]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
projects / proxmark3-svn / blob
? search:


91aa7218544ee6a2d8a23e72b81e164865b967b2
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
7 // Iceman - May 2014
8 //
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
11 // the license.
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
15
16 #include "mifarecmd.h"
17 #include "apps.h"
18 #include "util.h"
19 #include "crc.h"
20 #include "protocols.h"
21 #include "parity.h"
22
23 //-----------------------------------------------------------------------------
24 // Select, Authenticate, Read a MIFARE tag.
25 // read block
26 //-----------------------------------------------------------------------------
27 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
28 {
29 // params
30 uint8_t blockNo = arg0;
31 uint8_t keyType = arg1;
32 uint64_t ui64Key = 0;
33 ui64Key = bytes_to_num(datain, 6);
34
35 // variables
36 byte_t isOK = 0;
37 byte_t dataoutbuf[16];
38 uint8_t uid[10];
39 uint32_t cuid;
40 struct Crypto1State mpcs = {0, 0};
41 struct Crypto1State *pcs;
42 pcs = &mpcs;
43
44 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
45
46 clear_trace();
47
48 LED_A_ON();
49 LED_B_OFF();
50 LED_C_OFF();
51
52 while (true) {
53 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
54 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
55 break;
56 };
57
58 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
59 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
60 break;
61 };
62
63 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
64 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
65 break;
66 };
67
68 if(mifare_classic_halt(pcs, cuid)) {
69 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
70 break;
71 };
72
73 isOK = 1;
74 break;
75 }
76
77 // ----------------------------- crypto1 destroy
78 crypto1_destroy(pcs);
79
80 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
81
82 LED_B_ON();
83 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
84 LED_B_OFF();
85
86 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
87 LEDsoff();
88 }
89
90 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
91
92 bool turnOffField = (arg0 == 1);
93
94 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
95
96 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
97
98 clear_trace();
99
100 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
101 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
102 OnError(0);
103 return;
104 };
105
106 if(!mifare_ultra_auth(keybytes)){
107 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
108 OnError(1);
109 return;
110 }
111
112 if (turnOffField) {
113 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
114 LEDsoff();
115 }
116 cmd_send(CMD_ACK,1,0,0,0,0);
117 }
118
119 // Arg0 = BlockNo,
120 // Arg1 = UsePwd bool
121 // datain = PWD bytes,
122 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
123 {
124 uint8_t blockNo = arg0;
125 byte_t dataout[16] = {0x00};
126 bool useKey = (arg1 == 1); //UL_C
127 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
128
129 LEDsoff();
130 LED_A_ON();
131 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
132
133 clear_trace();
134
135 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
136 if(!len) {
137 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
138 OnError(1);
139 return;
140 }
141
142 // UL-C authentication
143 if ( useKey ) {
144 uint8_t key[16] = {0x00};
145 memcpy(key, datain, sizeof(key) );
146
147 if ( !mifare_ultra_auth(key) ) {
148 OnError(1);
149 return;
150 }
151 }
152
153 // UL-EV1 / NTAG authentication
154 if ( usePwd ) {
155 uint8_t pwd[4] = {0x00};
156 memcpy(pwd, datain, 4);
157 uint8_t pack[4] = {0,0,0,0};
158 if (!mifare_ul_ev1_auth(pwd, pack)) {
159 OnError(1);
160 return;
161 }
162 }
163
164 if( mifare_ultra_readblock(blockNo, dataout) ) {
165 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
166 OnError(2);
167 return;
168 }
169
170 if( mifare_ultra_halt() ) {
171 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
172 OnError(3);
173 return;
174 }
175
176 cmd_send(CMD_ACK,1,0,0,dataout,16);
177 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
178 LEDsoff();
179 }
180
181 //-----------------------------------------------------------------------------
182 // Select, Authenticate, Read a MIFARE tag.
183 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
184 //-----------------------------------------------------------------------------
185 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
186 {
187 // params
188 uint8_t sectorNo = arg0;
189 uint8_t keyType = arg1;
190 uint64_t ui64Key = 0;
191 ui64Key = bytes_to_num(datain, 6);
192
193 // variables
194 byte_t isOK = 0;
195 byte_t dataoutbuf[16 * 16];
196 uint8_t uid[10];
197 uint32_t cuid;
198 struct Crypto1State mpcs = {0, 0};
199 struct Crypto1State *pcs;
200 pcs = &mpcs;
201
202 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
203
204 clear_trace();
205
206 LED_A_ON();
207 LED_B_OFF();
208 LED_C_OFF();
209
210 isOK = 1;
211 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
212 isOK = 0;
213 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
214 }
215
216
217 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
218 isOK = 0;
219 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
220 }
221
222 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
223 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
224 isOK = 0;
225 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
226 break;
227 }
228 }
229
230 if(mifare_classic_halt(pcs, cuid)) {
231 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
232 }
233
234 // ----------------------------- crypto1 destroy
235 crypto1_destroy(pcs);
236
237 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
238
239 LED_B_ON();
240 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
241 LED_B_OFF();
242
243 // Thats it...
244 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
245 LEDsoff();
246 }
247
248 // arg0 = blockNo (start)
249 // arg1 = Pages (number of blocks)
250 // arg2 = useKey
251 // datain = KEY bytes
252 void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
253 {
254 LEDsoff();
255 LED_A_ON();
256 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
257
258 // free eventually allocated BigBuf memory
259 BigBuf_free();
260 clear_trace();
261
262 // params
263 uint8_t blockNo = arg0;
264 uint16_t blocks = arg1;
265 bool useKey = (arg2 == 1); //UL_C
266 bool usePwd = (arg2 == 2); //UL_EV1/NTAG
267 uint32_t countblocks = 0;
268 uint8_t *dataout = BigBuf_malloc(CARD_MEMORY_SIZE);
269 if (dataout == NULL){
270 Dbprintf("out of memory");
271 OnError(1);
272 return;
273 }
274
275 int len = iso14443a_select_card(NULL, NULL, NULL, true, 0);
276 if (!len) {
277 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
278 OnError(1);
279 return;
280 }
281
282 // UL-C authentication
283 if ( useKey ) {
284 uint8_t key[16] = {0x00};
285 memcpy(key, datain, sizeof(key) );
286
287 if ( !mifare_ultra_auth(key) ) {
288 OnError(1);
289 return;
290 }
291 }
292
293 // UL-EV1 / NTAG authentication
294 if (usePwd) {
295 uint8_t pwd[4] = {0x00};
296 memcpy(pwd, datain, sizeof(pwd));
297 uint8_t pack[4] = {0,0,0,0};
298
299 if (!mifare_ul_ev1_auth(pwd, pack)){
300 OnError(1);
301 return;
302 }
303 }
304
305 for (int i = 0; i < blocks; i++){
306 if ((i*4) + 4 >= CARD_MEMORY_SIZE) {
307 Dbprintf("Data exceeds buffer!!");
308 break;
309 }
310
311 len = mifare_ultra_readblock(blockNo + i, dataout + 4 * i);
312
313 if (len) {
314 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
315 // if no blocks read - error out
316 if (i==0){
317 OnError(2);
318 return;
319 } else {
320 //stop at last successful read block and return what we got
321 break;
322 }
323 } else {
324 countblocks++;
325 }
326 }
327
328 len = mifare_ultra_halt();
329 if (len) {
330 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
331 OnError(3);
332 return;
333 }
334
335 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
336
337 countblocks *= 4;
338
339 cmd_send(CMD_ACK, 1, countblocks, BigBuf_max_traceLen(), 0, 0);
340 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
341 LEDsoff();
342 BigBuf_free();
343 }
344
345 //-----------------------------------------------------------------------------
346 // Select, Authenticate, Write a MIFARE tag.
347 // read block
348 //-----------------------------------------------------------------------------
349 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
350 {
351 // params
352 uint8_t blockNo = arg0;
353 uint8_t keyType = arg1;
354 uint64_t ui64Key = 0;
355 byte_t blockdata[16];
356
357 ui64Key = bytes_to_num(datain, 6);
358 memcpy(blockdata, datain + 10, 16);
359
360 // variables
361 byte_t isOK = 0;
362 uint8_t uid[10];
363 uint32_t cuid;
364 struct Crypto1State mpcs = {0, 0};
365 struct Crypto1State *pcs;
366 pcs = &mpcs;
367
368 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
369
370 clear_trace();
371
372 LED_A_ON();
373 LED_B_OFF();
374 LED_C_OFF();
375
376 while (true) {
377 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
378 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
379 break;
380 };
381
382 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
383 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
384 break;
385 };
386
387 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
388 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
389 break;
390 };
391
392 if(mifare_classic_halt(pcs, cuid)) {
393 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
394 break;
395 };
396
397 isOK = 1;
398 break;
399 }
400
401 // ----------------------------- crypto1 destroy
402 crypto1_destroy(pcs);
403
404 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
405
406 LED_B_ON();
407 cmd_send(CMD_ACK,isOK,0,0,0,0);
408 LED_B_OFF();
409
410
411 // Thats it...
412 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
413 LEDsoff();
414 }
415
416 /* // Command not needed but left for future testing
417 void MifareUWriteBlockCompat(uint8_t arg0, uint8_t *datain)
418 {
419 uint8_t blockNo = arg0;
420 byte_t blockdata[16] = {0x00};
421
422 memcpy(blockdata, datain, 16);
423
424 uint8_t uid[10] = {0x00};
425
426 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
427
428 clear_trace();
429 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
430
431 if(!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
432 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
433 OnError(0);
434 return;
435 };
436
437 if(mifare_ultra_writeblock_compat(blockNo, blockdata)) {
438 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
439 OnError(0);
440 return; };
441
442 if(mifare_ultra_halt()) {
443 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
444 OnError(0);
445 return;
446 };
447
448 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
449
450 cmd_send(CMD_ACK,1,0,0,0,0);
451 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
452 LEDsoff();
453 }
454 */
455
456 // Arg0 : Block to write to.
457 // Arg1 : 0 = use no authentication.
458 // 1 = use 0x1A authentication.
459 // 2 = use 0x1B authentication.
460 // datain : 4 first bytes is data to be written.
461 // : 4/16 next bytes is authentication key.
462 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
463 {
464 uint8_t blockNo = arg0;
465 bool useKey = (arg1 == 1); //UL_C
466 bool usePwd = (arg1 == 2); //UL_EV1/NTAG
467 byte_t blockdata[4] = {0x00};
468
469 memcpy(blockdata, datain,4);
470
471 LEDsoff();
472 LED_A_ON();
473 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
474
475 clear_trace();
476
477 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
478 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
479 OnError(0);
480 return;
481 };
482
483 // UL-C authentication
484 if ( useKey ) {
485 uint8_t key[16] = {0x00};
486 memcpy(key, datain+4, sizeof(key) );
487
488 if ( !mifare_ultra_auth(key) ) {
489 OnError(1);
490 return;
491 }
492 }
493
494 // UL-EV1 / NTAG authentication
495 if (usePwd) {
496 uint8_t pwd[4] = {0x00};
497 memcpy(pwd, datain+4, 4);
498 uint8_t pack[4] = {0,0,0,0};
499 if (!mifare_ul_ev1_auth(pwd, pack)) {
500 OnError(1);
501 return;
502 }
503 }
504
505 if(mifare_ultra_writeblock(blockNo, blockdata)) {
506 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
507 OnError(0);
508 return;
509 };
510
511 if(mifare_ultra_halt()) {
512 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
513 OnError(0);
514 return;
515 };
516
517 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
518
519 cmd_send(CMD_ACK,1,0,0,0,0);
520 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
521 LEDsoff();
522 }
523
524 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
525
526 uint8_t pwd[16] = {0x00};
527 byte_t blockdata[4] = {0x00};
528
529 memcpy(pwd, datain, 16);
530
531 LED_A_ON(); LED_B_OFF(); LED_C_OFF();
532 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
533
534 clear_trace();
535
536 if(!iso14443a_select_card(NULL, NULL, NULL, true, 0)) {
537 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
538 OnError(0);
539 return;
540 };
541
542 blockdata[0] = pwd[7];
543 blockdata[1] = pwd[6];
544 blockdata[2] = pwd[5];
545 blockdata[3] = pwd[4];
546 if(mifare_ultra_writeblock( 44, blockdata)) {
547 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
548 OnError(44);
549 return;
550 };
551
552 blockdata[0] = pwd[3];
553 blockdata[1] = pwd[2];
554 blockdata[2] = pwd[1];
555 blockdata[3] = pwd[0];
556 if(mifare_ultra_writeblock( 45, blockdata)) {
557 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
558 OnError(45);
559 return;
560 };
561
562 blockdata[0] = pwd[15];
563 blockdata[1] = pwd[14];
564 blockdata[2] = pwd[13];
565 blockdata[3] = pwd[12];
566 if(mifare_ultra_writeblock( 46, blockdata)) {
567 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
568 OnError(46);
569 return;
570 };
571
572 blockdata[0] = pwd[11];
573 blockdata[1] = pwd[10];
574 blockdata[2] = pwd[9];
575 blockdata[3] = pwd[8];
576 if(mifare_ultra_writeblock( 47, blockdata)) {
577 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
578 OnError(47);
579 return;
580 };
581
582 if(mifare_ultra_halt()) {
583 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
584 OnError(0);
585 return;
586 };
587
588 cmd_send(CMD_ACK,1,0,0,0,0);
589 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
590 LEDsoff();
591 }
592
593 // Return 1 if the nonce is invalid else return 0
594 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
595 return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
596 (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
597 (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
598 }
599
600
601 //-----------------------------------------------------------------------------
602 // acquire encrypted nonces in order to perform the attack described in
603 // Carlo Meijer, Roel Verdult, "Ciphertext-only Cryptanalysis on Hardened
604 // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
605 // Computer and Communications Security, 2015
606 //-----------------------------------------------------------------------------
607 void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
608 {
609 uint64_t ui64Key = 0;
610 uint8_t uid[10];
611 uint32_t cuid;
612 uint8_t cascade_levels = 0;
613 struct Crypto1State mpcs = {0, 0};
614 struct Crypto1State *pcs;
615 pcs = &mpcs;
616 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
617 int16_t isOK = 0;
618 uint8_t par_enc[1];
619 uint8_t nt_par_enc = 0;
620 uint8_t buf[USB_CMD_DATA_SIZE];
621 uint32_t timeout;
622
623 uint8_t blockNo = arg0 & 0xff;
624 uint8_t keyType = (arg0 >> 8) & 0xff;
625 uint8_t targetBlockNo = arg1 & 0xff;
626 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
627 ui64Key = bytes_to_num(datain, 6);
628 bool initialize = flags & 0x0001;
629 bool slow = flags & 0x0002;
630 bool field_off = flags & 0x0004;
631
632 #define AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation)
633 #define PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication
634
635 LED_A_ON();
636 LED_C_OFF();
637
638 if (initialize) {
639 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
640 clear_trace();
641 set_tracing(true);
642 }
643
644 LED_C_ON();
645
646 uint16_t num_nonces = 0;
647 bool have_uid = false;
648 for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
649
650 // Test if the action was cancelled
651 if(BUTTON_PRESS()) {
652 isOK = 2;
653 field_off = true;
654 break;
655 }
656
657 if (!have_uid) { // need a full select cycle to get the uid first
658 iso14a_card_select_t card_info;
659 if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) {
660 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (ALL)");
661 continue;
662 }
663 switch (card_info.uidlen) {
664 case 4 : cascade_levels = 1; break;
665 case 7 : cascade_levels = 2; break;
666 case 10: cascade_levels = 3; break;
667 default: break;
668 }
669 have_uid = true;
670 } else { // no need for anticollision. We can directly select the card
671 if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) {
672 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Can't select card (UID)");
673 continue;
674 }
675 }
676
677 if (slow) {
678 timeout = GetCountSspClk() + PRE_AUTHENTICATION_LEADTIME;
679 while(GetCountSspClk() < timeout);
680 }
681
682 uint32_t nt1;
683 if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
684 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");
685 continue;
686 }
687
688 // nested authentication
689 uint16_t len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par_enc, NULL);
690 if (len != 4) {
691 if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
692 continue;
693 }
694
695 // send a dummy byte as reader response in order to trigger the cards authentication timeout
696 uint8_t dummy_answer = 0;
697 ReaderTransmit(&dummy_answer, 1, NULL);
698 timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;
699
700 num_nonces++;
701 if (num_nonces % 2) {
702 memcpy(buf+i, receivedAnswer, 4);
703 nt_par_enc = par_enc[0] & 0xf0;
704 } else {
705 nt_par_enc |= par_enc[0] >> 4;
706 memcpy(buf+i+4, receivedAnswer, 4);
707 memcpy(buf+i+8, &nt_par_enc, 1);
708 i += 9;
709 }
710
711 // wait for the card to become ready again
712 while(GetCountSspClk() < timeout);
713
714 }
715
716 LED_C_OFF();
717
718 crypto1_destroy(pcs);
719
720 LED_B_ON();
721 cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
722 LED_B_OFF();
723
724 if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
725
726 if (field_off) {
727 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
728 LEDsoff();
729 }
730 }
731
732
733 //-----------------------------------------------------------------------------
734 // MIFARE nested authentication.
735 //
736 //-----------------------------------------------------------------------------
737 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
738 {
739 // params
740 uint8_t blockNo = arg0 & 0xff;
741 uint8_t keyType = (arg0 >> 8) & 0xff;
742 uint8_t targetBlockNo = arg1 & 0xff;
743 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
744 uint64_t ui64Key = 0;
745
746 ui64Key = bytes_to_num(datain, 6);
747
748 // variables
749 uint16_t rtr, i, j, len;
750 uint16_t davg;
751 static uint16_t dmin, dmax;
752 uint8_t uid[10];
753 uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
754 uint8_t par[1];
755 uint32_t target_nt[2], target_ks[2];
756
757 uint8_t par_array[4];
758 uint16_t ncount = 0;
759 struct Crypto1State mpcs = {0, 0};
760 struct Crypto1State *pcs;
761 pcs = &mpcs;
762 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
763
764 uint32_t auth1_time, auth2_time;
765 static uint16_t delta_time;
766
767 LED_A_ON();
768 LED_C_OFF();
769 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
770
771 // free eventually allocated BigBuf memory
772 BigBuf_free();
773
774 if (calibrate) clear_trace();
775 set_tracing(true);
776
777 // statistics on nonce distance
778 int16_t isOK = 0;
779 #define NESTED_MAX_TRIES 12
780 uint16_t unsuccessfull_tries = 0;
781 if (calibrate) { // for first call only. Otherwise reuse previous calibration
782 LED_B_ON();
783 WDT_HIT();
784
785 davg = dmax = 0;
786 dmin = 2000;
787 delta_time = 0;
788
789 for (rtr = 0; rtr < 17; rtr++) {
790
791 // Test if the action was cancelled
792 if(BUTTON_PRESS()) {
793 isOK = -2;
794 break;
795 }
796
797 // prepare next select. No need to power down the card.
798 if(mifare_classic_halt(pcs, cuid)) {
799 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
800 rtr--;
801 continue;
802 }
803
804 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
805 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
806 rtr--;
807 continue;
808 };
809
810 auth1_time = 0;
811 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
812 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
813 rtr--;
814 continue;
815 };
816
817 if (delta_time) {
818 auth2_time = auth1_time + delta_time;
819 } else {
820 auth2_time = 0;
821 }
822 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
823 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
824 rtr--;
825 continue;
826 };
827
828 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
829 for (i = 101; i < 1200; i++) {
830 nttmp = prng_successor(nttmp, 1);
831 if (nttmp == nt2) break;
832 }
833
834 if (i != 1200) {
835 if (rtr != 0) {
836 davg += i;
837 dmin = MIN(dmin, i);
838 dmax = MAX(dmax, i);
839 }
840 else {
841 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
842 }
843 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
844 } else {
845 unsuccessfull_tries++;
846 if (unsuccessfull_tries > NESTED_MAX_TRIES) { // card isn't vulnerable to nested attack (random numbers are not predictable)
847 isOK = -3;
848 }
849 }
850 }
851
852 davg = (davg + (rtr - 1)/2) / (rtr - 1);
853
854 if (MF_DBGLEVEL >= 3) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
855
856 dmin = davg - 2;
857 dmax = davg + 2;
858
859 LED_B_OFF();
860 }
861 // -------------------------------------------------------------------------------------------------
862
863 LED_C_ON();
864
865 // get crypted nonces for target sector
866 for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
867
868 target_nt[i] = 0;
869 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
870
871 // prepare next select. No need to power down the card.
872 if(mifare_classic_halt(pcs, cuid)) {
873 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
874 continue;
875 }
876
877 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
878 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
879 continue;
880 };
881
882 auth1_time = 0;
883 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
884 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
885 continue;
886 };
887
888 // nested authentication
889 auth2_time = auth1_time + delta_time;
890 len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
891 if (len != 4) {
892 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
893 continue;
894 };
895
896 nt2 = bytes_to_num(receivedAnswer, 4);
897 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
898
899 // Parity validity check
900 for (j = 0; j < 4; j++) {
901 par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
902 }
903
904 ncount = 0;
905 nttest = prng_successor(nt1, dmin - 1);
906 for (j = dmin; j < dmax + 1; j++) {
907 nttest = prng_successor(nttest, 1);
908 ks1 = nt2 ^ nttest;
909
910 if (valid_nonce(nttest, nt2, ks1, par_array)){
911 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
912 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
913 target_nt[i] = 0;
914 break;
915 }
916 target_nt[i] = nttest;
917 target_ks[i] = ks1;
918 ncount++;
919 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
920 target_nt[i] = 0;
921 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
922 break;
923 }
924 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
925 }
926 }
927 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
928 }
929 }
930
931 LED_C_OFF();
932
933 // ----------------------------- crypto1 destroy
934 crypto1_destroy(pcs);
935
936 byte_t buf[4 + 4 * 4];
937 memcpy(buf, &cuid, 4);
938 memcpy(buf+4, &target_nt[0], 4);
939 memcpy(buf+8, &target_ks[0], 4);
940 memcpy(buf+12, &target_nt[1], 4);
941 memcpy(buf+16, &target_ks[1], 4);
942
943 LED_B_ON();
944 cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
945 LED_B_OFF();
946
947 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
948
949 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
950 LEDsoff();
951 set_tracing(FALSE);
952 }
953
954 //-----------------------------------------------------------------------------
955 // MIFARE check keys. key count up to 85.
956 //
957 //-----------------------------------------------------------------------------
958 void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
959 {
960 // params
961 uint8_t blockNo = arg0 & 0xff;
962 uint8_t keyType = (arg0 >> 8) & 0xff;
963 bool clearTrace = arg1;
964 uint8_t keyCount = arg2;
965 uint64_t ui64Key = 0;
966
967 // variables
968 int i;
969 byte_t isOK = 0;
970 uint8_t uid[10];
971 uint32_t cuid;
972 struct Crypto1State mpcs = {0, 0};
973 struct Crypto1State *pcs;
974 pcs = &mpcs;
975
976 // clear debug level
977 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
978 MF_DBGLEVEL = MF_DBG_NONE;
979
980 LED_A_ON();
981 LED_B_OFF();
982 LED_C_OFF();
983 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
984
985 if (clearTrace) clear_trace();
986 set_tracing(TRUE);
987
988 for (i = 0; i < keyCount; i++) {
989 if(mifare_classic_halt(pcs, cuid)) {
990 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
991 }
992
993 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
994 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
995 break;
996 };
997
998 ui64Key = bytes_to_num(datain + i * 6, 6);
999 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
1000 continue;
1001 };
1002
1003 isOK = 1;
1004 break;
1005 }
1006
1007 // ----------------------------- crypto1 destroy
1008 crypto1_destroy(pcs);
1009
1010 LED_B_ON();
1011 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
1012 LED_B_OFF();
1013
1014 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1015 LEDsoff();
1016 set_tracing(FALSE);
1017
1018 // restore debug level
1019 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
1020 }
1021
1022 //-----------------------------------------------------------------------------
1023 // MIFARE commands set debug level
1024 //
1025 //-----------------------------------------------------------------------------
1026 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1027 MF_DBGLEVEL = arg0;
1028 Dbprintf("Debug level: %d", MF_DBGLEVEL);
1029 }
1030
1031 //-----------------------------------------------------------------------------
1032 // Work with emulator memory
1033 //
1034 // Note: we call FpgaDownloadAndGo(FPGA_BITSTREAM_HF) here although FPGA is not
1035 // involved in dealing with emulator memory. But if it is called later, it might
1036 // destroy the Emulator Memory.
1037 //-----------------------------------------------------------------------------
1038
1039 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1040 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1041 emlClearMem();
1042 }
1043
1044 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1045 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1046 if (arg2==0) arg2 = 16; // backwards compat... default bytewidth
1047 emlSetMem_xt(datain, arg0, arg1, arg2); // data, block num, blocks count, block byte width
1048 }
1049
1050 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1051 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1052 byte_t buf[USB_CMD_DATA_SIZE];
1053 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
1054
1055 LED_B_ON();
1056 cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
1057 LED_B_OFF();
1058 }
1059
1060 //-----------------------------------------------------------------------------
1061 // Load a card into the emulator memory
1062 //
1063 //-----------------------------------------------------------------------------
1064 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1065 uint8_t numSectors = arg0;
1066 uint8_t keyType = arg1;
1067 uint64_t ui64Key = 0;
1068 uint32_t cuid;
1069 struct Crypto1State mpcs = {0, 0};
1070 struct Crypto1State *pcs;
1071 pcs = &mpcs;
1072
1073 // variables
1074 byte_t dataoutbuf[16];
1075 byte_t dataoutbuf2[16];
1076 uint8_t uid[10];
1077
1078 LED_A_ON();
1079 LED_B_OFF();
1080 LED_C_OFF();
1081 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1082
1083 clear_trace();
1084 set_tracing(TRUE);
1085
1086 bool isOK = true;
1087
1088 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1089 isOK = false;
1090 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1091 }
1092
1093 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
1094 ui64Key = emlGetKey(sectorNo, keyType);
1095 if (sectorNo == 0){
1096 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
1097 isOK = false;
1098 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
1099 break;
1100 }
1101 } else {
1102 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
1103 isOK = false;
1104 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
1105 break;
1106 }
1107 }
1108
1109 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
1110 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
1111 isOK = false;
1112 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
1113 break;
1114 };
1115 if (isOK) {
1116 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
1117 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
1118 } else { // sector trailer, keep the keys, set only the AC
1119 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1120 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
1121 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
1122 }
1123 }
1124 }
1125
1126 }
1127
1128 if(mifare_classic_halt(pcs, cuid)) {
1129 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1130 };
1131
1132 // ----------------------------- crypto1 destroy
1133 crypto1_destroy(pcs);
1134
1135 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1136 LEDsoff();
1137
1138 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
1139
1140 set_tracing(FALSE);
1141 }
1142
1143
1144 //-----------------------------------------------------------------------------
1145 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
1146 //
1147 // PARAMS - workFlags
1148 // bit 0 - need get UID
1149 // bit 1 - need wupC
1150 // bit 2 - need HALT after sequence
1151 // bit 3 - need turn on FPGA before sequence
1152 // bit 4 - need turn off FPGA
1153 // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a)
1154 // bit 6 - wipe tag.
1155 //-----------------------------------------------------------------------------
1156 // magic uid card generation 1 commands
1157 uint8_t wupC1[] = { MIFARE_MAGICWUPC1 };
1158 uint8_t wupC2[] = { MIFARE_MAGICWUPC2 };
1159 uint8_t wipeC[] = { MIFARE_MAGICWIPEC };
1160
1161 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1162
1163 // params
1164 uint8_t workFlags = arg0;
1165 uint8_t blockNo = arg1;
1166
1167 Dbprintf("ICE :: CSetBlocks Flags %02x", workFlags);
1168
1169 // variables
1170 uint8_t uid[10] = {0x00};
1171 uint8_t data[18] = {0x00};
1172 uint32_t cuid;
1173
1174 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1175 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1176
1177 if (workFlags & MAGIC_INIT) {
1178 LED_A_ON();
1179 LED_B_OFF();
1180 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1181 clear_trace();
1182 set_tracing(TRUE);
1183 }
1184
1185 // read UID and return to client
1186 if (workFlags & MAGIC_UID) {
1187 if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) {
1188 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1189 OnErrorMagic(MAGIC_UID);
1190 }
1191 }
1192
1193 // wipe tag, fill it with zeros
1194 if (workFlags & MAGIC_WIPE){
1195 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1196 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1197 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1198 OnErrorMagic(MAGIC_WIPE);
1199 }
1200
1201 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1202 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1203 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wipeC error");
1204 OnErrorMagic(MAGIC_WIPE);
1205 }
1206 }
1207
1208 // write block
1209 if (workFlags & MAGIC_WUPC) {
1210 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1211 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1212 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1213 OnErrorMagic(MAGIC_WUPC);
1214 }
1215
1216 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1217 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1218 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1219 OnErrorMagic(MAGIC_WUPC);
1220 }
1221 }
1222
1223 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1224 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send command error");
1225 OnErrorMagic(4);
1226 }
1227
1228 memcpy(data, datain, 16);
1229 AppendCrc14443a(data, 16);
1230
1231 ReaderTransmit(data, sizeof(data), NULL);
1232 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1233 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send data error");
1234 OnErrorMagic(0);
1235 }
1236
1237 if (workFlags & MAGIC_OFF)
1238 mifare_classic_halt_ex(NULL);
1239
1240 LED_B_ON();
1241 // check if uid is cuid?
1242 cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid));
1243 LED_B_OFF();
1244
1245 if (workFlags & MAGIC_OFF)
1246 OnSuccessMagic();
1247 }
1248
1249 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){
1250
1251 uint8_t workFlags = arg0;
1252 uint8_t blockNo = arg1;
1253
1254 // variables
1255 uint8_t data[MAX_MIFARE_FRAME_SIZE];
1256 uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1257 uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1258
1259 memset(data, 0x00, sizeof(data));
1260
1261 if (workFlags & MAGIC_INIT) {
1262 LED_A_ON();
1263 LED_B_OFF();
1264 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1265 clear_trace();
1266 set_tracing(TRUE);
1267 }
1268
1269 if (workFlags & MAGIC_WUPC) {
1270 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1271 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1272 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error");
1273 OnErrorMagic(MAGIC_WUPC);
1274 }
1275
1276 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1277 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1278 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error");
1279 OnErrorMagic(MAGIC_WUPC);
1280 }
1281 }
1282
1283 // read block
1284 if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1285 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error");
1286 OnErrorMagic(0);
1287 }
1288
1289 memcpy(data, receivedAnswer, sizeof(data));
1290
1291 // send HALT
1292 if (workFlags & MAGIC_HALT)
1293 mifare_classic_halt_ex(NULL);
1294
1295 LED_B_ON();
1296
1297 // if MAGIC_DATAIN, the data stays on device side.
1298 if (workFlags & MAGIC_DATAIN)
1299 memcpy(datain, data, sizeof(data));
1300 else
1301 cmd_send(CMD_ACK,1,0,0,data,sizeof(data));
1302
1303 LED_B_OFF();
1304
1305 if (workFlags & MAGIC_OFF)
1306 OnSuccessMagic();
1307 }
1308
1309 void MifareCIdent(){
1310
1311 // variables
1312 bool isOK = true;
1313 uint8_t receivedAnswer[1];
1314 uint8_t receivedAnswerPar[1];
1315
1316 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1317 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1318 isOK = false;
1319 }
1320
1321 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1322 if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1323 isOK = false;
1324 }
1325
1326 // removed the if, since some magic tags misbehavies and send an answer to it.
1327 mifare_classic_halt(NULL, 0);
1328 cmd_send(CMD_ACK,isOK,0,0,0,0);
1329 }
1330
1331 void OnSuccessMagic(){
1332 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1333 LEDsoff();
1334 set_tracing(FALSE);
1335 }
1336 void OnErrorMagic(uint8_t reason){
1337 // ACK, ISOK, reason,0,0,0
1338 cmd_send(CMD_ACK,0,reason,0,0,0);
1339 OnSuccessMagic();
1340 }
1341
1342 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1343 }
1344
1345 //
1346 // DESFIRE
1347 //
1348
1349 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1350
1351 byte_t dataout[11] = {0x00};
1352 uint8_t uid[10] = {0x00};
1353 uint32_t cuid = 0x00;
1354
1355 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1356 clear_trace();
1357
1358 int len = iso14443a_select_card(uid, NULL, &cuid, true, 0);
1359 if(!len) {
1360 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1361 OnError(1);
1362 return;
1363 };
1364
1365 if(mifare_desfire_des_auth1(cuid, dataout)){
1366 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1367 OnError(4);
1368 return;
1369 }
1370
1371 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1372 cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1373 }
1374
1375 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1376
1377 uint32_t cuid = arg0;
1378 uint8_t key[16] = {0x00};
1379 byte_t dataout[12] = {0x00};
1380 byte_t isOK = 0;
1381
1382 memcpy(key, datain, 16);
1383
1384 isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1385
1386 if( isOK) {
1387 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1388 OnError(4);
1389 return;
1390 }
1391
1392 if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1393
1394 cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1395 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1396 LEDsoff();
1397 }
Proxmark3 GIT tracking
Impressum, Datenschutz