint8_t algo
, uint8_t keyno
, uint8_t *datain
){
188 //uint8_t PICC_MASTER_KEY8[8] = { 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47};
189 uint8_t PICC_MASTER_KEY16
[16] = { 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48,0x49,0x4a,0x4b,0x4c,0x4d,0x4e,0x4f };
190 //uint8_t null_key_data8[8] = {0x00};
191 //uint8_t null_key_data16[16] = {0x00};
192 //uint8_t new_key_data8[8] = { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77};
193 //uint8_t new_key_data16[16] = { 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF};
195 //uint8_t* bigbuffer = get_bigbufptr_recvrespbuf();
196 uint8_t resp
[256] = {0x00};
197 uint8_t IV
[16] = {0x00};
199 size_t datalen
= datain
[0];
201 uint8_t cmd
[40] = {0x00};
202 uint8_t encRndB
[16] = {0x00};
203 uint8_t decRndB
[16] = {0x00};
204 uint8_t nonce
[16] = {0x00};
205 uint8_t both
[32] = {0x00};
206 uint8_t encBoth
[32] = {0x00};
214 // 3 olika sätt att authenticera. AUTH (CRC16) , AUTH_ISO (CRC32) , AUTH_AES (CRC32)
215 // 4 olika crypto algo DES, 3DES, 3K3DES, AES
216 // 3 olika kommunikations sätt, PLAIN,MAC,CRYPTO
221 // if ( SendDesfireCommand(AUTHENTICATE, &keyno, resp) > 0 ){
222 // // fick nonce från kortet
226 //SendDesfireCommand(AUTHENTICATE_ISO, &keyno, resp);
231 uint8_t keybytes
[16];
232 if (datain
[1] == 0xff){
233 memcpy(keybytes
,PICC_MASTER_KEY16
,16);
235 memcpy(keybytes
, datain
+1, datalen
);
238 struct desfire_key defaultkey
= {0};
239 desfirekey_t key
= &defaultkey
;
240 Desfire_aes_key_new( keybytes
, key
);
243 if ( AesCtxIni(&ctx
, IV
, key
->data
, KEY128
, CBC
) < 0 ){
244 if( MF_DBGLEVEL
>= 4) {
245 Dbprintf("AES context failed to init");
251 cmd
[0] = AUTHENTICATE_AES
;
252 cmd
[1] = 0x00; //keynumber
253 len
= DesfireAPDU(cmd
, 2, resp
);
255 if (MF_DBGLEVEL
>= 1) {
256 DbpString("Authentication failed. Card timeout.");
262 memcpy( encRndB
, resp
+3, 16);
264 // dekryptera tagnonce.
265 AesDecrypt(&ctx
, encRndB
, decRndB
, 16);
267 memcpy(both
, nonce
,16);
268 memcpy(both
+16, decRndB
,16 );
269 AesEncrypt(&ctx
, both
, encBoth
, 32 );
271 cmd
[0] = ADDITIONAL_FRAME
;
272 memcpy(cmd
+1, encBoth
, 32 );
274 len
= DesfireAPDU(cmd
, 33, resp
); // 1 + 32 == 33
276 if (MF_DBGLEVEL
>= 1) {
277 DbpString("Authentication failed. Card timeout.");
283 if ( resp
[2] == 0x00 ){
284 // Create AES Session key
285 struct desfire_key sessionKey
= {0};
286 desfirekey_t skey
= &sessionKey
;
287 Desfire_session_key_new( nonce
, decRndB
, key
, skey
);
288 print_result("SESSION : ", skey
->data
, 16);
290 DbpString("Authetication failed.");
300 cmd_send(CMD_ACK
,1,len
,0,resp
,len
);
303 // 3 olika ISO sätt att skicka data till DESFIRE (direkt, inkapslat, inkapslat ISO)
304 // cmd = cmd bytes to send
305 // cmd_len = length of cmd
306 // dataout = pointer to response data array
307 int DesfireAPDU(uint8_t *cmd
, size_t cmd_len
, uint8_t *dataout
){
310 size_t wrappedLen
= 0;
311 uint8_t wCmd
[USB_CMD_DATA_SIZE
] = {0};
313 uint8_t *resp
= ((uint8_t *)BigBuf
) + RECV_RESP_OFFSET
;
314 uint8_t *resp_par
= ((uint8_t *)BigBuf
) + RECV_RESP_PAR_OFFSET
;
316 wrappedLen
= CreateAPDU( cmd
, cmd_len
, wCmd
);
318 if (MF_DBGLEVEL
>= 4) {
319 print_result("WCMD <--: ", wCmd
, wrappedLen
);
321 ReaderTransmit( wCmd
, wrappedLen
, NULL
);
323 len
= ReaderReceive(resp
, resp_par
);
326 if (MF_DBGLEVEL
>= 4) {
329 return FALSE
; //DATA LINK ERROR
331 // if we received an I- or R(ACK)-Block with a block number equal to the
332 // current block number, toggle the current block number
333 else if (len
>= 4 // PCB+CID+CRC = 4 bytes
334 && ((resp
[0] & 0xC0) == 0 // I-Block
335 || (resp
[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
336 && (resp
[0] & 0x01) == pcb_blocknum
) // equal block numbers
338 pcb_blocknum
^= 1; //toggle next block
341 memcpy(dataout
, resp
, len
);
346 size_t CreateAPDU( uint8_t *datain
, size_t len
, uint8_t *dataout
){
348 size_t cmdlen
= MIN(len
+4, USB_CMD_DATA_SIZE
-1);
351 memset(cmd
, 0, cmdlen
);
353 cmd
[0] = 0x0A; // 0x0A = skicka cid, 0x02 = ingen cid. Särskilda bitar //
354 cmd
[0] |= pcb_blocknum
; // OR the block number into the PCB
355 cmd
[1] = 0x00; // CID: 0x00 //FIXME: allow multiple selected cards
357 memcpy(cmd
+2, datain
, len
);
358 AppendCrc14443a(cmd
, len
+2);
360 memcpy(dataout
, cmd
, cmdlen
);
365 // crc_update(&desfire_crc32, 0, 1); /* CMD_WRITE */
366 // crc_update(&desfire_crc32, addr, addr_sz);
367 // crc_update(&desfire_crc32, byte, 8);
368 // uint32_t crc = crc_finish(&desfire_crc32);
372 ReaderTransmit(deselect_cmd
, 3 , NULL
);
373 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
379 ReaderTransmit(deselect_cmd
, 3 , NULL
);
380 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
381 cmd_send(CMD_ACK
,0,0,0,0,0);