1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 // Midnitesnake - Dec 2013
6 // Andy Davies - Apr 2014
9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
10 // at your option, any later version. See the LICENSE.txt file for the text of
12 //-----------------------------------------------------------------------------
13 // Routines to support ISO 14443 type A.
14 //-----------------------------------------------------------------------------
16 #include "mifarecmd.h"
20 #include "../common/crc.h"
22 //-----------------------------------------------------------------------------
23 // Select, Authenticate, Read a MIFARE tag.
25 //-----------------------------------------------------------------------------
26 void MifareReadBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
29 uint8_t blockNo
= arg0
;
30 uint8_t keyType
= arg1
;
32 ui64Key
= bytes_to_num(datain
, 6);
36 byte_t dataoutbuf
[16];
39 struct Crypto1State mpcs
= {0, 0};
40 struct Crypto1State
*pcs
;
45 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
52 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
53 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
57 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
58 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
62 if(mifare_classic_readblock(pcs
, cuid
, blockNo
, dataoutbuf
)) {
63 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block error");
67 if(mifare_classic_halt(pcs
, cuid
)) {
68 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
76 // ----------------------------- crypto1 destroy
79 if (MF_DBGLEVEL
>= 2) DbpString("READ BLOCK FINISHED");
82 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16);
85 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
90 void MifareUC_Auth1(uint8_t arg0
, uint8_t *datain
){
93 byte_t dataoutbuf
[16];
99 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
106 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
107 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card, something went wrong before auth");
110 if(mifare_ultra_auth1(cuid
, dataoutbuf
)){
111 if (MF_DBGLEVEL
>= 1) Dbprintf("Authentication part1: Fail.");
115 if (MF_DBGLEVEL
>= 2) DbpString("AUTH 1 FINISHED");
118 cmd_send(CMD_ACK
,isOK
,cuid
,0,dataoutbuf
,11);
124 void MifareUC_Auth2(uint32_t arg0
, uint8_t *datain
){
126 uint32_t cuid
= arg0
;
127 uint8_t key
[16]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
130 byte_t dataoutbuf
[16];
132 memcpy(key
, datain
, 16);
138 if(mifare_ultra_auth2(cuid
, key
, dataoutbuf
)){
139 if (MF_DBGLEVEL
>= 1) Dbprintf("Authentication part2: Fail...");
142 if (MF_DBGLEVEL
>= 2) DbpString("AUTH 2 FINISHED");
145 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,11);
148 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
152 void MifareUReadBlock(uint8_t arg0
,uint8_t *datain
)
155 uint8_t blockNo
= arg0
;
159 byte_t dataoutbuf
[16];
164 iso14a_clear_trace();
165 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
172 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
173 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
177 if(mifare_ultra_readblock(cuid
, blockNo
, dataoutbuf
)) {
178 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block error");
182 if(mifare_ultra_halt(cuid
)) {
183 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
191 if (MF_DBGLEVEL
>= 2) DbpString("READ BLOCK FINISHED");
194 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16);
196 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
200 //-----------------------------------------------------------------------------
201 // Select, Authenticate, Read a MIFARE tag.
202 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
203 //-----------------------------------------------------------------------------
204 void MifareReadSector(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
207 uint8_t sectorNo
= arg0
;
208 uint8_t keyType
= arg1
;
209 uint64_t ui64Key
= 0;
210 ui64Key
= bytes_to_num(datain
, 6);
214 byte_t dataoutbuf
[16 * 16];
217 struct Crypto1State mpcs
= {0, 0};
218 struct Crypto1State
*pcs
;
222 iso14a_clear_trace();
224 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
231 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
233 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
237 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
239 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
242 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
243 if(mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
+ 16 * blockNo
)) {
245 if (MF_DBGLEVEL
>= 1) Dbprintf("Read sector %2d block %2d error", sectorNo
, blockNo
);
250 if(mifare_classic_halt(pcs
, cuid
)) {
251 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
254 // ----------------------------- crypto1 destroy
255 crypto1_destroy(pcs
);
257 if (MF_DBGLEVEL
>= 2) DbpString("READ SECTOR FINISHED");
260 cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,16*NumBlocksPerSector(sectorNo
));
264 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
268 void MifareUReadCard(uint8_t arg0
, int arg1
, uint8_t *datain
)
271 uint8_t sectorNo
= arg0
;
276 byte_t dataoutbuf
[176];
281 iso14a_clear_trace();
283 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
288 Dbprintf("Pages %d",Pages
);
290 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
291 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
294 for(int sec
=0;sec
<Pages
;sec
++){
295 if(mifare_ultra_readblock(cuid
, sectorNo
* 4 + sec
, dataoutbuf
+ 4 * sec
)) {
296 if (MF_DBGLEVEL
>= 1) Dbprintf("Read block %d error",sec
);
302 if(mifare_ultra_halt(cuid
)) {
303 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
310 Dbprintf("Pages read %d",count_Pages
);
311 if (MF_DBGLEVEL
>= 2) DbpString("READ CARD FINISHED");
314 if (Pages
==16) cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,64);
315 if (Pages
==44 && count_Pages
==16) cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,64);
316 if (Pages
==44 && count_Pages
>16) cmd_send(CMD_ACK
,isOK
,0,0,dataoutbuf
,176);
320 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
326 //-----------------------------------------------------------------------------
327 // Select, Authenticate, Write a MIFARE tag.
329 //-----------------------------------------------------------------------------
330 void MifareWriteBlock(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
333 uint8_t blockNo
= arg0
;
334 uint8_t keyType
= arg1
;
335 uint64_t ui64Key
= 0;
336 byte_t blockdata
[16];
338 ui64Key
= bytes_to_num(datain
, 6);
339 memcpy(blockdata
, datain
+ 10, 16);
345 struct Crypto1State mpcs
= {0, 0};
346 struct Crypto1State
*pcs
;
350 iso14a_clear_trace();
352 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
359 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
360 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
364 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
365 if (MF_DBGLEVEL
>= 1) Dbprintf("Auth error");
369 if(mifare_classic_writeblock(pcs
, cuid
, blockNo
, blockdata
)) {
370 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
374 if(mifare_classic_halt(pcs
, cuid
)) {
375 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
383 // ----------------------------- crypto1 destroy
384 crypto1_destroy(pcs
);
386 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
389 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
394 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
398 void MifareUWriteBlock(uint8_t arg0
, uint8_t *datain
)
401 uint8_t blockNo
= arg0
;
402 byte_t blockdata
[16];
404 memset(blockdata
,'\0',16);
405 memcpy(blockdata
, datain
,16);
413 iso14a_clear_trace();
415 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
422 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
423 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
427 if(mifare_ultra_writeblock(cuid
, blockNo
, blockdata
)) {
428 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
432 if(mifare_ultra_halt(cuid
)) {
433 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
441 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
444 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
449 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
451 // iso14a_set_tracing(TRUE);
454 void MifareUWriteBlock_Special(uint8_t arg0
, uint8_t *datain
)
457 uint8_t blockNo
= arg0
;
460 memcpy(blockdata
, datain
,4);
468 iso14a_clear_trace();
470 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
477 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
478 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
482 if(mifare_ultra_special_writeblock(cuid
, blockNo
, blockdata
)) {
483 if (MF_DBGLEVEL
>= 1) Dbprintf("Write block error");
487 if(mifare_ultra_halt(cuid
)) {
488 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
496 if (MF_DBGLEVEL
>= 2) DbpString("WRITE BLOCK FINISHED");
499 cmd_send(CMD_ACK
,isOK
,0,0,0,0);
503 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
507 // Return 1 if the nonce is invalid else return 0
508 int valid_nonce(uint32_t Nt
, uint32_t NtEnc
, uint32_t Ks1
, uint8_t * parity
) {
509 return ((oddparity((Nt
>> 24) & 0xFF) == ((parity
[0]) ^ oddparity((NtEnc
>> 24) & 0xFF) ^ BIT(Ks1
,16))) & \
510 (oddparity((Nt
>> 16) & 0xFF) == ((parity
[1]) ^ oddparity((NtEnc
>> 16) & 0xFF) ^ BIT(Ks1
,8))) & \
511 (oddparity((Nt
>> 8) & 0xFF) == ((parity
[2]) ^ oddparity((NtEnc
>> 8) & 0xFF) ^ BIT(Ks1
,0)))) ? 1 : 0;
515 //-----------------------------------------------------------------------------
516 // MIFARE nested authentication.
518 //-----------------------------------------------------------------------------
519 void MifareNested(uint32_t arg0
, uint32_t arg1
, uint32_t calibrate
, uint8_t *datain
)
522 uint8_t blockNo
= arg0
& 0xff;
523 uint8_t keyType
= (arg0
>> 8) & 0xff;
524 uint8_t targetBlockNo
= arg1
& 0xff;
525 uint8_t targetKeyType
= (arg1
>> 8) & 0xff;
526 uint64_t ui64Key
= 0;
528 ui64Key
= bytes_to_num(datain
, 6);
531 uint16_t rtr
, i
, j
, len
;
533 static uint16_t dmin
, dmax
;
535 uint32_t cuid
, nt1
, nt2
, nttmp
, nttest
, ks1
;
537 uint32_t target_nt
[2], target_ks
[2];
539 uint8_t par_array
[4];
541 struct Crypto1State mpcs
= {0, 0};
542 struct Crypto1State
*pcs
;
544 uint8_t* receivedAnswer
= get_bigbufptr_recvrespbuf();
546 uint32_t auth1_time
, auth2_time
;
547 static uint16_t delta_time
;
550 iso14a_clear_trace();
551 iso14a_set_tracing(false);
553 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
559 // statistics on nonce distance
560 if (calibrate
) { // for first call only. Otherwise reuse previous calibration
568 for (rtr
= 0; rtr
< 17; rtr
++) {
570 // prepare next select. No need to power down the card.
571 if(mifare_classic_halt(pcs
, cuid
)) {
572 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
577 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
578 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
584 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
585 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
591 auth2_time
= auth1_time
+ delta_time
;
595 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_NESTED
, &nt2
, &auth2_time
)) {
596 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error");
601 nttmp
= prng_successor(nt1
, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
602 for (i
= 141; i
< 1200; i
++) {
603 nttmp
= prng_successor(nttmp
, 1);
604 if (nttmp
== nt2
) break;
614 delta_time
= auth2_time
- auth1_time
+ 32; // allow some slack for proper timing
616 if (MF_DBGLEVEL
>= 3) Dbprintf("Nested: calibrating... ntdist=%d", i
);
620 if (rtr
<= 1) return;
622 davg
= (davg
+ (rtr
- 1)/2) / (rtr
- 1);
624 if (MF_DBGLEVEL
>= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin
, dmax
, davg
, delta_time
);
632 // -------------------------------------------------------------------------------------------------
636 // get crypted nonces for target sector
637 for(i
=0; i
< 2; i
++) { // look for exactly two different nonces
641 DbpString("Nested: cancelled");
642 crypto1_destroy(pcs
);
643 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
649 while(target_nt
[i
] == 0) { // continue until we have an unambiguous nonce
651 // prepare next select. No need to power down the card.
652 if(mifare_classic_halt(pcs
, cuid
)) {
653 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Halt error");
657 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
658 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Can't select card");
663 if(mifare_classic_authex(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
, &nt1
, &auth1_time
)) {
664 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth1 error");
668 // nested authentication
669 auth2_time
= auth1_time
+ delta_time
;
670 len
= mifare_sendcmd_shortex(pcs
, AUTH_NESTED
, 0x60 + (targetKeyType
& 0x01), targetBlockNo
, receivedAnswer
, par
, &auth2_time
);
672 if (MF_DBGLEVEL
>= 1) Dbprintf("Nested: Auth2 error len=%d", len
);
676 nt2
= bytes_to_num(receivedAnswer
, 4);
677 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i
+1, nt1
, nt2
, par
[0]);
679 // Parity validity check
680 for (j
= 0; j
< 4; j
++) {
681 par_array
[j
] = (oddparity(receivedAnswer
[j
]) != ((par
[0] >> (7-j
)) & 0x01));
685 nttest
= prng_successor(nt1
, dmin
- 1);
686 for (j
= dmin
; j
< dmax
+ 1; j
++) {
687 nttest
= prng_successor(nttest
, 1);
690 if (valid_nonce(nttest
, nt2
, ks1
, par_array
)){
691 if (ncount
> 0) { // we are only interested in disambiguous nonces, try again
692 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i
+1, j
);
696 target_nt
[i
] = nttest
;
699 if (i
== 1 && target_nt
[1] == target_nt
[0]) { // we need two different nonces
701 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j
);
704 if (MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i
+1, j
);
707 if (target_nt
[i
] == 0 && j
== dmax
+1 && MF_DBGLEVEL
>= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i
+1);
713 // ----------------------------- crypto1 destroy
714 crypto1_destroy(pcs
);
716 byte_t buf
[4 + 4 * 4];
717 memcpy(buf
, &cuid
, 4);
718 memcpy(buf
+4, &target_nt
[0], 4);
719 memcpy(buf
+8, &target_ks
[0], 4);
720 memcpy(buf
+12, &target_nt
[1], 4);
721 memcpy(buf
+16, &target_ks
[1], 4);
724 cmd_send(CMD_ACK
, 0, 2, targetBlockNo
+ (targetKeyType
* 0x100), buf
, sizeof(buf
));
727 if (MF_DBGLEVEL
>= 3) DbpString("NESTED FINISHED");
729 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
731 iso14a_set_tracing(TRUE
);
734 //-----------------------------------------------------------------------------
735 // MIFARE check keys. key count up to 85.
737 //-----------------------------------------------------------------------------
738 void MifareChkKeys(uint8_t arg0
, uint8_t arg1
, uint8_t arg2
, uint8_t *datain
)
741 uint8_t blockNo
= arg0
;
742 uint8_t keyType
= arg1
;
743 uint8_t keyCount
= arg2
;
744 uint64_t ui64Key
= 0;
751 struct Crypto1State mpcs
= {0, 0};
752 struct Crypto1State
*pcs
;
756 int OLD_MF_DBGLEVEL
= MF_DBGLEVEL
;
757 MF_DBGLEVEL
= MF_DBG_NONE
;
760 iso14a_clear_trace();
761 iso14a_set_tracing(TRUE
);
763 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
769 for (i
= 0; i
< keyCount
; i
++) {
770 if(mifare_classic_halt(pcs
, cuid
)) {
771 if (MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Halt error");
774 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
775 if (OLD_MF_DBGLEVEL
>= 1) Dbprintf("ChkKeys: Can't select card");
779 ui64Key
= bytes_to_num(datain
+ i
* 6, 6);
780 if(mifare_classic_auth(pcs
, cuid
, blockNo
, keyType
, ui64Key
, AUTH_FIRST
)) {
788 // ----------------------------- crypto1 destroy
789 crypto1_destroy(pcs
);
792 cmd_send(CMD_ACK
,isOK
,0,0,datain
+ i
* 6,6);
795 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
798 // restore debug level
799 MF_DBGLEVEL
= OLD_MF_DBGLEVEL
;
802 //-----------------------------------------------------------------------------
803 // MIFARE commands set debug level
805 //-----------------------------------------------------------------------------
806 void MifareSetDbgLvl(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
808 Dbprintf("Debug level: %d", MF_DBGLEVEL
);
811 //-----------------------------------------------------------------------------
812 // Work with emulator memory
814 //-----------------------------------------------------------------------------
815 void MifareEMemClr(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
819 void MifareEMemSet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
820 emlSetMem(datain
, arg0
, arg1
); // data, block num, blocks count
823 void MifareEMemGet(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
824 byte_t buf
[USB_CMD_DATA_SIZE
];
825 emlGetMem(buf
, arg0
, arg1
); // data, block num, blocks count (max 4)
828 cmd_send(CMD_ACK
,arg0
,arg1
,0,buf
,USB_CMD_DATA_SIZE
);
832 //-----------------------------------------------------------------------------
833 // Load a card into the emulator memory
835 //-----------------------------------------------------------------------------
836 void MifareECardLoad(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
837 uint8_t numSectors
= arg0
;
838 uint8_t keyType
= arg1
;
839 uint64_t ui64Key
= 0;
841 struct Crypto1State mpcs
= {0, 0};
842 struct Crypto1State
*pcs
;
846 byte_t dataoutbuf
[16];
847 byte_t dataoutbuf2
[16];
851 iso14a_clear_trace();
852 iso14a_set_tracing(false);
854 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
862 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
864 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
867 for (uint8_t sectorNo
= 0; isOK
&& sectorNo
< numSectors
; sectorNo
++) {
868 ui64Key
= emlGetKey(sectorNo
, keyType
);
870 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_FIRST
)) {
872 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo
);
876 if(isOK
&& mifare_classic_auth(pcs
, cuid
, FirstBlockOfSector(sectorNo
), keyType
, ui64Key
, AUTH_NESTED
)) {
878 if (MF_DBGLEVEL
>= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo
);
883 for (uint8_t blockNo
= 0; isOK
&& blockNo
< NumBlocksPerSector(sectorNo
); blockNo
++) {
884 if(isOK
&& mifare_classic_readblock(pcs
, cuid
, FirstBlockOfSector(sectorNo
) + blockNo
, dataoutbuf
)) {
886 if (MF_DBGLEVEL
>= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo
, blockNo
);
890 if (blockNo
< NumBlocksPerSector(sectorNo
) - 1) {
891 emlSetMem(dataoutbuf
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
892 } else { // sector trailer, keep the keys, set only the AC
893 emlGetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
894 memcpy(&dataoutbuf2
[6], &dataoutbuf
[6], 4);
895 emlSetMem(dataoutbuf2
, FirstBlockOfSector(sectorNo
) + blockNo
, 1);
902 if(mifare_classic_halt(pcs
, cuid
)) {
903 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
906 // ----------------------------- crypto1 destroy
907 crypto1_destroy(pcs
);
909 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
912 if (MF_DBGLEVEL
>= 2) DbpString("EMUL FILL SECTORS FINISHED");
917 //-----------------------------------------------------------------------------
918 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
920 //-----------------------------------------------------------------------------
921 void MifareCSetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
924 uint8_t needWipe
= arg0
;
925 // bit 0 - need get UID
927 // bit 2 - need HALT after sequence
928 // bit 3 - need init FPGA and field before sequence
929 // bit 4 - need reset FPGA and LED
930 uint8_t workFlags
= arg1
;
931 uint8_t blockNo
= arg2
;
934 uint8_t wupC1
[] = { 0x40 };
935 uint8_t wupC2
[] = { 0x43 };
936 uint8_t wipeC
[] = { 0x41 };
940 uint8_t uid
[10] = {0x00};
941 uint8_t d_block
[18] = {0x00};
944 uint8_t* receivedAnswer
= get_bigbufptr_recvrespbuf();
945 uint8_t *receivedAnswerPar
= receivedAnswer
+ MAX_FRAME_SIZE
;
947 // reset FPGA and LED
948 if (workFlags
& 0x08) {
953 iso14a_clear_trace();
954 iso14a_set_tracing(TRUE
);
955 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
961 if (workFlags
& 0x01) {
962 if(!iso14443a_select_card(uid
, NULL
, &cuid
)) {
963 if (MF_DBGLEVEL
>= 1) Dbprintf("Can't select card");
967 if(mifare_classic_halt(NULL
, cuid
)) {
968 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
975 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
976 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
977 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
981 ReaderTransmit(wipeC
, sizeof(wipeC
), NULL
);
982 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
983 if (MF_DBGLEVEL
>= 1) Dbprintf("wipeC error");
987 if(mifare_classic_halt(NULL
, cuid
)) {
988 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
994 if (workFlags
& 0x02) {
995 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
996 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
997 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1001 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1002 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1003 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1008 if ((mifare_sendcmd_short(NULL
, 0, 0xA0, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1009 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send command error");
1013 memcpy(d_block
, datain
, 16);
1014 AppendCrc14443a(d_block
, 16);
1016 ReaderTransmit(d_block
, sizeof(d_block
), NULL
);
1017 if ((ReaderReceive(receivedAnswer
, receivedAnswerPar
) != 1) || (receivedAnswer
[0] != 0x0a)) {
1018 if (MF_DBGLEVEL
>= 1) Dbprintf("write block send data error");
1022 if (workFlags
& 0x04) {
1023 if (mifare_classic_halt(NULL
, cuid
)) {
1024 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1034 cmd_send(CMD_ACK
,isOK
,0,0,uid
,4);
1037 if ((workFlags
& 0x10) || (!isOK
)) {
1038 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1044 void MifareCGetBlock(uint32_t arg0
, uint32_t arg1
, uint32_t arg2
, uint8_t *datain
){
1047 // bit 1 - need wupC
1048 // bit 2 - need HALT after sequence
1049 // bit 3 - need init FPGA and field before sequence
1050 // bit 4 - need reset FPGA and LED
1051 uint8_t workFlags
= arg0
;
1052 uint8_t blockNo
= arg2
;
1055 uint8_t wupC1
[] = { 0x40 };
1056 uint8_t wupC2
[] = { 0x43 };
1060 uint8_t data
[18] = {0x00};
1063 uint8_t* receivedAnswer
= get_bigbufptr_recvrespbuf();
1064 uint8_t *receivedAnswerPar
= receivedAnswer
+ MAX_FRAME_SIZE
;
1066 if (workFlags
& 0x08) {
1071 iso14a_clear_trace();
1072 iso14a_set_tracing(TRUE
);
1073 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN
);
1077 if (workFlags
& 0x02) {
1078 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1079 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1080 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC1 error");
1084 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1085 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1086 if (MF_DBGLEVEL
>= 1) Dbprintf("wupC2 error");
1092 if ((mifare_sendcmd_short(NULL
, 0, 0x30, blockNo
, receivedAnswer
, receivedAnswerPar
, NULL
) != 18)) {
1093 if (MF_DBGLEVEL
>= 1) Dbprintf("read block send command error");
1096 memcpy(data
, receivedAnswer
, 18);
1098 if (workFlags
& 0x04) {
1099 if (mifare_classic_halt(NULL
, cuid
)) {
1100 if (MF_DBGLEVEL
>= 1) Dbprintf("Halt error");
1110 cmd_send(CMD_ACK
,isOK
,0,0,data
,18);
1113 if ((workFlags
& 0x10) || (!isOK
)) {
1114 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
1119 void MifareCIdent(){
1122 uint8_t wupC1
[] = { 0x40 };
1123 uint8_t wupC2
[] = { 0x43 };
1128 uint8_t* receivedAnswer
= get_bigbufptr_recvrespbuf();
1129 uint8_t *receivedAnswerPar
= receivedAnswer
+ MAX_FRAME_SIZE
;
1131 ReaderTransmitBitsPar(wupC1
,7,0, NULL
);
1132 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1136 ReaderTransmit(wupC2
, sizeof(wupC2
), NULL
);
1137 if(!ReaderReceive(receivedAnswer
, receivedAnswerPar
) || (receivedAnswer
[0] != 0x0a)) {
1141 if (mifare_classic_halt(NULL
, 0)) {
1145 cmd_send(CMD_ACK
,isOK
,0,0,0,0);