]> cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifarecmd.c
Fix (iclass)
[proxmark3-svn] / armsrc / mifarecmd.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011, 2012
3 // Gerhard de Koning Gans - May 2008
4 // Hagen Fritsch - June 2010
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // Routines to support ISO 14443 type A.
11 //-----------------------------------------------------------------------------
12
13 #include "mifarecmd.h"
14 #include "apps.h"
15
16 //-----------------------------------------------------------------------------
17 // Select, Authenticate, Read a MIFARE tag.
18 // read block
19 //-----------------------------------------------------------------------------
20 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
21 {
22 // params
23 uint8_t blockNo = arg0;
24 uint8_t keyType = arg1;
25 uint64_t ui64Key = 0;
26 ui64Key = bytes_to_num(datain, 6);
27
28 // variables
29 byte_t isOK = 0;
30 byte_t dataoutbuf[16];
31 uint8_t uid[10];
32 uint32_t cuid;
33 struct Crypto1State mpcs = {0, 0};
34 struct Crypto1State *pcs;
35 pcs = &mpcs;
36
37 // clear trace
38 iso14a_clear_trace();
39 // iso14a_set_tracing(false);
40
41 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
42
43 LED_A_ON();
44 LED_B_OFF();
45 LED_C_OFF();
46
47 while (true) {
48 if(!iso14443a_select_card(uid, NULL, &cuid)) {
49 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
50 break;
51 };
52
53 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
54 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
55 break;
56 };
57
58 if(mifare_classic_readblock(pcs, cuid, blockNo, dataoutbuf)) {
59 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
60 break;
61 };
62
63 if(mifare_classic_halt(pcs, cuid)) {
64 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
65 break;
66 };
67
68 isOK = 1;
69 break;
70 }
71
72 // ----------------------------- crypto1 destroy
73 crypto1_destroy(pcs);
74
75 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
76
77 LED_B_ON();
78 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
79 LED_B_OFF();
80
81 // Thats it...
82 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
83 LEDsoff();
84 // iso14a_set_tracing(TRUE);
85
86 }
87
88 void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
89 {
90 // params
91 uint8_t blockNo = arg0;
92
93 // variables
94 byte_t isOK = 0;
95 byte_t dataoutbuf[16];
96 uint8_t uid[10];
97 uint32_t cuid;
98
99 // clear trace
100 iso14a_clear_trace();
101 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
102
103 LED_A_ON();
104 LED_B_OFF();
105 LED_C_OFF();
106
107 while (true) {
108 if(!iso14443a_select_card(uid, NULL, &cuid)) {
109 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
110 break;
111 };
112
113 if(mifare_ultra_readblock(cuid, blockNo, dataoutbuf)) {
114 if (MF_DBGLEVEL >= 1) Dbprintf("Read block error");
115 break;
116 };
117
118 if(mifare_ultra_halt(cuid)) {
119 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
120 break;
121 };
122
123 isOK = 1;
124 break;
125 }
126
127 if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
128
129 // add trace trailer
130 memset(uid, 0x44, 4);
131 LogTrace(uid, 4, 0, 0, TRUE);
132 LED_B_ON();
133 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
134 LED_B_OFF();
135
136
137 // Thats it...
138 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
139 LEDsoff();
140 }
141
142
143 //-----------------------------------------------------------------------------
144 // Select, Authenticate, Read a MIFARE tag.
145 // read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
146 //-----------------------------------------------------------------------------
147 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
148 {
149 // params
150 uint8_t sectorNo = arg0;
151 uint8_t keyType = arg1;
152 uint64_t ui64Key = 0;
153 ui64Key = bytes_to_num(datain, 6);
154
155 // variables
156 byte_t isOK;
157 byte_t dataoutbuf[16 * 16];
158 uint8_t uid[10];
159 uint32_t cuid;
160 struct Crypto1State mpcs = {0, 0};
161 struct Crypto1State *pcs;
162 pcs = &mpcs;
163
164 // clear trace
165 iso14a_clear_trace();
166 // iso14a_set_tracing(false);
167
168 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
169
170 LED_A_ON();
171 LED_B_OFF();
172 LED_C_OFF();
173
174 isOK = 1;
175 if(!iso14443a_select_card(uid, NULL, &cuid)) {
176 isOK = 0;
177 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
178 }
179
180
181 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
182 isOK = 0;
183 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
184 }
185
186 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
187 if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
188 isOK = 0;
189 if (MF_DBGLEVEL >= 1) Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
190 break;
191 }
192 }
193
194 if(mifare_classic_halt(pcs, cuid)) {
195 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
196 }
197
198
199 // ----------------------------- crypto1 destroy
200 crypto1_destroy(pcs);
201
202 if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
203
204 LED_B_ON();
205 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
206 LED_B_OFF();
207
208 // Thats it...
209 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
210 LEDsoff();
211 // iso14a_set_tracing(TRUE);
212 }
213
214
215 void MifareUReadCard(uint8_t arg0, uint8_t *datain)
216 {
217 // params
218 uint8_t sectorNo = arg0;
219
220 // variables
221 byte_t isOK = 0;
222 byte_t dataoutbuf[16 * 4];
223 uint8_t uid[10];
224 uint32_t cuid;
225
226 // clear trace
227 iso14a_clear_trace();
228 // iso14a_set_tracing(false);
229
230 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
231
232 LED_A_ON();
233 LED_B_OFF();
234 LED_C_OFF();
235
236 while (true) {
237 if(!iso14443a_select_card(uid, NULL, &cuid)) {
238 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
239 break;
240 };
241 for(int sec=0;sec<16;sec++){
242 if(mifare_ultra_readblock(cuid, sectorNo * 4 + sec, dataoutbuf + 4 * sec)) {
243 if (MF_DBGLEVEL >= 1) Dbprintf("Read block %d error",sec);
244 break;
245 };
246 }
247 if(mifare_ultra_halt(cuid)) {
248 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
249 break;
250 };
251
252 isOK = 1;
253 break;
254 }
255
256 if (MF_DBGLEVEL >= 2) DbpString("READ CARD FINISHED");
257
258 LED_B_ON();
259 cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
260 LED_B_OFF();
261
262 // Thats it...
263 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
264 LEDsoff();
265
266 }
267
268
269 //-----------------------------------------------------------------------------
270 // Select, Authenticate, Write a MIFARE tag.
271 // read block
272 //-----------------------------------------------------------------------------
273 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
274 {
275 // params
276 uint8_t blockNo = arg0;
277 uint8_t keyType = arg1;
278 uint64_t ui64Key = 0;
279 byte_t blockdata[16];
280
281 ui64Key = bytes_to_num(datain, 6);
282 memcpy(blockdata, datain + 10, 16);
283
284 // variables
285 byte_t isOK = 0;
286 uint8_t uid[10];
287 uint32_t cuid;
288 struct Crypto1State mpcs = {0, 0};
289 struct Crypto1State *pcs;
290 pcs = &mpcs;
291
292 // clear trace
293 iso14a_clear_trace();
294 // iso14a_set_tracing(false);
295
296 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
297
298 LED_A_ON();
299 LED_B_OFF();
300 LED_C_OFF();
301
302 while (true) {
303 if(!iso14443a_select_card(uid, NULL, &cuid)) {
304 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
305 break;
306 };
307
308 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
309 if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");
310 break;
311 };
312
313 if(mifare_classic_writeblock(pcs, cuid, blockNo, blockdata)) {
314 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
315 break;
316 };
317
318 if(mifare_classic_halt(pcs, cuid)) {
319 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
320 break;
321 };
322
323 isOK = 1;
324 break;
325 }
326
327 // ----------------------------- crypto1 destroy
328 crypto1_destroy(pcs);
329
330 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
331
332 LED_B_ON();
333 cmd_send(CMD_ACK,isOK,0,0,0,0);
334 LED_B_OFF();
335
336
337 // Thats it...
338 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
339 LEDsoff();
340 // iso14a_set_tracing(TRUE);
341
342 }
343
344
345 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
346 {
347 // params
348 uint8_t blockNo = arg0;
349 byte_t blockdata[16];
350
351 memset(blockdata,'\0',16);
352 memcpy(blockdata, datain,16);
353
354 // variables
355 byte_t isOK = 0;
356 uint8_t uid[10];
357 uint32_t cuid;
358
359 // clear trace
360 iso14a_clear_trace();
361 // iso14a_set_tracing(false);
362
363 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
364
365 LED_A_ON();
366 LED_B_OFF();
367 LED_C_OFF();
368
369 while (true) {
370 if(!iso14443a_select_card(uid, NULL, &cuid)) {
371 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
372 break;
373 };
374
375 if(mifare_ultra_writeblock(cuid, blockNo, blockdata)) {
376 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
377 break;
378 };
379
380 if(mifare_ultra_halt(cuid)) {
381 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
382 break;
383 };
384
385 isOK = 1;
386 break;
387 }
388
389 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
390
391 LED_B_ON();
392 cmd_send(CMD_ACK,isOK,0,0,0,0);
393 LED_B_OFF();
394
395
396 // Thats it...
397 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
398 LEDsoff();
399 // iso14a_set_tracing(TRUE);
400 }
401
402
403 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
404 {
405 // params
406 uint8_t blockNo = arg0;
407 byte_t blockdata[4];
408
409 memcpy(blockdata, datain,4);
410
411 // variables
412 byte_t isOK = 0;
413 uint8_t uid[10];
414 uint32_t cuid;
415
416 // clear trace
417 iso14a_clear_trace();
418 // iso14a_set_tracing(false);
419
420 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
421
422 LED_A_ON();
423 LED_B_OFF();
424 LED_C_OFF();
425
426 while (true) {
427 if(!iso14443a_select_card(uid, NULL, &cuid)) {
428 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
429 break;
430 };
431
432 if(mifare_ultra_special_writeblock(cuid, blockNo, blockdata)) {
433 if (MF_DBGLEVEL >= 1) Dbprintf("Write block error");
434 break;
435 };
436
437 if(mifare_ultra_halt(cuid)) {
438 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
439 break;
440 };
441
442 isOK = 1;
443 break;
444 }
445
446 if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
447
448 LED_B_ON();
449 cmd_send(CMD_ACK,isOK,0,0,0,0);
450 LED_B_OFF();
451
452
453 // Thats it...
454 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
455 LEDsoff();
456 // iso14a_set_tracing(TRUE);
457
458 }
459
460
461 // Return 1 if the nonce is invalid else return 0
462 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
463 return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
464 (oddparity((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity((NtEnc >> 16) & 0xFF) ^ BIT(Ks1,8))) & \
465 (oddparity((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity((NtEnc >> 8) & 0xFF) ^ BIT(Ks1,0)))) ? 1 : 0;
466 }
467
468
469 //-----------------------------------------------------------------------------
470 // MIFARE nested authentication.
471 //
472 //-----------------------------------------------------------------------------
473 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)
474 {
475 // params
476 uint8_t blockNo = arg0 & 0xff;
477 uint8_t keyType = (arg0 >> 8) & 0xff;
478 uint8_t targetBlockNo = arg1 & 0xff;
479 uint8_t targetKeyType = (arg1 >> 8) & 0xff;
480 uint64_t ui64Key = 0;
481
482 ui64Key = bytes_to_num(datain, 6);
483
484 // variables
485 uint16_t rtr, i, j, len;
486 uint16_t davg;
487 static uint16_t dmin, dmax;
488 uint8_t uid[10];
489 uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
490 uint32_t target_nt[2], target_ks[2];
491
492 uint8_t par_array[4];
493 uint16_t ncount = 0;
494 struct Crypto1State mpcs = {0, 0};
495 struct Crypto1State *pcs;
496 pcs = &mpcs;
497 uint8_t* receivedAnswer = mifare_get_bigbufptr();
498
499 uint32_t auth1_time, auth2_time;
500 static uint16_t delta_time;
501
502 // clear trace
503 iso14a_clear_trace();
504 iso14a_set_tracing(false);
505
506 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
507
508 LED_A_ON();
509 LED_C_OFF();
510
511
512 // statistics on nonce distance
513 if (calibrate) { // for first call only. Otherwise reuse previous calibration
514 LED_B_ON();
515
516 davg = dmax = 0;
517 dmin = 2000;
518 delta_time = 0;
519
520 for (rtr = 0; rtr < 17; rtr++) {
521
522 // prepare next select. No need to power down the card.
523 if(mifare_classic_halt(pcs, cuid)) {
524 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
525 rtr--;
526 continue;
527 }
528
529 if(!iso14443a_select_card(uid, NULL, &cuid)) {
530 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
531 rtr--;
532 continue;
533 };
534
535 auth1_time = 0;
536 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
537 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
538 rtr--;
539 continue;
540 };
541
542 if (delta_time) {
543 auth2_time = auth1_time + delta_time;
544 } else {
545 auth2_time = 0;
546 }
547 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {
548 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
549 rtr--;
550 continue;
551 };
552
553 nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
554 for (i = 101; i < 1200; i++) {
555 nttmp = prng_successor(nttmp, 1);
556 if (nttmp == nt2) break;
557 }
558
559 if (i != 1200) {
560 if (rtr != 0) {
561 davg += i;
562 dmin = MIN(dmin, i);
563 dmax = MAX(dmax, i);
564 }
565 else {
566 delta_time = auth2_time - auth1_time + 32; // allow some slack for proper timing
567 }
568 if (MF_DBGLEVEL >= 3) Dbprintf("Nested: calibrating... ntdist=%d", i);
569 }
570 }
571
572 if (rtr <= 1) return;
573
574 davg = (davg + (rtr - 1)/2) / (rtr - 1);
575
576 if (MF_DBGLEVEL >= 3) Dbprintf("min=%d max=%d avg=%d, delta_time=%d", dmin, dmax, davg, delta_time);
577
578 dmin = davg - 2;
579 dmax = davg + 2;
580
581 LED_B_OFF();
582
583 }
584 // -------------------------------------------------------------------------------------------------
585
586 LED_C_ON();
587
588 // get crypted nonces for target sector
589 for(i=0; i < 2; i++) { // look for exactly two different nonces
590
591 target_nt[i] = 0;
592 while(target_nt[i] == 0) { // continue until we have an unambiguous nonce
593
594 // prepare next select. No need to power down the card.
595 if(mifare_classic_halt(pcs, cuid)) {
596 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
597 continue;
598 }
599
600 if(!iso14443a_select_card(uid, NULL, &cuid)) {
601 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");
602 continue;
603 };
604
605 auth1_time = 0;
606 if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {
607 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");
608 continue;
609 };
610
611 // nested authentication
612 auth2_time = auth1_time + delta_time;
613 len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par, &auth2_time);
614 if (len != 4) {
615 if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len);
616 continue;
617 };
618
619 nt2 = bytes_to_num(receivedAnswer, 4);
620 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par);
621
622 // Parity validity check
623 for (j = 0; j < 4; j++) {
624 par_array[j] = (oddparity(receivedAnswer[j]) != ((par & 0x08) >> 3));
625 par = par << 1;
626 }
627
628 ncount = 0;
629 nttest = prng_successor(nt1, dmin - 1);
630 for (j = dmin; j < dmax + 1; j++) {
631 nttest = prng_successor(nttest, 1);
632 ks1 = nt2 ^ nttest;
633
634 if (valid_nonce(nttest, nt2, ks1, par_array)){
635 if (ncount > 0) { // we are only interested in disambiguous nonces, try again
636 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
637 target_nt[i] = 0;
638 break;
639 }
640 target_nt[i] = nttest;
641 target_ks[i] = ks1;
642 ncount++;
643 if (i == 1 && target_nt[1] == target_nt[0]) { // we need two different nonces
644 target_nt[i] = 0;
645 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#2: dismissed (= nonce#1), ntdist=%d", j);
646 break;
647 }
648 if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: valid, ntdist=%d", i+1, j);
649 }
650 }
651 if (target_nt[i] == 0 && j == dmax+1 && MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (all invalid)", i+1);
652 }
653 }
654
655 LED_C_OFF();
656
657 // ----------------------------- crypto1 destroy
658 crypto1_destroy(pcs);
659
660 // add trace trailer
661 memset(uid, 0x44, 4);
662 LogTrace(uid, 4, 0, 0, TRUE);
663
664 byte_t buf[4 + 4 * 4];
665 memcpy(buf, &cuid, 4);
666 memcpy(buf+4, &target_nt[0], 4);
667 memcpy(buf+8, &target_ks[0], 4);
668 memcpy(buf+12, &target_nt[1], 4);
669 memcpy(buf+16, &target_ks[1], 4);
670
671 LED_B_ON();
672 cmd_send(CMD_ACK, 0, 2, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
673 LED_B_OFF();
674
675 if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
676
677 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
678 LEDsoff();
679 iso14a_set_tracing(TRUE);
680 }
681
682 //-----------------------------------------------------------------------------
683 // MIFARE check keys. key count up to 85.
684 //
685 //-----------------------------------------------------------------------------
686 void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
687 {
688 // params
689 uint8_t blockNo = arg0;
690 uint8_t keyType = arg1;
691 uint8_t keyCount = arg2;
692 uint64_t ui64Key = 0;
693
694 // variables
695 int i;
696 byte_t isOK = 0;
697 uint8_t uid[10];
698 uint32_t cuid;
699 struct Crypto1State mpcs = {0, 0};
700 struct Crypto1State *pcs;
701 pcs = &mpcs;
702
703 // clear debug level
704 int OLD_MF_DBGLEVEL = MF_DBGLEVEL;
705 MF_DBGLEVEL = MF_DBG_NONE;
706
707 // clear trace
708 iso14a_clear_trace();
709 iso14a_set_tracing(TRUE);
710
711 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
712
713 LED_A_ON();
714 LED_B_OFF();
715 LED_C_OFF();
716
717 for (i = 0; i < keyCount; i++) {
718 if(mifare_classic_halt(pcs, cuid)) {
719 if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error");
720 }
721
722 if(!iso14443a_select_card(uid, NULL, &cuid)) {
723 if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card");
724 break;
725 };
726
727 ui64Key = bytes_to_num(datain + i * 6, 6);
728 if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {
729 continue;
730 };
731
732 isOK = 1;
733 break;
734 }
735
736 // ----------------------------- crypto1 destroy
737 crypto1_destroy(pcs);
738
739 LED_B_ON();
740 cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
741 LED_B_OFF();
742
743 // Thats it...
744 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
745 LEDsoff();
746
747 // restore debug level
748 MF_DBGLEVEL = OLD_MF_DBGLEVEL;
749 }
750
751 //-----------------------------------------------------------------------------
752 // MIFARE commands set debug level
753 //
754 //-----------------------------------------------------------------------------
755 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
756 MF_DBGLEVEL = arg0;
757 Dbprintf("Debug level: %d", MF_DBGLEVEL);
758 }
759
760
761 //-----------------------------------------------------------------------------
762 // Work with emulator memory
763 //
764 //-----------------------------------------------------------------------------
765 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
766 emlClearMem();
767 }
768
769
770 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
771 emlSetMem(datain, arg0, arg1); // data, block num, blocks count
772 }
773
774
775 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
776
777 byte_t buf[48];
778 emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
779
780 LED_B_ON();
781 cmd_send(CMD_ACK,arg0,arg1,0,buf,48);
782 LED_B_OFF();
783 }
784
785
786 //-----------------------------------------------------------------------------
787 // Load a card into the emulator memory
788 //
789 //-----------------------------------------------------------------------------
790 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
791 uint8_t numSectors = arg0;
792 uint8_t keyType = arg1;
793 uint64_t ui64Key = 0;
794 uint32_t cuid;
795 struct Crypto1State mpcs = {0, 0};
796 struct Crypto1State *pcs;
797 pcs = &mpcs;
798
799 // variables
800 byte_t dataoutbuf[16];
801 byte_t dataoutbuf2[16];
802 uint8_t uid[10];
803
804 // clear trace
805 iso14a_clear_trace();
806 iso14a_set_tracing(false);
807
808 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
809
810 LED_A_ON();
811 LED_B_OFF();
812 LED_C_OFF();
813
814 bool isOK = true;
815
816 if(!iso14443a_select_card(uid, NULL, &cuid)) {
817 isOK = false;
818 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
819 }
820
821 for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
822 ui64Key = emlGetKey(sectorNo, keyType);
823 if (sectorNo == 0){
824 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
825 isOK = false;
826 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);
827 break;
828 }
829 } else {
830 if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
831 isOK = false;
832 if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
833 break;
834 }
835 }
836
837 for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
838 if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
839 isOK = false;
840 if (MF_DBGLEVEL >= 1) Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
841 break;
842 };
843 if (isOK) {
844 if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
845 emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
846 } else { // sector trailer, keep the keys, set only the AC
847 emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
848 memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
849 emlSetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
850 }
851 }
852 }
853
854 }
855
856 if(mifare_classic_halt(pcs, cuid)) {
857 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
858 };
859
860 // ----------------------------- crypto1 destroy
861 crypto1_destroy(pcs);
862
863 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
864 LEDsoff();
865
866 if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
867
868 }
869
870
871 //-----------------------------------------------------------------------------
872 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
873 //
874 //-----------------------------------------------------------------------------
875 void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
876
877 // params
878 uint8_t needWipe = arg0;
879 // bit 0 - need get UID
880 // bit 1 - need wupC
881 // bit 2 - need HALT after sequence
882 // bit 3 - need init FPGA and field before sequence
883 // bit 4 - need reset FPGA and LED
884 uint8_t workFlags = arg1;
885 uint8_t blockNo = arg2;
886
887 // card commands
888 uint8_t wupC1[] = { 0x40 };
889 uint8_t wupC2[] = { 0x43 };
890 uint8_t wipeC[] = { 0x41 };
891
892 // variables
893 byte_t isOK = 0;
894 uint8_t uid[10];
895 uint8_t d_block[18];
896 uint32_t cuid;
897
898 memset(uid, 0x00, 10);
899 uint8_t* receivedAnswer = mifare_get_bigbufptr();
900
901 if (workFlags & 0x08) {
902 // clear trace
903 iso14a_clear_trace();
904 iso14a_set_tracing(TRUE);
905
906 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
907
908 LED_A_ON();
909 LED_B_OFF();
910 LED_C_OFF();
911
912 SpinDelay(300);
913 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
914 SpinDelay(100);
915 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
916 }
917
918 while (true) {
919 // get UID from chip
920 if (workFlags & 0x01) {
921 if(!iso14443a_select_card(uid, NULL, &cuid)) {
922 if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
923 break;
924 };
925
926 if(mifare_classic_halt(NULL, cuid)) {
927 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
928 break;
929 };
930 };
931
932 // reset chip
933 if (needWipe){
934 ReaderTransmitBitsPar(wupC1,7,0, NULL);
935 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
936 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
937 break;
938 };
939
940 ReaderTransmit(wipeC, sizeof(wipeC), NULL);
941 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
942 if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error");
943 break;
944 };
945
946 if(mifare_classic_halt(NULL, cuid)) {
947 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
948 break;
949 };
950 };
951
952 // write block
953 if (workFlags & 0x02) {
954 ReaderTransmitBitsPar(wupC1,7,0, NULL);
955 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
956 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
957 break;
958 };
959
960 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
961 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
962 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
963 break;
964 };
965 }
966
967 if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, NULL) != 1) || (receivedAnswer[0] != 0x0a)) {
968 if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error");
969 break;
970 };
971
972 memcpy(d_block, datain, 16);
973 AppendCrc14443a(d_block, 16);
974
975 ReaderTransmit(d_block, sizeof(d_block), NULL);
976 if ((ReaderReceive(receivedAnswer) != 1) || (receivedAnswer[0] != 0x0a)) {
977 if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error");
978 break;
979 };
980
981 if (workFlags & 0x04) {
982 if (mifare_classic_halt(NULL, cuid)) {
983 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
984 break;
985 };
986 }
987
988 isOK = 1;
989 break;
990 }
991
992 LED_B_ON();
993 cmd_send(CMD_ACK,isOK,0,0,uid,4);
994 LED_B_OFF();
995
996 if ((workFlags & 0x10) || (!isOK)) {
997 // Thats it...
998 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
999 LEDsoff();
1000 }
1001 }
1002
1003
1004 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
1005
1006 // params
1007 // bit 1 - need wupC
1008 // bit 2 - need HALT after sequence
1009 // bit 3 - need init FPGA and field before sequence
1010 // bit 4 - need reset FPGA and LED
1011 uint8_t workFlags = arg0;
1012 uint8_t blockNo = arg2;
1013
1014 // card commands
1015 uint8_t wupC1[] = { 0x40 };
1016 uint8_t wupC2[] = { 0x43 };
1017
1018 // variables
1019 byte_t isOK = 0;
1020 uint8_t data[18];
1021 uint32_t cuid = 0;
1022
1023 memset(data, 0x00, 18);
1024 uint8_t* receivedAnswer = mifare_get_bigbufptr();
1025
1026 if (workFlags & 0x08) {
1027 // clear trace
1028 iso14a_clear_trace();
1029 iso14a_set_tracing(TRUE);
1030
1031 iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
1032
1033 LED_A_ON();
1034 LED_B_OFF();
1035 LED_C_OFF();
1036
1037 SpinDelay(300);
1038 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1039 SpinDelay(100);
1040 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1041 }
1042
1043 while (true) {
1044 if (workFlags & 0x02) {
1045 ReaderTransmitBitsPar(wupC1,7,0, NULL);
1046 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
1047 if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error");
1048 break;
1049 };
1050
1051 ReaderTransmit(wupC2, sizeof(wupC2), NULL);
1052 if(!ReaderReceive(receivedAnswer) || (receivedAnswer[0] != 0x0a)) {
1053 if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error");
1054 break;
1055 };
1056 }
1057
1058 // read block
1059 if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, NULL) != 18)) {
1060 if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error");
1061 break;
1062 };
1063 memcpy(data, receivedAnswer, 18);
1064
1065 if (workFlags & 0x04) {
1066 if (mifare_classic_halt(NULL, cuid)) {
1067 if (MF_DBGLEVEL >= 1) Dbprintf("Halt error");
1068 break;
1069 };
1070 }
1071
1072 isOK = 1;
1073 break;
1074 }
1075
1076 LED_B_ON();
1077 cmd_send(CMD_ACK,isOK,0,0,data,18);
1078 LED_B_OFF();
1079
1080 if ((workFlags & 0x10) || (!isOK)) {
1081 // Thats it...
1082 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1083 LEDsoff();
1084 }
1085 }
1086
Impressum, Datenschutz