Update README.md

[proxmark3-svn] / armsrc / iclass.c

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index 6a2fd648c180dcd4a9e754cb3e3f2cd92220a878..3f89ae854b4fe1c904749728f0d3298905280b34 100644 (file)
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -3,6 +3,7 @@
 // Hagen Fritsch - June 2010
 // Gerhard de Koning Gans - May 2011
 // Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation
 // Hagen Fritsch - June 2010
 // Gerhard de Koning Gans - May 2011
 // Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation

+// piwi - 2019

 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of


@@ -10,31 +11,10 @@
 //-----------------------------------------------------------------------------
 // Routines to support iClass.
 //-----------------------------------------------------------------------------
 //-----------------------------------------------------------------------------
 // Routines to support iClass.
 //-----------------------------------------------------------------------------

-// Based on ISO14443a implementation. Still in experimental phase.

 // Contribution made during a security research at Radboud University Nijmegen
 //
 // Please feel free to contribute and extend iClass support!!
 //-----------------------------------------------------------------------------
 // Contribution made during a security research at Radboud University Nijmegen
 //
 // Please feel free to contribute and extend iClass support!!
 //-----------------------------------------------------------------------------

-//
-// FIX:
-// ====
-// We still have sometimes a demodulation error when snooping iClass communication.
-// The resulting trace of a read-block-03 command may look something like this:
-//
-//  +  22279:    :     0c  03  e8  01
-//
-//    ...with an incorrect answer...
-//
-//  +     85:   0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb  33  bb  00  01! 0e! 04! bb     !crc
-//
-// We still left the error signalling bytes in the traces like 0xbb
-//
-// A correct trace should look like this:
-//
-// +  21112:    :     0c  03  e8  01
-// +     85:   0: TAG ff  ff  ff  ff  ff  ff  ff  ff  ea  f5
-//
-//-----------------------------------------------------------------------------

 
 #include "iclass.h"
 
 
 #include "iclass.h"
 


@@ -44,7 +24,7 @@
 #include "string.h"
 #include "printf.h"
 #include "common.h"
 #include "string.h"
 #include "printf.h"
 #include "common.h"

-#include "cmd.h"
+#include "usb_cdc.h"

 #include "iso14443a.h"
 #include "iso15693.h"
 // Needed for CRC in emulation mode;
 #include "iso14443a.h"
 #include "iso15693.h"
 // Needed for CRC in emulation mode;


@@ -54,7 +34,6 @@
 #include "iso15693tools.h"
 #include "protocols.h"
 #include "optimized_cipher.h"
 #include "iso15693tools.h"
 #include "protocols.h"
 #include "optimized_cipher.h"

-#include "usb_cdc.h" // for usb_poll_validate_length

 #include "fpgaloader.h"
 
 // iCLASS has a slightly different timing compared to ISO15693. According to the picopass data sheet the tag response is expected 330us after
 #include "fpgaloader.h"
 
 // iCLASS has a slightly different timing compared to ISO15693. According to the picopass data sheet the tag response is expected 330us after


@@ -559,7 +538,7 @@ int doIClassSimulation(int simulationMode, uint8_t *reader_mac_buf) {
                if (modulated_response_size > 0) {
                        uint32_t response_time = reader_eof_time + DELAY_ICLASS_VCD_TO_VICC_SIM;
                        TransmitTo15693Reader(modulated_response, modulated_response_size, &response_time, 0, false);
                if (modulated_response_size > 0) {
                        uint32_t response_time = reader_eof_time + DELAY_ICLASS_VCD_TO_VICC_SIM;
                        TransmitTo15693Reader(modulated_response, modulated_response_size, &response_time, 0, false);

-                       LogTrace_ISO15693(trace_data, trace_data_size, response_time*32, response_time*32 + modulated_response_size/2, NULL, false);
+                       LogTrace_ISO15693(trace_data, trace_data_size, response_time*32, response_time*32 + modulated_response_size*32*64, NULL, false);

                }
 
        }
                }
 
        }


@@ -587,17 +566,11 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
 
        LED_A_ON();
 
 
        LED_A_ON();
 

+       Iso15693InitTag();
+       

        uint32_t simType = arg0;
        uint32_t numberOfCSNS = arg1;
 
        uint32_t simType = arg0;
        uint32_t numberOfCSNS = arg1;
 

-       // setup hardware for simulation:
-       FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
-       SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
-       FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_NO_MODULATION);
-       LED_D_OFF();
-       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
-       StartCountSspClk();
-

        // Enable and clear the trace
        set_tracing(true);
        clear_trace();
        // Enable and clear the trace
        set_tracing(true);
        clear_trace();


@@ -610,9 +583,8 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
                doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL);
        } else if (simType == ICLASS_SIM_MODE_CSN_DEFAULT) {
                //Default CSN
                doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL);
        } else if (simType == ICLASS_SIM_MODE_CSN_DEFAULT) {
                //Default CSN

-               uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };
-               // Use the CSN from commandline
-               memcpy(emulator, csn_crc, 8);
+               uint8_t csn[] = {0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0};
+               memcpy(emulator, csn, 8);

                doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL);
        } else if (simType == ICLASS_SIM_MODE_READER_ATTACK) {
                uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 };
                doIClassSimulation(ICLASS_SIM_MODE_CSN, NULL);
        } else if (simType == ICLASS_SIM_MODE_READER_ATTACK) {
                uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 };


@@ -657,17 +629,15 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
 static void ReaderTransmitIClass(uint8_t *frame, int len, uint32_t *start_time) {
 
        CodeIso15693AsReader(frame, len);
 static void ReaderTransmitIClass(uint8_t *frame, int len, uint32_t *start_time) {
 
        CodeIso15693AsReader(frame, len);

-

        TransmitTo15693Tag(ToSend, ToSendMax, start_time);
        TransmitTo15693Tag(ToSend, ToSendMax, start_time);

-

        uint32_t end_time = *start_time + 32*(8*ToSendMax-4); // substract the 4 padding bits after EOF
        LogTrace_ISO15693(frame, len, *start_time*4, end_time*4, NULL, true);
 }
 
 
 static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size,
        uint32_t end_time = *start_time + 32*(8*ToSendMax-4); // substract the 4 padding bits after EOF
        LogTrace_ISO15693(frame, len, *start_time*4, end_time*4, NULL, true);
 }
 
 
 static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size,

-                                                                                 uint8_t expected_size, uint8_t retries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
-       while (retries-- > 0) {
+                                                                                 uint8_t expected_size, uint8_t tries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
+       while (tries-- > 0) {

                ReaderTransmitIClass(command, cmdsize, &start_time);
                if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
                        return true;
                ReaderTransmitIClass(command, cmdsize, &start_time);
                if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
                        return true;


@@ -676,6 +646,7 @@ static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint
        return false;//Error
 }
 
        return false;//Error
 }
 

+

 /**
  * @brief Selects an iclass tag
  * @param card_data where the CSN is stored for return
 /**
  * @brief Selects an iclass tag
  * @param card_data where the CSN is stored for return


@@ -694,14 +665,14 @@ static bool selectIclassTag(uint8_t *card_data, uint32_t *eof_time) {
        // Send act_all
        ReaderTransmitIClass(act_all, 1, &start_time);
        // Card present?
        // Send act_all
        ReaderTransmitIClass(act_all, 1, &start_time);
        // Card present?

-       if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false;//Fail
+       if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false; //Fail

 
        //Send Identify
        start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
        ReaderTransmitIClass(identify, 1, &start_time);
        //We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC
        uint8_t len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);
 
        //Send Identify
        start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
        ReaderTransmitIClass(identify, 1, &start_time);
        //We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC
        uint8_t len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);

-       if (len != 10) return false;//Fail
+       if (len != 10) return false; //Fail

 
        //Copy the Anti-collision CSN to our select-packet
        memcpy(&select[1], resp, 8);
 
        //Copy the Anti-collision CSN to our select-packet
        memcpy(&select[1], resp, 8);


@@ -710,7 +681,7 @@ static bool selectIclassTag(uint8_t *card_data, uint32_t *eof_time) {
        ReaderTransmitIClass(select, sizeof(select), &start_time);
        //We expect a 10-byte response here, 8 byte CSN and 2 byte CRC
        len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);
        ReaderTransmitIClass(select, sizeof(select), &start_time);
        //We expect a 10-byte response here, 8 byte CSN and 2 byte CRC
        len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);

-       if (len != 10) return false;//Fail
+       if (len != 10) return false; //Fail

 
        //Success - we got CSN
        //Save CSN in response data
 
        //Success - we got CSN
        //Save CSN in response data


@@ -753,208 +724,54 @@ void ReaderIClass(uint8_t flags) {
        if (selectIclassTag(resp, &eof_time)) {
                result_status = FLAG_ICLASS_READER_CSN;
                memcpy(card_data, resp, 8);
        if (selectIclassTag(resp, &eof_time)) {
                result_status = FLAG_ICLASS_READER_CSN;
                memcpy(card_data, resp, 8);

-       }
-
-       start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-
-       //Read block 1, config
-       if (flags & FLAG_ICLASS_READER_CONF) {
-               if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-                       result_status |= FLAG_ICLASS_READER_CONF;
-                       memcpy(card_data+8, resp, 8);
-               } else {
-                       Dbprintf("Failed to read config block");
-               }
-               start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-       }
-
-       //Read block 2, e-purse
-       if (flags & FLAG_ICLASS_READER_CC) {
-               if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-                       result_status |= FLAG_ICLASS_READER_CC;
-                       memcpy(card_data + (8*2), resp, 8);
-               } else {
-                       Dbprintf("Failed to read e-purse");
-               }
-               start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-       }
-
-       //Read block 5, AA
-       if (flags & FLAG_ICLASS_READER_AA) {
-               if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-                       result_status |= FLAG_ICLASS_READER_AA;
-                       memcpy(card_data + (8*5), resp, 8);
-               } else {
-                       Dbprintf("Failed to read AA block");
-               }
-       }
-
-       cmd_send(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data));
-
-       LED_A_OFF();
-}
-
-
-void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
-
-       LED_A_ON();
-
-       bool use_credit_key = false;
-       uint8_t card_data[USB_CMD_DATA_SIZE]={0};
-       uint16_t block_crc_LUT[255] = {0};
-
-       //Generate a lookup table for block crc
-       for (int block = 0; block < 255; block++){
-               char bl = block;
-               block_crc_LUT[block] = iclass_crc16(&bl ,1);
-       }
-       //Dbprintf("Lookup table: %02x %02x %02x" ,block_crc_LUT[0],block_crc_LUT[1],block_crc_LUT[2]);
-
-       uint8_t readcheck_cc[] = { ICLASS_CMD_READCHECK_KD, 0x02 };
-       if (use_credit_key)
-               readcheck_cc[0] = ICLASS_CMD_READCHECK_KC;
-       uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
-       uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
-
-       uint16_t crc = 0;
-       uint8_t cardsize = 0;
-       uint8_t mem = 0;
-
-       static struct memory_t {
-               int k16;
-               int book;
-               int k2;
-               int lockauth;
-               int keyaccess;
-       } memory;
-
-       uint8_t resp[ICLASS_BUFFER_SIZE];
-
-       set_tracing(true);
-       clear_trace();
-       Iso15693InitReader();
-
-       StartCountSspClk();
-       uint32_t start_time = 0;
-       uint32_t eof_time = 0;
-
-       while (!BUTTON_PRESS()) {
-
-               WDT_HIT();
-
-               if (!get_tracing()) {
-                       DbpString("Trace full");
-                       break;
-               }
-
-               if (!selectIclassTag(card_data, &eof_time)) continue;

 
                start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
 
                start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;

-               if (!sendCmdGetResponseWithRetries(readcheck_cc, sizeof(readcheck_cc), resp, sizeof(resp), 8, 3, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) continue;
-
-               // replay captured auth (cc must not have been updated)
-               memcpy(check+5, MAC, 4);

 
 

-               start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-               if (!sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 5, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-                       Dbprintf("Error: Authentication Fail!");
-                       continue;
-               }
-
-               //first get configuration block (block 1)
-               crc = block_crc_LUT[1];
-               read[1] = 1;
-               read[2] = crc >> 8;
-               read[3] = crc & 0xff;
-
-               start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-               if (!sendCmdGetResponseWithRetries(read, sizeof(read), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+               //Read block 1, config
+               if (flags & FLAG_ICLASS_READER_CONF) {
+                       if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+                               result_status |= FLAG_ICLASS_READER_CONF;
+                               memcpy(card_data+8, resp, 8);
+                       } else {
+                               Dbprintf("Failed to read config block");
+                       }

                        start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
                        start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;

-                       Dbprintf("Dump config (block 1) failed");
-                       continue;

                }
 
                }
 

-               mem = resp[5];
-               memory.k16 = (mem & 0x80);
-               memory.book = (mem & 0x20);
-               memory.k2 = (mem & 0x8);
-               memory.lockauth = (mem & 0x2);
-               memory.keyaccess = (mem & 0x1);
-
-               cardsize = memory.k16 ? 255 : 32;
-               WDT_HIT();
-               //Set card_data to all zeroes, we'll fill it with data
-               memset(card_data, 0x0, USB_CMD_DATA_SIZE);
-               uint8_t failedRead = 0;
-               uint32_t stored_data_length = 0;
-               //then loop around remaining blocks
-               for (int block = 0; block < cardsize; block++) {
-                       read[1] = block;
-                       crc = block_crc_LUT[block];
-                       read[2] = crc >> 8;
-                       read[3] = crc & 0xff;
-
-                       start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-                       if (sendCmdGetResponseWithRetries(read, sizeof(read), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-                               Dbprintf("     %02x: %02x %02x %02x %02x %02x %02x %02x %02x",
-                                               block, resp[0], resp[1], resp[2],
-                                               resp[3], resp[4], resp[5],
-                                               resp[6], resp[7]);
-
-                               //Fill up the buffer
-                               memcpy(card_data+stored_data_length, resp, 8);
-                               stored_data_length += 8;
-                               if (stored_data_length +8 > USB_CMD_DATA_SIZE) {
-                                       //Time to send this off and start afresh
-                                       cmd_send(CMD_ACK,
-                                                        stored_data_length,//data length
-                                                        failedRead,//Failed blocks?
-                                                        0,//Not used ATM
-                                                        card_data, stored_data_length);
-                                       //reset
-                                       stored_data_length = 0;
-                                       failedRead = 0;
-                               }
-
+               //Read block 2, e-purse
+               if (flags & FLAG_ICLASS_READER_CC) {
+                       if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+                               result_status |= FLAG_ICLASS_READER_CC;
+                               memcpy(card_data + (8*2), resp, 8);

                        } else {
                        } else {

-                               failedRead = 1;
-                               stored_data_length += 8;//Otherwise, data becomes misaligned
-                               Dbprintf("Failed to dump block %d", block);
+                               Dbprintf("Failed to read e-purse");

                        }
                        }

+                       start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;

                }
 
                }
 

-               //Send off any remaining data
-               if (stored_data_length > 0) {
-                       cmd_send(CMD_ACK,
-                                        stored_data_length,//data length
-                                        failedRead,//Failed blocks?
-                                        0,//Not used ATM
-                                        card_data,
-                                        stored_data_length);
+               //Read block 5, AA
+               if (flags & FLAG_ICLASS_READER_AA) {
+                       if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+                               result_status |= FLAG_ICLASS_READER_AA;
+                               memcpy(card_data + (8*5), resp, 8);
+                       } else {
+                               Dbprintf("Failed to read AA block");
+                       }

                }
                }

-               //If we got here, let's break
-               break;

        }
        }

-       //Signal end of transmission
-       cmd_send(CMD_ACK,
-                        0,//data length
-                        0,//Failed blocks?
-                        0,//Not used ATM
-                        card_data,
-                        0);
+       
+       cmd_send(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data));

 
 

-       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-       LED_D_OFF();

        LED_A_OFF();
 }
 
 
        LED_A_OFF();
 }
 
 

-void iClass_Check(uint8_t *MAC) {
+void iClass_Check(uint8_t *NRMAC) {

        uint8_t check[9] = {ICLASS_CMD_CHECK_KD, 0x00};
        uint8_t resp[4];
        uint8_t check[9] = {ICLASS_CMD_CHECK_KD, 0x00};
        uint8_t resp[4];

-       memcpy(check+5, MAC, 4);
+       memcpy(check+1, NRMAC, 8);

        uint32_t eof_time;
        uint32_t eof_time;

-       bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+       bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);

        cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
 }
 
        cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
 }
 


@@ -966,14 +783,14 @@ void iClass_Readcheck(uint8_t block, bool use_credit_key) {
        }
        uint8_t resp[8];
        uint32_t eof_time;
        }
        uint8_t resp[8];
        uint32_t eof_time;

-       bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+       bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);

        cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
 }
 
 
 static bool iClass_ReadBlock(uint8_t blockNo, uint8_t *readdata) {
        uint8_t readcmd[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockNo, 0x00, 0x00}; //0x88, 0x00 // can i use 0C?
        cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
 }
 
 
 static bool iClass_ReadBlock(uint8_t blockNo, uint8_t *readdata) {
        uint8_t readcmd[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockNo, 0x00, 0x00}; //0x88, 0x00 // can i use 0C?

-       char bl = blockNo;
+       uint8_t bl = blockNo;

        uint16_t rdCrc = iclass_crc16(&bl, 1);
        readcmd[2] = rdCrc >> 8;
        readcmd[3] = rdCrc & 0xff;
        uint16_t rdCrc = iclass_crc16(&bl, 1);
        readcmd[2] = rdCrc >> 8;
        readcmd[3] = rdCrc & 0xff;


@@ -991,11 +808,11 @@ void iClass_ReadBlk(uint8_t blockno) {
 
        LED_A_ON();
 
 
        LED_A_ON();
 

-       uint8_t readblockdata[] = {0,0,0,0,0,0,0,0,0,0};
+       uint8_t readblockdata[10];

        bool isOK = iClass_ReadBlock(blockno, readblockdata);
        bool isOK = iClass_ReadBlock(blockno, readblockdata);

-       cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);

        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_D_OFF();
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_D_OFF();

+       cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);

 
        LED_A_OFF();
 }
 
        LED_A_OFF();
 }


@@ -1021,6 +838,9 @@ void iClass_Dump(uint8_t startblock, uint8_t numblks) {
                }
        }
 
                }
        }
 

+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LED_D_OFF();
+

        cmd_send(CMD_ACK, isOK, blkCnt, 0, readblockdata, blkCnt*8);
 
        LED_A_OFF();
        cmd_send(CMD_ACK, isOK, blkCnt, 0, readblockdata, blkCnt*8);
 
        LED_A_OFF();


@@ -1036,12 +856,27 @@ static bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) {
        bool isOK = false;
        uint32_t eof_time = 0;
 
        bool isOK = false;
        uint32_t eof_time = 0;
 

-       isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 10, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
-       if (isOK && blockNo != 3 && blockNo != 4 && memcmp(write+2, resp, 8)) { // check response
-               isOK = false;
+       isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 3, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
+       if (!isOK) {
+               return false;
+       }
+       
+       uint8_t all_ff[8] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+       if (blockNo == 2) {
+               if (memcmp(data+4, resp, 4) || memcmp(data, resp+4, 4)) { // check response. e-purse update swaps first and second half
+                       return false;
+               }
+       } else if (blockNo == 3 || blockNo == 4) {
+               if (memcmp(all_ff, resp, 8)) { // check response. Key updates always return 0xffffffffffffffff
+                       return false;
+               }
+       } else {
+               if (memcmp(data, resp, 8)) { // check response. All other updates return unchanged data
+                       return false;
+               }

        }
 
        }
 

-       return isOK;
+       return true;

 }
 
 
 }
 
 


@@ -1055,40 +890,39 @@ void iClass_WriteBlock(uint8_t blockNo, uint8_t *data) {
        } else {
                Dbprintf("Write block [%02x] failed", blockNo);
        }
        } else {
                Dbprintf("Write block [%02x] failed", blockNo);
        }

-       cmd_send(CMD_ACK, isOK, 0, 0, 0, 0);
-

        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_D_OFF();
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_D_OFF();
 

+       cmd_send(CMD_ACK, isOK, 0, 0, 0, 0);

        LED_A_OFF();
 }
 
 
 void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
        LED_A_OFF();
 }
 
 
 void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {

-       int i;
+
+       LED_A_ON();
+

        int written = 0;
        int written = 0;

-       int total_block = (endblock - startblock) + 1;
-       for (i = 0; i < total_block; i++) {
+       int total_blocks = (endblock - startblock) + 1;
+
+       for (uint8_t block = startblock; block <= endblock; block++) {

                // block number
                // block number

-               if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
-                       Dbprintf("Write block [%02x] successful", i + startblock);
+               if (iClass_WriteBlock_ext(block, data + (block-startblock)*12)) {
+                       Dbprintf("Write block [%02x] successful", block);

                        written++;
                } else {
                        written++;
                } else {

-                       if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
-                               Dbprintf("Write block [%02x] successful", i + startblock);
-                               written++;
-                       } else {
-                               Dbprintf("Write block [%02x] failed", i + startblock);
-                       }
+                       Dbprintf("Write block [%02x] failed", block);

                }
        }
                }
        }

-       if (written == total_block)
+
+       if (written == total_blocks)

                Dbprintf("Clone complete");
        else
                Dbprintf("Clone incomplete");
 
                Dbprintf("Clone complete");
        else
                Dbprintf("Clone incomplete");
 

-       cmd_send(CMD_ACK, 1, 0, 0, 0, 0);

        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_D_OFF();
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LED_D_OFF();

+
+       cmd_send(CMD_ACK, 1, 0, 0, 0, 0);

        LED_A_OFF();
 }
        LED_A_OFF();
 }