cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "desfire.h"
  20 #include "../common/crc.h"
  21
  22 //-----------------------------------------------------------------------------
  23 // Select, Authenticate, Read a MIFARE tag.
  24 // read block
  25 //-----------------------------------------------------------------------------
  26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  27 {
  28   // params
  29         uint8_t blockNo = arg0;
  30         uint8_t keyType = arg1;
  31         uint64_t ui64Key = 0;
  32         ui64Key = bytes_to_num(datain, 6);
  33
  34         // variables
  35         byte_t isOK = 0;
  36         byte_t dataoutbuf[16];
  37         uint8_t uid[10];
  38         uint32_t cuid;
  39         struct Crypto1State mpcs = {0, 0};
  40         struct Crypto1State *pcs;
  41         pcs = &mpcs;
  42
  43         // clear trace
  44         iso14a_clear_trace();
  45         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  46
  47         LED_A_ON();
  48         LED_B_OFF();
  49         LED_C_OFF();
  50
  51         while (true) {
  52                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  53                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  54                         break;
  55                 };
  56
  57                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  58                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  59                         break;
  60                 };
  61
  62                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  63                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  64                         break;
  65                 };
  66
  67                 if(mifare_classic_halt(pcs, cuid)) {
  68                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  69                         break;
  70                 };
  71
  72                 isOK = 1;
  73                 break;
  74         }
  75
  76         //  ----------------------------- crypto1 destroy
  77         crypto1_destroy(pcs);
  78
  79         if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
  80
  81         LED_B_ON();
  82         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  83         LED_B_OFF();
  84
  85         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  86         LEDsoff();
  87 }
  88
  89
  90 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  91
  92         byte_t isOK = 0;
  93         byte_t dataoutbuf[16] = {0x00};
  94         uint8_t uid[10] = {0x00};
  95         uint32_t cuid;
  96
  97         LED_A_ON();
  98         LED_B_OFF();
  99         LED_C_OFF();
 100
 101         iso14a_clear_trace();
 102         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 103
 104         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 105                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 106                         Dbprintf("Can't select card");
 107                 OnError(0);
 108                 return;
 109         };
 110
 111         if(mifare_ultra_auth1(cuid, dataoutbuf)){
 112                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 113                         Dbprintf("Authentication part1: Fail.");
 114                 OnError(1);
 115                 return;
 116         }
 117
 118         isOK = 1;
 119         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
 120                 DbpString("AUTH 1 FINISHED");
 121
 122     cmd_send(CMD_ACK,isOK,cuid,0,dataoutbuf,11);
 123         LEDsoff();
 124 }
 125 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 126
 127         uint32_t cuid = arg0;
 128         uint8_t key[16] = {0x00};
 129         byte_t isOK = 0;
 130         byte_t dataoutbuf[16] = {0x00};
 131
 132         memcpy(key, datain, 16);
 133
 134         LED_A_ON();
 135         LED_B_OFF();
 136         LED_C_OFF();
 137
 138         if(mifare_ultra_auth2(cuid, key, dataoutbuf)){
 139             if (MF_DBGLEVEL >= MF_DBG_ERROR)
 140                         Dbprintf("Authentication part2: Fail...");
 141                 OnError(1);
 142                 return;
 143         }
 144
 145         isOK = 1;
 146         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
 147                 DbpString("AUTH 2 FINISHED");
 148
 149         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);
 150         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 151         LEDsoff();
 152 }
 153
 154 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
 155 {
 156         uint8_t blockNo = arg0;
 157         byte_t dataout[16] = {0x00};
 158         uint8_t uid[10] = {0x00};
 159         uint32_t cuid;
 160
 161         LED_A_ON();
 162         LED_B_OFF();
 163         LED_C_OFF();
 164
 165         iso14a_clear_trace();
 166         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 167
 168         int len = iso14443a_select_card(uid, NULL, &cuid);
 169         if(!len) {
 170                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Can't select card");
 171                 OnError(1);
 172                 return;
 173         };
 174
 175         len = mifare_ultra_readblock(cuid, blockNo, dataout);
 176         if(len) {
 177                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Read block error");
 178                 OnError(2);
 179                 return;
 180         };
 181
 182         len = mifare_ultra_halt(cuid);
 183         if(len) {
 184                 if (MF_DBGLEVEL >= MF_DBG_ERROR)        Dbprintf("Halt error");
 185                 OnError(3);
 186                 return;
 187         };
 188
 189     cmd_send(CMD_ACK,1,0,0,dataout,16);
 190         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 191         LEDsoff();
 192 }
 193
 194 //-----------------------------------------------------------------------------
 195 // Select, Authenticate, Read a MIFARE tag.
 196 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 197 //-----------------------------------------------------------------------------
 198 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 199 {
 200   // params
 201         uint8_t sectorNo = arg0;
 202         uint8_t keyType = arg1;
 203         uint64_t ui64Key = 0;
 204         ui64Key = bytes_to_num(datain, 6);
 205
 206         // variables
 207         byte_t isOK = 0;
 208         byte_t dataoutbuf[16 * 16];
 209         uint8_t uid[10];
 210         uint32_t cuid;
 211         struct Crypto1State mpcs = {0, 0};
 212         struct Crypto1State *pcs;
 213         pcs = &mpcs;
 214
 215         // clear trace
 216         iso14a_clear_trace();
 217
 218         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 219
 220         LED_A_ON();
 221         LED_B_OFF();
 222         LED_C_OFF();
 223
 224         isOK = 1;
 225         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 226                 isOK = 0;
 227                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 228         }
 229
 230
 231         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 232                 isOK = 0;
 233                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 234         }
 235
 236         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 237                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 238                         isOK = 0;
 239                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 240                         break;
 241                 }
 242         }
 243
 244         if(mifare_classic_halt(pcs, cuid)) {
 245                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 246         }
 247
 248         //  ----------------------------- crypto1 destroy
 249         crypto1_destroy(pcs);
 250
 251         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 252
 253         LED_B_ON();
 254         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 255         LED_B_OFF();
 256
 257         // Thats it...
 258         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 259         LEDsoff();
 260 }
 261
 262 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 263 {
 264         // params
 265         uint8_t sectorNo = arg0;
 266         int Pages = arg1;
 267         int count_Pages = 0;
 268         byte_t dataout[176] = {0x00};;
 269         uint8_t uid[10] = {0x00};
 270         uint32_t cuid;
 271
 272         LED_A_ON();
 273         LED_B_OFF();
 274         LED_C_OFF();
 275
 276         if (MF_DBGLEVEL >= MF_DBG_ALL)
 277                 Dbprintf("Pages %d",Pages);
 278
 279         iso14a_clear_trace();
 280         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 281
 282         int len = iso14443a_select_card(uid, NULL, &cuid);
 283
 284         if (!len) {
 285                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 286                         Dbprintf("Can't select card");
 287                 OnError(1);
 288                 return;
 289         }
 290
 291         for (int i = 0; i < Pages; i++){
 292
 293                 len = mifare_ultra_readblock(cuid, sectorNo * 4 + i, dataout + 4 * i);
 294
 295                 if (len) {
 296                         if (MF_DBGLEVEL >= MF_DBG_ERROR)
 297                                 Dbprintf("Read block %d error",i);
 298                         OnError(2);
 299                         return;
 300                 } else {
 301                         count_Pages++;
 302                 }
 303         }
 304
 305         len = mifare_ultra_halt(cuid);
 306         if (len) {
 307                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 308                         Dbprintf("Halt error");
 309                 OnError(3);
 310                 return;
 311         }
 312
 313         if (MF_DBGLEVEL >= MF_DBG_ALL) {
 314                 Dbprintf("Pages read %d", count_Pages);
 315         }
 316
 317         len = 16*4; //64 bytes
 318
 319         // Read a UL-C
 320         if (Pages == 44 && count_Pages > 16)
 321                 len = 176;
 322
 323         cmd_send(CMD_ACK, 1, 0, 0, dataout, len);
 324         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 325         LEDsoff();
 326 }
 327
 328
 329 //-----------------------------------------------------------------------------
 330 // Select, Authenticate, Write a MIFARE tag.
 331 // read block
 332 //-----------------------------------------------------------------------------
 333 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 334 {
 335         // params
 336         uint8_t blockNo = arg0;
 337         uint8_t keyType = arg1;
 338         uint64_t ui64Key = 0;
 339         byte_t blockdata[16];
 340
 341         ui64Key = bytes_to_num(datain, 6);
 342         memcpy(blockdata, datain + 10, 16);
 343
 344         // variables
 345         byte_t isOK = 0;
 346         uint8_t uid[10];
 347         uint32_t cuid;
 348         struct Crypto1State mpcs = {0, 0};
 349         struct Crypto1State *pcs;
 350         pcs = &mpcs;
 351
 352         // clear trace
 353         iso14a_clear_trace();
 354
 355         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 356
 357         LED_A_ON();
 358         LED_B_OFF();
 359         LED_C_OFF();
 360
 361         while (true) {
 362                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 363                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 364                         break;
 365                 };
 366
 367                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 368                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 369                         break;
 370                 };
 371
 372                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 373                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 374                         break;
 375                 };
 376
 377                 if(mifare_classic_halt(pcs, cuid)) {
 378                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 379                         break;
 380                 };
 381
 382                 isOK = 1;
 383                 break;
 384         }
 385
 386         //  ----------------------------- crypto1 destroy
 387         crypto1_destroy(pcs);
 388
 389         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 390
 391         LED_B_ON();
 392         cmd_send(CMD_ACK,isOK,0,0,0,0);
 393         LED_B_OFF();
 394
 395
 396         // Thats it...
 397         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 398         LEDsoff();
 399 }
 400
 401 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 402 {
 403         // params
 404         uint8_t blockNo = arg0;
 405         byte_t blockdata[16] = {0x00};
 406
 407         memcpy(blockdata, datain, 16);
 408
 409         // variables
 410         byte_t isOK = 0;
 411         uint8_t uid[10] = {0x00};
 412         uint32_t cuid;
 413
 414         iso14a_clear_trace();
 415         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 416
 417         LED_A_ON();
 418         LED_B_OFF();
 419         LED_C_OFF();
 420
 421         while (true) {
 422                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 423                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 424                                 break;
 425                 };
 426
 427                 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
 428                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 429                                 break;
 430                 };
 431
 432                 if(mifare_ultra_halt(cuid)) {
 433                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 434                                 break;
 435                 };
 436
 437                 isOK = 1;
 438                 break;
 439         }
 440
 441         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 442
 443         cmd_send(CMD_ACK,isOK,0,0,0,0);
 444         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 445         LEDsoff();
 446 }
 447
 448 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 449 {
 450         // params
 451         uint8_t blockNo = arg0;
 452         byte_t blockdata[4] = {0x00};
 453
 454         memcpy(blockdata, datain,4);
 455
 456         // variables
 457         byte_t isOK = 0;
 458         uint8_t uid[10] = {0x00};
 459         uint32_t cuid;
 460
 461         iso14a_clear_trace();
 462         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 463
 464         LED_A_ON();
 465         LED_B_OFF();
 466         LED_C_OFF();
 467
 468         while (true) {
 469                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 470                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 471                         break;
 472                 };
 473
 474                 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
 475                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 476                         break;
 477                 };
 478
 479                 if(mifare_ultra_halt(cuid)) {
 480                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 481                         break;
 482                 };
 483
 484                 isOK = 1;
 485                 break;
 486         }
 487
 488         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 489
 490         cmd_send(CMD_ACK,isOK,0,0,0,0);
 491         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 492         LEDsoff();
 493 }
 494
 495 // Return 1 if the nonce is invalid else return 0
 496 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t * parity) {
 497         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 498         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 499         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 500 }
 501
 502
 503 //-----------------------------------------------------------------------------
 504 // MIFARE nested authentication.
 505 //
 506 //-----------------------------------------------------------------------------
 507 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 508 {
 509         // params
 510         uint8_t blockNo = arg0 & 0xff;
 511         uint8_t keyType = (arg0 >> 8) & 0xff;
 512         uint8_t targetBlockNo = arg1 & 0xff;
 513         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 514         uint64_t ui64Key = 0;
 515
 516         ui64Key = bytes_to_num(datain, 6);
 517
 518         // variables
 519         uint16_t rtr, i, j, len;
 520         uint16_t davg;
 521         static uint16_t dmin, dmax;
 522         uint8_t uid[10];
 523         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 524         uint8_t par[1];
 525         uint32_t target_nt[2], target_ks[2];
 526
 527         uint8_t par_array[4];
 528         uint16_t ncount = 0;
 529         struct Crypto1State mpcs = {0, 0};
 530         struct Crypto1State *pcs;
 531         pcs = &mpcs;
 532         uint8_t* receivedAnswer =  get_bigbufptr_recvrespbuf();
 533
 534         uint32_t auth1_time, auth2_time;
 535         static uint16_t delta_time;
 536
 537         // clear trace
 538         iso14a_clear_trace();
 539         iso14a_set_tracing(false);
 540
 541         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 542
 543         LED_A_ON();
 544         LED_C_OFF();
 545
 546
 547         // statistics on nonce distance
 548         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 549                 LED_B_ON();
 550                 WDT_HIT();
 551
 552                 davg = dmax = 0;
 553                 dmin = 2000;
 554                 delta_time = 0;
 555
 556                 for (rtr = 0; rtr < 17; rtr++) {
 557
 558                         // prepare next select. No need to power down the card.
 559                         if(mifare_classic_halt(pcs, cuid)) {
 560                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 561                                 rtr--;
 562                                 continue;
 563                         }
 564
 565                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 566                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 567                                 rtr--;
 568                                 continue;
 569                         };
 570
 571                         auth1_time = 0;
 572                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 573                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 574                                 rtr--;
 575                                 continue;
 576                         };
 577
 578                         if (delta_time) {
 579                                 auth2_time = auth1_time + delta_time;
 580                         } else {
 581                                 auth2_time = 0;
 582                         }
 583                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 584                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 585                                 rtr--;
 586                                 continue;
 587                         };
 588
 589                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 590                         for (i = 101; i < 1200; i++) {
 591                                 nttmp = prng_successor(nttmp, 1);
 592                                 if (nttmp == nt2) break;
 593                         }
 594
 595                         if (i != 1200) {
 596                                 if (rtr != 0) {
 597                                         davg += i;
 598                                         dmin = MIN(dmin, i);
 599                                         dmax = MAX(dmax, i);
 600                                 }
 601                                 else {
 602                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 603                                 }
 604                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 605                         }
 606                 }
 607
 608                 if (rtr <= 1) return;
 609
 610                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 611
 612                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 613
 614                 dmin = davg - 2;
 615                 dmax = davg + 2;
 616
 617                 LED_B_OFF();
 618
 619         }
 620 //  -------------------------------------------------------------------------------------------------
 621
 622         LED_C_ON();
 623
 624         //  get crypted nonces for target sector
 625         for(i=0; i < 2; i++) { // look for exactly two different nonces
 626
 627                 WDT_HIT();
 628             if(BUTTON_PRESS()) {
 629                         DbpString("Nested: cancelled");
 630                         crypto1_destroy(pcs);
 631                         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 632                         LEDsoff();
 633                         return;
 634                 }
 635
 636                 target_nt[i] = 0;
 637                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 638
 639                         // prepare next select. No need to power down the card.
 640                         if(mifare_classic_halt(pcs, cuid)) {
 641                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 642                                 continue;
 643                         }
 644
 645                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 646                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 647                                 continue;
 648                         };
 649
 650                         auth1_time = 0;
 651                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 652                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 653                                 continue;
 654                         };
 655
 656                         // nested authentication
 657                         auth2_time = auth1_time + delta_time;
 658                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 659                         if (len != 4) {
 660                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 661                                 continue;
 662                         };
 663
 664                         nt2 = bytes_to_num(receivedAnswer, 4);
 665                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 666
 667                         // Parity validity check
 668                         for (j = 0; j < 4; j++) {
 669                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 670                         }
 671
 672                         ncount = 0;
 673                         nttest = prng_successor(nt1, dmin - 1);
 674                         for (j = dmin; j < dmax + 1; j++) {
 675                                 nttest = prng_successor(nttest, 1);
 676                                 ks1 = nt2 ^ nttest;
 677
 678                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 679                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 680                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 681                                                 target_nt[i] = 0;
 682                                                 break;
 683                                         }
 684                                         target_nt[i] = nttest;
 685                                         target_ks[i] = ks1;
 686                                         ncount++;
 687                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 688                                                 target_nt[i] = 0;
 689                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 690                                                 break;
 691                                         }
 692                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 693                                 }
 694                         }
 695                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 696                 }
 697         }
 698
 699         LED_C_OFF();
 700
 701         //  ----------------------------- crypto1 destroy
 702         crypto1_destroy(pcs);
 703
 704         byte_t buf[4 + 4 * 4];
 705         memcpy(buf, &cuid, 4);
 706         memcpy(buf+4, &target_nt[0], 4);
 707         memcpy(buf+8, &target_ks[0], 4);
 708         memcpy(buf+12, &target_nt[1], 4);
 709         memcpy(buf+16, &target_ks[1], 4);
 710
 711         LED_B_ON();
 712         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 713         LED_B_OFF();
 714
 715         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 716
 717         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 718         LEDsoff();
 719         iso14a_set_tracing(TRUE);
 720 }
 721
 722 //-----------------------------------------------------------------------------
 723 // MIFARE check keys. key count up to 85.
 724 //
 725 //-----------------------------------------------------------------------------
 726 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 727 {
 728   // params
 729         uint8_t blockNo = arg0;
 730         uint8_t keyType = arg1;
 731         uint8_t keyCount = arg2;
 732         uint64_t ui64Key = 0;
 733
 734         // variables
 735         int i;
 736         byte_t isOK = 0;
 737         uint8_t uid[10];
 738         uint32_t cuid;
 739         struct Crypto1State mpcs = {0, 0};
 740         struct Crypto1State *pcs;
 741         pcs = &mpcs;
 742
 743         // clear debug level
 744         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 745         MF_DBGLEVEL = MF_DBG_NONE;
 746
 747         // clear trace
 748         iso14a_clear_trace();
 749         iso14a_set_tracing(TRUE);
 750
 751         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 752
 753         LED_A_ON();
 754         LED_B_OFF();
 755         LED_C_OFF();
 756
 757         for (i = 0; i < keyCount; i++) {
 758                 if(mifare_classic_halt(pcs, cuid)) {
 759                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 760                 }
 761
 762                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 763                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 764                         break;
 765                 };
 766
 767                 ui64Key = bytes_to_num(datain + i * 6, 6);
 768                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 769                         continue;
 770                 };
 771
 772                 isOK = 1;
 773                 break;
 774         }
 775
 776         //  ----------------------------- crypto1 destroy
 777         crypto1_destroy(pcs);
 778
 779         LED_B_ON();
 780     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 781         LED_B_OFF();
 782
 783         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 784         LEDsoff();
 785
 786         // restore debug level
 787         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 788 }
 789
 790 //-----------------------------------------------------------------------------
 791 // MIFARE commands set debug level
 792 //
 793 //-----------------------------------------------------------------------------
 794 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 795         MF_DBGLEVEL = arg0;
 796         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 797 }
 798
 799 //-----------------------------------------------------------------------------
 800 // Work with emulator memory
 801 //
 802 //-----------------------------------------------------------------------------
 803 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 804         emlClearMem();
 805 }
 806
 807 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 808         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 809 }
 810
 811 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 812         byte_t buf[USB_CMD_DATA_SIZE];
 813         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 814
 815         LED_B_ON();
 816         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 817         LED_B_OFF();
 818 }
 819
 820 //-----------------------------------------------------------------------------
 821 // Load a card into the emulator memory
 822 //
 823 //-----------------------------------------------------------------------------
 824 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 825         uint8_t numSectors = arg0;
 826         uint8_t keyType = arg1;
 827         uint64_t ui64Key = 0;
 828         uint32_t cuid;
 829         struct Crypto1State mpcs = {0, 0};
 830         struct Crypto1State *pcs;
 831         pcs = &mpcs;
 832
 833         // variables
 834         byte_t dataoutbuf[16];
 835         byte_t dataoutbuf2[16];
 836         uint8_t uid[10];
 837
 838         // clear trace
 839         iso14a_clear_trace();
 840         iso14a_set_tracing(false);
 841
 842         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 843
 844         LED_A_ON();
 845         LED_B_OFF();
 846         LED_C_OFF();
 847
 848         bool isOK = true;
 849
 850         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 851                 isOK = false;
 852                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 853         }
 854
 855         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 856                 ui64Key = emlGetKey(sectorNo, keyType);
 857                 if (sectorNo == 0){
 858                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 859                                 isOK = false;
 860                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 861                                 break;
 862                         }
 863                 } else {
 864                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 865                                 isOK = false;
 866                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 867                                 break;
 868                         }
 869                 }
 870
 871                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 872                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 873                                 isOK = false;
 874                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 875                                 break;
 876                         };
 877                         if (isOK) {
 878                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 879                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 880                                 } else {        // sector trailer, keep the keys, set only the AC
 881                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 882                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 883                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 884                                 }
 885                         }
 886                 }
 887
 888         }
 889
 890         if(mifare_classic_halt(pcs, cuid)) {
 891                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 892         };
 893
 894         //  ----------------------------- crypto1 destroy
 895         crypto1_destroy(pcs);
 896
 897         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 898         LEDsoff();
 899
 900         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 901
 902 }
 903
 904
 905 //-----------------------------------------------------------------------------
 906 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 907 //
 908 //-----------------------------------------------------------------------------
 909 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 910
 911   // params
 912         uint8_t needWipe = arg0;
 913         // bit 0 - need get UID
 914         // bit 1 - need wupC
 915         // bit 2 - need HALT after sequence
 916         // bit 3 - need init FPGA and field before sequence
 917         // bit 4 - need reset FPGA and LED
 918         uint8_t workFlags = arg1;
 919         uint8_t blockNo = arg2;
 920
 921         // card commands
 922         uint8_t wupC1[]       = { 0x40 };
 923         uint8_t wupC2[]       = { 0x43 };
 924         uint8_t wipeC[]       = { 0x41 };
 925
 926         // variables
 927         byte_t isOK = 0;
 928         uint8_t uid[10] = {0x00};
 929         uint8_t d_block[18] = {0x00};
 930         uint32_t cuid;
 931
 932         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
 933         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
 934
 935         // reset FPGA and LED
 936         if (workFlags & 0x08) {
 937                 LED_A_ON();
 938                 LED_B_OFF();
 939                 LED_C_OFF();
 940
 941                 iso14a_clear_trace();
 942                 iso14a_set_tracing(TRUE);
 943                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 944         }
 945
 946         while (true) {
 947
 948                 // get UID from chip
 949                 if (workFlags & 0x01) {
 950                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 951                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 952                                 break;
 953                         };
 954
 955                         if(mifare_classic_halt(NULL, cuid)) {
 956                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 957                                 break;
 958                         };
 959                 };
 960
 961                 // reset chip
 962                 if (needWipe){
 963                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 964                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 965                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 966                                 break;
 967                         };
 968
 969                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
 970                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 971                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
 972                                 break;
 973                         };
 974
 975                         if(mifare_classic_halt(NULL, cuid)) {
 976                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 977                                 break;
 978                         };
 979                 };
 980
 981                 // write block
 982                 if (workFlags & 0x02) {
 983                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 984                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 985                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 986                                 break;
 987                         };
 988
 989                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
 990                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 991                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
 992                                 break;
 993                         };
 994                 }
 995
 996                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
 997                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
 998                         break;
 999                 };
1000
1001                 memcpy(d_block, datain, 16);
1002                 AppendCrc14443a(d_block, 16);
1003
1004                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1005                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1006                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1007                         break;
1008                 };
1009
1010                 if (workFlags & 0x04) {
1011                         if (mifare_classic_halt(NULL, cuid)) {
1012                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1013                                 break;
1014                         };
1015                 }
1016
1017                 isOK = 1;
1018                 break;
1019         }
1020
1021         LED_B_ON();
1022         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1023         LED_B_OFF();
1024
1025         if ((workFlags & 0x10) || (!isOK)) {
1026                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1027                 LEDsoff();
1028         }
1029 }
1030
1031
1032 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1033
1034   // params
1035         // bit 1 - need wupC
1036         // bit 2 - need HALT after sequence
1037         // bit 3 - need init FPGA and field before sequence
1038         // bit 4 - need reset FPGA and LED
1039         uint8_t workFlags = arg0;
1040         uint8_t blockNo = arg2;
1041
1042         // card commands
1043         uint8_t wupC1[]       = { 0x40 };
1044         uint8_t wupC2[]       = { 0x43 };
1045
1046         // variables
1047         byte_t isOK = 0;
1048         uint8_t data[18] = {0x00};
1049         uint32_t cuid = 0;
1050
1051         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1052         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1053
1054         if (workFlags & 0x08) {
1055                 LED_A_ON();
1056                 LED_B_OFF();
1057                 LED_C_OFF();
1058
1059                 iso14a_clear_trace();
1060                 iso14a_set_tracing(TRUE);
1061                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1062         }
1063
1064         while (true) {
1065                 if (workFlags & 0x02) {
1066                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1067                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1068                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1069                                 break;
1070                         };
1071
1072                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1073                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1074                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1075                                 break;
1076                         };
1077                 }
1078
1079                 // read block
1080                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1081                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1082                         break;
1083                 };
1084                 memcpy(data, receivedAnswer, 18);
1085
1086                 if (workFlags & 0x04) {
1087                         if (mifare_classic_halt(NULL, cuid)) {
1088                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1089                                 break;
1090                         };
1091                 }
1092
1093                 isOK = 1;
1094                 break;
1095         }
1096
1097         LED_B_ON();
1098         cmd_send(CMD_ACK,isOK,0,0,data,18);
1099         LED_B_OFF();
1100
1101         if ((workFlags & 0x10) || (!isOK)) {
1102                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1103                 LEDsoff();
1104         }
1105 }
1106
1107 void MifareCIdent(){
1108
1109         // card commands
1110         uint8_t wupC1[]       = { 0x40 };
1111         uint8_t wupC2[]       = { 0x43 };
1112
1113         // variables
1114         byte_t isOK = 1;
1115
1116         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1117         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1118
1119         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1120         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1121                 isOK = 0;
1122         };
1123
1124         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1125         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1126                 isOK = 0;
1127         };
1128
1129         if (mifare_classic_halt(NULL, 0)) {
1130                 isOK = 0;
1131         };
1132
1133         cmd_send(CMD_ACK,isOK,0,0,0,0);
1134 }
1135
1136 //
1137 // DESFIRE
1138 //
1139
1140 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1141
1142         byte_t dataout[11] = {0x00};
1143         uint8_t uid[10] = {0x00};
1144         uint32_t cuid;
1145
1146         iso14a_clear_trace();
1147         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1148
1149         int len = iso14443a_select_card(uid, NULL, &cuid);
1150         if(!len) {
1151                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1152                         Dbprintf("Can't select card");
1153                 OnError(1);
1154                 return;
1155         };
1156
1157         if(mifare_desfire_des_auth1(cuid, dataout)){
1158                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
1159                         Dbprintf("Authentication part1: Fail.");
1160                 OnError(4);
1161                 return;
1162         }
1163
1164         if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
1165
1166     cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
1167 }
1168
1169 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1170
1171         uint32_t cuid = arg0;
1172         uint8_t key[16] = {0x00};
1173         byte_t isOK = 0;
1174         byte_t dataout[12] = {0x00};
1175
1176         memcpy(key, datain, 16);
1177
1178         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1179
1180         if( isOK) {
1181             if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1182                         Dbprintf("Authentication part2: Failed");
1183                 OnError(4);
1184                 return;
1185         }
1186
1187         if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
1188                 DbpString("AUTH 2 FINISHED");
1189
1190         cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout));
1191         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1192         LEDsoff();
1193 }