]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
1004e3422655680623f4662685dbce697576f6be
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17 #include "apps.h"
18 #include "util.h"
19 //#include "../client/loclass/des.h"
20 #include "des.h"
21 #include "crc.h"
22
23 //-----------------------------------------------------------------------------
24 // Select, Authenticate, Read a MIFARE tag.
25 // read block
26 //-----------------------------------------------------------------------------
27 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
28 {
29 // params
30 uint8_t blockNo = arg0;
31 uint8_t keyType = arg1;
32 uint64_t ui64Key = 0;
33 ui64Key = bytes_to_num(datain, 6);
34
35 // variables
36 byte_t isOK = 0;
37 byte_t dataoutbuf[16];
38 uint8_t uid[10];
39 uint32_t cuid;
40 struct Crypto1State mpcs = {0, 0};
41 struct Crypto1State *pcs;
42 pcs = &mpcs;
43
44 // clear trace
45 clear_trace();
46 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
47
48 LED_A_ON();
49 LED_B_OFF();
50 LED_C_OFF();
51
52 while (true) {
53 if(!iso14443a_select_card(uid, NULL, &cuid)) {
54 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
55 break;
56 };
57
58 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
59 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
60 break;
61 };
62
63 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
64 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
65 break;
66 };
67
68 if(mifare_classic_halt(pcs, cuid)) {
69 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
70 break;
71 };
72
73 isOK = 1;
74 break;
75 }
76
77 // ----------------------------- crypto1 destroy
78 crypto1_destroy(pcs);
79
80 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
81
82 LED_B_ON();
83 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
84 LED_B_OFF();
85
86 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
87 LEDsoff();
88 }
89
90
91 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
92
93 byte_t dataoutbuf[16] = {0x00};
94 uint8_t uid[10] = {0x00};
95 uint32_t cuid = 0x00;
96
97 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
98
99 clear_trace();
100 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
101
102 if(!iso14443a_select_card(uid, NULL, &cuid)) {
103 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
104 OnError(0);
105 return;
106 };
107
108 if(mifare_ultra_auth1(dataoutbuf)){
109 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
110 OnError(1);
111 return;
112 }
113
114 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
115
116 cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
117 LEDsoff();
118 }
119 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
120
121 uint8_t key[16] = {0x00};
122 byte_t dataoutbuf[16] = {0x00};
123
124 memcpy(key, datain, 16);
125
126 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
127
128 if(mifare_ultra_auth2(key, dataoutbuf)){
129 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
130 OnError(1);
131 return;
132 }
133
134 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
135
136 cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
137 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
138 LEDsoff();
139 }
140
141 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
142 {
143 uint8_t blockNo = arg0;
144 byte_t dataout[16] = {0x00};
145 uint8_t uid[10] = {0x00};
146 uint8_t key[16] = {0x00};
147 bool usePwd = (arg1 == 1);
148
149 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
150
151 clear_trace();
152 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
153
154 int len = iso14443a_select_card(uid, NULL, NULL);
155 if(!len) {
156 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
157 OnError(1);
158 return;
159 }
160
161 // authenticate here.
162 if ( usePwd ) {
163
164 memcpy(key, datain, 16);
165
166 uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
167 uint8_t random_b[8] = {0x00};
168 uint8_t enc_random_b[8] = {0x00};
169 uint8_t rnd_ab[16] = {0x00};
170 uint8_t IV[8] = {0x00};
171
172 uint16_t len;
173 uint8_t receivedAnswer[MAX_FRAME_SIZE];
174 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
175
176 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
177 if (len != 11) {
178 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
179 OnError(1);
180 return;
181 }
182
183 // tag nonce.
184 memcpy(enc_random_b,receivedAnswer+1,8);
185
186 // decrypt nonce.
187 tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
188
189
190 rol(random_b,8);
191
192 memcpy(rnd_ab ,random_a,8);
193 memcpy(rnd_ab+8,random_b,8);
194
195 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
196 Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
197 enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],
198 enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
199
200 Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",
201 random_b[0],random_b[1],random_b[2],random_b[3],
202 random_b[4],random_b[5],random_b[6],random_b[7]);
203
204 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
205 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
206 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
207
208 Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
209 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
210 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
211 }
212
213 // encrypt out, in, length, key, iv
214 tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
215
216
217 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
218 if (len != 11) {
219 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
220 OnError(1);
221 return;
222 }
223
224 uint8_t enc_resp[8] = { 0 };
225 uint8_t resp_random_a[8] = { 0 };
226 memcpy(enc_resp, receivedAnswer+1, 8);
227
228 // decrypt out, in, length, key, iv
229 tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
230 if ( memcmp(resp_random_a, random_a, 8) != 0 )
231 Dbprintf("failed authentication");
232
233 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
234 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
235 rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
236 rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
237
238 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
239 rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
240 rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
241
242 Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
243 random_a[0],random_a[1],random_a[2],random_a[3],
244 random_a[4],random_a[5],random_a[6],random_a[7]);
245
246 Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
247 resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
248 resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
249 }
250 }
251
252 if( mifare_ultra_readblock(blockNo, dataout) ) {
253 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
254 OnError(2);
255 return;
256 }
257
258 if( mifare_ultra_halt() ) {
259 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
260 OnError(3);
261 return;
262 }
263
264 cmd_send(CMD_ACK,1,0,0,dataout,16);
265 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
266 LEDsoff();
267 }
268 //-----------------------------------------------------------------------------
269 // Select, Authenticate, Read a MIFARE tag.
270 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
271 //-----------------------------------------------------------------------------
272 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
273 {
274 // params
275 uint8_t sectorNo = arg0;
276 uint8_t keyType = arg1;
277 uint64_t ui64Key = 0;
278 ui64Key = bytes_to_num(datain, 6);
279
280 // variables
281 byte_t isOK = 0;
282 byte_t dataoutbuf[16 * 16];
283 uint8_t uid[10];
284 uint32_t cuid;
285 struct Crypto1State mpcs = {0, 0};
286 struct Crypto1State *pcs;
287 pcs = &mpcs;
288
289 // clear trace
290 clear_trace();
291
292 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
293
294 LED_A_ON();
295 LED_B_OFF();
296 LED_C_OFF();
297
298 isOK = 1;
299 if(!iso14443a_select_card(uid, NULL, &cuid)) {
300 isOK = 0;
301 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
302 }
303
304
305 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
306 isOK = 0;
307 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
308 }
309
310 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
311 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
312 isOK = 0;
313 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
314 break;
315 }
316 }
317
318 if(mifare_classic_halt(pcs, cuid)) {
319 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
320 }
321
322 // ----------------------------- crypto1 destroy
323 crypto1_destroy(pcs);
324
325 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
326
327 LED_B_ON();
328 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
329 LED_B_OFF();
330
331 // Thats it...
332 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
333 LEDsoff();
334 }
335
336 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
337 {
338 // params
339 uint8_t sectorNo = arg0;
340 int Pages = arg1;
341 int countpages = 0;
342 uint8_t dataout[176] = {0x00};;
343
344 LEDsoff();
345 LED_A_ON();
346 clear_trace();
347 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
348
349 int len = iso14443a_select_card(NULL, NULL, NULL);
350 if (!len) {
351 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
352 OnError(1);
353 return;
354 }
355
356 for (int i = 0; i < Pages; i++){
357
358 len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);
359
360 if (len) {
361 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
362 OnError(2);
363 return;
364 } else {
365 countpages++;
366 }
367 }
368
369 if (mifare_ultra_halt()) {
370 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
371 OnError(3);
372 return;
373 }
374
375 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Pages read %d", countpages);
376
377 len = Pages*4;
378
379 cmd_send(CMD_ACK, 1, 0, 0, dataout, len);
380 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
381 LEDsoff();
382 }
383
384 //-----------------------------------------------------------------------------
385 // Select, Authenticate, Write a MIFARE tag.
386 // read block
387 //-----------------------------------------------------------------------------
388 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
389 {
390 // params
391 uint8_t blockNo = arg0;
392 uint8_t keyType = arg1;
393 uint64_t ui64Key = 0;
394 byte_t blockdata[16];
395
396 ui64Key = bytes_to_num(datain, 6);
397 memcpy(blockdata, datain + 10, 16);
398
399 // variables
400 byte_t isOK = 0;
401 uint8_t uid[10];
402 uint32_t cuid;
403 struct Crypto1State mpcs = {0, 0};
404 struct Crypto1State *pcs;
405 pcs = &mpcs;
406
407 // clear trace
408 clear_trace();
409
410 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
411
412 LED_A_ON();
413 LED_B_OFF();
414 LED_C_OFF();
415
416 while (true) {
417 if(!iso14443a_select_card(uid, NULL, &cuid)) {
418 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
419 break;
420 };
421
422 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
423 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
424 break;
425 };
426
427 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
428 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
429 break;
430 };
431
432 if(mifare_classic_halt(pcs, cuid)) {
433 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
434 break;
435 };
436
437 isOK = 1;
438 break;
439 }
440
441 // ----------------------------- crypto1 destroy
442 crypto1_destroy(pcs);
443
444 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
445
446 LED_B_ON();
447 cmd_send(CMD_ACK,isOK,0,0,0,0);
448 LED_B_OFF();
449
450
451 // Thats it...
452 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
453 LEDsoff();
454 }
455
456 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
457 {
458 uint8_t blockNo = arg0;
459 byte_t blockdata[16] = {0x00};
460
461 memcpy(blockdata, datain, 16);
462
463 uint8_t uid[10] = {0x00};
464
465 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
466
467 clear_trace();
468 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
469
470 if(!iso14443a_select_card(uid, NULL, NULL)) {
471 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
472 OnError(0);
473 return;
474 };
475
476 if(mifare_ultra_writeblock(blockNo, blockdata)) {
477 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
478 OnError(0);
479 return; };
480
481 if(mifare_ultra_halt()) {
482 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
483 OnError(0);
484 return;
485 };
486
487 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
488
489 cmd_send(CMD_ACK,1,0,0,0,0);
490 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
491 LEDsoff();
492 }
493
494 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
495 {
496 uint8_t blockNo = arg0;
497 byte_t blockdata[4] = {0x00};
498
499 memcpy(blockdata, datain,4);
500
501 uint8_t uid[10] = {0x00};
502
503 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
504 clear_trace();
505 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
506
507 if(!iso14443a_select_card(uid, NULL, NULL)) {
508 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
509 OnError(0);
510 return;
511 };
512
513 if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
514 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
515 OnError(0);
516 return;
517 };
518
519 if(mifare_ultra_halt()) {
520 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
521 OnError(0);
522 return;
523 };
524
525 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
526
527 cmd_send(CMD_ACK,1,0,0,0,0);
528 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
529 LEDsoff();
530 }
531
532 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
533
534 uint8_t pwd[16] = {0x00};
535 byte_t blockdata[4] = {0x00};
536
537 memcpy(pwd, datain, 16);
538
539 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
540 clear_trace();
541 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
542
543 if(!iso14443a_select_card(NULL, NULL, NULL)) {
544 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
545 OnError(0);
546 return;
547 };
548
549 blockdata[0] = pwd[7];
550 blockdata[1] = pwd[6];
551 blockdata[2] = pwd[5];
552 blockdata[3] = pwd[4];
553 if(mifare_ultra_special_writeblock( 44, blockdata)) {
554 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
555 OnError(44);
556 return;
557 };
558
559 blockdata[0] = pwd[3];
560 blockdata[1] = pwd[2];
561 blockdata[2] = pwd[1];
562 blockdata[3] = pwd[0];
563 if(mifare_ultra_special_writeblock( 45, blockdata)) {
564 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
565 OnError(45);
566 return;
567 };
568
569 blockdata[0] = pwd[15];
570 blockdata[1] = pwd[14];
571 blockdata[2] = pwd[13];
572 blockdata[3] = pwd[12];
573 if(mifare_ultra_special_writeblock( 46, blockdata)) {
574 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
575 OnError(46);
576 return;
577 };
578
579 blockdata[0] = pwd[11];
580 blockdata[1] = pwd[10];
581 blockdata[2] = pwd[9];
582 blockdata[3] = pwd[8];
583 if(mifare_ultra_special_writeblock( 47, blockdata)) {
584 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
585 OnError(47);
586 return;
587 };
588
589 if(mifare_ultra_halt()) {
590 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
591 OnError(0);
592 return;
593 };
594
595 cmd_send(CMD_ACK,1,0,0,0,0);
596 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
597 LEDsoff();
598 }
599
600 // Return 1 if the nonce is invalid else return 0
601 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
602 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
603 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
604 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
605 }
606
607
608 //-----------------------------------------------------------------------------
609 // MIFARE nested authentication.
610 //
611 //-----------------------------------------------------------------------------
612 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
613 {
614 // params
615 uint8_t blockNo = arg0 & 0xff;
616 uint8_t keyType = (arg0 >> 8) & 0xff;
617 uint8_t targetBlockNo = arg1 & 0xff;
618 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
619 uint64_t ui64Key = 0;
620
621 ui64Key = bytes_to_num(datain, 6);
622
623 // variables
624 uint16_t rtr, i, j, len;
625 uint16_t davg;
626 static uint16_t dmin, dmax;
627 uint8_t uid[10];
628 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
629 uint8_t par[1];
630 uint32_t target_nt[2], target_ks[2];
631
632 uint8_t par_array[4];
633 uint16_t ncount = 0;
634 struct Crypto1State mpcs = {0, 0};
635 struct Crypto1State *pcs;
636 pcs = &mpcs;
637 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
638
639 uint32_t auth1_time, auth2_time;
640 static uint16_t delta_time;
641
642 // free eventually allocated BigBuf memory
643 BigBuf_free();
644 // clear trace
645 clear_trace();
646 set_tracing(false);
647
648 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
649
650 LED_A_ON();
651 LED_C_OFF();
652
653
654 // statistics on nonce distance
655 if (calibrate) { // for first call only. Otherwise reuse previous calibration
656 LED_B_ON();
657 WDT_HIT();
658
659 davg = dmax = 0;
660 dmin = 2000;
661 delta_time = 0;
662
663 for (rtr = 0; rtr < 17; rtr++) {
664
665 // prepare next select. No need to power down the card.
666 if(mifare_classic_halt(pcs, cuid)) {
667 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
668 rtr--;
669 continue;
670 }
671
672 if(!iso14443a_select_card(uid, NULL, &cuid)) {
673 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
674 rtr--;
675 continue;
676 };
677
678 auth1_time = 0;
679 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
680 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
681 rtr--;
682 continue;
683 };
684
685 if (delta_time) {
686 auth2_time = auth1_time + delta_time;
687 } else {
688 auth2_time = 0;
689 }
690 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
691 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
692 rtr--;
693 continue;
694 };
695
696 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
697 for (i = 101; i < 1200; i++) {
698 nttmp = prng_successor(nttmp, 1);
699 if (nttmp == nt2) break;
700 }
701
702 if (i != 1200) {
703 if (rtr != 0) {
704 davg += i;
705 dmin = MIN(dmin, i);
706 dmax = MAX(dmax, i);
707 }
708 else {
709 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
710 }
711 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
712 }
713 }
714
715 if (rtr <= 1) return;
716
717 davg = (davg + (rtr - 1)/2) / (rtr - 1);
718
719 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
720
721 dmin = davg - 2;
722 dmax = davg + 2;
723
724 LED_B_OFF();
725
726 }
727 // -------------------------------------------------------------------------------------------------
728
729 LED_C_ON();
730
731 // get crypted nonces for target sector
732 for(i=0; i < 2; i++) { // look for exactly two different nonces
733
734 target_nt[i] = 0;
735 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
736
737 // prepare next select. No need to power down the card.
738 if(mifare_classic_halt(pcs, cuid)) {
739 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
740 continue;
741 }
742
743 if(!iso14443a_select_card(uid, NULL, &cuid)) {
744 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
745 continue;
746 };
747
748 auth1_time = 0;
749 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
750 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
751 continue;
752 };
753
754 // nested authentication
755 auth2_time = auth1_time + delta_time;
756 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
757 if (len != 4) {
758 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
759 continue;
760 };
761
762 nt2 = bytes_to_num(receivedAnswer, 4);
763 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
764
765 // Parity validity check
766 for (j = 0; j < 4; j++) {
767 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
768 }
769
770 ncount = 0;
771 nttest = prng_successor(nt1, dmin - 1);
772 for (j = dmin; j < dmax + 1; j++) {
773 nttest = prng_successor(nttest, 1);
774 ks1 = nt2 ^ nttest;
775
776 if (valid_nonce(nttest, nt2, ks1, par_array)){
777 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
778 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
779 target_nt[i] = 0;
780 break;
781 }
782 target_nt[i] = nttest;
783 target_ks[i] = ks1;
784 ncount++;
785 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
786 target_nt[i] = 0;
787 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
788 break;
789 }
790 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
791 }
792 }
793 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
794 }
795 }
796
797 LED_C_OFF();
798
799 // ----------------------------- crypto1 destroy
800 crypto1_destroy(pcs);
801
802 byte_t buf[4 + 4 * 4];
803 memcpy(buf, &cuid, 4);
804 memcpy(buf+4, &target_nt[0], 4);
805 memcpy(buf+8, &target_ks[0], 4);
806 memcpy(buf+12, &target_nt[1], 4);
807 memcpy(buf+16, &target_ks[1], 4);
808
809 LED_B_ON();
810 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
811 LED_B_OFF();
812
813 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
814
815 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
816 LEDsoff();
817 set_tracing(TRUE);
818 }
819
820 //-----------------------------------------------------------------------------
821 // MIFARE check keys. key count up to 85.
822 //
823 //-----------------------------------------------------------------------------
824 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
825 {
826 // params
827 uint8_t blockNo = arg0;
828 uint8_t keyType = arg1;
829 uint8_t keyCount = arg2;
830 uint64_t ui64Key = 0;
831
832 // variables
833 int i;
834 byte_t isOK = 0;
835 uint8_t uid[10];
836 uint32_t cuid;
837 struct Crypto1State mpcs = {0, 0};
838 struct Crypto1State *pcs;
839 pcs = &mpcs;
840
841 // clear debug level
842 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
843 MF_DBGLEVEL = MF_DBG_NONE;
844
845 // clear trace
846 clear_trace();
847 set_tracing(TRUE);
848
849 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
850
851 LED_A_ON();
852 LED_B_OFF();
853 LED_C_OFF();
854
855 for (i = 0; i < keyCount; i++) {
856 if(mifare_classic_halt(pcs, cuid)) {
857 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
858 }
859
860 if(!iso14443a_select_card(uid, NULL, &cuid)) {
861 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
862 break;
863 };
864
865 ui64Key = bytes_to_num(datain + i * 6, 6);
866 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
867 continue;
868 };
869
870 isOK = 1;
871 break;
872 }
873
874 // ----------------------------- crypto1 destroy
875 crypto1_destroy(pcs);
876
877 LED_B_ON();
878 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
879 LED_B_OFF();
880
881 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
882 LEDsoff();
883
884 // restore debug level
885 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
886 }
887
888 //-----------------------------------------------------------------------------
889 // MIFARE commands set debug level
890 //
891 //-----------------------------------------------------------------------------
892 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
893 MF_DBGLEVEL = arg0;
894 Dbprintf("Debug level: %d", MF_DBGLEVEL);
895 }
896
897 //-----------------------------------------------------------------------------
898 // Work with emulator memory
899 //
900 //-----------------------------------------------------------------------------
901 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
902 emlClearMem();
903 }
904
905 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
906 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
907 }
908
909 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
910 byte_t buf[USB_CMD_DATA_SIZE];
911 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
912
913 LED_B_ON();
914 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
915 LED_B_OFF();
916 }
917
918 //-----------------------------------------------------------------------------
919 // Load a card into the emulator memory
920 //
921 //-----------------------------------------------------------------------------
922 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
923 uint8_t numSectors = arg0;
924 uint8_t keyType = arg1;
925 uint64_t ui64Key = 0;
926 uint32_t cuid;
927 struct Crypto1State mpcs = {0, 0};
928 struct Crypto1State *pcs;
929 pcs = &mpcs;
930
931 // variables
932 byte_t dataoutbuf[16];
933 byte_t dataoutbuf2[16];
934 uint8_t uid[10];
935
936 // clear trace
937 clear_trace();
938 set_tracing(false);
939
940 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
941
942 LED_A_ON();
943 LED_B_OFF();
944 LED_C_OFF();
945
946 bool isOK = true;
947
948 if(!iso14443a_select_card(uid, NULL, &cuid)) {
949 isOK = false;
950 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
951 }
952
953 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
954 ui64Key = emlGetKey(sectorNo, keyType);
955 if (sectorNo == 0){
956 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
957 isOK = false;
958 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
959 break;
960 }
961 } else {
962 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
963 isOK = false;
964 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
965 break;
966 }
967 }
968
969 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
970 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
971 isOK = false;
972 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
973 break;
974 };
975 if (isOK) {
976 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
977 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
978 } else { // sector trailer, keep the keys, set only the AC
979 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
980 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
981 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
982 }
983 }
984 }
985
986 }
987
988 if(mifare_classic_halt(pcs, cuid)) {
989 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
990 };
991
992 // ----------------------------- crypto1 destroy
993 crypto1_destroy(pcs);
994
995 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
996 LEDsoff();
997
998 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
999
1000 }
1001
1002
1003 //-----------------------------------------------------------------------------
1004 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1005 //
1006 //-----------------------------------------------------------------------------
1007 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1008
1009 // params
1010 uint8_t needWipe = arg0;
1011 // bit 0 - need get UID
1012 // bit 1 - need wupC
1013 // bit 2 - need HALT after sequence
1014 // bit 3 - need init FPGA and field before sequence
1015 // bit 4 - need reset FPGA and LED
1016 uint8_t workFlags = arg1;
1017 uint8_t blockNo = arg2;
1018
1019 // card commands
1020 uint8_t wupC1[] = { 0x40 };
1021 uint8_t wupC2[] = { 0x43 };
1022 uint8_t wipeC[] = { 0x41 };
1023
1024 // variables
1025 byte_t isOK = 0;
1026 uint8_t uid[10] = {0x00};
1027 uint8_t d_block[18] = {0x00};
1028 uint32_t cuid;
1029
1030 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1031 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1032
1033 // reset FPGA and LED
1034 if (workFlags & 0x08) {
1035 LED_A_ON();
1036 LED_B_OFF();
1037 LED_C_OFF();
1038
1039 clear_trace();
1040 set_tracing(TRUE);
1041 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1042 }
1043
1044 while (true) {
1045
1046 // get UID from chip
1047 if (workFlags & 0x01) {
1048 if(!iso14443a_select_card(uid, NULL, &cuid)) {
1049 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1050 //break;
1051 };
1052
1053 if(mifare_classic_halt(NULL, cuid)) {
1054 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1055 //break;
1056 };
1057 };
1058
1059 // reset chip
1060 if (needWipe){
1061 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1062 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1063 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1064 break;
1065 };
1066
1067 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1068 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1069 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
1070 break;
1071 };
1072
1073 if(mifare_classic_halt(NULL, cuid)) {
1074 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1075 break;
1076 };
1077 };
1078
1079 // write block
1080 if (workFlags & 0x02) {
1081 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1082 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1083 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1084 break;
1085 };
1086
1087 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1088 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1089 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1090 break;
1091 };
1092 }
1093
1094 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1095 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1096 break;
1097 };
1098
1099 memcpy(d_block, datain, 16);
1100 AppendCrc14443a(d_block, 16);
1101
1102 ReaderTransmit(d_block, sizeof(d_block), NULL);
1103 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1104 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1105 break;
1106 };
1107
1108 if (workFlags & 0x04) {
1109 if (mifare_classic_halt(NULL, cuid)) {
1110 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1111 break;
1112 };
1113 }
1114
1115 isOK = 1;
1116 break;
1117 }
1118
1119 LED_B_ON();
1120 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1121 LED_B_OFF();
1122
1123 if ((workFlags & 0x10) || (!isOK)) {
1124 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1125 LEDsoff();
1126 }
1127 }
1128
1129
1130 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1131
1132 // params
1133 // bit 1 - need wupC
1134 // bit 2 - need HALT after sequence
1135 // bit 3 - need init FPGA and field before sequence
1136 // bit 4 - need reset FPGA and LED
1137 uint8_t workFlags = arg0;
1138 uint8_t blockNo = arg2;
1139
1140 // card commands
1141 uint8_t wupC1[] = { 0x40 };
1142 uint8_t wupC2[] = { 0x43 };
1143
1144 // variables
1145 byte_t isOK = 0;
1146 uint8_t data[18] = {0x00};
1147 uint32_t cuid = 0;
1148
1149 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1150 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1151
1152 if (workFlags & 0x08) {
1153 LED_A_ON();
1154 LED_B_OFF();
1155 LED_C_OFF();
1156
1157 clear_trace();
1158 set_tracing(TRUE);
1159 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1160 }
1161
1162 while (true) {
1163 if (workFlags & 0x02) {
1164 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1165 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1166 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1167 break;
1168 };
1169
1170 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1171 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1172 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1173 break;
1174 };
1175 }
1176
1177 // read block
1178 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1179 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1180 break;
1181 };
1182 memcpy(data, receivedAnswer, 18);
1183
1184 if (workFlags & 0x04) {
1185 if (mifare_classic_halt(NULL, cuid)) {
1186 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1187 break;
1188 };
1189 }
1190
1191 isOK = 1;
1192 break;
1193 }
1194
1195 LED_B_ON();
1196 cmd_send(CMD_ACK,isOK,0,0,data,18);
1197 LED_B_OFF();
1198
1199 if ((workFlags & 0x10) || (!isOK)) {
1200 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1201 LEDsoff();
1202 }
1203 }
1204
1205 void MifareCIdent(){
1206
1207 // card commands
1208 uint8_t wupC1[] = { 0x40 };
1209 uint8_t wupC2[] = { 0x43 };
1210
1211 // variables
1212 byte_t isOK = 1;
1213
1214 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1215 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1216
1217 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1218 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1219 isOK = 0;
1220 };
1221
1222 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1223 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1224 isOK = 0;
1225 };
1226
1227 if (mifare_classic_halt(NULL, 0)) {
1228 isOK = 0;
1229 };
1230
1231 cmd_send(CMD_ACK,isOK,0,0,0,0);
1232 }
1233
1234 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1235
1236 BigBuf_free();
1237
1238 uint32_t iterations = arg0;
1239 uint8_t uid[10] = {0x00};
1240
1241 uint8_t *response = BigBuf_malloc(MAX_MIFARE_FRAME_SIZE);
1242 uint8_t *responsePar = BigBuf_malloc(MAX_MIFARE_PARITY_SIZE);
1243
1244 uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1245
1246 // get memory from BigBuf.
1247 uint8_t *nonces = BigBuf_malloc(iterations * 4);
1248
1249 LED_A_ON();
1250 LED_B_OFF();
1251 LED_C_OFF();
1252
1253 clear_trace();
1254 set_tracing(TRUE);
1255 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1256
1257 for (int i = 0; i < iterations; i++) {
1258
1259 WDT_HIT();
1260
1261 // Test if the action was cancelled
1262 if(BUTTON_PRESS()) break;
1263
1264 // if(mifare_classic_halt(pcs, cuid)) {
1265 // if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1266 //}
1267
1268 if(!iso14443a_select_card(uid, NULL, NULL)) {
1269 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1270 continue;
1271 };
1272
1273 // Transmit MIFARE_CLASSIC_AUTH.
1274 ReaderTransmit(mf_auth, sizeof(mf_auth), NULL);
1275
1276 // Receive the (4 Byte) "random" nonce
1277 if (!ReaderReceive(response, responsePar)) {
1278 if (MF_DBGLEVEL >= 1) Dbprintf("Couldn't receive tag nonce");
1279 continue;
1280 }
1281
1282 nonces[i*4] = bytes_to_num(response, 4);
1283 }
1284
1285 int packLen = iterations * 4;
1286 int packSize = 0;
1287 int packNum = 0;
1288 while (packLen > 0) {
1289 packSize = MIN(USB_CMD_DATA_SIZE, packLen);
1290 LED_B_ON();
1291 cmd_send(CMD_ACK, 77, 0, packSize, nonces - packLen, packSize);
1292 LED_B_OFF();
1293
1294 packLen -= packSize;
1295 packNum++;
1296 }
1297
1298 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1299 LEDsoff();
1300 }
1301
1302 //
1303 // DESFIRE
1304 //
1305
1306 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1307
1308 byte_t dataout[11] = {0x00};
1309 uint8_t uid[10] = {0x00};
1310 uint32_t cuid = 0x00;
1311
1312 clear_trace();
1313 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1314
1315 int len = iso14443a_select_card(uid, NULL, &cuid);
1316 if(!len) {
1317 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1318 OnError(1);
1319 return;
1320 };
1321
1322 if(mifare_desfire_des_auth1(cuid, dataout)){
1323 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1324 OnError(4);
1325 return;
1326 }
1327
1328 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1329 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1330 }
1331
1332 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1333
1334 uint32_t cuid = arg0;
1335 uint8_t key[16] = {0x00};
1336 byte_t dataout[12] = {0x00};
1337 byte_t isOK = 0;
1338
1339 memcpy(key, datain, 16);
1340
1341 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1342
1343 if( isOK) {
1344 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1345 OnError(4);
1346 return;
1347 }
1348
1349 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1350
1351 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1352 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1353 LEDsoff();
1354 }
Impressum, Datenschutz