cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 //#include "../client/loclass/des.h"
  20 #include "des.h"
  21 #include "crc.h"
  22
  23 //-----------------------------------------------------------------------------
  24 // Select, Authenticate, Read a MIFARE tag.
  25 // read block
  26 //-----------------------------------------------------------------------------
  27 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  28 {
  29   // params
  30         uint8_t blockNo = arg0;
  31         uint8_t keyType = arg1;
  32         uint64_t ui64Key = 0;
  33         ui64Key = bytes_to_num(datain, 6);
  34
  35         // variables
  36         byte_t isOK = 0;
  37         byte_t dataoutbuf[16];
  38         uint8_t uid[10];
  39         uint32_t cuid;
  40         struct Crypto1State mpcs = {0, 0};
  41         struct Crypto1State *pcs;
  42         pcs = &mpcs;
  43
  44         // clear trace
  45         clear_trace();
  46         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  47
  48         LED_A_ON();
  49         LED_B_OFF();
  50         LED_C_OFF();
  51
  52         while (true) {
  53                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  54                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  55                         break;
  56                 };
  57
  58                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  59                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  60                         break;
  61                 };
  62
  63                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  64                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  65                         break;
  66                 };
  67
  68                 if(mifare_classic_halt(pcs, cuid)) {
  69                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  70                         break;
  71                 };
  72
  73                 isOK = 1;
  74                 break;
  75         }
  76
  77         //  ----------------------------- crypto1 destroy
  78         crypto1_destroy(pcs);
  79
  80         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
  81
  82         LED_B_ON();
  83         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  84         LED_B_OFF();
  85
  86         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  87         LEDsoff();
  88 }
  89
  90
  91 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  92
  93         byte_t dataoutbuf[16] = {0x00};
  94         uint8_t uid[10] = {0x00};
  95         uint32_t cuid = 0x00;
  96
  97         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
  98
  99         clear_trace();
 100         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 101
 102         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 103                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
 104                 OnError(0);
 105                 return;
 106         };
 107
 108         if(mifare_ultra_auth1(dataoutbuf)){
 109                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
 110                 OnError(1);
 111                 return;
 112         }
 113
 114         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
 115
 116     cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
 117         LEDsoff();
 118 }
 119 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 120
 121         uint8_t key[16] = {0x00};
 122         byte_t dataoutbuf[16] = {0x00};
 123
 124         memcpy(key, datain, 16);
 125
 126         LED_A_ON();     LED_B_OFF(); LED_C_OFF();
 127
 128         if(mifare_ultra_auth2(key, dataoutbuf)){
 129             if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
 130                 OnError(1);
 131                 return;
 132         }
 133
 134         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
 135
 136         cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
 137         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 138         LEDsoff();
 139 }
 140
 141 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 142 {
 143         uint8_t blockNo = arg0;
 144         byte_t dataout[16] = {0x00};
 145         uint8_t uid[10] = {0x00};
 146         uint8_t key[16] = {0x00};
 147     bool usePwd = (arg1 == 1);
 148
 149         LED_A_ON();     LED_B_OFF(); LED_C_OFF();
 150
 151         clear_trace();
 152         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 153
 154         int len = iso14443a_select_card(uid, NULL, NULL);
 155         if(!len) {
 156                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 157                 OnError(1);
 158                 return;
 159         }
 160
 161          // authenticate here.
 162         if ( usePwd ) {
 163
 164                 memcpy(key, datain, 16);
 165
 166                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );
 167                 // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );
 168
 169                 uint8_t a[8] = {1,1,1,1,1,1,1,1 };
 170                 uint8_t b[8] = {0x00};
 171                 uint8_t enc_b[8] = {0x00};
 172                 uint8_t ab[16] = {0x00};
 173                 uint8_t enc_ab[16] = {0x00};
 174                 uint8_t enc_key[8] = {0x00};
 175
 176                 uint16_t len;
 177                 uint8_t receivedAnswer[MAX_FRAME_SIZE];
 178                 uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
 179
 180                 len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
 181                 if (len != 11) {
 182                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 183                         OnError(1);
 184                         return;
 185                 }
 186
 187                 // tag nonce.
 188                 memcpy(enc_b,receivedAnswer+1,8);
 189
 190                 // decrypt nonce.
 191                 tdes_2key_dec(b, enc_b, 8, key );
 192
 193                 Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x", enc_b[0],enc_b[1],enc_b[2],enc_b[3],enc_b[4],enc_b[5],enc_b[6],enc_b[7] );
 194                 Dbprintf("    B: %02x %02x %02x %02x %02x %02x %02x %02x", b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7] );
 195                 rol(b,8);
 196
 197                 memcpy(ab  ,a,8);
 198                 memcpy(ab+8,b,8);
 199
 200                 Dbprintf("AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[0],ab[1],ab[2],ab[3],ab[4],ab[5],ab[6],ab[7] );
 201                 Dbprintf("AB: %02x %02x %02x %02x %02x %02x %02x %02x", ab[8],ab[9],ab[10],ab[11],ab[12],ab[13],ab[14],ab[15] );
 202
 203                 // encrypt
 204                 tdes_2key_enc(enc_ab, ab, 16, key);
 205
 206                 Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x", enc_ab[0],enc_ab[1],enc_ab[2],enc_ab[3],enc_ab[4],enc_ab[5],enc_ab[6],enc_ab[7] );
 207                 Dbprintf("e_enc_ab: %02x %02x %02x %02x %02x %02x %02x %02x", enc_ab[8],enc_ab[9],enc_ab[10],enc_ab[11],enc_ab[12],enc_ab[13],enc_ab[14],enc_ab[15] );
 208
 209                 len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, enc_ab, receivedAnswer, receivedAnswerPar, NULL);
 210                 if (len != 11) {
 211                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
 212                         OnError(1);
 213                         return;
 214                 }
 215
 216                 // the tags' encryption of our nonce, A.
 217                 memcpy(enc_key, receivedAnswer+1, 8);
 218
 219                 // clear B.
 220                 memset(b, 0x00, 8);
 221
 222                 // decrypt
 223                 tdes_2key_dec(b, enc_key, 8, key );
 224                 if ( memcmp(a, b, 8) == 0 )
 225                         Dbprintf("Verified key");
 226                 else
 227                         Dbprintf("failed authentication");
 228
 229                 Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x", a[0],a[1],a[2],a[3],a[4],a[5],a[6],a[7] );
 230                 Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x", b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7] );
 231         }
 232
 233         if( mifare_ultra_readblock(blockNo, dataout) ) {
 234                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 235                 OnError(2);
 236                 return;
 237         }
 238
 239         if( mifare_ultra_halt() ) {
 240                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 241                 OnError(3);
 242                 return;
 243         }
 244
 245     cmd_send(CMD_ACK,1,0,0,dataout,16);
 246         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 247         LEDsoff();
 248 }
 249 //-----------------------------------------------------------------------------
 250 // Select, Authenticate, Read a MIFARE tag.
 251 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 252 //-----------------------------------------------------------------------------
 253 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 254 {
 255   // params
 256         uint8_t sectorNo = arg0;
 257         uint8_t keyType = arg1;
 258         uint64_t ui64Key = 0;
 259         ui64Key = bytes_to_num(datain, 6);
 260
 261         // variables
 262         byte_t isOK = 0;
 263         byte_t dataoutbuf[16 * 16];
 264         uint8_t uid[10];
 265         uint32_t cuid;
 266         struct Crypto1State mpcs = {0, 0};
 267         struct Crypto1State *pcs;
 268         pcs = &mpcs;
 269
 270         // clear trace
 271         clear_trace();
 272
 273         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 274
 275         LED_A_ON();
 276         LED_B_OFF();
 277         LED_C_OFF();
 278
 279         isOK = 1;
 280         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 281                 isOK = 0;
 282                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 283         }
 284
 285
 286         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 287                 isOK = 0;
 288                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 289         }
 290
 291         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 292                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 293                         isOK = 0;
 294                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 295                         break;
 296                 }
 297         }
 298
 299         if(mifare_classic_halt(pcs, cuid)) {
 300                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 301         }
 302
 303         //  ----------------------------- crypto1 destroy
 304         crypto1_destroy(pcs);
 305
 306         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 307
 308         LED_B_ON();
 309         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 310         LED_B_OFF();
 311
 312         // Thats it...
 313         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 314         LEDsoff();
 315 }
 316
 317 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 318 {
 319         // params
 320         uint8_t sectorNo = arg0;
 321         int Pages = arg1;
 322         int countpages = 0;
 323         byte_t dataout[176] = {0x00};;
 324         uint32_t cuid = 0x00;
 325
 326         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 327         clear_trace();
 328         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 329
 330         int len = iso14443a_select_card(NULL, NULL, &cuid);
 331         if (!len) {
 332                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%d)",len);
 333                 OnError(1);
 334                 return;
 335         }
 336
 337         for (int i = 0; i < Pages; i++){
 338
 339                 len = mifare_ultra_readblock(sectorNo * 4 + i, dataout + 4 * i);
 340
 341                 if (len) {
 342                         if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 343                         OnError(2);
 344                         return;
 345                 } else {
 346                         countpages++;
 347                 }
 348         }
 349
 350         len = mifare_ultra_halt();
 351         if (len) {
 352                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 353                 OnError(3);
 354                 return;
 355         }
 356
 357         if (MF_DBGLEVEL >= MF_DBG_ALL) Dbprintf("Pages read %d", countpages);
 358
 359         len = 16*4; //64 bytes
 360
 361         // Read a UL-C
 362         if (Pages == 44 && countpages > 16)
 363                 len = 176;
 364
 365         cmd_send(CMD_ACK, 1, 0, 0, dataout, len);
 366         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 367         LEDsoff();
 368 }
 369
 370
 371 //-----------------------------------------------------------------------------
 372 // Select, Authenticate, Write a MIFARE tag.
 373 // read block
 374 //-----------------------------------------------------------------------------
 375 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 376 {
 377         // params
 378         uint8_t blockNo = arg0;
 379         uint8_t keyType = arg1;
 380         uint64_t ui64Key = 0;
 381         byte_t blockdata[16];
 382
 383         ui64Key = bytes_to_num(datain, 6);
 384         memcpy(blockdata, datain + 10, 16);
 385
 386         // variables
 387         byte_t isOK = 0;
 388         uint8_t uid[10];
 389         uint32_t cuid;
 390         struct Crypto1State mpcs = {0, 0};
 391         struct Crypto1State *pcs;
 392         pcs = &mpcs;
 393
 394         // clear trace
 395         clear_trace();
 396
 397         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 398
 399         LED_A_ON();
 400         LED_B_OFF();
 401         LED_C_OFF();
 402
 403         while (true) {
 404                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 405                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 406                         break;
 407                 };
 408
 409                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 410                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 411                         break;
 412                 };
 413
 414                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 415                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 416                         break;
 417                 };
 418
 419                 if(mifare_classic_halt(pcs, cuid)) {
 420                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 421                         break;
 422                 };
 423
 424                 isOK = 1;
 425                 break;
 426         }
 427
 428         //  ----------------------------- crypto1 destroy
 429         crypto1_destroy(pcs);
 430
 431         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 432
 433         LED_B_ON();
 434         cmd_send(CMD_ACK,isOK,0,0,0,0);
 435         LED_B_OFF();
 436
 437
 438         // Thats it...
 439         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 440         LEDsoff();
 441 }
 442
 443 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 444 {
 445     uint8_t blockNo = arg0;
 446         byte_t blockdata[16] = {0x00};
 447
 448     memcpy(blockdata, datain, 16);
 449
 450         uint8_t uid[10] = {0x00};
 451
 452         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 453
 454         clear_trace();
 455         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 456
 457         if(!iso14443a_select_card(uid, NULL, NULL)) {
 458                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 459                 OnError(0);
 460                 return;
 461         };
 462
 463         if(mifare_ultra_writeblock(blockNo, blockdata)) {
 464                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 465                 OnError(0);
 466                 return; };
 467
 468         if(mifare_ultra_halt()) {
 469                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 470                 OnError(0);
 471                 return;
 472         };
 473
 474         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 475
 476         cmd_send(CMD_ACK,1,0,0,0,0);
 477         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 478         LEDsoff();
 479 }
 480
 481 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 482 {
 483         uint8_t blockNo = arg0;
 484         byte_t blockdata[4] = {0x00};
 485
 486         memcpy(blockdata, datain,4);
 487
 488         uint8_t uid[10] = {0x00};
 489
 490         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 491         clear_trace();
 492         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 493
 494         if(!iso14443a_select_card(uid, NULL, NULL)) {
 495                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 496                 OnError(0);
 497                 return;
 498         };
 499
 500         if(mifare_ultra_special_writeblock(blockNo, blockdata)) {
 501                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 502                 OnError(0);
 503                 return;
 504         };
 505
 506         if(mifare_ultra_halt()) {
 507                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 508                 OnError(0);
 509                 return;
 510         };
 511
 512         if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
 513
 514         cmd_send(CMD_ACK,1,0,0,0,0);
 515         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 516         LEDsoff();
 517 }
 518
 519 void MifareUSetPwd(uint8_t arg0, uint8_t *datain){
 520
 521         uint8_t pwd[16] = {0x00};
 522         byte_t blockdata[4] = {0x00};
 523
 524         memcpy(pwd, datain, 16);
 525
 526         LED_A_ON(); LED_B_OFF(); LED_C_OFF();
 527         clear_trace();
 528         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 529
 530         if(!iso14443a_select_card(NULL, NULL, NULL)) {
 531                 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
 532                 OnError(0);
 533                 return;
 534         };
 535
 536         blockdata[0] = pwd[7];
 537         blockdata[1] = pwd[6];
 538         blockdata[2] = pwd[5];
 539         blockdata[3] = pwd[4];
 540         if(mifare_ultra_special_writeblock( 44, blockdata)) {
 541                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 542                 OnError(44);
 543                 return;
 544         };
 545
 546         blockdata[0] = pwd[3];
 547         blockdata[1] = pwd[2];
 548         blockdata[2] = pwd[1];
 549         blockdata[3] = pwd[0];
 550         if(mifare_ultra_special_writeblock( 45, blockdata)) {
 551                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 552                 OnError(45);
 553                 return;
 554         };
 555
 556         blockdata[0] = pwd[15];
 557         blockdata[1] = pwd[14];
 558         blockdata[2] = pwd[13];
 559         blockdata[3] = pwd[12];
 560         if(mifare_ultra_special_writeblock( 46, blockdata)) {
 561                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 562                 OnError(46);
 563                 return;
 564         };
 565
 566         blockdata[0] = pwd[11];
 567         blockdata[1] = pwd[10];
 568         blockdata[2] = pwd[9];
 569         blockdata[3] = pwd[8];
 570         if(mifare_ultra_special_writeblock( 47, blockdata)) {
 571                 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
 572                 OnError(47);
 573                 return;
 574         };
 575
 576         if(mifare_ultra_halt()) {
 577                 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
 578                 OnError(0);
 579                 return;
 580         };
 581
 582         cmd_send(CMD_ACK,1,0,0,0,0);
 583         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 584         LEDsoff();
 585 }
 586
 587 // Return 1 if the nonce is invalid else return 0
 588 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
 589         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 590         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 591         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 592 }
 593
 594
 595 //-----------------------------------------------------------------------------
 596 // MIFARE nested authentication.
 597 //
 598 //-----------------------------------------------------------------------------
 599 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 600 {
 601         // params
 602         uint8_t blockNo = arg0 & 0xff;
 603         uint8_t keyType = (arg0 >> 8) & 0xff;
 604         uint8_t targetBlockNo = arg1 & 0xff;
 605         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 606         uint64_t ui64Key = 0;
 607
 608         ui64Key = bytes_to_num(datain, 6);
 609
 610         // variables
 611         uint16_t rtr, i, j, len;
 612         uint16_t davg;
 613         static uint16_t dmin, dmax;
 614         uint8_t uid[10];
 615         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 616         uint8_t par[1];
 617         uint32_t target_nt[2], target_ks[2];
 618
 619         uint8_t par_array[4];
 620         uint16_t ncount = 0;
 621         struct Crypto1State mpcs = {0, 0};
 622         struct Crypto1State *pcs;
 623         pcs = &mpcs;
 624         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
 625
 626         uint32_t auth1_time, auth2_time;
 627         static uint16_t delta_time;
 628
 629         // free eventually allocated BigBuf memory
 630         BigBuf_free();
 631         // clear trace
 632         clear_trace();
 633         set_tracing(false);
 634
 635         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 636
 637         LED_A_ON();
 638         LED_C_OFF();
 639
 640
 641         // statistics on nonce distance
 642         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 643                 LED_B_ON();
 644                 WDT_HIT();
 645
 646                 davg = dmax = 0;
 647                 dmin = 2000;
 648                 delta_time = 0;
 649
 650                 for (rtr = 0; rtr < 17; rtr++) {
 651
 652                         // prepare next select. No need to power down the card.
 653                         if(mifare_classic_halt(pcs, cuid)) {
 654                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 655                                 rtr--;
 656                                 continue;
 657                         }
 658
 659                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 660                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 661                                 rtr--;
 662                                 continue;
 663                         };
 664
 665                         auth1_time = 0;
 666                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 667                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 668                                 rtr--;
 669                                 continue;
 670                         };
 671
 672                         if (delta_time) {
 673                                 auth2_time = auth1_time + delta_time;
 674                         } else {
 675                                 auth2_time = 0;
 676                         }
 677                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 678                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 679                                 rtr--;
 680                                 continue;
 681                         };
 682
 683                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 684                         for (i = 101; i < 1200; i++) {
 685                                 nttmp = prng_successor(nttmp, 1);
 686                                 if (nttmp == nt2) break;
 687                         }
 688
 689                         if (i != 1200) {
 690                                 if (rtr != 0) {
 691                                         davg += i;
 692                                         dmin = MIN(dmin, i);
 693                                         dmax = MAX(dmax, i);
 694                                 }
 695                                 else {
 696                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 697                                 }
 698                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 699                         }
 700                 }
 701
 702                 if (rtr <= 1)   return;
 703
 704                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 705
 706                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 707
 708                 dmin = davg - 2;
 709                 dmax = davg + 2;
 710
 711                 LED_B_OFF();
 712
 713         }
 714 //  -------------------------------------------------------------------------------------------------
 715
 716         LED_C_ON();
 717
 718         //  get crypted nonces for target sector
 719         for(i=0; i < 2; i++) { // look for exactly two different nonces
 720
 721                 target_nt[i] = 0;
 722                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 723
 724                         // prepare next select. No need to power down the card.
 725                         if(mifare_classic_halt(pcs, cuid)) {
 726                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 727                                 continue;
 728                         }
 729
 730                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 731                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 732                                 continue;
 733                         };
 734
 735                         auth1_time = 0;
 736                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 737                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 738                                 continue;
 739                         };
 740
 741                         // nested authentication
 742                         auth2_time = auth1_time + delta_time;
 743                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 744                         if (len != 4) {
 745                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 746                                 continue;
 747                         };
 748
 749                         nt2 = bytes_to_num(receivedAnswer, 4);
 750                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 751
 752                         // Parity validity check
 753                         for (j = 0; j < 4; j++) {
 754                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 755                         }
 756
 757                         ncount = 0;
 758                         nttest = prng_successor(nt1, dmin - 1);
 759                         for (j = dmin; j < dmax + 1; j++) {
 760                                 nttest = prng_successor(nttest, 1);
 761                                 ks1 = nt2 ^ nttest;
 762
 763                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 764                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 765                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 766                                                 target_nt[i] = 0;
 767                                                 break;
 768                                         }
 769                                         target_nt[i] = nttest;
 770                                         target_ks[i] = ks1;
 771                                         ncount++;
 772                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 773                                                 target_nt[i] = 0;
 774                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 775                                                 break;
 776                                         }
 777                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 778                                 }
 779                         }
 780                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 781                 }
 782         }
 783
 784         LED_C_OFF();
 785
 786         //  ----------------------------- crypto1 destroy
 787         crypto1_destroy(pcs);
 788
 789         byte_t buf[4 + 4 * 4];
 790         memcpy(buf, &cuid, 4);
 791         memcpy(buf+4, &target_nt[0], 4);
 792         memcpy(buf+8, &target_ks[0], 4);
 793         memcpy(buf+12, &target_nt[1], 4);
 794         memcpy(buf+16, &target_ks[1], 4);
 795
 796         LED_B_ON();
 797         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 798         LED_B_OFF();
 799
 800         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 801
 802         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 803         LEDsoff();
 804         set_tracing(TRUE);
 805 }
 806
 807 //-----------------------------------------------------------------------------
 808 // MIFARE check keys. key count up to 85.
 809 //
 810 //-----------------------------------------------------------------------------
 811 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 812 {
 813   // params
 814         uint8_t blockNo = arg0;
 815         uint8_t keyType = arg1;
 816         uint8_t keyCount = arg2;
 817         uint64_t ui64Key = 0;
 818
 819         // variables
 820         int i;
 821         byte_t isOK = 0;
 822         uint8_t uid[10];
 823         uint32_t cuid;
 824         struct Crypto1State mpcs = {0, 0};
 825         struct Crypto1State *pcs;
 826         pcs = &mpcs;
 827
 828         // clear debug level
 829         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 830         MF_DBGLEVEL = MF_DBG_NONE;
 831
 832         // clear trace
 833         clear_trace();
 834         set_tracing(TRUE);
 835
 836         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 837
 838         LED_A_ON();
 839         LED_B_OFF();
 840         LED_C_OFF();
 841
 842         for (i = 0; i < keyCount; i++) {
 843                 if(mifare_classic_halt(pcs, cuid)) {
 844                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 845                 }
 846
 847                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 848                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 849                         break;
 850                 };
 851
 852                 ui64Key = bytes_to_num(datain + i * 6, 6);
 853                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 854                         continue;
 855                 };
 856
 857                 isOK = 1;
 858                 break;
 859         }
 860
 861         //  ----------------------------- crypto1 destroy
 862         crypto1_destroy(pcs);
 863
 864         LED_B_ON();
 865     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 866         LED_B_OFF();
 867
 868         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 869         LEDsoff();
 870
 871         // restore debug level
 872         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 873 }
 874
 875 //-----------------------------------------------------------------------------
 876 // MIFARE commands set debug level
 877 //
 878 //-----------------------------------------------------------------------------
 879 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 880         MF_DBGLEVEL = arg0;
 881         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 882 }
 883
 884 //-----------------------------------------------------------------------------
 885 // Work with emulator memory
 886 //
 887 //-----------------------------------------------------------------------------
 888 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 889         emlClearMem();
 890 }
 891
 892 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 893         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 894 }
 895
 896 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 897         byte_t buf[USB_CMD_DATA_SIZE];
 898         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 899
 900         LED_B_ON();
 901         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 902         LED_B_OFF();
 903 }
 904
 905 //-----------------------------------------------------------------------------
 906 // Load a card into the emulator memory
 907 //
 908 //-----------------------------------------------------------------------------
 909 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 910         uint8_t numSectors = arg0;
 911         uint8_t keyType = arg1;
 912         uint64_t ui64Key = 0;
 913         uint32_t cuid;
 914         struct Crypto1State mpcs = {0, 0};
 915         struct Crypto1State *pcs;
 916         pcs = &mpcs;
 917
 918         // variables
 919         byte_t dataoutbuf[16];
 920         byte_t dataoutbuf2[16];
 921         uint8_t uid[10];
 922
 923         // clear trace
 924         clear_trace();
 925         set_tracing(false);
 926
 927         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 928
 929         LED_A_ON();
 930         LED_B_OFF();
 931         LED_C_OFF();
 932
 933         bool isOK = true;
 934
 935         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 936                 isOK = false;
 937                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 938         }
 939
 940         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 941                 ui64Key = emlGetKey(sectorNo, keyType);
 942                 if (sectorNo == 0){
 943                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 944                                 isOK = false;
 945                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 946                                 break;
 947                         }
 948                 } else {
 949                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 950                                 isOK = false;
 951                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 952                                 break;
 953                         }
 954                 }
 955
 956                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 957                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 958                                 isOK = false;
 959                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 960                                 break;
 961                         };
 962                         if (isOK) {
 963                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 964                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 965                                 } else {        // sector trailer, keep the keys, set only the AC
 966                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 967                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 968                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 969                                 }
 970                         }
 971                 }
 972
 973         }
 974
 975         if(mifare_classic_halt(pcs, cuid)) {
 976                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 977         };
 978
 979         //  ----------------------------- crypto1 destroy
 980         crypto1_destroy(pcs);
 981
 982         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 983         LEDsoff();
 984
 985         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 986
 987 }
 988
 989
 990 //-----------------------------------------------------------------------------
 991 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 992 //
 993 //-----------------------------------------------------------------------------
 994 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 995
 996   // params
 997         uint8_t needWipe = arg0;
 998         // bit 0 - need get UID
 999         // bit 1 - need wupC
1000         // bit 2 - need HALT after sequence
1001         // bit 3 - need init FPGA and field before sequence
1002         // bit 4 - need reset FPGA and LED
1003         uint8_t workFlags = arg1;
1004         uint8_t blockNo = arg2;
1005
1006         // card commands
1007         uint8_t wupC1[]       = { 0x40 };
1008         uint8_t wupC2[]       = { 0x43 };
1009         uint8_t wipeC[]       = { 0x41 };
1010
1011         // variables
1012         byte_t isOK = 0;
1013         uint8_t uid[10] = {0x00};
1014         uint8_t d_block[18] = {0x00};
1015         uint32_t cuid;
1016
1017         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1018         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1019
1020         // reset FPGA and LED
1021         if (workFlags & 0x08) {
1022                 LED_A_ON();
1023                 LED_B_OFF();
1024                 LED_C_OFF();
1025
1026                 clear_trace();
1027                 set_tracing(TRUE);
1028                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1029         }
1030
1031         while (true) {
1032
1033                 // get UID from chip
1034                 if (workFlags & 0x01) {
1035                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
1036                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
1037                                 //break;
1038                         };
1039
1040                         if(mifare_classic_halt(NULL, cuid)) {
1041                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1042                                 //break;
1043                         };
1044                 };
1045
1046                 // reset chip
1047                 if (needWipe){
1048                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1049                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1050                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1051                                 break;
1052                         };
1053
1054                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
1055                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1056                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
1057                                 break;
1058                         };
1059
1060                         if(mifare_classic_halt(NULL, cuid)) {
1061                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1062                                 break;
1063                         };
1064                 };
1065
1066                 // write block
1067                 if (workFlags & 0x02) {
1068                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1069                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1070                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1071                                 break;
1072                         };
1073
1074                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1075                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1076                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1077                                 break;
1078                         };
1079                 }
1080
1081                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
1082                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
1083                         break;
1084                 };
1085
1086                 memcpy(d_block, datain, 16);
1087                 AppendCrc14443a(d_block, 16);
1088
1089                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1090                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1091                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1092                         break;
1093                 };
1094
1095                 if (workFlags & 0x04) {
1096                         if (mifare_classic_halt(NULL, cuid)) {
1097                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1098                                 break;
1099                         };
1100                 }
1101
1102                 isOK = 1;
1103                 break;
1104         }
1105
1106         LED_B_ON();
1107         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1108         LED_B_OFF();
1109
1110         if ((workFlags & 0x10) || (!isOK)) {
1111                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1112                 LEDsoff();
1113         }
1114 }
1115
1116
1117 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1118
1119   // params
1120         // bit 1 - need wupC
1121         // bit 2 - need HALT after sequence
1122         // bit 3 - need init FPGA and field before sequence
1123         // bit 4 - need reset FPGA and LED
1124         uint8_t workFlags = arg0;
1125         uint8_t blockNo = arg2;
1126
1127         // card commands
1128         uint8_t wupC1[]       = { 0x40 };
1129         uint8_t wupC2[]       = { 0x43 };
1130
1131         // variables
1132         byte_t isOK = 0;
1133         uint8_t data[18] = {0x00};
1134         uint32_t cuid = 0;
1135
1136         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1137         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1138
1139         if (workFlags & 0x08) {
1140                 LED_A_ON();
1141                 LED_B_OFF();
1142                 LED_C_OFF();
1143
1144                 clear_trace();
1145                 set_tracing(TRUE);
1146                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1147         }
1148
1149         while (true) {
1150                 if (workFlags & 0x02) {
1151                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1152                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1153                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1154                                 break;
1155                         };
1156
1157                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1158                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1159                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1160                                 break;
1161                         };
1162                 }
1163
1164                 // read block
1165                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1166                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1167                         break;
1168                 };
1169                 memcpy(data, receivedAnswer, 18);
1170
1171                 if (workFlags & 0x04) {
1172                         if (mifare_classic_halt(NULL, cuid)) {
1173                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1174                                 break;
1175                         };
1176                 }
1177
1178                 isOK = 1;
1179                 break;
1180         }
1181
1182         LED_B_ON();
1183         cmd_send(CMD_ACK,isOK,0,0,data,18);
1184         LED_B_OFF();
1185
1186         if ((workFlags & 0x10) || (!isOK)) {
1187                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1188                 LEDsoff();
1189         }
1190 }
1191
1192 void MifareCIdent(){
1193
1194         // card commands
1195         uint8_t wupC1[]       = { 0x40 };
1196         uint8_t wupC2[]       = { 0x43 };
1197
1198         // variables
1199         byte_t isOK = 1;
1200
1201         uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
1202         uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
1203
1204         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1205         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1206                 isOK = 0;
1207         };
1208
1209         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1210         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1211                 isOK = 0;
1212         };
1213
1214         if (mifare_classic_halt(NULL, 0)) {
1215                 isOK = 0;
1216         };
1217
1218         cmd_send(CMD_ACK,isOK,0,0,0,0);
1219 }
1220
1221 void MifareCollectNonces(uint32_t arg0, uint32_t arg1){
1222
1223         BigBuf_free();
1224
1225         uint32_t iterations = arg0;
1226         uint8_t uid[10] = {0x00};
1227
1228         uint8_t *response = BigBuf_malloc(MAX_MIFARE_FRAME_SIZE);
1229         uint8_t *responsePar = BigBuf_malloc(MAX_MIFARE_PARITY_SIZE);
1230
1231         uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
1232
1233         // get memory from BigBuf.
1234         uint8_t *nonces = BigBuf_malloc(iterations * 4);
1235
1236         LED_A_ON();
1237         LED_B_OFF();
1238         LED_C_OFF();
1239
1240         clear_trace();
1241         set_tracing(TRUE);
1242         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1243
1244         for (int i = 0; i < iterations; i++) {
1245
1246                 WDT_HIT();
1247
1248                 // Test if the action was cancelled
1249                 if(BUTTON_PRESS()) break;
1250
1251                 //              if(mifare_classic_halt(pcs, cuid)) {
1252                 //                      if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1253                 //}
1254
1255                 if(!iso14443a_select_card(uid, NULL, NULL)) {
1256                         if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
1257                         continue;
1258                 };
1259
1260                 // Transmit MIFARE_CLASSIC_AUTH.
1261                 ReaderTransmit(mf_auth, sizeof(mf_auth), NULL);
1262
1263                 // Receive the (4 Byte) "random" nonce
1264                 if (!ReaderReceive(response, responsePar)) {
1265                         if (MF_DBGLEVEL >= 1)   Dbprintf("Couldn't receive tag nonce");
1266                         continue;
1267                 }
1268
1269                 nonces[i*4] = bytes_to_num(response, 4);
1270         }
1271
1272         int packLen =  iterations * 4;
1273         int packSize = 0;
1274         int packNum = 0;
1275         while (packLen > 0) {
1276                 packSize = MIN(USB_CMD_DATA_SIZE, packLen);
1277                 LED_B_ON();
1278                 cmd_send(CMD_ACK, 77, 0, packSize, nonces - packLen, packSize);
1279                 LED_B_OFF();
1280
1281                 packLen -= packSize;
1282                 packNum++;
1283         }
1284
1285         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1286         LEDsoff();
1287 }
1288
1289 //
1290 // DESFIRE
1291 //
1292
1293 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1294
1295         byte_t dataout[11] = {0x00};
1296         uint8_t uid[10] = {0x00};
1297         uint32_t cuid = 0x00;
1298
1299         clear_trace();
1300         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1301
1302         int len = iso14443a_select_card(uid, NULL, &cuid);
1303         if(!len) {
1304                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
1305                 OnError(1);
1306                 return;
1307         };
1308
1309         if(mifare_desfire_des_auth1(cuid, dataout)){
1310                 if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
1311                 OnError(4);
1312                 return;
1313         }
1314
1315         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1316     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1317 }
1318
1319 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1320
1321         uint32_t cuid = arg0;
1322         uint8_t key[16] = {0x00};
1323         byte_t dataout[12] = {0x00};
1324         byte_t isOK = 0;
1325
1326         memcpy(key, datain, 16);
1327
1328         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1329
1330         if( isOK) {
1331             if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Authentication part2: Failed");
1332                 OnError(4);
1333                 return;
1334         }
1335
1336         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
1337
1338         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1339         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1340         LEDsoff();
1341 }