]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
1352215e2314df9488cfb8e64eecb1f62b7bbeaf
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "desfire.h"
20 #include "../common/crc.h"
21
22 //-----------------------------------------------------------------------------
23 // Select, Authenticate, Read a MIFARE tag.
24 // read block
25 //-----------------------------------------------------------------------------
26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
27 {
28 // params
29 uint8_t blockNo = arg0;
30 uint8_t keyType = arg1;
31 uint64_t ui64Key = 0;
32 ui64Key = bytes_to_num(datain, 6);
33
34 // variables
35 byte_t isOK = 0;
36 byte_t dataoutbuf[16];
37 uint8_t uid[10];
38 uint32_t cuid;
39 struct Crypto1State mpcs = {0, 0};
40 struct Crypto1State *pcs;
41 pcs = &mpcs;
42
43 // clear trace
44 iso14a_clear_trace();
45 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
46
47 LED_A_ON();
48 LED_B_OFF();
49 LED_C_OFF();
50
51 while (true) {
52 if(!iso14443a_select_card(uid, NULL, &cuid)) {
53 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
54 break;
55 };
56
57 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
58 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
59 break;
60 };
61
62 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
63 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
64 break;
65 };
66
67 if(mifare_classic_halt(pcs, cuid)) {
68 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
69 break;
70 };
71
72 isOK = 1;
73 break;
74 }
75
76 // ----------------------------- crypto1 destroy
77 crypto1_destroy(pcs);
78
79 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
80
81 LED_B_ON();
82 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
83 LED_B_OFF();
84
85 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
86 LEDsoff();
87 }
88
89
90 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
91 // variables
92 byte_t isOK = 0;
93 byte_t dataoutbuf[16];
94 uint8_t uid[10];
95 uint32_t cuid;
96
97 // clear trace
98 iso14a_clear_trace();
99 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
100
101 LED_A_ON();
102 LED_B_OFF();
103 LED_C_OFF();
104
105
106 if(!iso14443a_select_card(uid, NULL, &cuid)) {
107 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card, something went wrong before auth");
108 };
109
110 if(mifare_ultra_auth1(cuid, dataoutbuf)){
111 if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part1: Fail.");
112 }
113
114 isOK=1;
115 if (MF_DBGLEVEL >= 2) DbpString("AUTH 1 FINISHED");
116
117 LED_B_ON();
118 cmd_send(CMD_ACK,isOK,cuid,0,dataoutbuf,11);
119 LED_B_OFF();
120
121 // Thats it...
122 LEDsoff();
123 }
124 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
125 // params
126 uint32_t cuid = arg0;
127 uint8_t key[16]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
128 // variables
129 byte_t isOK = 0;
130 byte_t dataoutbuf[16];
131
132 memcpy(key, datain, 16);
133
134 LED_A_ON();
135 LED_B_OFF();
136 LED_C_OFF();
137
138 if(mifare_ultra_auth2(cuid, key, dataoutbuf)){
139 if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part2: Fail...");
140 }
141 isOK=1;
142 if (MF_DBGLEVEL >= 2) DbpString("AUTH 2 FINISHED");
143
144 LED_B_ON();
145 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);
146 LED_B_OFF();
147
148 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
149 LEDsoff();
150 }
151
152 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
153 {
154 // params
155 uint8_t blockNo = arg0;
156
157 // variables
158 byte_t isOK = 0;
159 byte_t dataoutbuf[16];
160 uint8_t uid[10];
161 uint32_t cuid;
162
163 // clear trace
164 iso14a_clear_trace();
165 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
166
167 LED_A_ON();
168 LED_B_OFF();
169 LED_C_OFF();
170
171 while (true) {
172 if(!iso14443a_select_card(uid, NULL, &cuid)) {
173 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
174 break;
175 };
176
177 if(mifare_ultra_readblock(cuid, blockNo, dataoutbuf)) {
178 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
179 break;
180 };
181
182 if(mifare_ultra_halt(cuid)) {
183 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
184 break;
185 };
186
187 isOK = 1;
188 break;
189 }
190
191 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
192
193 LED_B_ON();
194 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
195 LED_B_OFF();
196 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
197 LEDsoff();
198 }
199
200 //-----------------------------------------------------------------------------
201 // Select, Authenticate, Read a MIFARE tag.
202 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
203 //-----------------------------------------------------------------------------
204 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
205 {
206 // params
207 uint8_t sectorNo = arg0;
208 uint8_t keyType = arg1;
209 uint64_t ui64Key = 0;
210 ui64Key = bytes_to_num(datain, 6);
211
212 // variables
213 byte_t isOK = 0;
214 byte_t dataoutbuf[16 * 16];
215 uint8_t uid[10];
216 uint32_t cuid;
217 struct Crypto1State mpcs = {0, 0};
218 struct Crypto1State *pcs;
219 pcs = &mpcs;
220
221 // clear trace
222 iso14a_clear_trace();
223
224 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
225
226 LED_A_ON();
227 LED_B_OFF();
228 LED_C_OFF();
229
230 isOK = 1;
231 if(!iso14443a_select_card(uid, NULL, &cuid)) {
232 isOK = 0;
233 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
234 }
235
236
237 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
238 isOK = 0;
239 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
240 }
241
242 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
243 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
244 isOK = 0;
245 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
246 break;
247 }
248 }
249
250 if(mifare_classic_halt(pcs, cuid)) {
251 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
252 }
253
254 // ----------------------------- crypto1 destroy
255 crypto1_destroy(pcs);
256
257 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
258
259 LED_B_ON();
260 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
261 LED_B_OFF();
262
263 // Thats it...
264 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
265 LEDsoff();
266 }
267
268 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
269 {
270 // params
271 uint8_t sectorNo = arg0;
272 int Pages=arg1;
273 int count_Pages=0;
274 // variables
275 byte_t isOK = 0;
276 byte_t dataoutbuf[176];
277 uint8_t uid[10];
278 uint32_t cuid;
279
280 // clear trace
281 iso14a_clear_trace();
282
283 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
284
285 LED_A_ON();
286 LED_B_OFF();
287 LED_C_OFF();
288 Dbprintf("Pages %d",Pages);
289 while (true) {
290 if(!iso14443a_select_card(uid, NULL, &cuid)) {
291 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
292 break;
293 };
294 for(int sec=0;sec<Pages;sec++){
295 if(mifare_ultra_readblock(cuid, sectorNo * 4 + sec, dataoutbuf + 4 * sec)) {
296 if (MF_DBGLEVEL >= 1) Dbprintf("Read block %d error",sec);
297 break;
298 }else{
299 count_Pages++;
300 };
301 }
302 if(mifare_ultra_halt(cuid)) {
303 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
304 break;
305 };
306
307 isOK = 1;
308 break;
309 }
310 Dbprintf("Pages read %d",count_Pages);
311 if (MF_DBGLEVEL >= 2) DbpString("READ CARD FINISHED");
312
313 LED_B_ON();
314 if (Pages==16) cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
315 if (Pages==44 && count_Pages==16) cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
316 if (Pages==44 && count_Pages>16) cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,176);
317 LED_B_OFF();
318
319 // Thats it...
320 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
321 LEDsoff();
322
323 }
324
325
326 //-----------------------------------------------------------------------------
327 // Select, Authenticate, Write a MIFARE tag.
328 // read block
329 //-----------------------------------------------------------------------------
330 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
331 {
332 // params
333 uint8_t blockNo = arg0;
334 uint8_t keyType = arg1;
335 uint64_t ui64Key = 0;
336 byte_t blockdata[16];
337
338 ui64Key = bytes_to_num(datain, 6);
339 memcpy(blockdata, datain + 10, 16);
340
341 // variables
342 byte_t isOK = 0;
343 uint8_t uid[10];
344 uint32_t cuid;
345 struct Crypto1State mpcs = {0, 0};
346 struct Crypto1State *pcs;
347 pcs = &mpcs;
348
349 // clear trace
350 iso14a_clear_trace();
351
352 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
353
354 LED_A_ON();
355 LED_B_OFF();
356 LED_C_OFF();
357
358 while (true) {
359 if(!iso14443a_select_card(uid, NULL, &cuid)) {
360 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
361 break;
362 };
363
364 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
365 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
366 break;
367 };
368
369 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
370 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
371 break;
372 };
373
374 if(mifare_classic_halt(pcs, cuid)) {
375 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
376 break;
377 };
378
379 isOK = 1;
380 break;
381 }
382
383 // ----------------------------- crypto1 destroy
384 crypto1_destroy(pcs);
385
386 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
387
388 LED_B_ON();
389 cmd_send(CMD_ACK,isOK,0,0,0,0);
390 LED_B_OFF();
391
392
393 // Thats it...
394 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
395 LEDsoff();
396 }
397
398 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
399 {
400 // params
401 uint8_t blockNo = arg0;
402 byte_t blockdata[16];
403
404 memset(blockdata,'\0',16);
405 memcpy(blockdata, datain,16);
406
407 // variables
408 byte_t isOK = 0;
409 uint8_t uid[10];
410 uint32_t cuid;
411
412 // clear trace
413 iso14a_clear_trace();
414
415 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
416
417 LED_A_ON();
418 LED_B_OFF();
419 LED_C_OFF();
420
421 while (true) {
422 if(!iso14443a_select_card(uid, NULL, &cuid)) {
423 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
424 break;
425 };
426
427 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
428 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
429 break;
430 };
431
432 if(mifare_ultra_halt(cuid)) {
433 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
434 break;
435 };
436
437 isOK = 1;
438 break;
439 }
440
441 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
442
443 LED_B_ON();
444 cmd_send(CMD_ACK,isOK,0,0,0,0);
445 LED_B_OFF();
446
447
448 // Thats it...
449 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
450 LEDsoff();
451 // iso14a_set_tracing(TRUE);
452 }
453
454 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
455 {
456 // params
457 uint8_t blockNo = arg0;
458 byte_t blockdata[4];
459
460 memcpy(blockdata, datain,4);
461
462 // variables
463 byte_t isOK = 0;
464 uint8_t uid[10];
465 uint32_t cuid;
466
467 // clear trace
468 iso14a_clear_trace();
469
470 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
471
472 LED_A_ON();
473 LED_B_OFF();
474 LED_C_OFF();
475
476 while (true) {
477 if(!iso14443a_select_card(uid, NULL, &cuid)) {
478 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
479 break;
480 };
481
482 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
483 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
484 break;
485 };
486
487 if(mifare_ultra_halt(cuid)) {
488 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
489 break;
490 };
491
492 isOK = 1;
493 break;
494 }
495
496 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
497
498 LED_B_ON();
499 cmd_send(CMD_ACK,isOK,0,0,0,0);
500 LED_B_OFF();
501
502 // Thats it...
503 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
504 LEDsoff();
505 }
506
507 // Return 1 if the nonce is invalid else return 0
508 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t * parity) {
509 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
510 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
511 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
512 }
513
514
515 //-----------------------------------------------------------------------------
516 // MIFARE nested authentication.
517 //
518 //-----------------------------------------------------------------------------
519 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
520 {
521 // params
522 uint8_t blockNo = arg0 & 0xff;
523 uint8_t keyType = (arg0 >> 8) & 0xff;
524 uint8_t targetBlockNo = arg1 & 0xff;
525 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
526 uint64_t ui64Key = 0;
527
528 ui64Key = bytes_to_num(datain, 6);
529
530 // variables
531 uint16_t rtr, i, j, len;
532 uint16_t davg;
533 static uint16_t dmin, dmax;
534 uint8_t uid[10];
535 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
536 uint8_t par[1];
537 uint32_t target_nt[2], target_ks[2];
538
539 uint8_t par_array[4];
540 uint16_t ncount = 0;
541 struct Crypto1State mpcs = {0, 0};
542 struct Crypto1State *pcs;
543 pcs = &mpcs;
544 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
545
546 uint32_t auth1_time, auth2_time;
547 static uint16_t delta_time;
548
549 // clear trace
550 iso14a_clear_trace();
551 iso14a_set_tracing(false);
552
553 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
554
555 LED_A_ON();
556 LED_C_OFF();
557
558
559 // statistics on nonce distance
560 if (calibrate) { // for first call only. Otherwise reuse previous calibration
561 LED_B_ON();
562 WDT_HIT();
563
564 davg = dmax = 0;
565 dmin = 2000;
566 delta_time = 0;
567
568 for (rtr = 0; rtr < 17; rtr++) {
569
570 // prepare next select. No need to power down the card.
571 if(mifare_classic_halt(pcs, cuid)) {
572 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
573 rtr--;
574 continue;
575 }
576
577 if(!iso14443a_select_card(uid, NULL, &cuid)) {
578 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
579 rtr--;
580 continue;
581 };
582
583 auth1_time = 0;
584 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
585 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
586 rtr--;
587 continue;
588 };
589
590 if (delta_time) {
591 auth2_time = auth1_time + delta_time;
592 } else {
593 auth2_time = 0;
594 }
595 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
596 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
597 rtr--;
598 continue;
599 };
600
601 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
602 for (i = 141; i < 1200; i++) {
603 nttmp = prng_successor(nttmp, 1);
604 if (nttmp == nt2) break;
605 }
606
607 if (i != 1200) {
608 if (rtr != 0) {
609 davg += i;
610 dmin = MIN(dmin, i);
611 dmax = MAX(dmax, i);
612 }
613 else {
614 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
615 }
616 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
617 }
618 }
619
620 if (rtr <= 1) return;
621
622 davg = (davg + (rtr - 1)/2) / (rtr - 1);
623
624 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
625
626 dmin = davg - 2;
627 dmax = davg + 2;
628
629 LED_B_OFF();
630
631 }
632 // -------------------------------------------------------------------------------------------------
633
634 LED_C_ON();
635
636 // get crypted nonces for target sector
637 for(i=0; i < 2; i++) { // look for exactly two different nonces
638
639 WDT_HIT();
640 if(BUTTON_PRESS()) {
641 DbpString("Nested: cancelled");
642 crypto1_destroy(pcs);
643 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
644 LEDsoff();
645 return;
646 }
647
648 target_nt[i] = 0;
649 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
650
651 // prepare next select. No need to power down the card.
652 if(mifare_classic_halt(pcs, cuid)) {
653 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
654 continue;
655 }
656
657 if(!iso14443a_select_card(uid, NULL, &cuid)) {
658 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
659 continue;
660 };
661
662 auth1_time = 0;
663 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
664 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
665 continue;
666 };
667
668 // nested authentication
669 auth2_time = auth1_time + delta_time;
670 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
671 if (len != 4) {
672 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
673 continue;
674 };
675
676 nt2 = bytes_to_num(receivedAnswer, 4);
677 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
678
679 // Parity validity check
680 for (j = 0; j < 4; j++) {
681 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
682 }
683
684 ncount = 0;
685 nttest = prng_successor(nt1, dmin - 1);
686 for (j = dmin; j < dmax + 1; j++) {
687 nttest = prng_successor(nttest, 1);
688 ks1 = nt2 ^ nttest;
689
690 if (valid_nonce(nttest, nt2, ks1, par_array)){
691 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
692 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
693 target_nt[i] = 0;
694 break;
695 }
696 target_nt[i] = nttest;
697 target_ks[i] = ks1;
698 ncount++;
699 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
700 target_nt[i] = 0;
701 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
702 break;
703 }
704 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
705 }
706 }
707 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
708 }
709 }
710
711 LED_C_OFF();
712
713 // ----------------------------- crypto1 destroy
714 crypto1_destroy(pcs);
715
716 byte_t buf[4 + 4 * 4];
717 memcpy(buf, &cuid, 4);
718 memcpy(buf+4, &target_nt[0], 4);
719 memcpy(buf+8, &target_ks[0], 4);
720 memcpy(buf+12, &target_nt[1], 4);
721 memcpy(buf+16, &target_ks[1], 4);
722
723 LED_B_ON();
724 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
725 LED_B_OFF();
726
727 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
728
729 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
730 LEDsoff();
731 iso14a_set_tracing(TRUE);
732 }
733
734 //-----------------------------------------------------------------------------
735 // MIFARE check keys. key count up to 85.
736 //
737 //-----------------------------------------------------------------------------
738 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
739 {
740 // params
741 uint8_t blockNo = arg0;
742 uint8_t keyType = arg1;
743 uint8_t keyCount = arg2;
744 uint64_t ui64Key = 0;
745
746 // variables
747 int i;
748 byte_t isOK = 0;
749 uint8_t uid[10];
750 uint32_t cuid;
751 struct Crypto1State mpcs = {0, 0};
752 struct Crypto1State *pcs;
753 pcs = &mpcs;
754
755 // clear debug level
756 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
757 MF_DBGLEVEL = MF_DBG_NONE;
758
759 // clear trace
760 iso14a_clear_trace();
761 iso14a_set_tracing(TRUE);
762
763 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
764
765 LED_A_ON();
766 LED_B_OFF();
767 LED_C_OFF();
768
769 for (i = 0; i < keyCount; i++) {
770 if(mifare_classic_halt(pcs, cuid)) {
771 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
772 }
773
774 if(!iso14443a_select_card(uid, NULL, &cuid)) {
775 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
776 break;
777 };
778
779 ui64Key = bytes_to_num(datain + i * 6, 6);
780 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
781 continue;
782 };
783
784 isOK = 1;
785 break;
786 }
787
788 // ----------------------------- crypto1 destroy
789 crypto1_destroy(pcs);
790
791 LED_B_ON();
792 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
793 LED_B_OFF();
794
795 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
796 LEDsoff();
797
798 // restore debug level
799 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
800 }
801
802 //-----------------------------------------------------------------------------
803 // MIFARE commands set debug level
804 //
805 //-----------------------------------------------------------------------------
806 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
807 MF_DBGLEVEL = arg0;
808 Dbprintf("Debug level: %d", MF_DBGLEVEL);
809 }
810
811 //-----------------------------------------------------------------------------
812 // Work with emulator memory
813 //
814 //-----------------------------------------------------------------------------
815 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
816 emlClearMem();
817 }
818
819 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
820 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
821 }
822
823 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
824 byte_t buf[USB_CMD_DATA_SIZE];
825 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
826
827 LED_B_ON();
828 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
829 LED_B_OFF();
830 }
831
832 //-----------------------------------------------------------------------------
833 // Load a card into the emulator memory
834 //
835 //-----------------------------------------------------------------------------
836 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
837 uint8_t numSectors = arg0;
838 uint8_t keyType = arg1;
839 uint64_t ui64Key = 0;
840 uint32_t cuid;
841 struct Crypto1State mpcs = {0, 0};
842 struct Crypto1State *pcs;
843 pcs = &mpcs;
844
845 // variables
846 byte_t dataoutbuf[16];
847 byte_t dataoutbuf2[16];
848 uint8_t uid[10];
849
850 // clear trace
851 iso14a_clear_trace();
852 iso14a_set_tracing(false);
853
854 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
855
856 LED_A_ON();
857 LED_B_OFF();
858 LED_C_OFF();
859
860 bool isOK = true;
861
862 if(!iso14443a_select_card(uid, NULL, &cuid)) {
863 isOK = false;
864 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
865 }
866
867 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
868 ui64Key = emlGetKey(sectorNo, keyType);
869 if (sectorNo == 0){
870 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
871 isOK = false;
872 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
873 break;
874 }
875 } else {
876 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
877 isOK = false;
878 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
879 break;
880 }
881 }
882
883 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
884 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
885 isOK = false;
886 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
887 break;
888 };
889 if (isOK) {
890 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
891 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
892 } else { // sector trailer, keep the keys, set only the AC
893 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
894 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
895 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
896 }
897 }
898 }
899
900 }
901
902 if(mifare_classic_halt(pcs, cuid)) {
903 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
904 };
905
906 // ----------------------------- crypto1 destroy
907 crypto1_destroy(pcs);
908
909 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
910 LEDsoff();
911
912 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
913
914 }
915
916
917 //-----------------------------------------------------------------------------
918 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
919 //
920 //-----------------------------------------------------------------------------
921 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
922
923 // params
924 uint8_t needWipe = arg0;
925 // bit 0 - need get UID
926 // bit 1 - need wupC
927 // bit 2 - need HALT after sequence
928 // bit 3 - need init FPGA and field before sequence
929 // bit 4 - need reset FPGA and LED
930 uint8_t workFlags = arg1;
931 uint8_t blockNo = arg2;
932
933 // card commands
934 uint8_t wupC1[] = { 0x40 };
935 uint8_t wupC2[] = { 0x43 };
936 uint8_t wipeC[] = { 0x41 };
937
938 // variables
939 byte_t isOK = 0;
940 uint8_t uid[10];
941 uint8_t d_block[18];
942 uint32_t cuid;
943
944 memset(uid, 0x00, 10);
945 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
946 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
947
948 // reset FPGA and LED
949 if (workFlags & 0x08) {
950 iso14a_clear_trace();
951 iso14a_set_tracing(TRUE);
952
953 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
954
955 LED_A_ON();
956 LED_B_OFF();
957 LED_C_OFF();
958
959 //SpinDelay(300);
960 //FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
961 //SpinDelay(100);
962 //FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
963 }
964
965 while (true) {
966
967 // get UID from chip
968 if (workFlags & 0x01) {
969 if(!iso14443a_select_card(uid, NULL, &cuid)) {
970 Dbprintf("ICE");
971 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
972 break;
973 };
974
975 if(mifare_classic_halt(NULL, cuid)) {
976 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
977 break;
978 };
979 };
980
981 // reset chip
982 if (needWipe){
983 ReaderTransmitBitsPar(wupC1,7,0, NULL);
984 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
985 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
986 break;
987 };
988
989 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
990 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
991 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
992 break;
993 };
994
995 if(mifare_classic_halt(NULL, cuid)) {
996 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
997 break;
998 };
999 };
1000
1001 // write block
1002 if (workFlags & 0x02) {
1003 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1004 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1005 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1006 break;
1007 };
1008
1009 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1010 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1011 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1012 break;
1013 };
1014 }
1015
1016 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1017 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
1018 break;
1019 };
1020
1021 memcpy(d_block, datain, 16);
1022 AppendCrc14443a(d_block, 16);
1023
1024 ReaderTransmit(d_block, sizeof(d_block), NULL);
1025 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1026 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
1027 break;
1028 };
1029
1030 if (workFlags & 0x04) {
1031 if (mifare_classic_halt(NULL, cuid)) {
1032 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1033 break;
1034 };
1035 }
1036
1037 isOK = 1;
1038 break;
1039 }
1040
1041 LED_B_ON();
1042 cmd_send(CMD_ACK,isOK,0,0,uid,4);
1043 LED_B_OFF();
1044
1045 if ((workFlags & 0x10) || (!isOK)) {
1046 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1047 LEDsoff();
1048 }
1049 }
1050
1051
1052 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1053
1054 // params
1055 // bit 1 - need wupC
1056 // bit 2 - need HALT after sequence
1057 // bit 3 - need init FPGA and field before sequence
1058 // bit 4 - need reset FPGA and LED
1059 uint8_t workFlags = arg0;
1060 uint8_t blockNo = arg2;
1061
1062 // card commands
1063 uint8_t wupC1[] = { 0x40 };
1064 uint8_t wupC2[] = { 0x43 };
1065
1066 // variables
1067 byte_t isOK = 0;
1068 uint8_t data[18];
1069 uint32_t cuid = 0;
1070
1071 memset(data, 0x00, 18);
1072 uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1073 uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1074
1075 if (workFlags & 0x08) {
1076 // clear trace
1077 iso14a_clear_trace();
1078 iso14a_set_tracing(TRUE);
1079
1080 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1081
1082 LED_A_ON();
1083 LED_B_OFF();
1084 LED_C_OFF();
1085
1086 // SpinDelay(300);
1087 // FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1088 // SpinDelay(100);
1089 // FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1090 }
1091
1092 while (true) {
1093 if (workFlags & 0x02) {
1094 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1095 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1096 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1097 break;
1098 };
1099
1100 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1101 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1102 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1103 break;
1104 };
1105 }
1106
1107 // read block
1108 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1109 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1110 break;
1111 };
1112 memcpy(data, receivedAnswer, 18);
1113
1114 if (workFlags & 0x04) {
1115 if (mifare_classic_halt(NULL, cuid)) {
1116 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1117 break;
1118 };
1119 }
1120
1121 isOK = 1;
1122 break;
1123 }
1124
1125 LED_B_ON();
1126 cmd_send(CMD_ACK,isOK,0,0,data,18);
1127 LED_B_OFF();
1128
1129 if ((workFlags & 0x10) || (!isOK)) {
1130 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1131 LEDsoff();
1132 }
1133 }
1134
Impressum, Datenschutz