#define IsMillerModulationNibble1(b) (Mod_Miller_LUT[(b & 0x000000F0) >> 4])
#define IsMillerModulationNibble2(b) (Mod_Miller_LUT[(b & 0x0000000F)])
-static void UartReset()
-{
+static void UartReset() {
Uart.state = STATE_UNSYNCD;
Uart.bitCount = 0;
Uart.len = 0; // number of decoded data bytes
Uart.parityBits = 0; // holds 8 parity bits
}
-static void UartInit(uint8_t *data, uint8_t *parity)
-{
+static void UartInit(uint8_t *data, uint8_t *parity) {
Uart.output = data;
Uart.parity = parity;
Uart.fourBits = 0x00000000; // clear the buffer for 4 Bits
}
// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
-static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time)
-{
+static RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time) {
Uart.fourBits = (Uart.fourBits << 8) | bit;
#define IsManchesterModulationNibble2(b) (Mod_Manchester_LUT[(b & 0x000F)])
-static void DemodReset()
-{
+static void DemodReset() {
Demod.state = DEMOD_UNSYNCD;
Demod.len = 0; // number of decoded data bytes
Demod.parityLen = 0;
Demod.endTime = 0;
}
-static void DemodInit(uint8_t *data, uint8_t *parity)
-{
+static void DemodInit(uint8_t *data, uint8_t *parity) {
Demod.output = data;
Demod.parity = parity;
DemodReset();
}
// use parameter non_real_time to provide a timestamp. Set to 0 if the decoder should measure real time
-static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time)
-{
+static RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time) {
Demod.twoBits = (Demod.twoBits << 8) | bit;
//-----------------------------------------------------------------------------
// Prepare tag messages
//-----------------------------------------------------------------------------
-static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity)
-{
+static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *parity) {
ToSendReset();
// Correction bit, might be removed when not needed
}
-static void Code4bitAnswerAsTag(uint8_t cmd)
-{
+static void Code4bitAnswerAsTag(uint8_t cmd) {
int i;
ToSendReset();
// Stop when button is pressed
// Or return true when command is captured
//-----------------------------------------------------------------------------
-static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len)
-{
+static int GetIso14443aCommandFromReader(uint8_t *received, uint8_t *parity, int *len) {
// Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
// only, since we are receiving, not transmitting).
// Signal field is off with the appropriate LED
// Main loop of simulated tag: receive commands from reader, decide what
// response to send, and send it.
//-----------------------------------------------------------------------------
-void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
-{
+void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) {
+
uint8_t sak;
// The first response contains the ATQA (note: bytes are transmitted in reverse order).
// prepare a delayed transfer. This simply shifts ToSend[] by a number
// of bits specified in the delay parameter.
-static void PrepareDelayedTransfer(uint16_t delay)
-{
+static void PrepareDelayedTransfer(uint16_t delay) {
uint8_t bitmask = 0;
uint8_t bits_to_shift = 0;
uint8_t bits_shifted = 0;
// if == 0: transfer immediately and return time of transfer
// if != 0: delay transfer until time specified
//-------------------------------------------------------------------------------------
-static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing)
-{
+static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing) {
LED_B_ON();
LED_D_ON();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
uint32_t ThisTransferTime = 0;
if (timing) {
- if(*timing == 0) { // Measure time
+ if (*timing == 0) { // Measure time
*timing = (GetCountSspClk() + 8) & 0xfffffff8;
} else {
PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks)
}
- if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
+ if (MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
while (GetCountSspClk() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks)
LastTimeProxToAirStart = *timing;
} else {
LastTimeProxToAirStart = ThisTransferTime;
}
- // clear TXRDY
- AT91C_BASE_SSC->SSC_THR = SEC_Y;
-
uint16_t c = 0;
for (;;) {
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
+ if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = cmd[c];
c++;
if(c >= len) {
//-----------------------------------------------------------------------------
// Prepare reader command (in bits, support short frames) to send to FPGA
//-----------------------------------------------------------------------------
-static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity)
-{
+static void CodeIso14443aBitsAsReaderPar(const uint8_t *cmd, uint16_t bits, const uint8_t *parity) {
int i, j;
int last;
uint8_t b;
// Stop when button is pressed (return 1) or field was gone (return 2)
// Or return 0 when command is captured
//-----------------------------------------------------------------------------
-int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity)
-{
+int EmGetCmd(uint8_t *received, uint16_t *len, uint8_t *parity) {
uint32_t field_off_time = -1;
uint32_t samples = 0;
int ret = 0;
}
-static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen)
-{
+static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen) {
LED_C_ON();
uint8_t b;
// If a response is captured return true
// If it takes too long return false
//-----------------------------------------------------------------------------
-static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset)
-{
+static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receivedResponsePar, uint16_t offset) {
uint32_t c;
// Set FPGA mode to "reader listen mode", no modulation (listen
for (;;) {
WDT_HIT();
- if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
+ if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
- if(ManchesterDecoding(b, offset, 0)) {
+ if (ManchesterDecoding(b, offset, 0)) {
NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);
return true;
} else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {
}
-void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing)
-{
+void ReaderTransmitBitsPar(uint8_t* frame, uint16_t bits, uint8_t *par, uint32_t *timing) {
+
CodeIso14443aBitsAsReaderPar(frame, bits, par);
// Send command to tag
TransmitFor14443a(ToSend, ToSendMax, timing);
- if(trigger)
+ if (trigger)
LED_A_ON();
// Log reader command in trace buffer
}
-void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing)
-{
- ReaderTransmitBitsPar(frame, len*8, par, timing);
+void ReaderTransmitPar(uint8_t* frame, uint16_t len, uint8_t *par, uint32_t *timing) {
+ ReaderTransmitBitsPar(frame, len*8, par, timing);
}
-static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing)
-{
+static void ReaderTransmitBits(uint8_t* frame, uint16_t len, uint32_t *timing) {
// Generate parity and redirect
uint8_t par[MAX_PARITY_SIZE];
GetParity(frame, len/8, par);
}
-void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing)
-{
+void ReaderTransmit(uint8_t* frame, uint16_t len, uint32_t *timing) {
// Generate parity and redirect
uint8_t par[MAX_PARITY_SIZE];
GetParity(frame, len, par);
}
-static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity)
-{
+static int ReaderReceiveOffset(uint8_t* receivedAnswer, uint16_t offset, uint8_t *parity) {
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, offset)) return false;
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
return Demod.len;
}
-int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity)
-{
+int ReaderReceive(uint8_t *receivedAnswer, uint8_t *parity) {
if (!GetIso14443aAnswerFromTag(receivedAnswer, parity, 0)) return false;
+
LogTrace(receivedAnswer, Demod.len, Demod.startTime*16 - DELAY_AIR2ARM_AS_READER, Demod.endTime*16 - DELAY_AIR2ARM_AS_READER, parity, false);
return Demod.len;
}
static int GetATQA(uint8_t *resp, uint8_t *resp_par) {
#define WUPA_RETRY_TIMEOUT 10 // 10ms
- uint8_t wupa[] = { 0x52 }; // 0x26 - REQA 0x52 - WAKE-UP
+ uint8_t wupa[] = {ISO14443A_CMD_WUPA}; // 0x26 - REQA 0x52 - WAKE-UP
uint32_t save_iso14a_timeout = iso14a_get_timeout();
iso14a_set_timeout(1236/(16*8)+1); // response to WUPA is expected at exactly 1236/fc. No need to wait longer.
int len;
// init card struct
- if(p_hi14a_card) {
+ if (p_hi14a_card) {
p_hi14a_card->uidlen = 0;
memset(p_hi14a_card->uid, 0, 10);
p_hi14a_card->ats_len = 0;
return 0;
}
- if(p_hi14a_card) {
+ if (p_hi14a_card) {
memcpy(p_hi14a_card->atqa, resp, 2);
}
// Read an ISO 14443a tag. Send out commands and store answers.
//
//-----------------------------------------------------------------------------
-void ReaderIso14443a(UsbCommand *c)
-{
+void ReaderIso14443a(UsbCommand *c) {
+
iso14a_command_t param = c->arg[0];
uint8_t *cmd = c->d.asBytes;
size_t len = c->arg[1] & 0xffff;
extern int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *resp_data, uint32_t *cuid_ptr, bool anticollision, uint8_t num_cascades, bool no_rats);
extern void iso14a_set_trigger(bool enable);
extern void iso14a_set_timeout(uint32_t timeout);
+extern uint32_t iso14a_get_timeout(void);
#endif /* __ISO14443A_H */
break;\r
};\r
\r
- if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
+ if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
break;\r
};\r
}\r
\r
\r
- if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
+ if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {\r
isOK = 0;\r
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
}\r
break;\r
};\r
\r
- if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
+ if(mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
break;\r
};\r
}\r
\r
uint32_t nt1;\r
- if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {\r
+ if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("AcquireNonces: Auth1 error");\r
continue;\r
}\r
// MIFARE nested authentication.\r
//\r
//-----------------------------------------------------------------------------\r
-void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain)\r
-{\r
- // params\r
+void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *datain) {\r
+\r
uint8_t blockNo = arg0 & 0xff;\r
uint8_t keyType = (arg0 >> 8) & 0xff;\r
uint8_t targetBlockNo = arg1 & 0xff;\r
\r
ui64Key = bytes_to_num(datain, 6);\r
\r
- // variables\r
uint16_t rtr, i, j, len;\r
uint16_t davg;\r
static uint16_t dmin, dmax;\r
pcs = &mpcs;\r
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];\r
\r
- uint32_t auth1_time, auth2_time;\r
+ uint32_t auth1_time, auth2_time, authentication_timeout = 0;\r
static uint16_t delta_time;\r
\r
LED_A_ON();\r
- LED_C_OFF();\r
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
\r
// free eventually allocated BigBuf memory\r
for (rtr = 0; rtr < 17; rtr++) {\r
\r
// prepare next select. No need to power down the card.\r
- if(mifare_classic_halt(pcs, cuid)) {\r
+ if (mifare_classic_halt(pcs, cuid)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");\r
rtr--;\r
continue;\r
}\r
\r
// Test if the action was cancelled\r
- if(BUTTON_PRESS()) {\r
+ if (BUTTON_PRESS()) {\r
isOK = -2;\r
break;\r
}\r
\r
- if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
+ if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
rtr--;\r
continue;\r
};\r
\r
auth1_time = 0;\r
- if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
+ if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
rtr--;\r
continue;\r
} else {\r
auth2_time = 0;\r
}\r
- if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) {\r
+ if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");\r
rtr--;\r
continue;\r
LED_C_ON();\r
\r
// get crypted nonces for target sector\r
- for(i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r
+ for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces\r
\r
target_nt[i] = 0;\r
- while(target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce\r
+ while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce\r
\r
// prepare next select. No need to power down the card.\r
if(mifare_classic_halt(pcs, cuid)) {\r
}\r
\r
// break out of the loop on button press\r
- if(BUTTON_PRESS()) {\r
+ if (BUTTON_PRESS()) {\r
isOK = -2;\r
break;\r
}\r
\r
- if(!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
+ if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Can't select card");\r
continue;\r
}\r
\r
auth1_time = 0;\r
- if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time)) {\r
- if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
+ authentication_timeout = 0;\r
+ if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, &auth1_time, &authentication_timeout)) {\r
+ if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth1 error");\r
continue;\r
}\r
\r
// ----------------------------- crypto1 destroy\r
crypto1_destroy(pcs);\r
\r
- byte_t buf[4 + 4 * 4];\r
+ uint8_t buf[4 + 4 * 4 + 4];\r
memcpy(buf, &cuid, 4);\r
memcpy(buf+4, &target_nt[0], 4);\r
memcpy(buf+8, &target_ks[0], 4);\r
memcpy(buf+12, &target_nt[1], 4);\r
memcpy(buf+16, &target_ks[1], 4);\r
+ memcpy(buf+20, &authentication_timeout, 4);\r
\r
LED_B_ON();\r
cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));\r
LEDsoff();\r
}\r
\r
+\r
//-----------------------------------------------------------------------------\r
// MIFARE check keys. key count up to 85.\r
//\r
//-----------------------------------------------------------------------------\r
-void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)\r
-{\r
+void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain) {\r
+\r
uint8_t blockNo = arg0 & 0xff;\r
- uint8_t keyType = (arg0 >> 8) & 0xff;\r
+ uint8_t keyType = arg0 >> 8;\r
bool clearTrace = arg1 & 0x01;\r
bool multisectorCheck = arg1 & 0x02;\r
- uint8_t set14aTimeout = (arg1 >> 8) & 0xff;\r
+ bool init = arg1 & 0x04;\r
+ bool drop_field = arg1 & 0x08;\r
+ uint32_t auth_timeout = arg1 >> 16;\r
uint8_t keyCount = arg2;\r
\r
LED_A_ON();\r
\r
- // clear debug level\r
- int OLD_MF_DBGLEVEL = MF_DBGLEVEL;\r
- MF_DBGLEVEL = MF_DBG_NONE;\r
-\r
- iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
-\r
+ if (init) {\r
+ iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);\r
+ }\r
+ \r
if (clearTrace) {\r
clear_trace();\r
}\r
set_tracing(true);\r
\r
- if (set14aTimeout){\r
- iso14a_set_timeout(set14aTimeout * 10); // timeout: ms = x/106 35-minimum, 50-OK 106-recommended 500-safe\r
- }\r
+ // clear debug level. We are expecting lots of authentication failures...\r
+ int OLD_MF_DBGLEVEL = MF_DBGLEVEL;\r
+ MF_DBGLEVEL = MF_DBG_NONE;\r
\r
+ int res = 0;\r
if (multisectorCheck) {\r
TKeyIndex keyIndex = {{0}};\r
uint8_t sectorCnt = blockNo;\r
- int res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, OLD_MF_DBGLEVEL, &keyIndex);\r
-\r
+ res = MifareMultisectorChk(datain, keyCount, sectorCnt, keyType, &auth_timeout, OLD_MF_DBGLEVEL, &keyIndex);\r
if (res >= 0) {\r
cmd_send(CMD_ACK, 1, res, 0, keyIndex, 80);\r
} else {\r
cmd_send(CMD_ACK, 0, res, 0, NULL, 0);\r
}\r
} else { \r
- int res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, OLD_MF_DBGLEVEL);\r
- \r
+ res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);\r
if (res > 0) {\r
cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);\r
} else {\r
}\r
}\r
\r
- FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
- LED_D_OFF();\r
+ if (drop_field || res != 0) {\r
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);\r
+ LED_D_OFF();\r
+ }\r
\r
// restore debug level\r
MF_DBGLEVEL = OLD_MF_DBGLEVEL;\r
- \r
+\r
LED_A_OFF();\r
}\r
\r
\r
uint8_t block_number = 0;\r
uint64_t key = bytes_to_num(data, 6);\r
- if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) {\r
+ if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST, NULL)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Auth error");\r
break;\r
}\r
for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {\r
ui64Key = emlGetKey(sectorNo, keyType);\r
if (sectorNo == 0){\r
- if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {\r
+ if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST, NULL)) {\r
isOK = false;\r
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth error", sectorNo);\r
break;\r
}\r
} else {\r
- if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {\r
+ if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED, NULL)) {\r
isOK = false;\r
if (MF_DBGLEVEL >= 1) Dbprintf("Sector[%2d]. Auth nested error", sectorNo);\r
break;\r
extern void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);\r
extern void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);\r
extern void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain);\r
-extern void MifareChkKeys(uint16_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain);\r
+extern void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain);\r
extern void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);\r
extern void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);\r
extern void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);\r
ecmd[pos] = crypto1_byte(pcs, 0x00, 0) ^ dcmd[pos];\r
par[0] |= (((filter(pcs->odd) ^ oddparity8(dcmd[pos])) & 0x01) << (7-pos));\r
}\r
-\r
ReaderTransmitPar(ecmd, sizeof(ecmd), par, timing);\r
-\r
} else {\r
ReaderTransmit(dcmd, sizeof(dcmd), timing);\r
}\r
return len;\r
}\r
\r
+\r
// mifare classic commands\r
-int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested)\r
-{\r
- return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL);\r
+int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout) {\r
+\r
+ return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL, NULL, auth_timeout);\r
}\r
\r
-int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing)\r
-{\r
- // variables\r
+\r
+int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *ntptr, uint32_t *timing, uint32_t *auth_timeout) {\r
+\r
int len;\r
uint32_t pos;\r
- uint8_t tmp4[4];\r
uint8_t par[1] = {0x00};\r
byte_t nr[4];\r
uint32_t nt, ntpp; // Supplied tag nonce\r
\r
// Generate (encrypted) nr+parity by loading it into the cipher (Nr)\r
par[0] = 0;\r
- for (pos = 0; pos < 4; pos++)\r
- {\r
+ for (pos = 0; pos < 4; pos++) {\r
mf_nr_ar[pos] = crypto1_byte(pcs, nr[pos], 0) ^ nr[pos];\r
par[0] |= (((filter(pcs->odd) ^ oddparity8(nr[pos])) & 0x01) << (7-pos));\r
}\r
nt = prng_successor(nt,32);\r
\r
// ar+parity\r
- for (pos = 4; pos < 8; pos++)\r
- {\r
+ for (pos = 4; pos < 8; pos++) {\r
nt = prng_successor(nt,8);\r
mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);\r
par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos));\r
ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL);\r
\r
// Receive 4 byte tag answer\r
+ uint32_t save_timeout = iso14a_get_timeout(); // save standard timeout\r
+ if (auth_timeout && *auth_timeout) {\r
+ iso14a_set_timeout(*auth_timeout); // set timeout for authentication response\r
+ }\r
+ uint32_t auth_timeout_start = GetCountSspClk();\r
len = ReaderReceive(receivedAnswer, receivedAnswerPar);\r
- if (!len)\r
- {\r
+ iso14a_set_timeout(save_timeout); // restore standard timeout\r
+ if (!len) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Card timeout.");\r
return 2;\r
}\r
+ if (auth_timeout && !*auth_timeout) { // measure time for future authentication response timeout\r
+ *auth_timeout = (GetCountSspClk() - auth_timeout_start - (len * 9 + 2) * 8) / 8 + 1;\r
+ }\r
\r
- memcpy(tmp4, receivedAnswer, 4);\r
- ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0,0);\r
+ ntpp = prng_successor(nt, 32) ^ crypto1_word(pcs, 0, 0);\r
\r
- if (ntpp != bytes_to_num(tmp4, 4)) {\r
+ if (ntpp != bytes_to_num(receivedAnswer, 4)) {\r
if (MF_DBGLEVEL >= 1) Dbprintf("Authentication failed. Error card response.");\r
return 3;\r
}\r
return 0;\r
}\r
\r
-int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData)\r
-{\r
+\r
+int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData) {\r
// variables\r
int len;\r
uint8_t bt[2];\r
//\r
//-----------------------------------------------------------------------------\r
// one key check\r
-int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) {\r
+int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {\r
\r
struct Crypto1State mpcs = {0, 0};\r
struct Crypto1State *pcs;\r
// Iceman: use piwi's faster nonce collecting part in hardnested.\r
if (*cascade_levels == 0) { // need a full select cycle to get the uid first\r
iso14a_card_select_t card_info;\r
- if(!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {\r
+ if (!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {\r
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card");\r
return 1;\r
}\r
default: break;\r
}\r
} else { // no need for anticollision. We can directly select the card\r
- if(!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {\r
+ if (!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {\r
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card (UID) lvl=%d", *cascade_levels);\r
return 1;\r
}\r
}\r
\r
- if(mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) {\r
-// SpinDelayUs(AUTHENTICATION_TIMEOUT); // it not needs because mifare_classic_auth have timeout from iso14a_set_timeout()\r
+ if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed\r
return 2;\r
} else {\r
-/* // let it be here. it like halt command, but maybe it will work in some strange cases\r
- uint8_t dummy_answer = 0;\r
- ReaderTransmit(&dummy_answer, 1, NULL);\r
- int timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT;\r
- // wait for the card to become ready again\r
- while(GetCountSspClk() < timeout) {};\r
-*/\r
- // it needs after success authentication\r
mifare_classic_halt(pcs, *cuid);\r
}\r
\r
return 0;\r
}\r
\r
+\r
// multi key check\r
-int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel) {\r
+int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {\r
+\r
uint8_t uid[10];\r
uint32_t cuid = 0;\r
uint8_t cascade_levels = 0;\r
int retryCount = 0;\r
for (uint8_t i = 0; i < keyCount; i++) {\r
\r
- // Allow button press / usb cmd to interrupt device\r
- if (BUTTON_PRESS() && !usb_poll_validate_length()) {\r
- Dbprintf("ChkKeys: Cancel operation. Exit...");\r
- return -2;\r
- }\r
-\r
ui64Key = bytes_to_num(keys + i * 6, 6);\r
- int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, debugLevel);\r
+ int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, auth_timeout, debugLevel);\r
\r
// can't select\r
if (res == 1) {\r
continue; // can't auth. wrong key.\r
}\r
\r
+ // successful authentication\r
return i + 1;\r
}\r
\r
+ if (BUTTON_PRESS()) {\r
+ return -2;\r
+ }\r
+\r
return 0;\r
}\r
\r
+\r
// multisector multikey check\r
-int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex) {\r
+int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex) {\r
int res = 0;\r
\r
// int clk = GetCountSspClk();\r
\r
int keyAB = keyType;\r
do {\r
- res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, debugLevel);\r
- if (res < 0){\r
+ res = MifareChkBlockKeys(keys, keyCount, FirstBlockOfSector(sc), keyAB & 0x01, auth_timeout, debugLevel);\r
+ if (res < 0) {\r
return res;\r
}\r
- if (res > 0){\r
+ if (res > 0) {\r
(*keyIndex)[keyAB & 0x01][sc] = res;\r
}\r
} while(--keyAB > 0);\r
\r
// Dbprintf("%d %d", GetCountSspClk() - clk, (GetCountSspClk() - clk)/(SectorCount*keyCount*(keyType==2?2:1)));\r
\r
- return 0;\r
+ return 1;\r
}\r
\r
\r
// code for work with mifare cards.\r
//-----------------------------------------------------------------------------\r
\r
-#ifndef __MIFAREUTIL_H\r
-#define __MIFAREUTIL_H\r
+#ifndef MIFAREUTIL_H__\r
+#define MIFAREUTIL_H__\r
\r
#include <stdint.h>\r
#include <stdbool.h>\r
#include "usb_cdc.h"\r
\r
// mifare authentication\r
-#define CRYPT_NONE 0\r
-#define CRYPT_ALL 1\r
-#define CRYPT_REQUEST 2\r
-#define AUTH_FIRST 0 \r
-#define AUTH_NESTED 2\r
+#define CRYPT_NONE 0\r
+#define CRYPT_ALL 1\r
+#define CRYPT_REQUEST 2\r
+#define AUTH_FIRST 0\r
+#define AUTH_NESTED 2\r
\r
// reader voltage field detector\r
#define MF_MINFIELDV 4000\r
int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);\r
\r
// mifare classic\r
-int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested);\r
-int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing);\r
+int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t *auth_timeout);\r
+int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing, uint32_t *auth_timeout);\r
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);\r
-int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid); \r
+int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid);\r
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);\r
\r
// Ultralight/NTAG...\r
\r
// mifare check keys\r
typedef uint8_t TKeyIndex[2][40];\r
-int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel);\r
-int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint8_t debugLevel);\r
-int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint8_t debugLevel, TKeyIndex *keyIndex);\r
+int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);\r
+int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);\r
+int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex);\r
\r
#endif\r
// Nested\r
//----------------------------------------------\r
\r
-static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint8_t *timeout) {\r
+static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint16_t *timeout) {\r
char ctmp3[4] = {0};\r
int len = param_getlength(Cmd, indx);\r
if (len > 0 && len < 4){\r
\r
// slow and very slow\r
if (ctmp3[0] == 's' || ctmp3[0] == 'S' || ctmp3[1] == 's' || ctmp3[1] == 'S') {\r
- *timeout = 11; // slow\r
+ *timeout = MF_CHKKEYS_SLOWTIMEOUT; // slow\r
\r
if (!paramS1 && (ctmp3[1] == 's' || ctmp3[1] == 'S')) {\r
- *timeout = 53; // very slow\r
+ *timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow\r
}\r
if (paramS1 && (ctmp3[2] == 's' || ctmp3[2] == 'S')) {\r
- *timeout = 53; // very slow\r
+ *timeout = MF_CHKKEYS_VERYSLOWTIMEOUT; // very slow\r
}\r
}\r
}\r
}\r
\r
-int CmdHF14AMfNested(const char *Cmd)\r
-{\r
+int CmdHF14AMfNested(const char *Cmd) {\r
int i, j, res, iterations;\r
sector_t *e_sector = NULL;\r
uint8_t blockNo = 0;\r
uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
uint8_t keyBlock[MifareDefaultKeysSize * 6];\r
uint64_t key64 = 0;\r
- // timeout in units. (ms * 106)/10 or us*0.0106\r
- uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default\r
+ // timeout in units. (ms * 106) or us*0.106\r
+ uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default\r
\r
bool autosearchKey = false;\r
\r
if (param_getchar(Cmd, 1) == '*') {\r
autosearchKey = true;\r
\r
- parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a);\r
+ parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);\r
\r
PrintAndLog("--nested. sectors:%2d, block no:*, eml:%c, dmp=%c checktimeout=%d us",\r
- SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);\r
+ SectorsCnt, transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);\r
} else {\r
blockNo = param_get8(Cmd, 1);\r
\r
}\r
\r
// check if we can authenticate to sector\r
- res = mfCheckKeys(blockNo, keyType, true, 1, key, &key64);\r
+ res = mfCheckKeys(blockNo, keyType, timeout14a, true, 1, key, &key64);\r
if (res) {\r
PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));\r
return 3;\r
if (ctmp != 'A' && ctmp != 'a')\r
trgKeyType = 1;\r
\r
- parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &btimeout14a);\r
+ parseParamTDS(Cmd, 6, &transferToEml, &createDumpFile, &timeout14a);\r
} else {\r
- parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &btimeout14a);\r
+ parseParamTDS(Cmd, 4, &transferToEml, &createDumpFile, &timeout14a);\r
}\r
\r
PrintAndLog("--nested. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",\r
- SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);\r
+ SectorsCnt, blockNo, keyType?'B':'A', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);\r
}\r
\r
// one-sector nested\r
if (cmdp == 'o') { // ------------------------------------ one sector working\r
PrintAndLog("--target block no:%3d, target key type:%c ", trgBlockNo, trgKeyType?'B':'A');\r
- int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);\r
+ int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, trgBlockNo, trgKeyType, keyBlock, true);\r
if (isOK < 0) {\r
switch (isOK) {\r
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
}\r
\r
PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);\r
- mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, MifareDefaultKeysSize, keyBlock, e_sector);\r
+ mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, MifareDefaultKeysSize, keyBlock, e_sector);\r
\r
// get known key from array\r
bool keyFound = false;\r
for (trgKeyType = 0; trgKeyType < 2; trgKeyType++) {\r
if (e_sector[sectorNo].foundKey[trgKeyType]) continue;\r
PrintAndLog("-----------------------------------------------");\r
- int16_t isOK = mfnested(blockNo, keyType, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);\r
+ int16_t isOK = mfnested(blockNo, keyType, timeout14a, key, FirstBlockOfSector(sectorNo), trgKeyType, keyBlock, calibrate);\r
if(isOK < 0) {\r
switch (isOK) {\r
case -1 : PrintAndLog("Error: No response from Proxmark.\n"); break;\r
e_sector[sectorNo].Key[trgKeyType] = key64;\r
\r
// try to check this key as a key to the other sectors\r
- mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, 1, keyBlock, e_sector);\r
+ mfCheckKeysSec(SectorsCnt, 2, timeout14a, true, true, true, 1, keyBlock, e_sector);\r
}\r
}\r
}\r
}\r
\r
\r
-int CmdHF14AMfChk(const char *Cmd)\r
-{\r
+int CmdHF14AMfChk(const char *Cmd) {\r
+\r
if (strlen(Cmd)<3) {\r
PrintAndLog("Usage: hf mf chk <block number>|<*card memory> <key type (A/B/?)> [t|d|s|ss] [<key (12 hex symbols)>] [<dic (*.dic)>]");\r
PrintAndLog(" * - all sectors");\r
uint8_t keyType = 0;\r
uint64_t key64 = 0;\r
// timeout in units. (ms * 106)/10 or us*0.0106\r
- uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default\r
+ uint16_t timeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default\r
bool param3InUse = false;\r
bool transferToEml = 0;\r
bool createDumpFile = 0;\r
};\r
}\r
\r
- parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &btimeout14a);\r
+ parseParamTDS(Cmd, 2, &transferToEml, &createDumpFile, &timeout14a);\r
\r
if (singleBlock & createDumpFile) {\r
PrintAndLog (" block key check (<block no>) and write to dump file (d) combination is not supported ");\r
return 1;\r
}\r
\r
- param3InUse = transferToEml | createDumpFile | (btimeout14a != MF_CHKKEYS_DEFTIMEOUT);\r
+ param3InUse = transferToEml | createDumpFile | (timeout14a != MF_CHKKEYS_DEFTIMEOUT);\r
\r
PrintAndLog("--chk keys. sectors:%2d, block no:%3d, key type:%c, eml:%c, dmp=%c checktimeout=%d us",\r
- SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((int)btimeout14a * 10000) / 106);\r
+ SectorsCnt, blockNo, keyType==0?'A':keyType==1?'B':'?', transferToEml?'y':'n', createDumpFile?'y':'n', ((uint32_t)timeout14a * 1000) / 106);\r
\r
for (i = param3InUse; param_getchar(Cmd, 2 + i); i++) {\r
if (!param_gethex(Cmd, 2 + i, keyBlock + 6 * keycnt, 12)) {\r
for (uint32_t c = 0; c < keycnt; c += max_keys) {\r
\r
uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;\r
- res = mfCheckKeysSec(SectorsCnt, keyType, btimeout14a, clearTraceLog, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106\r
+ bool init = (c == 0);\r
+ bool drop_field = (c + size == keycnt);\r
+ res = mfCheckKeysSec(SectorsCnt, keyType, timeout14a, clearTraceLog, init, drop_field, size, &keyBlock[6 * c], e_sector); // timeout is (ms * 106)/10 or us*0.0106\r
clearTraceLog = false;\r
\r
if (res != 1) {\r
} else {\r
int keyAB = keyType;\r
do {\r
- for (uint32_t c = 0; c < keycnt; c += max_keys) {\r
-\r
- uint32_t size = keycnt-c > max_keys ? max_keys : keycnt-c;\r
- res = mfCheckKeys(blockNo, keyAB & 0x01, true, size, &keyBlock[6 * c], &key64);\r
- clearTraceLog = false;\r
+ res = mfCheckKeys(blockNo, keyAB & 0x01, timeout14a, true, keycnt, keyBlock, &key64);\r
+ clearTraceLog = false;\r
\r
- if (res != 1) {\r
- if (!res) {\r
- // Use the common format below\r
- // PrintAndLog("Found valid key:[%d:%c]%012" PRIx64, blockNo, (keyAB & 0x01)?'B':'A', key64);\r
- foundAKey = true;\r
+ if (res != 1) {\r
+ if (!res) {\r
+ // Use the common format below\r
+ // PrintAndLog("Found valid key:[%d:%c]%012" PRIx64, blockNo, (keyAB & 0x01)?'B':'A', key64);\r
+ foundAKey = true;\r
\r
- // Store the Single Key for display list\r
- // For a single block check, SectorsCnt = Sector that contains the block\r
- e_sector[SectorsCnt-1].foundKey[(keyAB & 0x01)] = true; // flag key found\r
- e_sector[SectorsCnt-1].Key[(keyAB & 0x01)] = key64; // Save key data\r
+ // Store the Single Key for display list\r
+ // For a single block check, SectorsCnt = Sector that contains the block\r
+ e_sector[SectorsCnt-1].foundKey[(keyAB & 0x01)] = true; // flag key found\r
+ e_sector[SectorsCnt-1].Key[(keyAB & 0x01)] = key64; // Save key data\r
\r
- }\r
- } else {\r
- PrintAndLog("Command execute timeout");\r
}\r
+ } else {\r
+ PrintAndLog("Command execute timeout");\r
}\r
} while(--keyAB > 0);\r
}\r
#include "mifarehost.h"
+#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
}
-int mfDarkside(uint64_t *key)
-{
+int mfDarkside(uint64_t *key) {
uint32_t uid = 0;
uint32_t nt = 0, nr = 0, ar = 0;
uint64_t par_list = 0, ks_list = 0;
PrintAndLog("Found a possible key. Trying to authenticate...\n");
}
- *key = -1;
- uint8_t keyBlock[USB_CMD_DATA_SIZE];
- int max_keys = USB_CMD_DATA_SIZE/6;
- for (int i = 0; i < keycount; i += max_keys) {
- int size = keycount - i > max_keys ? max_keys : keycount - i;
- for (int j = 0; j < size; j++) {
- if (par_list == 0) {
- num_to_bytes(last_keylist[i*max_keys + j], 6, keyBlock+(j*6));
- } else {
- num_to_bytes(keylist[i*max_keys + j], 6, keyBlock+(j*6));
- }
- }
- if (!mfCheckKeys(0, 0, false, size, keyBlock, key)) {
- break;
- }
+ uint8_t *keys_to_chk = malloc(keycount * 6);
+ for (int i = 0; i < keycount; i++) {
+ num_to_bytes(keylist[i], 6, keys_to_chk+i);
}
+
+ *key = -1;
+ mfCheckKeys(0, 0, 0, false, keycount, keys_to_chk, key);
+
+ free(keys_to_chk);
if (*key != -1) {
free(last_keylist);
}
-int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){
+int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keys, uint64_t *found_key) {
- *key = -1;
+ bool display_progress = false;
+ uint64_t start_time = msclock();
+ uint64_t next_print_time = start_time + 5 * 1000;
- UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), clear_trace, keycnt}};
- memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
- SendCommand(&c);
+ if (keycnt > 1000) {
+ PrintAndLog("We have %d keys to check. This will take some time!", keycnt);
+ PrintAndLog("Press button to abort.");
+ display_progress = true;
+ }
- UsbCommand resp;
- if (!WaitForResponseTimeout(CMD_ACK,&resp,3000))
- return 1;
+ uint32_t max_keys = (keycnt > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : keycnt;
+ *found_key = -1;
+ bool multisectorCheck = false;
+
+ for (int i = 0, ii = 0; i < keycnt; i += max_keys) {
+
+ if ((i + max_keys) >= keycnt) {
+ max_keys = keycnt - i;
+ }
- if ((resp.arg[0] & 0xff) != 0x01) {
- if (((int)resp.arg[1]) < 0)
- return (int)resp.arg[1];
+ bool init = (i == 0);
+ bool drop_field = (max_keys == keycnt);
+ uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
- return 2;
+ UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, max_keys}};
+ memcpy(c.d.asBytes, keys + i * 6, max_keys * 6);
+ SendCommand(&c);
+
+ UsbCommand resp;
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 3000))
+ return 1;
+
+ if ((resp.arg[0] & 0xff) != 0x01) {
+ if (((int)resp.arg[1]) < 0) { // error
+ return (int)resp.arg[1];
+ } else { // nothing found yet
+ if (display_progress && msclock() >= next_print_time) {
+ float brute_force_per_second = (float)(i - ii) / (float)(msclock() - start_time) * 1000.0;
+ ii = i;
+ start_time = msclock();
+ next_print_time = start_time + 10 * 1000;
+ PrintAndLog(" %8d keys left | %5.1f keys/sec | worst case %6.1f seconds remaining", keycnt - i, brute_force_per_second, (keycnt-i)/brute_force_per_second);
+ }
+ }
+ } else { // success
+ *found_key = bytes_to_num(resp.d.asBytes, 6);
+ return 0;
+ }
}
- *key = bytes_to_num(resp.d.asBytes, 6);
- return 0;
+ return 2; // nothing found
}
-int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector){
+
+int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector) {
uint8_t keyPtr = 0;
if (e_sector == NULL)
return -1;
- UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), (clear_trace | 0x02)|((timeout14a & 0xff) << 8), keycnt}};
+ bool multisectorCheck = true;
+ uint8_t flags = clear_trace | multisectorCheck << 1 | init << 2 | drop_field << 3;
+
+ UsbCommand c = {CMD_MIFARE_CHKKEYS, {((sectorCnt & 0xff) | ((keyType & 0xff) << 8)), flags | timeout14a << 16, keycnt}};
memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
SendCommand(&c);
uint32_t uid;
uint32_t blockNo;
uint32_t keyType;
- uint32_t nt;
+ uint32_t nt_enc;
uint32_t ks1;
} StateList_t;
__attribute__((force_align_arg_pointer))
#endif
#endif
-*nested_worker_thread(void *arg)
-{
+*nested_worker_thread(void *arg) {
struct Crypto1State *p1;
StateList_t *statelist = arg;
- statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt ^ statelist->uid);
+ statelist->head.slhead = lfsr_recovery32(statelist->ks1, statelist->nt_enc ^ statelist->uid);
for (p1 = statelist->head.slhead; *(uint64_t *)p1 != 0; p1++);
statelist->len = p1 - statelist->head.slhead;
statelist->tail.sltail = --p1;
}
-int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate)
-{
- uint32_t i, j;
+int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *resultKey, bool calibrate) {
+ uint32_t i;
uint32_t uid;
UsbCommand resp;
int isOK = 1;
- uint64_t next_print_time = 0;
- uint64_t start_time;
- float brute_force_time;
- float brute_force_per_second;
-
// flush queue
(void)WaitForResponseTimeout(CMD_ACK,NULL,100);
statelists[i].blockNo = resp.arg[2] & 0xff;
statelists[i].keyType = (resp.arg[2] >> 8) & 0xff;
statelists[i].uid = uid;
- memcpy(&statelists[i].nt, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
+ memcpy(&statelists[i].nt_enc, (void *)(resp.d.asBytes + 4 + i * 8 + 0), 4);
memcpy(&statelists[i].ks1, (void *)(resp.d.asBytes + 4 + i * 8 + 4), 4);
}
- if (statelists[0].nt == statelists[1].nt && statelists[0].ks1 == statelists[1].ks1)
+ uint32_t authentication_timeout;
+ memcpy(&authentication_timeout, resp.d.asBytes + 20, 4);
+ PrintAndLog("Setting authentication timeout to %" PRIu32 "us", authentication_timeout * 1000 / 106);
+
+ if (statelists[0].nt_enc == statelists[1].nt_enc && statelists[0].ks1 == statelists[1].ks1)
num_unique_nonces = 1;
else
num_unique_nonces = 2;
savestate = *p1;
while(Compare16Bits(p1, savep) == 0 && p1 <= statelists[0].tail.sltail) {
*p3 = *p1;
- lfsr_rollback_word(p3, statelists[0].nt ^ statelists[0].uid, 0);
+ lfsr_rollback_word(p3, statelists[0].nt_enc ^ statelists[0].uid, 0);
p3++;
p1++;
}
savestate = *p2;
while(Compare16Bits(p2, savep) == 0 && p2 <= statelists[1].tail.sltail) {
*p4 = *p2;
- lfsr_rollback_word(p4, statelists[1].nt ^ statelists[1].uid, 0);
+ lfsr_rollback_word(p4, statelists[1].nt_enc ^ statelists[1].uid, 0);
p4++;
p2++;
}
statelists[1].tail.sltail=--p4;
for (i = 0; i < 2; i++) {
- PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt, statelists[i].ks1);
+ PrintAndLog("statelist %d: length:%d block:%02d keytype:%d nt_enc:%08X ks1:%08X", i, statelists[i].len, statelists[i].blockNo, statelists[i].keyType, statelists[i].nt_enc, statelists[i].ks1);
}
// the statelists now contain possible keys. The key we are searching for must be in the
PrintAndLog("Nonce 1 and 2 are the same!");
}
- if (statelists[0].len > 100) {
- PrintAndLog("We have %d keys to check. This will take a very long time!", statelists[0].len);
- PrintAndLog("Press button to abort.");
- }
- else if (statelists[0].len < 1) {
- PrintAndLog("No candidate keys to check!");
- }
- else {
- PrintAndLog("We have %d key(s) to check.", statelists[0].len);
- }
-
- uint32_t max_keys = (statelists[0].len > (USB_CMD_DATA_SIZE / 6)) ? (USB_CMD_DATA_SIZE / 6) : statelists[0].len;
- keyBlock = calloc(max_keys, 6);
-
+ uint32_t num_keys = statelists[0].len;
+ keyBlock = calloc(num_keys, 6);
if (keyBlock == NULL) {
free(statelists[0].head.slhead);
free(statelists[1].head.slhead);
return -4;
}
- memset(resultKey, 0, 6);
- start_time = msclock();
- next_print_time = start_time + 1 * 1000;
- // The list may still contain several key candidates. Test each of them with mfCheckKeys
- for (i = 0; i < statelists[0].len; i+=max_keys) {
- if (next_print_time <= msclock()) {
- brute_force_per_second = ((float)i) / (((float)(msclock() - start_time)) / 1000.0);
- brute_force_time = ((float)(statelists[0].len - i)) / brute_force_per_second;
- next_print_time = msclock() + 10 * 1000;
- PrintAndLog(" %8d keys left | %5.1f keys/sec | worst case %6.1f seconds remaining", statelists[0].len - i, brute_force_per_second, brute_force_time);
- }
-
- if ((i+max_keys) >= statelists[0].len)
- max_keys = statelists[0].len - i;
-
- for (j = 0; j < max_keys; j++) {
- crypto1_get_lfsr(statelists[0].head.slhead + i + j, &key64);
- num_to_bytes(key64, 6, keyBlock+(j*6));
- }
+ for (i = 0; i < num_keys; i++) {
+ crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);
+ num_to_bytes(key64, 6, keyBlock + i*6);
+ }
- key64 = 0;
- isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, true, max_keys, keyBlock, &key64);
+ // The list may still contain several key candidates. Test each of them with mfCheckKeys
+ isOK = mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, authentication_timeout, true, num_keys, keyBlock, &key64);
- if (isOK == 1) { // timeout
- isOK = -1;
- break;
- }
- else if (isOK < 0) { // -2 is button pressed
- break;
- }
- else if (!isOK) {
- num_to_bytes(key64, 6, resultKey);
- break;
- }
+ if (isOK == 0) { // success, key found
+ num_to_bytes(key64, 6, resultKey);
}
- if (isOK == 0 && statelists[0].len != 1)
- PrintAndLog("Key found in %0.2f seconds after checking %d keys\n", ((float)(msclock() - start_time)) / 1000.0, i+max_keys);
+ if (isOK == 1) { // timeout
+ isOK = -1;
+ }
free(statelists[0].head.slhead);
free(statelists[1].head.slhead);
// High frequency ISO14443A commands
//-----------------------------------------------------------------------------
-#ifndef MIFAREHOST_H
-#define MIFAREHOST_H
+#ifndef MIFAREHOST_H__
+#define MIFAREHOST_H__
#include <stdint.h>
#include <stdbool.h>
#include "util.h"
// defaults
-// timeout in units. (ms * 106)/10 or us*0.0106
-// 5 == 500us
-#define MF_CHKKEYS_DEFTIMEOUT 5
+// timeout in units. ms * 106 or us * 0.106
+#define MF_CHKKEYS_DEFTIMEOUT 50 // 0.47ms
+#define MF_CHKKEYS_SLOWTIMEOUT 106 // 1ms
+#define MF_CHKKEYS_VERYSLOWTIMEOUT 530 // 5ms
// mfCSetBlock work flags
-#define CSETBLOCK_UID 0x01
-#define CSETBLOCK_WUPC 0x02
-#define CSETBLOCK_HALT 0x04
-#define CSETBLOCK_INIT_FIELD 0x08
-#define CSETBLOCK_RESET_FIELD 0x10
-#define CSETBLOCK_SINGLE_OPER 0x1F
-#define CSETBLOCK_MAGIC_1B 0x40
+#define CSETBLOCK_UID 0x01
+#define CSETBLOCK_WUPC 0x02
+#define CSETBLOCK_HALT 0x04
+#define CSETBLOCK_INIT_FIELD 0x08
+#define CSETBLOCK_RESET_FIELD 0x10
+#define CSETBLOCK_SINGLE_OPER 0x1F
+#define CSETBLOCK_MAGIC_1B 0x40
typedef struct {
uint64_t Key[2];
extern char logHexFileName[FILE_PATH_SIZE];
extern int mfDarkside(uint64_t *key);
-extern int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
-extern int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t *keyBlock, uint64_t *key);
-extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint8_t timeout14a, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
+extern int mfnested(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, uint8_t *key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t *ResultKeys, bool calibrate);
+extern int mfCheckKeys(uint8_t blockNo, uint8_t keyType, uint16_t timeout14a, bool clear_trace, uint32_t keycnt, uint8_t *keyBlock, uint64_t *key);
+extern int mfCheckKeysSec(uint8_t sectorCnt, uint8_t keyType, uint16_t timeout14a, bool clear_trace, bool init, bool drop_field, uint8_t keycnt, uint8_t * keyBlock, sector_t * e_sector);
extern int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data);
projects / proxmark3-svn / commitdiff