1. small bugfix in hf 14a mifare

2. now in cmd  hf 14a mifare - blinks LED_C
3. bugfix in readblock
2. bugfix in USB CommandReceived
3. small improvements

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 7b709ab099fc47a0730b9fdd047ea2ab146d2dc0..b64a1942a033a2d6a46afa8b1efe0e45b5ce66e2 100644 (file)
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -1693,7 +1693,7 @@ void ReaderMifare(uint32_t parameter)
        byte_t par_mask = 0xff;
        byte_t par_low = 0;
        int led_on = TRUE;
-       uint8_t uid[7];
+       uint8_t uid[8];
        uint32_t cuid;
 
        tracing = FALSE;
@@ -1702,13 +1702,15 @@ void ReaderMifare(uint32_t parameter)
        byte_t par_list[8] = {0,0,0,0,0,0,0,0};
        byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
        num_to_bytes(parameter, 4, nt_attacked);
-       int isOK = 0;
+       int isOK = 0, isNULL = 0;
        
        while(TRUE)
        {
+               LED_C_ON();
                FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
                SpinDelay(200);
                FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+               LED_C_OFF();
 
                // Test if the action was cancelled
                if(BUTTON_PRESS()) {
@@ -1730,6 +1732,9 @@ void ReaderMifare(uint32_t parameter)
                // Receive 4 bit answer
                if (ReaderReceive(receivedAnswer))
                {
+                       isNULL = (nt_attacked[0] = 0) && (nt_attacked[1] = 0) && (nt_attacked[2] = 0) && (nt_attacked[3] = 0);
+                       if ( (isNULL != 0 ) && (memcmp(nt, nt_attacked, 4) != 0) ) continue;
+
                        if (nt_diff == 0)
                        {
                                LED_A_ON();
@@ -1738,8 +1743,6 @@ void ReaderMifare(uint32_t parameter)
                                par_low = par & 0x07;
                        }
 
-                       if (memcmp(nt, nt_attacked, 4) != 0) continue;
-
                        led_on = !led_on;
                        if(led_on) LED_B_ON(); else LED_B_OFF();
                        par_list[nt_diff] = par;
@@ -1801,7 +1804,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        // variables
        byte_t isOK = 0;
        byte_t dataoutbuf[16];
-       uint8_t uid[7];
+       uint8_t uid[8];
        uint32_t cuid;
        struct Crypto1State mpcs = {0, 0};
        struct Crypto1State *pcs;
@@ -2075,7 +2078,8 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        
        // variables
        uint8_t targetBlockNo = blockNo + 1;
-       int rtr, i, m, len;
+       uint8_t targetKeyType = keyType;
+       int rtr, i, j, m, len;
        int davg, dmin, dmax;
        uint8_t uid[8];
        uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
@@ -2083,6 +2087,7 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        nestedVector nvector[3][10];
        int nvectorcount[3] = {10, 10, 10};
        int ncount = 0;
+       UsbCommand ack = {CMD_ACK, {0, 0, 0}};
        struct Crypto1State mpcs = {0, 0};
        struct Crypto1State *pcs;
        pcs = &mpcs;
@@ -2156,8 +2161,8 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        LED_C_ON();
 
        //  get crypted nonces for target sector
-       for (rtr = 0; rtr < 4; rtr++) {
-               Dbprintf("------------------------------");
+       for (rtr = 0; rtr < 2; rtr++) {
+//             Dbprintf("------------------------------");
 
                FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     SpinDelay(100);
@@ -2179,14 +2184,14 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                };
 
                // nested authentication
-               len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (keyType & 0x01), targetBlockNo, receivedAnswer, &par);
+               len = mifare_sendcmd_shortex(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, &par);
                if (len != 4) {
                        Dbprintf("Auth2 error len=%d", len);
                        break;
                };
        
                nt2 = bytes_to_num(receivedAnswer, 4);          
-               Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
+//             Dbprintf("r=%d nt1=%08x nt2enc=%08x nt2par=%08x", rtr, nt1, nt2, par);
                
 // -----------------------  test               
 /*     uint32_t d_nt, d_ks1, d_ks2, d_ks3, reader_challenge;
@@ -2234,23 +2239,25 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
                                ncount++;
                                nvectorcount[2] = ncount;
                                
-                               Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
+//                             Dbprintf("valid m=%d ks1=%08x nttest=%08x", m, ks1, nttest);
                        }
 
                }
                
                // select vector with length less than got
-               m = 2;
-               if (nvectorcount[2] < nvectorcount[1]) m = 1;
-               if (nvectorcount[2] < nvectorcount[0]) m = 0;
-               if (m != 2) {
-                       for (i = 0; i < nvectorcount[m]; i++) {
-                               nvector[m][i] = nvector[2][i];
+               if (nvectorcount[2] != 0) {
+                       m = 2;
+                       if (nvectorcount[2] < nvectorcount[1]) m = 1;
+                       if (nvectorcount[2] < nvectorcount[0]) m = 0;
+                       if (m != 2) {
+                               for (i = 0; i < nvectorcount[m]; i++) {
+                                       nvector[m][i] = nvector[2][i];
+                               }
+                               nvectorcount[m] = nvectorcount[2];
                        }
-                       nvectorcount[m] = nvectorcount[2];
                }
                
-               Dbprintf("vector count: 1=%d 2=%d 3=%d", nvectorcount[0], nvectorcount[1], nvectorcount[2]);
+//             Dbprintf("vector count: 1=%d 2=%d 3=%d", nvectorcount[0], nvectorcount[1], nvectorcount[2]);
        }
 
        LED_C_OFF();
@@ -2267,27 +2274,36 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        LogTrace(uid, 4, 0, 0, TRUE);
 
        for (i = 0; i < 2; i++) {
-               ncount = nvectorcount[i];
-               if (ncount > 5) ncount = 5; //!!!!!  needs to be 2 packets x 5 pairs (nt,ks1)
-
-               // isEOF = 0
-               UsbCommand ack = {CMD_ACK, {0, ncount, targetBlockNo}};
-               memcpy(ack.d.asBytes, &cuid, 4);
-               for (m = 0; m < 5; m++) {
-                       memcpy(ack.d.asBytes + 4 + m * 8 + 0, &nvector[i][m].nt, 4);
-                       memcpy(ack.d.asBytes + 4 + m * 8 + 4, &nvector[i][m].ks1, 4);
-               }
+               for (j = 0; j < nvectorcount[i]; j += 5) {
+                       ncount = nvectorcount[i] - j;
+                       if (ncount > 5) ncount = 5; 
+
+                       ack.arg[0] = 0; // isEOF = 0
+                       ack.arg[1] = ncount;
+                       ack.arg[2] = targetBlockNo + (targetKeyType * 0x100);
+                       memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
+                       
+                       memcpy(ack.d.asBytes, &cuid, 4);
+                       for (m = 0; m < ncount; m++) {
+                               memcpy(ack.d.asBytes + 8 + m * 8 + 0, &nvector[i][m + j].nt, 4);
+                               memcpy(ack.d.asBytes + 8 + m * 8 + 4, &nvector[i][m + j].ks1, 4);
+                       }
        
-               LED_B_ON();
-               UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
-               LED_B_OFF();    
+                       LED_B_ON();
+                       SpinDelay(100);
+                       UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
+                       LED_B_OFF();    
+               }
        }
 
        // finalize list
-       // isEOF = 1
-       UsbCommand ack = {CMD_ACK, {1, 0, 0}};
+       ack.arg[0] = 1; // isEOF = 1
+       ack.arg[1] = 0;
+       ack.arg[2] = 0;
+       memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
        
        LED_B_ON();
+       SpinDelay(300);
        UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
        LED_B_OFF();    
 
@@ -2306,4 +2322,39 @@ void MifareNested(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 //-----------------------------------------------------------------------------
 void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 {
+       int cardSTATE = MFEMUL_NOFIELD;
+
+       while (true) {
+
+               if(BUTTON_PRESS()) {
+      break;
+    }
+       
+               switch (cardSTATE) {
+                       case MFEMUL_NOFIELD:{
+                               break;
+                       }
+                       case MFEMUL_IDLE:{
+                               break;
+                       }
+                       case MFEMUL_SELECT1:{
+                               break;
+                       }
+                       case MFEMUL_SELECT2:{
+                               break;
+                       }
+                       case MFEMUL_AUTH1:{
+                               break;
+                       }
+                       case MFEMUL_AUTH2:{
+                               break;
+                       }
+                       case MFEMUL_HALTED:{
+                               break;
+                       }
+               
+               }
+       
+       }
+
 }

diff --git a/armsrc/mifareutil.h b/armsrc/mifareutil.h
index d3307bb7093fe1a66b6a57231d8975e4459de93e..715dfe63c05d83cd998843dc28f2fcd255a4b497 100644 (file)
--- a/armsrc/mifareutil.h
+++ b/armsrc/mifareutil.h
@@ -15,6 +15,16 @@
 #define AUTH_FIRST    0\r
 #define AUTH_NESTED   2\r
 \r
+//mifare emulate states\r
+#define MFEMUL_NOFIELD  0\r
+#define MFEMUL_IDLE     1\r
+#define MFEMUL_SELECT1  2\r
+#define MFEMUL_SELECT2  3\r
+#define MFEMUL_AUTH1    4\r
+#define MFEMUL_AUTH2    5\r
+#define MFEMUL_HALTED   6\r
+\r
+//functions\r
 uint8_t* mifare_get_bigbufptr(void);\r
 int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer);\r
 int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint32_t * parptr);\r

diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c
index e0b1c3a91ed2a3b8ecc01ce6d2871041ba9d6c5c..46cfbebe3d5a2726f748215ae6ac911633a49b03 100644 (file)
--- a/client/cmdhf14a.c
+++ b/client/cmdhf14a.c
@@ -444,14 +444,19 @@ int CmdHF14AMfRdSc(const char *Cmd)
 
 int CmdHF14AMfNested(const char *Cmd)
 {
-       int i, temp;
+       int i, temp, len;
        uint8_t sectorNo = 0;
        uint8_t keyType = 0;
        uint8_t key[6] = {0, 0, 0, 0, 0, 0};
+       uint8_t isEOF;
+       uint8_t * data;
+       uint32_t uid;
+       fnVector * vector = NULL;
+       int lenVector = 0;
+       UsbCommand * resp = NULL;
        
        const char *cmdp        = Cmd;
 
-
        if (strlen(Cmd)<3) {
                PrintAndLog("Usage:  hf 14a nested    <sector number> <key A/B> <key (12 hex symbols)>");
                PrintAndLog("           sample: hf 14a nested 0 A FFFFFFFFFFFF ");
@@ -485,24 +490,69 @@ int CmdHF14AMfNested(const char *Cmd)
                cmdp++;
        }       
        PrintAndLog(" sector no:%02x key type:%02x key:%s ", sectorNo, keyType, sprint_hex(key, 6));
+
+       // flush queue
+       while (WaitForResponseTimeout(CMD_ACK, 500) != NULL) ;
        
   UsbCommand c = {CMD_MIFARE_NESTED, {sectorNo, keyType, 0}};
        memcpy(c.d.asBytes, key, 6);
   SendCommand(&c);
-       UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
-       PrintAndLog(" ");
 
-       if (resp != NULL) {
-               uint8_t                isOK  = resp->arg[0] & 0xff;
-               uint8_t              * data  = resp->d.asBytes;
+       PrintAndLog("\n");
+       printf("-------------------------------------------------------------------------\n");
 
-               PrintAndLog("isOk:%02x", isOK);
-               for (i = 0; i < 2; i++) {
-                       PrintAndLog("data:%s", sprint_hex(data + i * 16, 16));
+       // wait cycle
+       while (true) {
+               printf(".");
+               if (kbhit()) {
+                       getchar();
+                       printf("\naborted via keyboard!\n");
+                       break;
+               }
+
+               resp = WaitForResponseTimeout(CMD_ACK, 1500);
+
+               if (resp != NULL) {
+                       isEOF  = resp->arg[0] & 0xff;
+                       data  = resp->d.asBytes;
+
+                       PrintAndLog("isEOF:%02x", isEOF);       
+                       for (i = 0; i < 2; i++) {
+                               PrintAndLog("data:%s", sprint_hex(data + i * 16, 16));
+                       }
+                       if (isEOF) break;
+                       
+                       len = resp->arg[1] & 0xff;
+                       if (len == 0) continue;
+                       
+                       memcpy(&uid, resp->d.asBytes, 4); 
+                       PrintAndLog("uid:%08x len=%d trgbl=%d trgkey=%d", uid, len, resp->arg[2] & 0xff, (resp->arg[2] >> 8) & 0xff);
+
+                       vector = (fnVector *) realloc((void *)vector, (lenVector + len) * sizeof(fnVector) + 200);
+                       if (vector == NULL) {
+                               PrintAndLog("Memory allocation error for fnVector. len: %d bytes: %d", lenVector + len, (lenVector + len) * sizeof(fnVector)); 
+                               break;
+                       }
+                       
+                       for (i = 0; i < len; i++) {
+                               vector[lenVector + i].blockNo = resp->arg[2] & 0xff;
+                               vector[lenVector + i].keyType = (resp->arg[2] >> 8) & 0xff;
+                               vector[lenVector + i].uid = uid;
+
+                               memcpy(&vector[lenVector + i].nt,  (void *)(resp->d.asBytes + 8 + i * 8 + 0), 4);
+                               memcpy(&vector[lenVector + i].ks1, (void *)(resp->d.asBytes + 8 + i * 8 + 4), 4);
+
+                               PrintAndLog("i=%d nt:%08x ks1:%08x", i, vector[lenVector + i].nt, vector[lenVector + i].ks1);
+                       }
+
+                       lenVector += len;
                }
-       } else {
-               PrintAndLog("Command execute timeout");
        }
+       
+       
+       
+       // finalize
+       free(vector);
 
   return 0;
 }

diff --git a/client/cmdhf14a.h b/client/cmdhf14a.h
index eaab18cb2c5fca5dd0342f8f63e312064f57daa9..fdb8b959a9136e1c58ee3345e09e59e378e7a5c7 100644 (file)
--- a/client/cmdhf14a.h
+++ b/client/cmdhf14a.h
@@ -1,4 +1,5 @@
 //-----------------------------------------------------------------------------
+// 2011, Merlok
 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
@@ -11,6 +12,8 @@
 #ifndef CMDHF14A_H__
 #define CMDHF14A_H__
 
+typedef struct fnVector { uint8_t blockNo, keyType; uint32_t uid, nt, ks1; } fnVector;
+
 int CmdHF14A(const char *Cmd);
 
 int CmdHF14AList(const char *Cmd);

diff --git a/client/cmdmain.c b/client/cmdmain.c
index 3388d75fbc64bf4caee8508426b8e5daf578e1b1..c27d840618f74435e7d123a2a24acfe592f84d94 100644 (file)
--- a/client/cmdmain.c
+++ b/client/cmdmain.c
@@ -26,6 +26,7 @@
 unsigned int current_command = CMD_UNKNOWN;
 unsigned int received_command = CMD_UNKNOWN;
 UsbCommand current_response;
+UsbCommand current_response_user;
 
 static int CmdHelp(const char *Cmd);
 static int CmdQuit(const char *Cmd);
@@ -55,12 +56,16 @@ int CmdQuit(const char *Cmd)
 }
 
 UsbCommand * WaitForResponseTimeout(uint32_t response_type, uint32_t ms_timeout) {
-       UsbCommand * ret = &current_response;
+       UsbCommand * ret =  NULL;
        int i=0;
 
        for(i=0; received_command != response_type && i < ms_timeout / 10; i++) {
                msleep(10); // XXX ugh
        }
+       
+       // There was evil BUG
+       memcpy(&current_response_user, &current_response, sizeof(UsbCommand));
+       ret = &current_response_user;
 
        if(received_command != response_type)
                ret = NULL;