cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - June 2011, 2012
   3 // Gerhard de Koning Gans - May 2008
   4 // Hagen Fritsch - June 2010
   5 // Midnitesnake - Dec 2013
   6 // Andy Davies  - Apr 2014
   7 // Iceman - May 2014
   8 //
   9 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
  10 // at your option, any later version. See the LICENSE.txt file for the text of
  11 // the license.
  12 //-----------------------------------------------------------------------------
  13 // Routines to support ISO 14443 type A.
  14 //-----------------------------------------------------------------------------
  15
  16 #include "mifarecmd.h"
  17 #include "apps.h"
  18 #include "util.h"
  19 #include "desfire.h"
  20 #include "../common/crc.h"
  21
  22 //-----------------------------------------------------------------------------
  23 // Select, Authenticate, Read a MIFARE tag.
  24 // read block
  25 //-----------------------------------------------------------------------------
  26 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
  27 {
  28   // params
  29         uint8_t blockNo = arg0;
  30         uint8_t keyType = arg1;
  31         uint64_t ui64Key = 0;
  32         ui64Key = bytes_to_num(datain, 6);
  33
  34         // variables
  35         byte_t isOK = 0;
  36         byte_t dataoutbuf[16];
  37         uint8_t uid[10];
  38         uint32_t cuid;
  39         struct Crypto1State mpcs = {0, 0};
  40         struct Crypto1State *pcs;
  41         pcs = &mpcs;
  42
  43         // clear trace
  44         iso14a_clear_trace();
  45         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
  46
  47         LED_A_ON();
  48         LED_B_OFF();
  49         LED_C_OFF();
  50
  51         while (true) {
  52                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
  53                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
  54                         break;
  55                 };
  56
  57                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
  58                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
  59                         break;
  60                 };
  61
  62                 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
  63                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read block error");
  64                         break;
  65                 };
  66
  67                 if(mifare_classic_halt(pcs, cuid)) {
  68                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
  69                         break;
  70                 };
  71
  72                 isOK = 1;
  73                 break;
  74         }
  75
  76         //  ----------------------------- crypto1 destroy
  77         crypto1_destroy(pcs);
  78
  79         if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
  80
  81         LED_B_ON();
  82         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
  83         LED_B_OFF();
  84
  85         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
  86         LEDsoff();
  87 }
  88
  89
  90 void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
  91         // variables
  92         byte_t isOK = 0;
  93         byte_t dataoutbuf[16] = {0x00};
  94         uint8_t uid[10] = {0x00};
  95         uint32_t cuid;
  96
  97         // clear trace
  98         iso14a_clear_trace();
  99         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 100
 101         LED_A_ON();
 102         LED_B_OFF();
 103         LED_C_OFF();
 104
 105
 106         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 107           if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card, something went wrong before auth");
 108         };
 109
 110         if(mifare_ultra_auth1(cuid, dataoutbuf)){
 111           if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part1: Fail.");
 112         }
 113
 114         isOK=1;
 115         if (MF_DBGLEVEL >= 2)   DbpString("AUTH 1 FINISHED");
 116
 117         LED_B_ON();
 118     cmd_send(CMD_ACK,isOK,cuid,0,dataoutbuf,11);
 119
 120         LEDsoff();
 121 }
 122 void MifareUC_Auth2(uint32_t arg0, uint8_t *datain){
 123
 124         uint32_t cuid = arg0;
 125         uint8_t key[16] = {0x00};
 126         byte_t isOK = 0;
 127         byte_t dataoutbuf[16] = {0x00};
 128
 129         memcpy(key, datain, 16);
 130
 131         LED_A_ON();
 132         LED_B_OFF();
 133         LED_C_OFF();
 134
 135         if(mifare_ultra_auth2(cuid, key, dataoutbuf)){
 136             if (MF_DBGLEVEL >= 1) Dbprintf("Authentication part2: Fail...");
 137         }
 138         isOK = 1;
 139         if (MF_DBGLEVEL >= 2)   DbpString("AUTH 2 FINISHED");
 140
 141         LED_B_ON();
 142         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,11);
 143         LED_B_OFF();
 144
 145         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 146         LEDsoff();
 147 }
 148
 149 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
 150 {
 151     // params
 152         uint8_t blockNo = arg0;
 153
 154         // variables
 155         byte_t isOK = 0;
 156         byte_t dataoutbuf[16] = {0x00};
 157         uint8_t uid[10] = {0x00};
 158         uint32_t cuid;
 159
 160         // clear trace
 161         iso14a_clear_trace();
 162         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 163
 164         LED_A_ON();
 165         LED_B_OFF();
 166         LED_C_OFF();
 167
 168         while (true) {
 169                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 170             if (MF_DBGLEVEL >= 1)       Dbprintf("Can't select card");
 171                         break;
 172                 };
 173
 174                 if(mifare_ultra_readblock(cuid, blockNo, dataoutbuf)) {
 175             if (MF_DBGLEVEL >= 1)       Dbprintf("Read block error");
 176                         break;
 177                 };
 178
 179                 if(mifare_ultra_halt(cuid)) {
 180             if (MF_DBGLEVEL >= 1)       Dbprintf("Halt error");
 181                         break;
 182                 };
 183
 184                 isOK = 1;
 185                 break;
 186         }
 187
 188         if (MF_DBGLEVEL >= 2)   DbpString("READ BLOCK FINISHED");
 189
 190         LED_B_ON();
 191     cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
 192         LED_B_OFF();
 193         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 194         LEDsoff();
 195 }
 196
 197 //-----------------------------------------------------------------------------
 198 // Select, Authenticate, Read a MIFARE tag.
 199 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 200 //-----------------------------------------------------------------------------
 201 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 202 {
 203   // params
 204         uint8_t sectorNo = arg0;
 205         uint8_t keyType = arg1;
 206         uint64_t ui64Key = 0;
 207         ui64Key = bytes_to_num(datain, 6);
 208
 209         // variables
 210         byte_t isOK = 0;
 211         byte_t dataoutbuf[16 * 16];
 212         uint8_t uid[10];
 213         uint32_t cuid;
 214         struct Crypto1State mpcs = {0, 0};
 215         struct Crypto1State *pcs;
 216         pcs = &mpcs;
 217
 218         // clear trace
 219         iso14a_clear_trace();
 220
 221         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 222
 223         LED_A_ON();
 224         LED_B_OFF();
 225         LED_C_OFF();
 226
 227         isOK = 1;
 228         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 229                 isOK = 0;
 230                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 231         }
 232
 233
 234         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 235                 isOK = 0;
 236                 if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 237         }
 238
 239         for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 240                 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
 241                         isOK = 0;
 242                         if (MF_DBGLEVEL >= 1)   Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 243                         break;
 244                 }
 245         }
 246
 247         if(mifare_classic_halt(pcs, cuid)) {
 248                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 249         }
 250
 251         //  ----------------------------- crypto1 destroy
 252         crypto1_destroy(pcs);
 253
 254         if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 255
 256         LED_B_ON();
 257         cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
 258         LED_B_OFF();
 259
 260         // Thats it...
 261         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 262         LEDsoff();
 263 }
 264
 265 void MifareUReadCard(uint8_t arg0, int arg1, uint8_t *datain)
 266 {
 267         // params
 268         uint8_t sectorNo = arg0;
 269         int Pages = arg1;
 270         int count_Pages = 0;
 271         byte_t dataoutbuf[176] = {0x00};;
 272         uint8_t uid[10] = {0x00};
 273         uint32_t cuid;
 274
 275         iso14a_clear_trace();
 276         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 277
 278         LED_A_ON();
 279         LED_B_OFF();
 280         LED_C_OFF();
 281
 282         if (MF_DBGLEVEL >= MF_DBG_ALL)
 283                 Dbprintf("Pages %d",Pages);
 284
 285         if (!iso14443a_select_card(uid, NULL, &cuid)) {
 286                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 287                         Dbprintf("Can't select card");
 288                 OnError();
 289                 return;
 290         }
 291
 292         for (int i = 0; i < Pages; i++){
 293                 if (mifare_ultra_readblock(cuid, sectorNo * 4 + i, dataoutbuf + 4 * i)) {
 294                         if (MF_DBGLEVEL >= MF_DBG_ERROR)
 295                                 Dbprintf("Read block %d error",i);
 296                         OnError();
 297                         return;
 298                 } else {
 299                         count_Pages++;
 300                 }
 301         }
 302
 303         if (mifare_ultra_halt(cuid)) {
 304                 if (MF_DBGLEVEL >= MF_DBG_ERROR)
 305                         Dbprintf("Halt error");
 306                 OnError();
 307                 return;
 308         }
 309
 310         if (MF_DBGLEVEL >= MF_DBG_ALL) {
 311                 Dbprintf("Pages read %d",count_Pages);
 312                 DbpString("Read card finished");
 313         }
 314
 315         int len = 16*4; //64 bytes
 316
 317         // Read a UL-C
 318         if (Pages == 44 && count_Pages > 16)
 319                 len = 176;
 320
 321         cmd_send(CMD_ACK, 1, 0, 0, dataoutbuf, len);
 322
 323         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 324         LEDsoff();
 325 }
 326
 327
 328 //-----------------------------------------------------------------------------
 329 // Select, Authenticate, Write a MIFARE tag.
 330 // read block
 331 //-----------------------------------------------------------------------------
 332 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 333 {
 334         // params
 335         uint8_t blockNo = arg0;
 336         uint8_t keyType = arg1;
 337         uint64_t ui64Key = 0;
 338         byte_t blockdata[16];
 339
 340         ui64Key = bytes_to_num(datain, 6);
 341         memcpy(blockdata, datain + 10, 16);
 342
 343         // variables
 344         byte_t isOK = 0;
 345         uint8_t uid[10];
 346         uint32_t cuid;
 347         struct Crypto1State mpcs = {0, 0};
 348         struct Crypto1State *pcs;
 349         pcs = &mpcs;
 350
 351         // clear trace
 352         iso14a_clear_trace();
 353
 354         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 355
 356         LED_A_ON();
 357         LED_B_OFF();
 358         LED_C_OFF();
 359
 360         while (true) {
 361                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 362                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 363                         break;
 364                 };
 365
 366                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 367                         if (MF_DBGLEVEL >= 1)   Dbprintf("Auth error");
 368                         break;
 369                 };
 370
 371                 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
 372                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 373                         break;
 374                 };
 375
 376                 if(mifare_classic_halt(pcs, cuid)) {
 377                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 378                         break;
 379                 };
 380
 381                 isOK = 1;
 382                 break;
 383         }
 384
 385         //  ----------------------------- crypto1 destroy
 386         crypto1_destroy(pcs);
 387
 388         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 389
 390         LED_B_ON();
 391         cmd_send(CMD_ACK,isOK,0,0,0,0);
 392         LED_B_OFF();
 393
 394
 395         // Thats it...
 396         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 397         LEDsoff();
 398 }
 399
 400 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 401 {
 402         // params
 403         uint8_t blockNo = arg0;
 404         byte_t blockdata[16] = {0x00};
 405
 406         memcpy(blockdata, datain, 16);
 407
 408         // variables
 409         byte_t isOK = 0;
 410         uint8_t uid[10] = {0x00};
 411         uint32_t cuid;
 412
 413         iso14a_clear_trace();
 414         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 415
 416         LED_A_ON();
 417         LED_B_OFF();
 418         LED_C_OFF();
 419
 420         while (true) {
 421                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 422                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 423                                 break;
 424                 };
 425
 426                 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
 427                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 428                                 break;
 429                 };
 430
 431                 if(mifare_ultra_halt(cuid)) {
 432                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 433                                 break;
 434                 };
 435
 436                 isOK = 1;
 437                 break;
 438         }
 439
 440         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 441
 442         cmd_send(CMD_ACK,isOK,0,0,0,0);
 443         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 444         LEDsoff();
 445 }
 446
 447 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 448 {
 449         // params
 450         uint8_t blockNo = arg0;
 451         byte_t blockdata[4] = {0x00};
 452
 453         memcpy(blockdata, datain,4);
 454
 455         // variables
 456         byte_t isOK = 0;
 457         uint8_t uid[10] = {0x00};
 458         uint32_t cuid;
 459
 460         iso14a_clear_trace();
 461         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 462
 463         LED_A_ON();
 464         LED_B_OFF();
 465         LED_C_OFF();
 466
 467         while (true) {
 468                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 469                         if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 470                         break;
 471                 };
 472
 473                 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
 474                         if (MF_DBGLEVEL >= 1)   Dbprintf("Write block error");
 475                         break;
 476                 };
 477
 478                 if(mifare_ultra_halt(cuid)) {
 479                         if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 480                         break;
 481                 };
 482
 483                 isOK = 1;
 484                 break;
 485         }
 486
 487         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 488
 489         cmd_send(CMD_ACK,isOK,0,0,0,0);
 490         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 491         LEDsoff();
 492 }
 493
 494 // Return 1 if the nonce is invalid else return 0
 495 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t * parity) {
 496         return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
 497         (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
 498         (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
 499 }
 500
 501
 502 //-----------------------------------------------------------------------------
 503 // MIFARE nested authentication.
 504 //
 505 //-----------------------------------------------------------------------------
 506 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
 507 {
 508         // params
 509         uint8_t blockNo = arg0 & 0xff;
 510         uint8_t keyType = (arg0 >> 8) & 0xff;
 511         uint8_t targetBlockNo = arg1 & 0xff;
 512         uint8_t targetKeyType = (arg1 >> 8) & 0xff;
 513         uint64_t ui64Key = 0;
 514
 515         ui64Key = bytes_to_num(datain, 6);
 516
 517         // variables
 518         uint16_t rtr, i, j, len;
 519         uint16_t davg;
 520         static uint16_t dmin, dmax;
 521         uint8_t uid[10];
 522         uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
 523         uint8_t par[1];
 524         uint32_t target_nt[2], target_ks[2];
 525
 526         uint8_t par_array[4];
 527         uint16_t ncount = 0;
 528         struct Crypto1State mpcs = {0, 0};
 529         struct Crypto1State *pcs;
 530         pcs = &mpcs;
 531         uint8_t* receivedAnswer =  get_bigbufptr_recvrespbuf();
 532
 533         uint32_t auth1_time, auth2_time;
 534         static uint16_t delta_time;
 535
 536         // clear trace
 537         iso14a_clear_trace();
 538         iso14a_set_tracing(false);
 539
 540         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 541
 542         LED_A_ON();
 543         LED_C_OFF();
 544
 545
 546         // statistics on nonce distance
 547         if (calibrate) {        // for first call only. Otherwise reuse previous calibration
 548                 LED_B_ON();
 549                 WDT_HIT();
 550
 551                 davg = dmax = 0;
 552                 dmin = 2000;
 553                 delta_time = 0;
 554
 555                 for (rtr = 0; rtr < 17; rtr++) {
 556
 557                         // prepare next select. No need to power down the card.
 558                         if(mifare_classic_halt(pcs, cuid)) {
 559                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 560                                 rtr--;
 561                                 continue;
 562                         }
 563
 564                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 565                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 566                                 rtr--;
 567                                 continue;
 568                         };
 569
 570                         auth1_time = 0;
 571                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 572                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 573                                 rtr--;
 574                                 continue;
 575                         };
 576
 577                         if (delta_time) {
 578                                 auth2_time = auth1_time + delta_time;
 579                         } else {
 580                                 auth2_time = 0;
 581                         }
 582                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
 583                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error");
 584                                 rtr--;
 585                                 continue;
 586                         };
 587
 588                         nttmp = prng_successor(nt1, 100);                               //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
 589                         for (i = 141; i < 1200; i++) {
 590                                 nttmp = prng_successor(nttmp, 1);
 591                                 if (nttmp == nt2) break;
 592                         }
 593
 594                         if (i != 1200) {
 595                                 if (rtr != 0) {
 596                                         davg += i;
 597                                         dmin = MIN(dmin, i);
 598                                         dmax = MAX(dmax, i);
 599                                 }
 600                                 else {
 601                                         delta_time = auth2_time - auth1_time + 32;  // allow some slack for proper timing
 602                                 }
 603                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
 604                         }
 605                 }
 606
 607                 if (rtr <= 1) return;
 608
 609                 davg = (davg + (rtr - 1)/2) / (rtr - 1);
 610
 611                 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
 612
 613                 dmin = davg - 2;
 614                 dmax = davg + 2;
 615
 616                 LED_B_OFF();
 617
 618         }
 619 //  -------------------------------------------------------------------------------------------------
 620
 621         LED_C_ON();
 622
 623         //  get crypted nonces for target sector
 624         for(i=0; i < 2; i++) { // look for exactly two different nonces
 625
 626                 WDT_HIT();
 627             if(BUTTON_PRESS()) {
 628                         DbpString("Nested: cancelled");
 629                         crypto1_destroy(pcs);
 630                         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 631                         LEDsoff();
 632                         return;
 633                 }
 634
 635                 target_nt[i] = 0;
 636                 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
 637
 638                         // prepare next select. No need to power down the card.
 639                         if(mifare_classic_halt(pcs, cuid)) {
 640                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Halt error");
 641                                 continue;
 642                         }
 643
 644                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 645                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Can't select card");
 646                                 continue;
 647                         };
 648
 649                         auth1_time = 0;
 650                         if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
 651                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth1 error");
 652                                 continue;
 653                         };
 654
 655                         // nested authentication
 656                         auth2_time = auth1_time + delta_time;
 657                         len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time);
 658                         if (len != 4) {
 659                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Nested: Auth2 error len=%d", len);
 660                                 continue;
 661                         };
 662
 663                         nt2 = bytes_to_num(receivedAnswer, 4);
 664                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
 665
 666                         // Parity validity check
 667                         for (j = 0; j < 4; j++) {
 668                                 par_array[j] = (oddparity(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01));
 669                         }
 670
 671                         ncount = 0;
 672                         nttest = prng_successor(nt1, dmin - 1);
 673                         for (j = dmin; j < dmax + 1; j++) {
 674                                 nttest = prng_successor(nttest, 1);
 675                                 ks1 = nt2 ^ nttest;
 676
 677                                 if (valid_nonce(nttest, nt2, ks1, par_array)){
 678                                         if (ncount > 0) {               // we are only interested in disambiguous nonces, try again
 679                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
 680                                                 target_nt[i] = 0;
 681                                                 break;
 682                                         }
 683                                         target_nt[i] = nttest;
 684                                         target_ks[i] = ks1;
 685                                         ncount++;
 686                                         if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
 687                                                 target_nt[i] = 0;
 688                                                 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
 689                                                 break;
 690                                         }
 691                                         if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
 692                                 }
 693                         }
 694                         if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
 695                 }
 696         }
 697
 698         LED_C_OFF();
 699
 700         //  ----------------------------- crypto1 destroy
 701         crypto1_destroy(pcs);
 702
 703         byte_t buf[4 + 4 * 4];
 704         memcpy(buf, &cuid, 4);
 705         memcpy(buf+4, &target_nt[0], 4);
 706         memcpy(buf+8, &target_ks[0], 4);
 707         memcpy(buf+12, &target_nt[1], 4);
 708         memcpy(buf+16, &target_ks[1], 4);
 709
 710         LED_B_ON();
 711         cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
 712         LED_B_OFF();
 713
 714         if (MF_DBGLEVEL >= 3)   DbpString("NESTED FINISHED");
 715
 716         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 717         LEDsoff();
 718         iso14a_set_tracing(TRUE);
 719 }
 720
 721 //-----------------------------------------------------------------------------
 722 // MIFARE check keys. key count up to 85.
 723 //
 724 //-----------------------------------------------------------------------------
 725 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 726 {
 727   // params
 728         uint8_t blockNo = arg0;
 729         uint8_t keyType = arg1;
 730         uint8_t keyCount = arg2;
 731         uint64_t ui64Key = 0;
 732
 733         // variables
 734         int i;
 735         byte_t isOK = 0;
 736         uint8_t uid[10];
 737         uint32_t cuid;
 738         struct Crypto1State mpcs = {0, 0};
 739         struct Crypto1State *pcs;
 740         pcs = &mpcs;
 741
 742         // clear debug level
 743         int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
 744         MF_DBGLEVEL = MF_DBG_NONE;
 745
 746         // clear trace
 747         iso14a_clear_trace();
 748         iso14a_set_tracing(TRUE);
 749
 750         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 751
 752         LED_A_ON();
 753         LED_B_OFF();
 754         LED_C_OFF();
 755
 756         for (i = 0; i < keyCount; i++) {
 757                 if(mifare_classic_halt(pcs, cuid)) {
 758                         if (MF_DBGLEVEL >= 1)   Dbprintf("ChkKeys: Halt error");
 759                 }
 760
 761                 if(!iso14443a_select_card(uid, NULL, &cuid)) {
 762                         if (OLD_MF_DBGLEVEL >= 1)       Dbprintf("ChkKeys: Can't select card");
 763                         break;
 764                 };
 765
 766                 ui64Key = bytes_to_num(datain + i * 6, 6);
 767                 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
 768                         continue;
 769                 };
 770
 771                 isOK = 1;
 772                 break;
 773         }
 774
 775         //  ----------------------------- crypto1 destroy
 776         crypto1_destroy(pcs);
 777
 778         LED_B_ON();
 779     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 780         LED_B_OFF();
 781
 782         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 783         LEDsoff();
 784
 785         // restore debug level
 786         MF_DBGLEVEL = OLD_MF_DBGLEVEL;
 787 }
 788
 789 //-----------------------------------------------------------------------------
 790 // MIFARE commands set debug level
 791 //
 792 //-----------------------------------------------------------------------------
 793 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 794         MF_DBGLEVEL = arg0;
 795         Dbprintf("Debug level: %d", MF_DBGLEVEL);
 796 }
 797
 798 //-----------------------------------------------------------------------------
 799 // Work with emulator memory
 800 //
 801 //-----------------------------------------------------------------------------
 802 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 803         emlClearMem();
 804 }
 805
 806 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 807         emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 808 }
 809
 810 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 811         byte_t buf[USB_CMD_DATA_SIZE];
 812         emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 813
 814         LED_B_ON();
 815         cmd_send(CMD_ACK,arg0,arg1,0,buf,USB_CMD_DATA_SIZE);
 816         LED_B_OFF();
 817 }
 818
 819 //-----------------------------------------------------------------------------
 820 // Load a card into the emulator memory
 821 //
 822 //-----------------------------------------------------------------------------
 823 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 824         uint8_t numSectors = arg0;
 825         uint8_t keyType = arg1;
 826         uint64_t ui64Key = 0;
 827         uint32_t cuid;
 828         struct Crypto1State mpcs = {0, 0};
 829         struct Crypto1State *pcs;
 830         pcs = &mpcs;
 831
 832         // variables
 833         byte_t dataoutbuf[16];
 834         byte_t dataoutbuf2[16];
 835         uint8_t uid[10];
 836
 837         // clear trace
 838         iso14a_clear_trace();
 839         iso14a_set_tracing(false);
 840
 841         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 842
 843         LED_A_ON();
 844         LED_B_OFF();
 845         LED_C_OFF();
 846
 847         bool isOK = true;
 848
 849         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 850                 isOK = false;
 851                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 852         }
 853
 854         for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
 855                 ui64Key = emlGetKey(sectorNo, keyType);
 856                 if (sectorNo == 0){
 857                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
 858                                 isOK = false;
 859                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth error", sectorNo);
 860                                 break;
 861                         }
 862                 } else {
 863                         if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
 864                                 isOK = false;
 865                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 866                                 break;
 867                         }
 868                 }
 869
 870                 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
 871                         if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
 872                                 isOK = false;
 873                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 874                                 break;
 875                         };
 876                         if (isOK) {
 877                                 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
 878                                         emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
 879                                 } else {        // sector trailer, keep the keys, set only the AC
 880                                         emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
 881                                         memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
 882                                         emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
 883                                 }
 884                         }
 885                 }
 886
 887         }
 888
 889         if(mifare_classic_halt(pcs, cuid)) {
 890                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 891         };
 892
 893         //  ----------------------------- crypto1 destroy
 894         crypto1_destroy(pcs);
 895
 896         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 897         LEDsoff();
 898
 899         if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 900
 901 }
 902
 903
 904 //-----------------------------------------------------------------------------
 905 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
 906 //
 907 //-----------------------------------------------------------------------------
 908 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 909
 910   // params
 911         uint8_t needWipe = arg0;
 912         // bit 0 - need get UID
 913         // bit 1 - need wupC
 914         // bit 2 - need HALT after sequence
 915         // bit 3 - need init FPGA and field before sequence
 916         // bit 4 - need reset FPGA and LED
 917         uint8_t workFlags = arg1;
 918         uint8_t blockNo = arg2;
 919
 920         // card commands
 921         uint8_t wupC1[]       = { 0x40 };
 922         uint8_t wupC2[]       = { 0x43 };
 923         uint8_t wipeC[]       = { 0x41 };
 924
 925         // variables
 926         byte_t isOK = 0;
 927         uint8_t uid[10] = {0x00};
 928         uint8_t d_block[18] = {0x00};
 929         uint32_t cuid;
 930
 931         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
 932         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
 933
 934         // reset FPGA and LED
 935         if (workFlags & 0x08) {
 936                 LED_A_ON();
 937                 LED_B_OFF();
 938                 LED_C_OFF();
 939
 940                 iso14a_clear_trace();
 941                 iso14a_set_tracing(TRUE);
 942                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 943         }
 944
 945         while (true) {
 946
 947                 // get UID from chip
 948                 if (workFlags & 0x01) {
 949                         if(!iso14443a_select_card(uid, NULL, &cuid)) {
 950                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Can't select card");
 951                                 break;
 952                         };
 953
 954                         if(mifare_classic_halt(NULL, cuid)) {
 955                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 956                                 break;
 957                         };
 958                 };
 959
 960                 // reset chip
 961                 if (needWipe){
 962                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 963                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 964                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 965                                 break;
 966                         };
 967
 968                         ReaderTransmit(wipeC, sizeof(wipeC), NULL);
 969                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 970                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wipeC error");
 971                                 break;
 972                         };
 973
 974                         if(mifare_classic_halt(NULL, cuid)) {
 975                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
 976                                 break;
 977                         };
 978                 };
 979
 980                 // write block
 981                 if (workFlags & 0x02) {
 982                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
 983                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 984                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
 985                                 break;
 986                         };
 987
 988                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
 989                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
 990                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
 991                                 break;
 992                         };
 993                 }
 994
 995                 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
 996                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send command error");
 997                         break;
 998                 };
 999
1000                 memcpy(d_block, datain, 16);
1001                 AppendCrc14443a(d_block, 16);
1002
1003                 ReaderTransmit(d_block, sizeof(d_block), NULL);
1004                 if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) {
1005                         if (MF_DBGLEVEL >= 1)   Dbprintf("write block send data error");
1006                         break;
1007                 };
1008
1009                 if (workFlags & 0x04) {
1010                         if (mifare_classic_halt(NULL, cuid)) {
1011                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1012                                 break;
1013                         };
1014                 }
1015
1016                 isOK = 1;
1017                 break;
1018         }
1019
1020         LED_B_ON();
1021         cmd_send(CMD_ACK,isOK,0,0,uid,4);
1022         LED_B_OFF();
1023
1024         if ((workFlags & 0x10) || (!isOK)) {
1025                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1026                 LEDsoff();
1027         }
1028 }
1029
1030
1031 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1032
1033   // params
1034         // bit 1 - need wupC
1035         // bit 2 - need HALT after sequence
1036         // bit 3 - need init FPGA and field before sequence
1037         // bit 4 - need reset FPGA and LED
1038         uint8_t workFlags = arg0;
1039         uint8_t blockNo = arg2;
1040
1041         // card commands
1042         uint8_t wupC1[]       = { 0x40 };
1043         uint8_t wupC2[]       = { 0x43 };
1044
1045         // variables
1046         byte_t isOK = 0;
1047         uint8_t data[18] = {0x00};
1048         uint32_t cuid = 0;
1049
1050         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1051         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1052
1053         if (workFlags & 0x08) {
1054                 LED_A_ON();
1055                 LED_B_OFF();
1056                 LED_C_OFF();
1057
1058                 iso14a_clear_trace();
1059                 iso14a_set_tracing(TRUE);
1060                 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1061         }
1062
1063         while (true) {
1064                 if (workFlags & 0x02) {
1065                         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1066                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1067                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC1 error");
1068                                 break;
1069                         };
1070
1071                         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1072                         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1073                                 if (MF_DBGLEVEL >= 1)   Dbprintf("wupC2 error");
1074                                 break;
1075                         };
1076                 }
1077
1078                 // read block
1079                 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) {
1080                         if (MF_DBGLEVEL >= 1)   Dbprintf("read block send command error");
1081                         break;
1082                 };
1083                 memcpy(data, receivedAnswer, 18);
1084
1085                 if (workFlags & 0x04) {
1086                         if (mifare_classic_halt(NULL, cuid)) {
1087                                 if (MF_DBGLEVEL >= 1)   Dbprintf("Halt error");
1088                                 break;
1089                         };
1090                 }
1091
1092                 isOK = 1;
1093                 break;
1094         }
1095
1096         LED_B_ON();
1097         cmd_send(CMD_ACK,isOK,0,0,data,18);
1098         LED_B_OFF();
1099
1100         if ((workFlags & 0x10) || (!isOK)) {
1101                 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1102                 LEDsoff();
1103         }
1104 }
1105
1106 void MifareCIdent(){
1107
1108         // card commands
1109         uint8_t wupC1[]       = { 0x40 };
1110         uint8_t wupC2[]       = { 0x43 };
1111
1112         // variables
1113         byte_t isOK = 1;
1114
1115         uint8_t* receivedAnswer = get_bigbufptr_recvrespbuf();
1116         uint8_t *receivedAnswerPar = receivedAnswer + MAX_FRAME_SIZE;
1117
1118         ReaderTransmitBitsPar(wupC1,7,0, NULL);
1119         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1120                 isOK = 0;
1121         };
1122
1123         ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1124         if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) {
1125                 isOK = 0;
1126         };
1127
1128         if (mifare_classic_halt(NULL, 0)) {
1129                 isOK = 0;
1130         };
1131
1132         cmd_send(CMD_ACK,isOK,0,0,0,0);
1133 }
1134
1135                         //
1136 // DESFIRE
1137 //
1138
1139 void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
1140         // variables
1141         byte_t isOK = 0;
1142         byte_t dataout[11] = {0x00};
1143         uint8_t uid[10] = {0x00};
1144         uint32_t cuid;
1145
1146         iso14a_clear_trace();
1147         iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1148
1149         if(!iso14443a_select_card(uid, NULL, &cuid)) {
1150           if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card, something went wrong before auth");
1151         };
1152
1153         if(mifare_desfire_des_auth1(cuid, dataout)){
1154           if (MF_DBGLEVEL >= 1)
1155                 Dbprintf("Authentication part1: Fail.");
1156         }
1157
1158         isOK = 1;
1159         if (MF_DBGLEVEL >= 2) DbpString("AUTH 1 FINISHED");
1160
1161     cmd_send(CMD_ACK,isOK,cuid,0,dataout, sizeof(dataout));
1162 }
1163
1164 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
1165
1166         uint32_t cuid = arg0;
1167         uint8_t key[16] = {0x00};
1168         byte_t isOK = 0;
1169         byte_t dataout[12] = {0x00};
1170
1171         memcpy(key, datain, 16);
1172
1173         LED_A_ON();
1174         LED_B_OFF();
1175         LED_C_OFF();
1176
1177         isOK = mifare_desfire_des_auth2(cuid, key, dataout);
1178
1179         if(isOK){
1180                 if (MF_DBGLEVEL >= 2)
1181                         DbpString("AUTH 2 FINISHED");
1182                 cmd_send(CMD_ACK,isOK,0,0,dataout,sizeof(dataout));
1183         }
1184         else {
1185             if (MF_DBGLEVEL >= 2)
1186                         Dbprintf("Authentication part2: Failed");
1187                 OnError();
1188         }
1189
1190         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1191         LEDsoff();
1192 }