]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
small improvements, added new command `hf mf sniff` (there will be cool sniffer)...
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "mifarecmd.h"
14 #include "apps.h"
15
16 //-----------------------------------------------------------------------------
17 // Select, Authenticaate, Read an MIFARE tag.
18 // read block
19 //-----------------------------------------------------------------------------
20 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
21 {
22 // params
23 uint8_t blockNo = arg0;
24 uint8_t keyType = arg1;
25 uint64_t ui64Key = 0;
26 ui64Key = bytes_to_num(datain, 6);
27
28 // variables
29 byte_t isOK = 0;
30 byte_t dataoutbuf[16];
31 uint8_t uid[8];
32 uint32_t cuid;
33 struct Crypto1State mpcs = {0, 0};
34 struct Crypto1State *pcs;
35 pcs = &mpcs;
36
37 // clear trace
38 iso14a_clear_tracelen();
39 // iso14a_set_tracing(false);
40
41 iso14443a_setup();
42
43 LED_A_ON();
44 LED_B_OFF();
45 LED_C_OFF();
46
47 while (true) {
48 if(!iso14443a_select_card(uid, NULL, &cuid)) {
49 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
50 break;
51 };
52
53 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
54 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
55 break;
56 };
57
58 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
59 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
60 break;
61 };
62
63 if(mifare_classic_halt(pcs, cuid)) {
64 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
65 break;
66 };
67
68 isOK = 1;
69 break;
70 }
71
72 // ----------------------------- crypto1 destroy
73 crypto1_destroy(pcs);
74
75 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
76
77 // add trace trailer
78 memset(uid, 0x44, 4);
79 LogTrace(uid, 4, 0, 0, TRUE);
80
81 UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
82 memcpy(ack.d.asBytes, dataoutbuf, 16);
83
84 LED_B_ON();
85 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
86 LED_B_OFF();
87
88
89 // Thats it...
90 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
91 LEDsoff();
92 // iso14a_set_tracing(TRUE);
93
94 }
95
96 //-----------------------------------------------------------------------------
97 // Select, Authenticaate, Read an MIFARE tag.
98 // read sector (data = 4 x 16 bytes = 64 bytes)
99 //-----------------------------------------------------------------------------
100 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
101 {
102 // params
103 uint8_t sectorNo = arg0;
104 uint8_t keyType = arg1;
105 uint64_t ui64Key = 0;
106 ui64Key = bytes_to_num(datain, 6);
107
108 // variables
109 byte_t isOK = 0;
110 byte_t dataoutbuf[16 * 4];
111 uint8_t uid[8];
112 uint32_t cuid;
113 struct Crypto1State mpcs = {0, 0};
114 struct Crypto1State *pcs;
115 pcs = &mpcs;
116
117 // clear trace
118 iso14a_clear_tracelen();
119 // iso14a_set_tracing(false);
120
121 iso14443a_setup();
122
123 LED_A_ON();
124 LED_B_OFF();
125 LED_C_OFF();
126
127 while (true) {
128 if(!iso14443a_select_card(uid, NULL, &cuid)) {
129 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
130 break;
131 };
132
133 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
134 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
135 break;
136 };
137
138 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf + 16 * 0)) {
139 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 0 error");
140 break;
141 };
142 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf + 16 * 1)) {
143 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 1 error");
144 break;
145 };
146 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf + 16 * 2)) {
147 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 2 error");
148 break;
149 };
150 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf + 16 * 3)) {
151 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 3 error");
152 break;
153 };
154
155 if(mifare_classic_halt(pcs, cuid)) {
156 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
157 break;
158 };
159
160 isOK = 1;
161 break;
162 }
163
164 // ----------------------------- crypto1 destroy
165 crypto1_destroy(pcs);
166
167 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
168
169 // add trace trailer
170 memset(uid, 0x44, 4);
171 LogTrace(uid, 4, 0, 0, TRUE);
172
173 UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
174 memcpy(ack.d.asBytes, dataoutbuf, 16 * 2);
175
176 LED_B_ON();
177 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
178
179 SpinDelay(100);
180
181 memcpy(ack.d.asBytes, dataoutbuf + 16 * 2, 16 * 2);
182 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
183 LED_B_OFF();
184
185 // Thats it...
186 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
187 LEDsoff();
188 // iso14a_set_tracing(TRUE);
189
190 }
191
192 //-----------------------------------------------------------------------------
193 // Select, Authenticaate, Read an MIFARE tag.
194 // read block
195 //-----------------------------------------------------------------------------
196 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
197 {
198 // params
199 uint8_t blockNo = arg0;
200 uint8_t keyType = arg1;
201 uint64_t ui64Key = 0;
202 byte_t blockdata[16];
203
204 ui64Key = bytes_to_num(datain, 6);
205 memcpy(blockdata, datain + 10, 16);
206
207 // variables
208 byte_t isOK = 0;
209 uint8_t uid[8];
210 uint32_t cuid;
211 struct Crypto1State mpcs = {0, 0};
212 struct Crypto1State *pcs;
213 pcs = &mpcs;
214
215 // clear trace
216 iso14a_clear_tracelen();
217 // iso14a_set_tracing(false);
218
219 iso14443a_setup();
220
221 LED_A_ON();
222 LED_B_OFF();
223 LED_C_OFF();
224
225 while (true) {
226 if(!iso14443a_select_card(uid, NULL, &cuid)) {
227 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
228 break;
229 };
230
231 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
232 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
233 break;
234 };
235
236 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
237 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
238 break;
239 };
240
241 if(mifare_classic_halt(pcs, cuid)) {
242 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
243 break;
244 };
245
246 isOK = 1;
247 break;
248 }
249
250 // ----------------------------- crypto1 destroy
251 crypto1_destroy(pcs);
252
253 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
254
255 // add trace trailer
256 memset(uid, 0x44, 4);
257 LogTrace(uid, 4, 0, 0, TRUE);
258
259 UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
260
261 LED_B_ON();
262 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
263 LED_B_OFF();
264
265
266 // Thats it...
267 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
268 LEDsoff();
269 // iso14a_set_tracing(TRUE);
270
271 }
272
273 // Return 1 if the nonce is invalid else return 0
274 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
275 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
276 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
277 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
278 }
279
280 //-----------------------------------------------------------------------------
281 // MIFARE nested authentication.
282 //
283 //-----------------------------------------------------------------------------
284 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
285 {
286 // params
287 uint8_t blockNo = arg0;
288 uint8_t keyType = arg1;
289 uint8_t targetBlockNo = arg2 & 0xff;
290 uint8_t targetKeyType = (arg2 >> 8) & 0xff;
291 uint64_t ui64Key = 0;
292
293 ui64Key = bytes_to_num(datain, 6);
294
295 // variables
296 int rtr, i, j, m, len;
297 int davg, dmin, dmax;
298 uint8_t uid[8];
299 uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
300 uint8_t par_array[4];
301 nestedVector nvector[NES_MAX_INFO + 1][11];
302 int nvectorcount[NES_MAX_INFO + 1];
303 int ncount = 0;
304 UsbCommand ack = {CMD_ACK, {0, 0, 0}};
305 struct Crypto1State mpcs = {0, 0};
306 struct Crypto1State *pcs;
307 pcs = &mpcs;
308 uint8_t* receivedAnswer = mifare_get_bigbufptr();
309
310 //init
311 for (i = 0; i < NES_MAX_INFO + 1; i++) nvectorcount[i] = 11; // 11 - empty block;
312
313 // clear trace
314 iso14a_clear_tracelen();
315 iso14a_set_tracing(false);
316
317 iso14443a_setup();
318
319 LED_A_ON();
320 LED_B_ON();
321 LED_C_OFF();
322
323 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
324 SpinDelay(200);
325
326 davg = dmax = 0;
327 dmin = 2000;
328
329 // test nonce distance
330 for (rtr = 0; rtr < 10; rtr++) {
331 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
332 SpinDelay(100);
333 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
334
335 // Test if the action was cancelled
336 if(BUTTON_PRESS()) {
337 break;
338 }
339
340 if(!iso14443a_select_card(uid, NULL, &cuid)) {
341 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
342 break;
343 };
344
345 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
346 if (MF_DBGLEVEL >= 1) Dbprintf("Auth1 error");
347 break;
348 };
349
350 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2)) {
351 if (MF_DBGLEVEL >= 1) Dbprintf("Auth2 error");
352 break;
353 };
354
355 nttmp = prng_successor(nt1, 500);
356 for (i = 501; i < 2000; i++) {
357 nttmp = prng_successor(nttmp, 1);
358 if (nttmp == nt2) break;
359 }
360
361 if (i != 2000) {
362 davg += i;
363 if (dmin > i) dmin = i;
364 if (dmax < i) dmax = i;
365 if (MF_DBGLEVEL >= 4) Dbprintf("r=%d nt1=%08x nt2=%08x distance=%d", rtr, nt1, nt2, i);
366 }
367 }
368
369 if (rtr == 0) return;
370
371 davg = davg / rtr;
372 if (MF_DBGLEVEL >= 3) Dbprintf("distance: min=%d max=%d avg=%d", dmin, dmax, davg);
373
374 LED_B_OFF();
375
376 // -------------------------------------------------------------------------------------------------
377
378 LED_C_ON();
379
380 // get crypted nonces for target sector
381 for (rtr = 0; rtr < NS_RETRIES_GETNONCE; rtr++) {
382 if (MF_DBGLEVEL >= 4) Dbprintf("------------------------------");
383
384 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
385 SpinDelay(100);
386 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
387
388 // Test if the action was cancelled
389 if(BUTTON_PRESS()) {
390 break;
391 }
392
393 if(!iso14443a_select_card(uid, NULL, &cuid)) {
394 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
395 break;
396 };
397
398 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1)) {
399 if (MF_DBGLEVEL >= 1) Dbprintf("Auth1 error");
400 break;
401 };
402
403 // nested authentication
404 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par);
405 if (len != 4) {
406 if (MF_DBGLEVEL >= 1) Dbprintf("Auth2 error len=%d", len);
407 break;
408 };
409
410 nt2 = bytes_to_num(receivedAnswer, 4);
411 if (MF_DBGLEVEL >= 4) Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
412
413 // Parity validity check
414 for (i = 0; i < 4; i++) {
415 par_array[i] = (oddparity(receivedAnswer[i]) != ((par & 0x08) >> 3));
416 par = par << 1;
417 }
418
419 ncount = 0;
420 nttest = prng_successor(nt1, dmin - NS_TOLERANCE);
421 for (m = dmin - NS_TOLERANCE + 1; m < dmax + NS_TOLERANCE; m++) {
422 nttest = prng_successor(nttest, 1);
423 ks1 = nt2 ^ nttest;
424
425 if (valid_nonce(nttest, nt2, ks1, par_array) && (ncount < 11)){
426
427 nvector[NES_MAX_INFO][ncount].nt = nttest;
428 nvector[NES_MAX_INFO][ncount].ks1 = ks1;
429 ncount++;
430 nvectorcount[NES_MAX_INFO] = ncount;
431 if (MF_DBGLEVEL >= 4) Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
432 }
433
434 }
435
436 // select vector with length less than got
437 if (nvectorcount[NES_MAX_INFO] != 0) {
438 m = NES_MAX_INFO;
439
440 for (i = 0; i < NES_MAX_INFO; i++)
441 if (nvectorcount[i] > 10) {
442 m = i;
443 break;
444 }
445
446 if (m == NES_MAX_INFO)
447 for (i = 0; i < NES_MAX_INFO; i++)
448 if (nvectorcount[NES_MAX_INFO] < nvectorcount[i]) {
449 m = i;
450 break;
451 }
452
453 if (m != NES_MAX_INFO) {
454 for (i = 0; i < nvectorcount[m]; i++) {
455 nvector[m][i] = nvector[NES_MAX_INFO][i];
456 }
457 nvectorcount[m] = nvectorcount[NES_MAX_INFO];
458 }
459 }
460 }
461
462 LED_C_OFF();
463
464 // ----------------------------- crypto1 destroy
465 crypto1_destroy(pcs);
466
467 // add trace trailer
468 memset(uid, 0x44, 4);
469 LogTrace(uid, 4, 0, 0, TRUE);
470
471 for (i = 0; i < NES_MAX_INFO; i++) {
472 if (nvectorcount[i] > 10) continue;
473
474 for (j = 0; j < nvectorcount[i]; j += 5) {
475 ncount = nvectorcount[i] - j;
476 if (ncount > 5) ncount = 5;
477
478 ack.arg[0] = 0; // isEOF = 0
479 ack.arg[1] = ncount;
480 ack.arg[2] = targetBlockNo + (targetKeyType * 0x100);
481 memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
482
483 memcpy(ack.d.asBytes, &cuid, 4);
484 for (m = 0; m < ncount; m++) {
485 memcpy(ack.d.asBytes + 8 + m * 8 + 0, &nvector[i][m + j].nt, 4);
486 memcpy(ack.d.asBytes + 8 + m * 8 + 4, &nvector[i][m + j].ks1, 4);
487 }
488
489 LED_B_ON();
490 SpinDelay(100);
491 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
492 LED_B_OFF();
493 }
494 }
495
496 // finalize list
497 ack.arg[0] = 1; // isEOF = 1
498 ack.arg[1] = 0;
499 ack.arg[2] = 0;
500 memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
501
502 LED_B_ON();
503 SpinDelay(300);
504 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
505 LED_B_OFF();
506
507 if (MF_DBGLEVEL >= 4) DbpString("NESTED FINISHED");
508
509 // Thats it...
510 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
511 LEDsoff();
512
513 iso14a_set_tracing(TRUE);
514 }
515
516 //-----------------------------------------------------------------------------
517 // MIFARE check keys. key count up to 8.
518 //
519 //-----------------------------------------------------------------------------
520 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
521 {
522 // params
523 uint8_t blockNo = arg0;
524 uint8_t keyType = arg1;
525 uint8_t keyCount = arg2;
526 uint64_t ui64Key = 0;
527
528 // variables
529 int i;
530 byte_t isOK = 0;
531 uint8_t uid[8];
532 uint32_t cuid;
533 struct Crypto1State mpcs = {0, 0};
534 struct Crypto1State *pcs;
535 pcs = &mpcs;
536
537 // clear debug level
538 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
539 MF_DBGLEVEL = MF_DBG_NONE;
540
541 // clear trace
542 iso14a_clear_tracelen();
543 iso14a_set_tracing(TRUE);
544
545 iso14443a_setup();
546
547 LED_A_ON();
548 LED_B_OFF();
549 LED_C_OFF();
550
551 SpinDelay(300);
552 for (i = 0; i < keyCount; i++) {
553 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
554 SpinDelay(100);
555 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
556
557 if(!iso14443a_select_card(uid, NULL, &cuid)) {
558 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
559 break;
560 };
561
562 ui64Key = bytes_to_num(datain + i * 6, 6);
563 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
564 continue;
565 };
566
567 isOK = 1;
568 break;
569 }
570
571 // ----------------------------- crypto1 destroy
572 crypto1_destroy(pcs);
573
574 // add trace trailer
575 memset(uid, 0x44, 4);
576 LogTrace(uid, 4, 0, 0, TRUE);
577
578 UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
579 if (isOK) memcpy(ack.d.asBytes, datain + i * 6, 6);
580
581 LED_B_ON();
582 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
583 LED_B_OFF();
584
585 // Thats it...
586 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
587 LEDsoff();
588
589 // restore debug level
590 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
591 }
592
593 //-----------------------------------------------------------------------------
594 // MIFARE commands set debug level
595 //
596 //-----------------------------------------------------------------------------
597 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
598 MF_DBGLEVEL = arg0;
599 Dbprintf("Debug level: %d", MF_DBGLEVEL);
600 }
601
602 //-----------------------------------------------------------------------------
603 // Work with emulator memory
604 //
605 //-----------------------------------------------------------------------------
606 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
607 emlClearMem();
608 }
609
610 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
611 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
612 }
613
614 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
615 UsbCommand ack = {CMD_ACK, {arg0, arg1, 0}};
616
617 emlGetMem(ack.d.asBytes, arg0, arg1); // data, block num, blocks count
618
619 LED_B_ON();
620 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
621 LED_B_OFF();
622 }
623
624 //-----------------------------------------------------------------------------
625 // Load a card into the emulator memory
626 //
627 //-----------------------------------------------------------------------------
628 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
629 int i;
630 uint8_t sectorNo = 0;
631 uint8_t keyType = arg1;
632 uint64_t ui64Key = 0;
633 uint32_t cuid;
634 struct Crypto1State mpcs = {0, 0};
635 struct Crypto1State *pcs;
636 pcs = &mpcs;
637
638 // variables
639 byte_t dataoutbuf[16];
640 byte_t dataoutbuf2[16];
641 uint8_t uid[8];
642
643 // clear trace
644 iso14a_clear_tracelen();
645 iso14a_set_tracing(false);
646
647 iso14443a_setup();
648
649 LED_A_ON();
650 LED_B_OFF();
651 LED_C_OFF();
652
653 while (true) {
654 if(!iso14443a_select_card(uid, NULL, &cuid)) {
655 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
656 break;
657 };
658
659 for (i = 0; i < 16; i++) {
660 sectorNo = i;
661 ui64Key = emlGetKey(sectorNo, keyType);
662
663 if (!i){
664 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
665 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%d]. Auth error", i);
666 break;
667 }
668 } else {
669 if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_NESTED)) {
670 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%d]. Auth nested error", i);
671 break;
672 }
673 }
674
675 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf)) {
676 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 0 error");
677 break;
678 };
679 emlSetMem(dataoutbuf, sectorNo * 4 + 0, 1);
680
681 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf)) {
682 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 1 error");
683 break;
684 };
685 emlSetMem(dataoutbuf, sectorNo * 4 + 1, 1);
686
687 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf)) {
688 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 2 error");
689 break;
690 };
691 emlSetMem(dataoutbuf, sectorNo * 4 + 2, 1);
692
693 // get block 3 bytes 6-9
694 if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf)) {
695 if (MF_DBGLEVEL >= 1) Dbprintf("Read block 3 error");
696 break;
697 };
698 emlGetMem(dataoutbuf2, sectorNo * 4 + 3, 1);
699 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
700 emlSetMem(dataoutbuf2, sectorNo * 4 + 3, 1);
701 }
702
703 if(mifare_classic_halt(pcs, cuid)) {
704 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
705 break;
706 };
707
708 break;
709 }
710
711 // ----------------------------- crypto1 destroy
712 crypto1_destroy(pcs);
713
714 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
715 LEDsoff();
716
717 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
718
719 // add trace trailer
720 memset(uid, 0x44, 4);
721 LogTrace(uid, 4, 0, 0, TRUE);
722 }
723
724 //-----------------------------------------------------------------------------
725 // MIFARE 1k emulator
726 //
727 //-----------------------------------------------------------------------------
728
729
730 //-----------------------------------------------------------------------------
731 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
732 //
733 //-----------------------------------------------------------------------------
734 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
735
736 // params
737 uint8_t needWipe = arg0;
738 // bit 0 - need get UID
739 // bit 1 - need wupC
740 // bit 2 - need HALT after sequence
741 // bit 3 - need init FPGA and field before sequence
742 // bit 4 - need reset FPGA and LED
743 uint8_t workFlags = arg1;
744 uint8_t blockNo = arg2;
745
746 // card commands
747 uint8_t wupC1[] = { 0x40 };
748 uint8_t wupC2[] = { 0x43 };
749 uint8_t wipeC[] = { 0x41 };
750
751 // variables
752 byte_t isOK = 0;
753 uint8_t uid[8];
754 uint8_t d_block[18];
755 uint32_t cuid;
756
757 memset(uid, 0x00, 8);
758 uint8_t* receivedAnswer = mifare_get_bigbufptr();
759
760 if (workFlags & 0x08) {
761 // clear trace
762 iso14a_clear_tracelen();
763 iso14a_set_tracing(TRUE);
764
765 iso14443a_setup();
766
767 LED_A_ON();
768 LED_B_OFF();
769 LED_C_OFF();
770
771 SpinDelay(300);
772 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
773 SpinDelay(100);
774 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
775 }
776
777 while (true) {
778 // get UID from chip
779 if (workFlags & 0x01) {
780 if(!iso14443a_select_card(uid, NULL, &cuid)) {
781 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
782 break;
783 };
784
785 if(mifare_classic_halt(NULL, cuid)) {
786 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
787 break;
788 };
789 };
790
791 // reset chip
792 if (needWipe){
793 ReaderTransmitShort(wupC1);
794 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
795 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
796 break;
797 };
798
799 ReaderTransmit(wipeC, sizeof(wipeC));
800 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
801 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
802 break;
803 };
804
805 if(mifare_classic_halt(NULL, cuid)) {
806 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
807 break;
808 };
809 };
810
811 // write block
812 if (workFlags & 0x02) {
813 ReaderTransmitShort(wupC1);
814 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
815 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
816 break;
817 };
818
819 ReaderTransmit(wupC2, sizeof(wupC2));
820 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
821 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
822 break;
823 };
824 }
825
826 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer) != 1) || (receivedAnswer[0] != 0x0a)) {
827 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
828 break;
829 };
830
831 memcpy(d_block, datain, 16);
832 AppendCrc14443a(d_block, 16);
833
834 ReaderTransmit(d_block, sizeof(d_block));
835 if ((ReaderReceive(receivedAnswer) != 1) || (receivedAnswer[0] != 0x0a)) {
836 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
837 break;
838 };
839
840 if (workFlags & 0x04) {
841 if (mifare_classic_halt(NULL, cuid)) {
842 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
843 break;
844 };
845 }
846
847 isOK = 1;
848 break;
849 }
850
851 UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
852 if (isOK) memcpy(ack.d.asBytes, uid, 4);
853
854 // add trace trailer
855 memset(uid, 0x44, 4);
856 LogTrace(uid, 4, 0, 0, TRUE);
857
858 LED_B_ON();
859 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
860 LED_B_OFF();
861
862 if ((workFlags & 0x10) || (!isOK)) {
863 // Thats it...
864 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
865 LEDsoff();
866 }
867 }
868
869 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
870
871 // params
872 // bit 1 - need wupC
873 // bit 2 - need HALT after sequence
874 // bit 3 - need init FPGA and field before sequence
875 // bit 4 - need reset FPGA and LED
876 uint8_t workFlags = arg0;
877 uint8_t blockNo = arg2;
878
879 // card commands
880 uint8_t wupC1[] = { 0x40 };
881 uint8_t wupC2[] = { 0x43 };
882
883 // variables
884 byte_t isOK = 0;
885 uint8_t data[18];
886 uint32_t cuid = 0;
887
888 memset(data, 0x00, 18);
889 uint8_t* receivedAnswer = mifare_get_bigbufptr();
890
891 if (workFlags & 0x08) {
892 // clear trace
893 iso14a_clear_tracelen();
894 iso14a_set_tracing(TRUE);
895
896 iso14443a_setup();
897
898 LED_A_ON();
899 LED_B_OFF();
900 LED_C_OFF();
901
902 SpinDelay(300);
903 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
904 SpinDelay(100);
905 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
906 }
907
908 while (true) {
909 if (workFlags & 0x02) {
910 ReaderTransmitShort(wupC1);
911 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
912 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
913 break;
914 };
915
916 ReaderTransmit(wupC2, sizeof(wupC2));
917 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
918 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
919 break;
920 };
921 }
922
923 // read block
924 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer) != 18)) {
925 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
926 break;
927 };
928 memcpy(data, receivedAnswer, 18);
929
930 if (workFlags & 0x04) {
931 if (mifare_classic_halt(NULL, cuid)) {
932 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
933 break;
934 };
935 }
936
937 isOK = 1;
938 break;
939 }
940
941 UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
942 if (isOK) memcpy(ack.d.asBytes, data, 18);
943
944 // add trace trailer
945 memset(data, 0x44, 4);
946 LogTrace(data, 4, 0, 0, TRUE);
947
948 LED_B_ON();
949 UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
950 LED_B_OFF();
951
952 if ((workFlags & 0x10) || (!isOK)) {
953 // Thats it...
954 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
955 LEDsoff();
956 }
957 }
958
Impressum, Datenschutz