cvs.zerfleddert.de Git - proxmark3-svn/blob - client/emv/cmdemv.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2017 Merlok
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // EMV commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include "cmdemv.h"
  12
  13 int UsageCmdHFEMVSelect(void) {
  14         PrintAndLog("HELP :  Executes select applet command:\n");
  15         PrintAndLog("Usage:  hf emv select [-s][-k][-a][-t] <HEX applet AID>\n");
  16         PrintAndLog("  Options:");
  17         PrintAndLog("  -s       : select card");
  18         PrintAndLog("  -k       : keep field for next command");
  19         PrintAndLog("  -a       : show APDU reqests and responses\n");
  20         PrintAndLog("  -t       : TLV decode results\n");
  21         PrintAndLog("Samples:");
  22         PrintAndLog(" hf emv select -s a00000000101 -> select card, select applet");
  23         PrintAndLog(" hf emv select -s -t a00000000101 -> select card, select applet, show result in TLV");
  24         return 0;
  25 }
  26
  27 int CmdHFEMVSelect(const char *cmd) {
  28         uint8_t data[APDU_AID_LEN] = {0};
  29         int datalen = 0;
  30         bool activateField = false;
  31         bool leaveSignalON = false;
  32         bool decodeTLV = false;
  33
  34         if (strlen(cmd) < 1) {
  35                 UsageCmdHFEMVSelect();
  36                 return 0;
  37         }
  38
  39         SetAPDULogging(false);
  40
  41         int cmdp = 0;
  42         while(param_getchar(cmd, cmdp) != 0x00) {
  43                 char c = param_getchar(cmd, cmdp);
  44                 if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
  45                         switch (param_getchar_indx(cmd, 1, cmdp)) {
  46                                 case 'h':
  47                                 case 'H':
  48                                         UsageCmdHFEMVSelect();
  49                                         return 0;
  50                                 case 's':
  51                                 case 'S':
  52                                         activateField = true;
  53                                         break;
  54                                 case 'k':
  55                                 case 'K':
  56                                         leaveSignalON = true;
  57                                         break;
  58                                 case 'a':
  59                                 case 'A':
  60                                         SetAPDULogging(true);
  61                                         break;
  62                                 case 't':
  63                                 case 'T':
  64                                         decodeTLV = true;
  65                                         break;
  66                                 default:
  67                                         PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
  68                                         return 1;
  69                 }
  70
  71                 if (isxdigit(c)) {
  72                         switch(param_gethex_to_eol(cmd, cmdp, data, sizeof(data), &datalen)) {
  73                         case 1:
  74                                 PrintAndLog("Invalid HEX value.");
  75                                 return 1;
  76                         case 2:
  77                                 PrintAndLog("AID too large.");
  78                                 return 1;
  79                         case 3:
  80                                 PrintAndLog("Hex must have even number of digits.");
  81                                 return 1;
  82                         }
  83
  84                         // we get all the hex to end of line with spaces
  85                         break;
  86                 }
  87
  88
  89                 cmdp++;
  90         }
  91
  92         // exec
  93         uint8_t buf[APDU_RES_LEN] = {0};
  94         size_t len = 0;
  95         uint16_t sw = 0;
  96         int res = EMVSelect(activateField, leaveSignalON, data, datalen, buf, sizeof(buf), &len, &sw, NULL);
  97
  98         if (sw)
  99                 PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
 100
 101         if (res)
 102                 return res;
 103
 104         if (decodeTLV)
 105                 TLVPrintFromBuffer(buf, len);
 106
 107         return 0;
 108 }
 109
 110 int UsageCmdHFEMVSearch(void) {
 111         PrintAndLog("HELP :  Tries to select all applets from applet list:\n");
 112         PrintAndLog("Usage:  hf emv search [-s][-k][-a][-t]\n");
 113         PrintAndLog("  Options:");
 114         PrintAndLog("  -s       : select card");
 115         PrintAndLog("  -k       : keep field for next command");
 116         PrintAndLog("  -a       : show APDU reqests and responses\n");
 117         PrintAndLog("  -t       : TLV decode results of selected applets\n");
 118         PrintAndLog("Samples:");
 119         PrintAndLog(" hf emv search -s -> select card and search");
 120         PrintAndLog(" hf emv search -s -t -> select card, search and show result in TLV");
 121         return 0;
 122 }
 123
 124 int CmdHFEMVSearch(const char *cmd) {
 125
 126         bool activateField = false;
 127         bool leaveSignalON = false;
 128         bool decodeTLV = false;
 129
 130         if (strlen(cmd) < 1) {
 131                 UsageCmdHFEMVSearch();
 132                 return 0;
 133         }
 134
 135         SetAPDULogging(false);
 136
 137         int cmdp = 0;
 138         while(param_getchar(cmd, cmdp) != 0x00) {
 139                 char c = param_getchar(cmd, cmdp);
 140                 if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
 141                         switch (param_getchar_indx(cmd, 1, cmdp)) {
 142                                 case 'h':
 143                                 case 'H':
 144                                         UsageCmdHFEMVSearch();
 145                                         return 0;
 146                                 case 's':
 147                                 case 'S':
 148                                         activateField = true;
 149                                         break;
 150                                 case 'k':
 151                                 case 'K':
 152                                         leaveSignalON = true;
 153                                         break;
 154                                 case 'a':
 155                                 case 'A':
 156                                         SetAPDULogging(true);
 157                                         break;
 158                                 case 't':
 159                                 case 'T':
 160                                         decodeTLV = true;
 161                                         break;
 162                                 default:
 163                                         PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
 164                                         return 1;
 165                 }
 166                 cmdp++;
 167         }
 168
 169         struct tlvdb *t = NULL;
 170         const char *al = "Applets list";
 171         t = tlvdb_fixed(1, strlen(al), (const unsigned char *)al);
 172
 173         if (EMVSearch(activateField, leaveSignalON, decodeTLV, t)) {
 174                 tlvdb_free(t);
 175                 return 2;
 176         }
 177
 178         PrintAndLog("Search completed.");
 179
 180         // print list here
 181         if (!decodeTLV) {
 182                 TLVPrintAIDlistFromSelectTLV(t);
 183         }
 184
 185         tlvdb_free(t);
 186
 187         return 0;
 188 }
 189
 190 int UsageCmdHFEMVPPSE(void) {
 191         PrintAndLog("HELP :  Executes PSE/PPSE select command. It returns list of applet on the card:\n");
 192         PrintAndLog("Usage:  hf emv pse [-s][-k][-1][-2][-a][-t]\n");
 193         PrintAndLog("  Options:");
 194         PrintAndLog("  -s       : select card");
 195         PrintAndLog("  -k       : keep field for next command");
 196         PrintAndLog("  -1       : ppse (1PAY.SYS.DDF01)");
 197         PrintAndLog("  -2       : pse (2PAY.SYS.DDF01)");
 198         PrintAndLog("  -a       : show APDU reqests and responses\n");
 199         PrintAndLog("  -t       : TLV decode results\n");
 200         PrintAndLog("Samples:");
 201         PrintAndLog(" hf emv pse -s -1 -> select, get pse");
 202         PrintAndLog(" hf emv pse -s -k -2 -> select, get ppse, keep field");
 203         PrintAndLog(" hf emv pse -s -t -2 -> select, get ppse, show result in TLV");
 204         return 0;
 205 }
 206
 207 int CmdHFEMVPPSE(const char *cmd) {
 208
 209         uint8_t PSENum = 2;
 210         bool activateField = false;
 211         bool leaveSignalON = false;
 212         bool decodeTLV = false;
 213
 214         if (strlen(cmd) < 1) {
 215                 UsageCmdHFEMVPPSE();
 216                 return 0;
 217         }
 218
 219         SetAPDULogging(false);
 220
 221         int cmdp = 0;
 222         while(param_getchar(cmd, cmdp) != 0x00) {
 223                 char c = param_getchar(cmd, cmdp);
 224                 if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
 225                         switch (param_getchar_indx(cmd, 1, cmdp)) {
 226                                 case 'h':
 227                                 case 'H':
 228                                         UsageCmdHFEMVPPSE();
 229                                         return 0;
 230                                 case 's':
 231                                 case 'S':
 232                                         activateField = true;
 233                                         break;
 234                                 case 'k':
 235                                 case 'K':
 236                                         leaveSignalON = true;
 237                                         break;
 238                                 case 'a':
 239                                 case 'A':
 240                                         SetAPDULogging(true);
 241                                         break;
 242                                 case 't':
 243                                 case 'T':
 244                                         decodeTLV = true;
 245                                         break;
 246                                 case '1':
 247                                         PSENum = 1;
 248                                         break;
 249                                 case '2':
 250                                         PSENum = 2;
 251                                         break;
 252                                 default:
 253                                         PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
 254                                         return 1;
 255                 }
 256                 cmdp++;
 257         }
 258
 259         // exec
 260         uint8_t buf[APDU_RES_LEN] = {0};
 261         size_t len = 0;
 262         uint16_t sw = 0;
 263         int res = EMVSelectPSE(activateField, leaveSignalON, PSENum, buf, sizeof(buf), &len, &sw);
 264
 265         if (sw)
 266                 PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
 267
 268         if (res)
 269                 return res;
 270
 271
 272         if (decodeTLV)
 273                 TLVPrintFromBuffer(buf, len);
 274
 275         return 0;
 276 }
 277
 278 int UsageCmdHFEMVExec(void) {
 279         PrintAndLog("HELP :  Executes EMV contactless transaction:\n");
 280         PrintAndLog("Usage:  hf emv exec [-s][-a][-t]\n");
 281         PrintAndLog("  Options:");
 282         PrintAndLog("  -s       : select card");
 283         PrintAndLog("  -a       : show APDU reqests and responses\n");
 284         PrintAndLog("  -t       : TLV decode results\n");
 285         PrintAndLog("  -f       : force search AID. Search AID instead of execute PPSE.\n");
 286         PrintAndLog("  -v       : transaction type - qVSDC or M/Chip.\n");
 287         PrintAndLog("  -c       : transaction type - qVSDC or M/Chip plus CDA (SDAD generation).\n");
 288         PrintAndLog("  -x       : transaction type - VSDC. For test only. Not a standart behavior.\n");
 289         PrintAndLog("By default : transaction type - MSD.\n");
 290         PrintAndLog("Samples:");
 291         PrintAndLog(" hf emv pse -s -> select card");
 292         PrintAndLog(" hf emv pse -s -t -a -> select card, show responses in TLV, show APDU");
 293         return 0;
 294 }
 295
 296 #define TLV_ADD(tag, value)( tlvdb_add(tlvRoot, tlvdb_fixed(tag, sizeof(value) - 1, (const unsigned char *)value)) )
 297
 298 int CmdHFEMVExec(const char *cmd) {
 299         bool activateField = false;
 300         bool showAPDU = false;
 301         bool decodeTLV = false;
 302         bool forceSearch = false;
 303         enum TransactionType TrType = TT_MSD;
 304
 305         uint8_t buf[APDU_RES_LEN] = {0};
 306         size_t len = 0;
 307         uint16_t sw = 0;
 308         uint8_t AID[APDU_AID_LEN] = {0};
 309         size_t AIDlen = 0;
 310
 311         int res;
 312
 313         if (strlen(cmd) < 1) {
 314                 UsageCmdHFEMVExec();
 315                 return 0;
 316         }
 317
 318         int cmdp = 0;
 319         while(param_getchar(cmd, cmdp) != 0x00) {
 320                 char c = param_getchar(cmd, cmdp);
 321                 if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
 322                         switch (param_getchar_indx(cmd, 1, cmdp)) {
 323                                 case 'h':
 324                                 case 'H':
 325                                         UsageCmdHFEMVExec();
 326                                         return 0;
 327                                 case 's':
 328                                 case 'S':
 329                                         activateField = true;
 330                                         break;
 331                                 case 'a':
 332                                 case 'A':
 333                                         showAPDU = true;
 334                                         break;
 335                                 case 't':
 336                                 case 'T':
 337                                         decodeTLV = true;
 338                                         break;
 339                                 case 'f':
 340                                 case 'F':
 341                                         forceSearch = true;
 342                                         break;
 343                                 case 'x':
 344                                 case 'X':
 345                                         TrType = TT_VSDC;
 346                                         break;
 347                                 case 'v':
 348                                 case 'V':
 349                                         TrType = TT_QVSDCMCHIP;
 350                                         break;
 351                                 case 'c':
 352                                 case 'C':
 353                                         TrType = TT_CDA;
 354                                         break;
 355                                 default:
 356                                         PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
 357                                         return 1;
 358                 }
 359                 cmdp++;
 360         }
 361
 362
 363         // init applets list tree
 364         struct tlvdb *tlvSelect = NULL;
 365         const char *al = "Applets list";
 366         tlvSelect = tlvdb_fixed(1, strlen(al), (const unsigned char *)al);
 367
 368         // Application Selection
 369         // https://www.openscdp.org/scripts/tutorial/emv/applicationselection.html
 370         if (!forceSearch) {
 371                 // PPSE
 372                 PrintAndLog("\n* PPSE.");
 373                 SetAPDULogging(showAPDU);
 374                 res = EMVSearchPSE(activateField, true, decodeTLV, tlvSelect);
 375
 376                 // check PPSE and select application id
 377                 if (!res) {
 378                         TLVPrintAIDlistFromSelectTLV(tlvSelect);
 379                         EMVSelectApplication(tlvSelect, AID, &AIDlen);
 380                 }
 381         }
 382
 383         // Search
 384         if (!AIDlen) {
 385                 PrintAndLog("\n* Search AID in list.");
 386                 SetAPDULogging(false);
 387                 if (EMVSearch(activateField, true, decodeTLV, tlvSelect)) {
 388                         tlvdb_free(tlvSelect);
 389                         return 2;
 390                 }
 391
 392                 // check search and select application id
 393                 TLVPrintAIDlistFromSelectTLV(tlvSelect);
 394                 EMVSelectApplication(tlvSelect, AID, &AIDlen);
 395         }
 396
 397         // Init TLV tree
 398         struct tlvdb *tlvRoot = NULL;
 399         const char *alr = "Root terminal TLV tree";
 400         tlvRoot = tlvdb_fixed(1, strlen(alr), (const unsigned char *)alr);
 401
 402         // check if we found EMV application on card
 403         if (!AIDlen) {
 404                 PrintAndLog("Can't select AID. EMV AID not found");
 405                 return 2;
 406         }
 407
 408         // Select
 409         PrintAndLog("\n* Selecting AID:%s", sprint_hex_inrow(AID, AIDlen));
 410         SetAPDULogging(showAPDU);
 411         res = EMVSelect(false, true, AID, AIDlen, buf, sizeof(buf), &len, &sw, tlvRoot);
 412
 413         if (res) {
 414                 PrintAndLog("Can't select AID (%d). Exit...", res);
 415                 return 3;
 416         }
 417
 418         if (decodeTLV)
 419                 TLVPrintFromBuffer(buf, len);
 420         PrintAndLog("* Selected.");
 421
 422         PrintAndLog("\n* Init transaction parameters.");
 423
 424     //9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
 425         switch(TrType) {
 426                 case TT_MSD:
 427                         TLV_ADD(0x9F66, "\x86\x00\x00\x00"); // MSD
 428                         break;
 429                 // not standart for contactless. just for test.
 430                 case TT_VSDC:
 431                         TLV_ADD(0x9F66, "\x46\x00\x00\x00"); // VSDC
 432                         break;
 433                 case TT_QVSDCMCHIP:
 434                         TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
 435                         break;
 436                 case TT_CDA:
 437                         TLV_ADD(0x9F66, "\x86\x80\x00\x00"); // CDA
 438                         break;
 439                 default:
 440                         TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
 441                         break;
 442         }
 443     //9F02:(Amount, Authorised (Numeric)) len:6
 444         TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
 445     //9F1A:(Terminal Country Code) len:2
 446         TLV_ADD(0x9F1A, "ru");
 447     //5F2A:(Transaction Currency Code) len:2
 448     // USD 840, EUR 978, RUR 810, RUB 643, RUR 810(old), UAH 980, AZN 031, n/a 999
 449         TLV_ADD(0x5F2A, "\x09\x80");
 450     //9A:(Transaction Date) len:3
 451         TLV_ADD(0x9A,   "\x00\x00\x00");
 452     //9C:(Transaction Type) len:1   |  00 => Goods and service #01 => Cash
 453         TLV_ADD(0x9C,   "\x00");
 454         // 9F37 Unpredictable Number len:4
 455         TLV_ADD(0x9F37, "\x01\x02\x03\x04");
 456         // 9F6A Unpredictable Number (MSD for UDOL) len:4
 457         TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
 458
 459         TLVPrintFromTLV(tlvRoot); // TODO delete!!!
 460
 461         PrintAndLog("\n* Calc PDOL.");
 462         struct tlv *pdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x9f38, NULL), tlvRoot, 0x83);
 463         if (!pdol_data_tlv){
 464                 PrintAndLog("ERROR: can't create PDOL TLV.");
 465                 return 4;
 466         }
 467
 468         size_t pdol_data_tlv_data_len;
 469         unsigned char *pdol_data_tlv_data = tlv_encode(pdol_data_tlv, &pdol_data_tlv_data_len);
 470         if (!pdol_data_tlv_data) {
 471                 PrintAndLog("ERROR: can't create PDOL data.");
 472                 return 4;
 473         }
 474         PrintAndLog("PDOL data[%d]: %s", pdol_data_tlv_data_len, sprint_hex(pdol_data_tlv_data, pdol_data_tlv_data_len));
 475
 476         PrintAndLog("\n* GPO.");
 477         res = EMVGPO(true, pdol_data_tlv_data, pdol_data_tlv_data_len, buf, sizeof(buf), &len, &sw, tlvRoot);
 478
 479         free(pdol_data_tlv_data);
 480         free(pdol_data_tlv);
 481
 482         if (res) {
 483                 PrintAndLog("GPO error(%d): %4x. Exit...", res, sw);
 484                 return 5;
 485         }
 486
 487         // process response template format 1 [id:80  2b AIP + x4b AFL] and format 2 [id:77 TLV]
 488         if (buf[0] == 0x80) {
 489                 if (decodeTLV){
 490                         PrintAndLog("GPO response format1:");
 491                         TLVPrintFromBuffer(buf, len);
 492                 }
 493
 494                 if (len < 4 || (len - 4) % 4) {
 495                         PrintAndLog("ERROR: GPO response format1 parsing error. length=%d", len);
 496                 } else {
 497                         // AIP
 498                         struct tlvdb * f1AIP = tlvdb_fixed(0x82, 2, buf + 2);
 499                         tlvdb_add(tlvRoot, f1AIP);
 500                         if (decodeTLV){
 501                                 PrintAndLog("\n* * Decode response format 1 (0x80) AIP and AFL:");
 502                                 TLVPrintFromTLV(f1AIP);
 503                         }
 504
 505                         // AFL
 506                         struct tlvdb * f1AFL = tlvdb_fixed(0x94, len - 4, buf + 2 + 2);
 507                         tlvdb_add(tlvRoot, f1AFL);
 508                         if (decodeTLV)
 509                                 TLVPrintFromTLV(f1AFL);
 510                 }
 511         } else {
 512                 if (decodeTLV)
 513                         TLVPrintFromBuffer(buf, len);
 514         }
 515
 516         // extract PAN from track2
 517         {
 518                 const struct tlv *track2 = tlvdb_get(tlvRoot, 0x57, NULL);
 519                 if (!tlvdb_get(tlvRoot, 0x5a, NULL) && track2 && track2->len >= 8) {
 520                         struct tlvdb *pan = GetPANFromTrack2(track2);
 521                         if (pan) {
 522                                 tlvdb_add(tlvRoot, pan);
 523
 524                                 const struct tlv *pantlv = tlvdb_get(tlvRoot, 0x5a, NULL);
 525                                 PrintAndLog("\n* * Extracted PAN from track2: %s", sprint_hex(pantlv->value, pantlv->len));
 526                         } else {
 527                                 PrintAndLog("\n* * WARNING: Can't extract PAN from track2.");
 528                         }
 529                 }
 530         }
 531
 532         PrintAndLog("\n* Read records from AFL.");
 533         const struct tlv *AFL = tlvdb_get(tlvRoot, 0x94, NULL);
 534         if (!AFL || !AFL->len) {
 535                 PrintAndLog("WARNING: AFL not found.");
 536         }
 537
 538         while(AFL && AFL->len) {
 539                 if (AFL->len % 4) {
 540                         PrintAndLog("ERROR: Wrong AFL length: %d", AFL->len);
 541                         break;
 542                 }
 543
 544                 for (int i = 0; i < AFL->len / 4; i++) {
 545                         uint8_t SFI = AFL->value[i * 4 + 0] >> 3;
 546                         uint8_t SFIstart = AFL->value[i * 4 + 1];
 547                         uint8_t SFIend = AFL->value[i * 4 + 2];
 548                         uint8_t SFIoffline = AFL->value[i * 4 + 3];
 549
 550                         PrintAndLog("* * SFI[%02x] start:%02x end:%02x offline:%02x", SFI, SFIstart, SFIend, SFIoffline);
 551                         if (SFI == 0 || SFI == 31 || SFIstart == 0 || SFIstart > SFIend) {
 552                                 PrintAndLog("SFI ERROR! Skipped...");
 553                                 continue;
 554                         }
 555
 556                         for(int n = SFIstart; n <= SFIend; n++) {
 557                                 PrintAndLog("* * * SFI[%02x] %d", SFI, n);
 558
 559                                 res = EMVReadRecord(true, SFI, n, buf, sizeof(buf), &len, &sw, tlvRoot);
 560                                 if (res) {
 561                                         PrintAndLog("ERROR SFI[%02x]. APDU error %4x", SFI, sw);
 562                                         continue;
 563                                 }
 564
 565                                 if (decodeTLV) {
 566                                         TLVPrintFromBuffer(buf, len);
 567                                         PrintAndLog("");
 568                                 }
 569
 570                                 if (SFIoffline) {
 571                                         // here will be offline records storing...
 572                                         // dont foget: if (sfi < 11)
 573                                 }
 574                         }
 575                 }
 576
 577                 break;
 578         }
 579
 580         // get AIP
 581         const struct tlv *AIPtlv = tlvdb_get(tlvRoot, 0x82, NULL);
 582         uint16_t AIP = AIPtlv->value[0] + AIPtlv->value[1] * 0x100;
 583         PrintAndLog("* * AIP=%04x", AIP);
 584
 585         // SDA
 586         if (AIP & 0x0040) {
 587                 PrintAndLog("\n* SDA");
 588                 trSDA(AID, AIDlen, tlvRoot);
 589         }
 590
 591         // DDA
 592         if (AIP & 0x0020) {
 593                 PrintAndLog("\n* DDA");
 594
 595         }
 596
 597         // transaction check
 598
 599         // qVSDC
 600         if (TrType == TT_QVSDCMCHIP|| TrType == TT_CDA){
 601                 // 9F26: Application Cryptogram
 602                 const struct tlv *AC = tlvdb_get(tlvRoot, 0x9F26, NULL);
 603                 if (AC) {
 604                         PrintAndLog("\n--> qVSDC transaction.");
 605                         PrintAndLog("* AC path");
 606
 607                         // 9F36: Application Transaction Counter (ATC)
 608                         const struct tlv *ATC = tlvdb_get(tlvRoot, 0x9F36, NULL);
 609                         if (ATC) {
 610
 611                                 // 9F10: Issuer Application Data - optional
 612                                 const struct tlv *IAD = tlvdb_get(tlvRoot, 0x9F10, NULL);
 613
 614                                 // print AC data
 615                                 PrintAndLog("ATC: %s", sprint_hex(ATC->value, ATC->len));
 616                                 PrintAndLog("AC: %s", sprint_hex(AC->value, AC->len));
 617                                 if (IAD){
 618                                         PrintAndLog("IAD: %s", sprint_hex(IAD->value, IAD->len));
 619
 620                                         if (IAD->len >= IAD->value[0] + 1) {
 621                                                 PrintAndLog("\tKey index:  0x%02x", IAD->value[1]);
 622                                                 PrintAndLog("\tCrypto ver: 0x%02x(%03d)", IAD->value[2], IAD->value[2]);
 623                                                 PrintAndLog("\tCVR:", sprint_hex(&IAD->value[3], IAD->value[0] - 2));
 624                                                 struct tlvdb * cvr = tlvdb_fixed(0x20, IAD->value[0] - 2, &IAD->value[3]);
 625                                                 TLVPrintFromTLVLev(cvr, 1);
 626                                         }
 627                                 } else {
 628                                         PrintAndLog("WARNING: IAD not found.");
 629                                 }
 630
 631                         } else {
 632                                 PrintAndLog("ERROR AC: Application Transaction Counter (ATC) not found.");
 633                         }
 634                 }
 635         }
 636
 637         // Mastercard M/CHIP
 638         if (GetCardPSVendor(AID, AIDlen) == CV_MASTERCARD && (TrType == TT_QVSDCMCHIP || TrType == TT_CDA)){
 639                 const struct tlv *CDOL1 = tlvdb_get(tlvRoot, 0x8c, NULL);
 640                 if (CDOL1 && GetCardPSVendor(AID, AIDlen) == CV_MASTERCARD) { // and m/chip transaction flag
 641                         PrintAndLog("\n--> Mastercard M/Chip transaction.");
 642
 643                         PrintAndLog("* * Generate challenge");
 644                         res = EMVGenerateChallenge(true, buf, sizeof(buf), &len, &sw, tlvRoot);
 645                         if (res) {
 646                                 PrintAndLog("ERROR GetChallenge. APDU error %4x", sw);
 647                                 return 5;
 648                         }
 649                         if (len < 4) {
 650                                 PrintAndLog("ERROR GetChallenge. Wrong challenge length %d", len);
 651                                 return 5;
 652                         }
 653
 654                         // ICC Dynamic Number
 655                         struct tlvdb * ICCDynN = tlvdb_fixed(0x9f4c, len, buf);
 656                         tlvdb_add(tlvRoot, ICCDynN);
 657                         if (decodeTLV){
 658                                 PrintAndLog("\n* * ICC Dynamic Number:");
 659                                 TLVPrintFromTLV(ICCDynN);
 660                         }
 661
 662                         PrintAndLog("* * Calc CDOL1");
 663                         struct tlv *cdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x8c, NULL), tlvRoot, 0x01); // 0x01 - dummy tag
 664                         if (!cdol_data_tlv){
 665                                 PrintAndLog("ERROR: can't create CDOL1 TLV.");
 666                                 return 4;
 667                         }
 668                         PrintAndLog("CDOL1 data[%d]: %s", cdol_data_tlv->len, sprint_hex(cdol_data_tlv->value, cdol_data_tlv->len));
 669
 670                         PrintAndLog("* * AC1");
 671                         // EMVAC_TC + EMVAC_CDAREQ --- to get SDAD
 672                         res = EMVAC(true, (TrType == TT_CDA) ? EMVAC_TC + EMVAC_CDAREQ : EMVAC_TC, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
 673
 674                         free(cdol_data_tlv);
 675
 676                         if (res) {
 677                                 PrintAndLog("AC1 error(%d): %4x. Exit...", res, sw);
 678                                 return 5;
 679                         }
 680
 681                         if (decodeTLV)
 682                                 TLVPrintFromBuffer(buf, len);
 683
 684                         PrintAndLog("* M/Chip transaction result:");
 685                         // 9F27: Cryptogram Information Data (CID)
 686                         const struct tlv *CID = tlvdb_get(tlvRoot, 0x9F27, NULL);
 687                         if (CID) {
 688                                 emv_tag_dump(CID, stdout, 0);
 689                                 PrintAndLog("------------------------------");
 690                                 if (CID->len > 0) {
 691                                         switch(CID->value[0] & EMVAC_AC_MASK){
 692                                                 case EMVAC_AAC:
 693                                                         PrintAndLog("Transaction DECLINED.");
 694                                                         break;
 695                                                 case EMVAC_TC:
 696                                                         PrintAndLog("Transaction approved OFFLINE.");
 697                                                         break;
 698                                                 case EMVAC_ARQC:
 699                                                         PrintAndLog("Transaction approved ONLINE.");
 700                                                         break;
 701                                                 default:
 702                                                         PrintAndLog("ERROR: CID transaction code error %2x", CID->value[0] & EMVAC_AC_MASK);
 703                                                         break;
 704                                         }
 705                                 } else {
 706                                         PrintAndLog("ERROR: Wrong CID length %d", CID->len);
 707                                 }
 708                         } else {
 709                                 PrintAndLog("ERROR: CID(9F27) not found.");
 710                         }
 711
 712                 }
 713         }
 714
 715         // MSD
 716         if (AIP & 0x8000 && TrType == TT_MSD) {
 717                 PrintAndLog("\n--> MSD transaction.");
 718
 719                 PrintAndLog("* MSD dCVV path. Check dCVV");
 720
 721                 const struct tlv *track2 = tlvdb_get(tlvRoot, 0x57, NULL);
 722                 if (track2) {
 723                         PrintAndLog("Track2: %s", sprint_hex(track2->value, track2->len));
 724
 725                         struct tlvdb *dCVV = GetdCVVRawFromTrack2(track2);
 726                         PrintAndLog("dCVV raw data:");
 727                         TLVPrintFromTLV(dCVV);
 728
 729                         if (GetCardPSVendor(AID, AIDlen) == CV_MASTERCARD) {
 730                                 PrintAndLog("\n* Mastercard calculate UDOL");
 731
 732                                 // UDOL (9F69)
 733                                 const struct tlv *UDOL = tlvdb_get(tlvRoot, 0x9F69, NULL);
 734                                 // UDOL(9F69) default: 9F6A (Unpredictable number) 4 bytes
 735                                 const struct tlv defUDOL = {
 736                                         .tag = 0x01,
 737                                         .len = 3,
 738                                         .value = (uint8_t *)"\x9f\x6a\x04",
 739                                 };
 740                                 if (!UDOL)
 741                                         PrintAndLog("Use default UDOL.");
 742
 743                                 struct tlv *udol_data_tlv = dol_process(UDOL ? UDOL : &defUDOL, tlvRoot, 0x01); // 0x01 - dummy tag
 744                                 if (!udol_data_tlv){
 745                                         PrintAndLog("ERROR: can't create UDOL TLV.");
 746                                         return 4;
 747                                 }
 748
 749                                 PrintAndLog("UDOL data[%d]: %s", udol_data_tlv->len, sprint_hex(udol_data_tlv->value, udol_data_tlv->len));
 750
 751                                 PrintAndLog("\n* Mastercard compute cryptographic checksum(UDOL)");
 752
 753                                 res = MSCComputeCryptoChecksum(true, (uint8_t *)udol_data_tlv->value, udol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
 754                                 if (res) {
 755                                         PrintAndLog("ERROR Compute Crypto Checksum. APDU error %4x", sw);
 756                                         return 5;
 757                                 }
 758
 759                                 if (decodeTLV) {
 760                                         TLVPrintFromBuffer(buf, len);
 761                                         PrintAndLog("");
 762                                 }
 763
 764                         }
 765                 } else {
 766                         PrintAndLog("ERROR MSD: Track2 data not found.");
 767                 }
 768         }
 769
 770         // DropField
 771         DropField();
 772
 773         // Destroy TLV's
 774         tlvdb_free(tlvSelect);
 775         tlvdb_free(tlvRoot);
 776
 777         PrintAndLog("\n* Transaction completed.");
 778
 779         return 0;
 780 }
 781
 782 int CmdHelp(const char *Cmd);
 783 static command_t CommandTable[] =  {
 784         {"help",        CmdHelp,                1,      "This help"},
 785         {"exec",        CmdHFEMVExec,   0,      "Executes EMV contactless transaction."},
 786         {"pse",         CmdHFEMVPPSE,   0,      "Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory."},
 787         {"search",      CmdHFEMVSearch, 0,      "Try to select all applets from applets list and print installed applets."},
 788         {"select",      CmdHFEMVSelect, 0,      "Select applet."},
 789         {NULL, NULL, 0, NULL}
 790 };
 791
 792 int CmdHFEMV(const char *Cmd) {
 793         CmdsParse(CommandTable, Cmd);
 794         return 0;
 795 }
 796
 797 int CmdHelp(const char *Cmd) {
 798         CmdsHelp(CommandTable);
 799         return 0;
 800 }