1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
 };
 
+
 void iso14a_set_trigger(bool enable) {
        trigger = enable;
 }
 
 
-
 void iso14a_set_timeout(uint32_t timeout) {
        iso14a_timeout = timeout;
+       if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);
 }
 
+
+void iso14a_set_ATS_timeout(uint8_t *ats) {
+
+       uint8_t tb1;
+       uint8_t fwi; 
+       uint32_t fwt;
+       
+       if (ats[0] > 1) {                                                       // there is a format byte T0
+               if ((ats[1] & 0x20) == 0x20) {                  // there is an interface byte TB(1)
+                       if ((ats[1] & 0x10) == 0x10) {          // there is an interface byte TA(1) preceding TB(1)
+                               tb1 = ats[3];
+                       } else {
+                               tb1 = ats[2];
+                       }
+                       fwi = (tb1 & 0xf0) >> 4;                        // frame waiting indicator (FWI)
+                       fwt = 256 * 16 * (1 << fwi);            // frame waiting time (FWT) in 1/fc
+                       
+                       iso14a_set_timeout(fwt/(8*16));
+               }
+       }
+}
+
+
 //-----------------------------------------------------------------------------
 // Generate the parity value for a byte sequence
 //
                        if(ManchesterDecoding(b, offset, 0)) {
                                NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
                                return TRUE;
-                       } else if (c++ > iso14a_timeout) {
+                       } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
                                return FALSE; 
                        }
                }
 
        // reset the PCB block number
        iso14_pcb_blocknum = 0;
+
+       // set default timeout based on ATS
+       iso14a_set_ATS_timeout(resp);
+
        return 1;       
 }
 
 {
        iso14a_command_t param = c->arg[0];
        uint8_t *cmd = c->d.asBytes;
-       size_t len = c->arg[1];
-       size_t lenbits = c->arg[2];
+       size_t len = c->arg[1] & 0xffff;
+       size_t lenbits = c->arg[1] >> 16;
+       uint32_t timeout = c->arg[2];
        uint32_t arg0 = 0;
        byte_t buf[USB_CMD_DATA_SIZE];
        uint8_t par[MAX_PARITY_SIZE];
        }
 
        if(param & ISO14A_SET_TIMEOUT) {
-               iso14a_set_timeout(c->arg[2]);
+               iso14a_set_timeout(timeout);
        }
 
        if(param & ISO14A_APDU) {
                } 
                if(cardSTATE == MFEMUL_NOFIELD) continue;
 
-               //Now, get data
-
                res = EmGetCmd(receivedCmd, &len, receivedCmd_par);
                if (res == 2) { //Field is off!
                        cardSTATE = MFEMUL_NOFIELD;
                                uint32_t nr = bytes_to_num(&receivedCmd[4], 4);
 
                                //Collect AR/NR
-                               if(ar_nr_collected < 2){
+                               if(ar_nr_collected < 2 && cardAUTHSC == 2){
                                        if(ar_nr_responses[2] != ar)
                                        {// Avoid duplicates... probably not necessary, ar should vary. 
                                                ar_nr_responses[ar_nr_collected*4] = cuid;
                                                ar_nr_responses[ar_nr_collected*4+2] = ar;
                                                ar_nr_responses[ar_nr_collected*4+3] = nr;
                                                ar_nr_collected++;
+                                       }                                               
+                                       // Interactive mode flag, means we need to send ACK
+                                       if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
+                                       {
+                                               finished = true;
                                        }
                                }
 
                                        mf_crypto1_encrypt(pcs, response, 18, response_par);
                                        EmSendCmdPar(response, 18, response_par);
                                        numReads++;
-                                       if(exitAfterNReads > 0 && numReads == exitAfterNReads) {
+                                       if(exitAfterNReads > 0 && numReads >= exitAfterNReads) {
                                                Dbprintf("%d reads done, exiting", numReads);
                                                finished = true;
                                        }
        if(flags & FLAG_INTERACTIVE)// Interactive mode flag, means we need to send ACK
        {
                //May just aswell send the collected ar_nr in the response aswell
-               cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,0,0,&ar_nr_responses,ar_nr_collected*4*4);
+               cmd_send(CMD_ACK,CMD_SIMULATE_MIFARE_CARD,1,0,&ar_nr_responses,ar_nr_collected*4*4);
        }
 
-       if(flags & FLAG_NR_AR_ATTACK)
+       if(flags & FLAG_NR_AR_ATTACK && MF_DBGLEVEL >= 1 )
        {
-               if(ar_nr_collected > 1) {
+               if(ar_nr_collected > 1 ) {
                        Dbprintf("Collected two pairs of AR/NR which can be used to extract keys from reader:");
                        Dbprintf("../tools/mfkey/mfkey32 %08x %08x %08x %08x %08x %08x",
                                        ar_nr_responses[0], // UID
                                        );
                } else {
                        Dbprintf("Failed to obtain two AR/NR pairs!");
-                       if(ar_nr_collected >0) {
+                       if(ar_nr_collected > 0 ) {
                                Dbprintf("Only got these: UID=%08x, nonce=%08x, AR1=%08x, NR1=%08x",
                                                ar_nr_responses[0], // UID
                                                ar_nr_responses[1], //NT