diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 48b8c0dd2..7b94f8a3c 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -826,11 +826,8 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_MIFAREU_READBL:
MifareUReadBlock(c->arg[0],c->arg[1], c->d.asBytes);
break;
- case CMD_MIFAREUC_AUTH1:
- MifareUC_Auth1(c->arg[0],c->d.asBytes);
- break;
- case CMD_MIFAREUC_AUTH2:
- MifareUC_Auth2(c->arg[0],c->d.asBytes);
+ case CMD_MIFAREUC_AUTH:
+ MifareUC_Auth(c->arg[0],c->d.asBytes);
break;
case CMD_MIFAREU_READCARD:
case CMD_MIFAREUC_READCARD:
diff --git a/armsrc/apps.h b/armsrc/apps.h
index d325dbe8d..57fb55fd3 100644
--- a/armsrc/apps.h
+++ b/armsrc/apps.h
@@ -166,8 +166,7 @@ void ReaderMifare(bool first_try);
int32_t dist_nt(uint32_t nt1, uint32_t nt2);
void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
-void MifareUC_Auth1(uint8_t arg0, uint8_t *datain);
-void MifareUC_Auth2(uint8_t arg0, uint8_t *datain);
+void MifareUC_Auth(uint8_t arg0, uint8_t *datain);
void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain);
void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c
index cf36b95a0..1f8f4ee8e 100644
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@@ -17,7 +17,6 @@
#include "apps.h"
#include "util.h"
-#include "des.h"
#include "crc.h"
// the block number for the ISO14443-4 PCB
@@ -93,53 +92,28 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
LEDsoff();
}
-void MifareUC_Auth1(uint8_t arg0, uint8_t *datain){
+void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
- byte_t dataoutbuf[16] = {0x00};
- uint8_t uid[10] = {0x00};
- uint32_t cuid = 0x00;
+ bool turnOffField = (arg0 == 1);
LED_A_ON(); LED_B_OFF(); LED_C_OFF();
-
clear_trace();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
- if(!iso14443a_select_card(uid, NULL, &cuid)) {
+ if(!iso14443a_select_card(NULL, NULL, NULL)) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
OnError(0);
return;
};
- if(mifare_ultra_auth1(dataoutbuf)){
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
+ if(mifare_ultra_auth(keybytes) == 1){
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed");
OnError(1);
return;
}
+ cmd_send(CMD_ACK,1,0,0,0,0);
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
-
- cmd_send(CMD_ACK,1,cuid,0,dataoutbuf,11);
- LEDsoff();
-}
-void MifareUC_Auth2(uint8_t arg0, uint8_t *datain){
-
- uint8_t key[16] = {0x00};
- byte_t dataoutbuf[16] = {0x00};
-
- memcpy(key, datain, 16);
-
- LED_A_ON(); LED_B_OFF(); LED_C_OFF();
-
- if(mifare_ultra_auth2(key, dataoutbuf)){
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part2: Fail...");
- OnError(1);
- return;
- }
-
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 2 FINISHED");
-
- cmd_send(CMD_ACK,1,0,0,dataoutbuf,11);
- if (arg0) {
+ if (turnOffField) {
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
}
@@ -152,125 +126,56 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
{
uint8_t blockNo = arg0;
byte_t dataout[16] = {0x00};
- uint8_t uid[10] = {0x00};
- uint8_t key[16] = {0x00};
- bool usePwd = (arg1 == 1);
+ bool useKey = (arg1 == 1); //UL_C
+ bool usePwd = (arg1 == 2); //UL_EV1/NTAG
LEDsoff();
LED_A_ON();
clear_trace();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
- int len = iso14443a_select_card(uid, NULL, NULL);
+ int len = iso14443a_select_card(NULL, NULL, NULL);
if(!len) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
OnError(1);
return;
}
- // authenticate here.
- if ( usePwd ) {
+ // UL-C authentication
+ if ( useKey ) {
+ uint8_t key[16] = {0x00};
+ memcpy(key, datain, sizeof(key) );
- memcpy(key, datain, 16);
-
- // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[0],key[1],key[2],key[3],key[4],key[5],key[6],key[7] );
- // Dbprintf("KEY: %02x %02x %02x %02x %02x %02x %02x %02x", key[8],key[9],key[10],key[11],key[12],key[13],key[14],key[15] );
-
- uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
- uint8_t random_b[8] = {0x00};
- uint8_t enc_random_b[8] = {0x00};
- uint8_t rnd_ab[16] = {0x00};
- uint8_t IV[8] = {0x00};
-
- uint16_t len;
- uint8_t receivedAnswer[MAX_FRAME_SIZE];
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
-
- len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
- if (len != 11) {
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
+ if ( mifare_ultra_auth(key) == 1 ) {
OnError(1);
return;
}
-
- // tag nonce.
- memcpy(enc_random_b,receivedAnswer+1,8);
-
- // decrypt nonce.
- tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
- rol(random_b,8);
- memcpy(rnd_ab ,random_a,8);
- memcpy(rnd_ab+8,random_b,8);
-
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
- Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
- enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],
- enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
-
- Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",
- random_b[0],random_b[1],random_b[2],random_b[3],
- random_b[4],random_b[5],random_b[6],random_b[7]);
-
- Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
- rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
- rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
-
- Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
- rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
- rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
- }
-
- // encrypt out, in, length, key, iv
- tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
-
- len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
- if (len != 11) {
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
- OnError(1);
- return;
- }
-
- uint8_t enc_resp[8] = { 0 };
- uint8_t resp_random_a[8] = { 0 };
- memcpy(enc_resp, receivedAnswer+1, 8);
-
- // decrypt out, in, length, key, iv
- tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
- if ( memcmp(resp_random_a, random_a, 8) != 0 )
- Dbprintf("failed authentication");
-
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
- Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
- rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
- rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
-
- Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
- rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
- rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
-
- Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
- random_a[0],random_a[1],random_a[2],random_a[3],
- random_a[4],random_a[5],random_a[6],random_a[7]);
-
- Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
- resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
- resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
- }
}
-
+
+ // UL-EV1 / NTAG authentication
+ if ( usePwd ) {
+ uint8_t pwd[4] = {0x00};
+ memcpy(pwd, datain, 4);
+ uint8_t pack[4] = {0,0,0,0};
+ if (mifare_ul_ev1_auth(pwd, pack) == 1) {
+ OnError(1);
+ return;
+ }
+ }
+
if( mifare_ultra_readblock(blockNo, dataout) ) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
OnError(2);
return;
}
-
+
if( mifare_ultra_halt() ) {
if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
OnError(3);
return;
}
-
- cmd_send(CMD_ACK,1,0,0,dataout,16);
+
+ cmd_send(CMD_ACK,1,0,0,dataout,16);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
}
@@ -365,64 +270,25 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
return;
}
- // authenticate
+ // UL-C authentication
if ( useKey ) {
uint8_t key[16] = {0x00};
- memcpy(key, datain, 16);
+ memcpy(key, datain, sizeof(key) );
- uint8_t random_a[8] = {1,1,1,1,1,1,1,1 };
- uint8_t random_b[8] = {0x00};
- uint8_t enc_random_b[8] = {0x00};
- uint8_t rnd_ab[16] = {0x00};
- uint8_t IV[8] = {0x00};
-
- uint16_t len2;
- uint8_t receivedAnswer[MAX_FRAME_SIZE];
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
-
- len2 = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
- if (len2 != 11) {
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
+ if ( mifare_ultra_auth(key) == 1 ) {
OnError(1);
return;
}
-
- // tag nonce.
- memcpy(enc_random_b,receivedAnswer+1,8);
-
- // decrypt nonce.
- tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
- rol(random_b,8);
- memcpy(rnd_ab ,random_a,8);
- memcpy(rnd_ab+8,random_b,8);
-
- // encrypt out, in, length, key, iv
- tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
-
- len2 = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, receivedAnswer, receivedAnswerPar, NULL);
- if (len2 != 11) {
- OnError(1);
- return;
- }
-
- uint8_t enc_resp[8] = { 0 };
- uint8_t resp_random_a[8] = { 0 };
- memcpy(enc_resp, receivedAnswer+1, 8);
-
- // decrypt out, in, length, key, iv
- tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
- if ( memcmp(resp_random_a, random_a, 8) != 0 )
- Dbprintf("failed authentication");
}
- if (usePwd) { //ev1 or ntag auth
- uint8_t Pwd[4] = {0x00};
- memcpy(Pwd, datain, 4);
+ // UL-EV1 / NTAG authentication
+ if (usePwd) {
+ uint8_t pwd[4] = {0x00};
+ memcpy(pwd, datain, sizeof(pwd));
uint8_t pack[4] = {0,0,0,0};
- if (mifare_ul_ev1_auth(Pwd, pack)){
+ if (mifare_ul_ev1_auth(pwd, pack) == 1){
OnError(1);
- Dbprintf("failed authentication");
return;
}
}
@@ -569,16 +435,15 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
{
uint8_t blockNo = arg0;
byte_t blockdata[4] = {0x00};
-
- memcpy(blockdata, datain,4);
- uint8_t uid[10] = {0x00};
+ memcpy(blockdata, datain,4);
- LED_A_ON(); LED_B_OFF(); LED_C_OFF();
+ LEDsoff();
+ LED_A_ON();
clear_trace();
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
- if(!iso14443a_select_card(uid, NULL, NULL)) {
+ if(!iso14443a_select_card(NULL, NULL, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card");
OnError(0);
return;
@@ -1320,21 +1185,18 @@ void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){
int len = iso14443a_select_card(uid, NULL, &cuid);
if(!len) {
- if (MF_DBGLEVEL >= MF_DBG_ERROR)
- Dbprintf("Can't select card");
- //OnError(1);
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card");
+ OnError(1);
return;
};
if(mifare_desfire_des_auth1(cuid, dataout)){
- if (MF_DBGLEVEL >= MF_DBG_ERROR)
- Dbprintf("Authentication part1: Fail.");
- //OnError(4);
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication part1: Fail.");
+ OnError(4);
return;
}
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED");
-
cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout));
}
diff --git a/armsrc/mifareutil.c b/armsrc/mifareutil.c
index cc54b7402..0469364c3 100644
--- a/armsrc/mifareutil.c
+++ b/armsrc/mifareutil.c
@@ -18,6 +18,7 @@
#include "iso14443a.h"
#include "crapto1.h"
#include "mifareutil.h"
+#include "des.h"
int MF_DBGLEVEL = MF_DBG_ALL;
@@ -110,6 +111,27 @@ int mifare_sendcmd_short_mfucauth(struct Crypto1State *pcs, uint8_t crypted, uin
return len;
}
+int mifare_sendcmd_short_mfuev1auth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)
+{
+ uint8_t dcmd[7];
+ int len;
+ dcmd[0] = cmd;
+ memcpy(dcmd+1,data,4);
+ AppendCrc14443a(dcmd, 5);
+
+ ReaderTransmit(dcmd, sizeof(dcmd), timing);
+ len = ReaderReceive(answer, answer_parity);
+ if(!len) {
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Authentication failed. Card timeout.");
+ len = ReaderReceive(answer,answer_parity);
+ }
+ if(len==1) {
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("NAK - Authentication failed.");
+ return 1;
+ }
+ return len;
+}
+
int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)
{
uint8_t dcmd[4], ecmd[4];
@@ -288,67 +310,114 @@ int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blo
}
// mifare ultralight commands
-int mifare_ul_ev1_auth(uint8_t *key, uint8_t *pack){
+int mifare_ul_ev1_auth(uint8_t *keybytes, uint8_t *pack){
uint16_t len;
- uint8_t receivedAnswer[MAX_FRAME_SIZE];
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
-
- len = mifare_sendcmd_short_mfucauth(NULL, 0, 0x1B, key, receivedAnswer, receivedAnswerPar, NULL);
+ uint8_t resp[4];
+ uint8_t respPar[1];
+ uint8_t key[4] = {0x00};
+ memcpy(key, keybytes, 4);
+
+ Dbprintf("EV1 Auth : %02x%02x%02x%02x", key[0], key[1], key[2], key[3]);
+ len = mifare_sendcmd_short_mfuev1auth(NULL, 0, 0x1B, key, resp, respPar, NULL);
if (len != 4) {
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", receivedAnswer[0], len);
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", resp[0], len);
+ OnError(1);
return 1;
}
-
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
- Dbprintf("Auth Resp: %02x%02x%02x%02x",
- receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3]);
- }
- memcpy(pack, receivedAnswer, 4);
+
+ if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
+ Dbprintf("Auth Resp: %02x%02x%02x%02x", resp[0],resp[1],resp[2],resp[3]);
+
+ memcpy(pack, resp, 4);
return 0;
}
-int mifare_ultra_auth1(uint8_t *blockData){
+int mifare_ultra_auth(uint8_t *keybytes){
+
+ /// 3des2k
+
+ uint8_t random_a[8] = {1,1,1,1,1,1,1,1};
+ uint8_t random_b[8] = {0x00};
+ uint8_t enc_random_b[8] = {0x00};
+ uint8_t rnd_ab[16] = {0x00};
+ uint8_t IV[8] = {0x00};
+ uint8_t key[16] = {0x00};
+ memcpy(key, keybytes, 16);
uint16_t len;
- uint8_t receivedAnswer[MAX_FRAME_SIZE];
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
-
- len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, receivedAnswer,receivedAnswerPar ,NULL);
+ uint8_t resp[19] = {0x00};
+ uint8_t respPar[3] = {0,0,0};
+
+ // REQUEST AUTHENTICATION
+ len = mifare_sendcmd_short(NULL, 1, 0x1A, 0x00, resp, respPar ,NULL);
if (len != 11) {
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);
+ OnError(1);
+ return 1;
+ }
+
+ // tag nonce.
+ memcpy(enc_random_b,resp+1,8);
+
+ // decrypt nonce.
+ tdes_2key_dec(random_b, enc_random_b, sizeof(random_b), key, IV );
+ rol(random_b,8);
+ memcpy(rnd_ab ,random_a,8);
+ memcpy(rnd_ab+8,random_b,8);
+
+ if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
+ Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
+ enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
+
+ Dbprintf(" B: %02x %02x %02x %02x %02x %02x %02x %02x",
+ random_b[0],random_b[1],random_b[2],random_b[3],random_b[4],random_b[5],random_b[6],random_b[7]);
+
+ Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
+ rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
+
+ Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
+ rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
+ }
+
+ // encrypt out, in, length, key, iv
+ tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
+
+ len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, resp, respPar, NULL);
+ if (len != 11) {
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);
+ OnError(1);
+ return 1;
+ }
+
+ uint8_t enc_resp[8] = { 0,0,0,0,0,0,0,0 };
+ uint8_t resp_random_a[8] = { 0,0,0,0,0,0,0,0 };
+ memcpy(enc_resp, resp+1, 8);
+
+ // decrypt out, in, length, key, iv
+ tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
+ if ( memcmp(resp_random_a, random_a, 8) != 0 ) {
+ if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("failed authentication");
return 1;
}
if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
- Dbprintf("Auth1 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
- receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],
- receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],
- receivedAnswer[10]);
- }
- memcpy(blockData, receivedAnswer, 11);
- return 0;
-}
+ Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
+ rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],
+ rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
-int mifare_ultra_auth2(uint8_t *key, uint8_t *blockData){
+ Dbprintf("e_AB: %02x %02x %02x %02x %02x %02x %02x %02x",
+ rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],
+ rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15]);
- uint16_t len;
- uint8_t receivedAnswer[MAX_FRAME_SIZE];
- uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
-
- len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, key, receivedAnswer, receivedAnswerPar, NULL);
- if (len != 11) {
- if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
- return 1;
+ Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
+ random_a[0],random_a[1],random_a[2],random_a[3],
+ random_a[4],random_a[5],random_a[6],random_a[7]);
+
+ Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
+ resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
+ resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
}
-
- if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
- Dbprintf("Auth2 Resp: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
- receivedAnswer[0],receivedAnswer[1],receivedAnswer[2],receivedAnswer[3],receivedAnswer[4],
- receivedAnswer[5],receivedAnswer[6],receivedAnswer[7],receivedAnswer[8],receivedAnswer[9],
- receivedAnswer[10]);
- }
- memcpy(blockData, receivedAnswer, 11);
return 0;
}
@@ -380,8 +449,6 @@ int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData)
return 0;
}
-
-
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData)
{
// variables
diff --git a/armsrc/mifareutil.h b/armsrc/mifareutil.h
index 03a545b48..d4fcd8189 100644
--- a/armsrc/mifareutil.h
+++ b/armsrc/mifareutil.h
@@ -57,14 +57,14 @@ int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd,
int mifare_sendcmd_short_special(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
int mifare_sendcmd_short_mfucauth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
+int mifare_sendcmd_short_mfuev1auth(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t *data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing);
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested);
int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing);
int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
int mifare_ul_ev1_auth(uint8_t *key, uint8_t *pack);
-int mifare_ultra_auth1(uint8_t *blockData);
-int mifare_ultra_auth2(uint8_t *key, uint8_t *blockData);
+int mifare_ultra_auth(uint8_t *key);
int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData);
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData);
diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c
index a502a23d9..a22ff8597 100644
--- a/client/cmdhfmfu.c
+++ b/client/cmdhfmfu.c
@@ -34,12 +34,16 @@ uint8_t default_3des_keys[KEYS_3DES_COUNT][16] = {
{ 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF } // 11 22 33
};
-#define KEYS_PWD_COUNT 8
+#define KEYS_PWD_COUNT 10
uint8_t default_pwd_pack[KEYS_PWD_COUNT][4] = {
{0xFF,0xFF,0xFF,0xFF}, // PACK 0x00,0x00 -- factory default
+
{0x4A,0xF8,0x4B,0x19}, // PACK 0xE5,0xBE -- italian bus (sniffed)
{0x33,0x6B,0xA1,0x19}, // PACK 0x9c,0x2d -- italian bus (sniffed)
{0xFF,0x90,0x6C,0xB2}, // PACK 0x12,0x9e -- italian bus (sniffed)
+ {0x46,0x1c,0xA3,0x19}, // PACK 0xE9,0x5A -- italian bus (sniffed)
+ {0x35,0x1C,0xD0,0x19}, // PACK 0x9A,0x5a -- italian bus (sniffed)
+
{0x05,0x22,0xE6,0xB4}, // PACK 0x80,0x80 -- Amiiboo (sniffed) pikachu-b UID:
{0x7E,0x22,0xE6,0xB4}, // PACK 0x80,0x80 -- AMiiboo (sniffed)
{0x02,0xE1,0xEE,0x36}, // PACK 0x80,0x80 -- AMiiboo (sniffed) sonic UID: 04d257 7ae33e8027
@@ -56,20 +60,20 @@ uint8_t UL_MEMORY_ARRAY[MAX_UL_TYPES] = {MAX_UL_BLOCKS, MAX_UL_BLOCKS, MAX_ULC_B
static int CmdHelp(const char *Cmd);
-char* getProductTypeStr( uint8_t id){
+char *getProductTypeStr( uint8_t id){
static char buf[20];
char *retStr = buf;
switch(id) {
case 3:
- sprintf(retStr, "0x%02X %s", id, "(Ultralight)");
+ sprintf(retStr, "%02X %s", id, "(Ultralight)");
break;
case 4:
- sprintf(retStr, "0x%02X %s", id, "(NTAG)");
+ sprintf(retStr, "%02X %s", id, "(NTAG)");
break;
default:
- sprintf(retStr, "0x%02X %s", id, "(unknown)");
+ sprintf(retStr, "%02X %s", id, "(unknown)");
break;
}
return buf;
@@ -80,7 +84,7 @@ char* getProductTypeStr( uint8_t id){
the LSBit is set to '0' if the size is exactly 2^n
and set to '1' if the storage size is between 2^n and 2^(n+1).
*/
-char* getUlev1CardSizeStr( uint8_t fsize ){
+char *getUlev1CardSizeStr( uint8_t fsize ){
static char buf[40];
char *retStr = buf;
@@ -153,8 +157,6 @@ static int ul_read( uint8_t page, uint8_t *response, uint16_t responseLength ){
uint8_t cmd[] = {ISO14443A_CMD_READBLOCK, page};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if ( len == -1 )
- ul_switch_off_field();
return len;
}
@@ -169,9 +171,7 @@ static int ul_comp_write( uint8_t page, uint8_t *data, uint8_t datalen ){
memcpy(cmd+2, data, datalen);
uint8_t response[1] = {0xff};
- int len = ul_send_cmd_raw(cmd, 2+datalen, response, sizeof(response));
- if ( len == -1 )
- ul_switch_off_field();
+ ul_send_cmd_raw(cmd, 2+datalen, response, sizeof(response));
// ACK
if ( response[0] == 0x0a ) return 0;
// NACK
@@ -182,17 +182,25 @@ static int ulc_requestAuthentication( uint8_t *nonce, uint16_t nonceLength ){
uint8_t cmd[] = {MIFARE_ULC_AUTH_1, 0x00};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), nonce, nonceLength);
- if ( len == -1 )
- ul_switch_off_field();
return len;
}
+static int ulc_authentication( uint8_t *key, bool switch_off_field ){
+
+ UsbCommand c = {CMD_MIFAREUC_AUTH, {switch_off_field}};
+ memcpy(c.d.asBytes, key, 16);
+ SendCommand(&c);
+ UsbCommand resp;
+ if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) return -1;
+ if ( resp.arg[0] == 1 ) return 0;
+
+ return -2;
+}
+
static int ulev1_requestAuthentication( uint8_t *pwd, uint8_t *pack, uint16_t packLength ){
uint8_t cmd[] = {MIFARE_ULEV1_AUTH, pwd[0], pwd[1], pwd[2], pwd[3]};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), pack, packLength);
- if ( len == -1)
- ul_switch_off_field();
return len;
}
@@ -200,8 +208,6 @@ static int ulev1_getVersion( uint8_t *response, uint16_t responseLength ){
uint8_t cmd[] = {MIFARE_ULEV1_VERSION};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if ( len == -1 )
- ul_switch_off_field();
return len;
}
@@ -210,7 +216,6 @@ static int ulev1_getVersion( uint8_t *response, uint16_t responseLength ){
// uint8_t cmd[] = {MIFARE_ULEV1_FASTREAD, startblock, endblock};
// if ( !ul_send_cmd_raw(cmd, sizeof(cmd), response)){
- // ul_switch_off_field();
// return -1;
// }
// return 0;
@@ -220,8 +225,6 @@ static int ulev1_readCounter( uint8_t counter, uint8_t *response, uint16_t respo
uint8_t cmd[] = {MIFARE_ULEV1_READ_CNT, counter};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if (len == -1)
- ul_switch_off_field();
return len;
}
@@ -229,8 +232,6 @@ static int ulev1_readTearing( uint8_t counter, uint8_t *response, uint16_t respo
uint8_t cmd[] = {MIFARE_ULEV1_CHECKTEAR, counter};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if (len == -1)
- ul_switch_off_field();
return len;
}
@@ -238,15 +239,12 @@ static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){
uint8_t cmd[] = {MIFARE_ULEV1_READSIG, 0x00};
int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
- if (len == -1)
- ul_switch_off_field();
return len;
}
static int ul_print_default( uint8_t *data){
uint8_t uid[7];
-
uid[0] = data[0];
uid[1] = data[1];
uid[2] = data[2];
@@ -504,7 +502,7 @@ uint16_t GetHF14AMfU_Type(void){
status = ul_select(&card);
if ( status < 1 ){
- PrintAndLog("Error: couldn't select");
+ PrintAndLog("iso14443a card select failed");
ul_switch_off_field();
return UL_ERROR;
}
@@ -518,7 +516,7 @@ uint16_t GetHF14AMfU_Type(void){
if ( card.uid[0] != 0x05) {
len = ulev1_getVersion(version, sizeof(version));
- if (len > -1) ul_switch_off_field(); //if -1 it is already off
+ ul_switch_off_field();
switch (len) {
case 0x0A: {
@@ -551,11 +549,11 @@ uint16_t GetHF14AMfU_Type(void){
ul_switch_off_field();
return UL_ERROR;
}
- uint8_t nonce1[11] = {0x00};
- status = ulc_requestAuthentication(nonce1, sizeof(nonce1));
+ uint8_t nonce[11] = {0x00};
+ status = ulc_requestAuthentication(nonce, sizeof(nonce));
tagtype = ( status > 0 ) ? UL_C : UL;
- if (status != -1) ul_switch_off_field();
+ ul_switch_off_field();
}
} else {
// Infinition MY-D tests Exam high nibble
@@ -642,9 +640,8 @@ int CmdHF14AMfUInfo(const char *Cmd){
if ( hasAuthKey ) {
if ((tagtype & UL_C)) {
- ul_switch_off_field();
//will select card automatically
- if (try3DesAuthentication(authenticationkey, false) != 1) {
+ if (ulc_authentication(authenticationkey, false) != 0) {
ul_switch_off_field();
PrintAndLog("Error: Authentication Failed UL-C");
return 0;
@@ -652,7 +649,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
} else {
len = ulev1_requestAuthentication(authenticationkey, pack, sizeof(pack));
if (len < 1) {
- if (!len) ul_switch_off_field();
+ ul_switch_off_field();
PrintAndLog("Error: Authentication Failed UL-EV1/NTAG");
return 0;
}
@@ -663,6 +660,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
// read pages 0,1,2,4 (should read 4pages)
status = ul_read(0, data, sizeof(data));
if ( status == -1 ){
+ ul_switch_off_field();
PrintAndLog("Error: tag didn't answer to READ");
return status;
}
@@ -685,6 +683,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
uint8_t ulc_deskey[16] = {0x00};
status = ul_read(0x2C, ulc_deskey, sizeof(ulc_deskey));
if ( status == -1 ){
+ ul_switch_off_field();
PrintAndLog("Error: tag didn't answer to READ magic");
return status;
}
@@ -695,17 +694,18 @@ int CmdHF14AMfUInfo(const char *Cmd){
if ( hasAuthKey ) return 1;
PrintAndLog("Trying some default 3des keys");
- ul_switch_off_field(); //will select again in try3DesAuth...
for (uint8_t i = 0; i < KEYS_3DES_COUNT; ++i ){
key = default_3des_keys[i];
- if (try3DesAuthentication(key, true) == 1){
+ if (ulc_authentication(key, true) == 0){
PrintAndLog("Found default 3des key: "); //%s", sprint_hex(key,16));
uint8_t keySwap[16];
memcpy(keySwap, SwapEndian64(key,16,8), 16);
ulc_print_3deskey(keySwap);
+ ul_switch_off_field();
return 1;
}
}
+ ul_switch_off_field();
return 1; //return even if key not found (UL_C is done)
}
}
@@ -718,6 +718,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
status = ulev1_readSignature( ulev1_signature, sizeof(ulev1_signature));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to READ SIGNATURE");
+ ul_switch_off_field();
return status;
}
ulev1_print_signature( ulev1_signature, sizeof(ulev1_signature));
@@ -727,6 +728,7 @@ int CmdHF14AMfUInfo(const char *Cmd){
status = ul_read(startconfigblock, ulev1_conf, sizeof(ulev1_conf));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to READ EV1");
+ ul_switch_off_field();
return status;
}
// save AUTHENTICATION LIMITS for later:
@@ -745,12 +747,16 @@ int CmdHF14AMfUInfo(const char *Cmd){
status = ulev1_getVersion(version, sizeof(version));
if ( status == -1 ){
PrintAndLog("Error: tag didn't answer to GETVERSION");
+ ul_switch_off_field();
return status;
}
ulev1_print_version(version);
// if we called info with key, just return
- if ( hasAuthKey ) return 1;
+ if ( hasAuthKey ) {
+ ul_switch_off_field();
+ return 1;
+ }
// AUTHLIMIT, (number of failed authentications)
// 0 = limitless.
@@ -768,7 +774,6 @@ int CmdHF14AMfUInfo(const char *Cmd){
}
}
}
- if (len > -1) ul_switch_off_field();
}
}
@@ -985,9 +990,6 @@ int CmdHF14AMfUDump(const char *Cmd){
errors = param_gethex(tempStr, 0, key, dataLen);
else
errors = true;
-
- if (!errors)
- memcpy(key, data, dataLen/2);
cmdp += 2;
hasPwd = true;
@@ -1087,11 +1089,10 @@ int CmdHF14AMfUDump(const char *Cmd){
}
// add keys
- if (hasPwd && dataLen == 32){ //UL_C
- memcpy(data + Pages*4, key, 16);
+ if (hasPwd){ //UL_C
+ memcpy(data + Pages*4, key, dataLen/2);
Pages += 4;
}
- //TODO add key MEM location for other tags
for (i = 0; i < Pages; ++i) {
if ( i < 3 ) {
@@ -1165,6 +1166,7 @@ int CmdHF14AMfUDump(const char *Cmd){
return 0;
}
+/*
// Needed to Authenticate to Ultralight C tags
void rol (uint8_t *data, const size_t len){
uint8_t first = data[0];
@@ -1173,6 +1175,7 @@ void rol (uint8_t *data, const size_t len){
}
data[len-1] = first;
}
+*/
//-------------------------------------------------------------------------------
// Ultralight C Methods
@@ -1191,7 +1194,7 @@ int CmdHF14AMfucAuth(const char *Cmd){
//Change key to user defined one
if (cmdp == 'k' || cmdp == 'K'){
keyNo = param_get8(Cmd, 1);
- if(keyNo > 6)
+ if(keyNo > KEYS_3DES_COUNT)
errors = true;
}
@@ -1213,7 +1216,7 @@ int CmdHF14AMfucAuth(const char *Cmd){
}
uint8_t *key = default_3des_keys[keyNo];
- if (try3DesAuthentication(key, true) > 0)
+ if (ulc_authentication(key, true) == 0)
PrintAndLog("Authentication successful. 3des key: %s",sprint_hex(key, 16));
else
PrintAndLog("Authentication failed");
@@ -1221,68 +1224,6 @@ int CmdHF14AMfucAuth(const char *Cmd){
return 0;
}
-int try3DesAuthentication( uint8_t *key, bool switch_off_field ){
-
- //uint32_t cuid = 0;
-
- des3_context ctx = { 0 };
-
- uint8_t random_a[8] = { 1,1,1,1,1,1,1,1 };
- uint8_t random_b[8] = { 0 };
- uint8_t enc_random_b[8] = { 0 };
- uint8_t rnd_ab[16] = { 0 };
- uint8_t iv[8] = { 0 };
-
- UsbCommand c = {CMD_MIFAREUC_AUTH1, {0x00}};
- SendCommand(&c);
- UsbCommand resp;
- if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500) ) return -1;
- if ( !(resp.arg[0] & 0xff) ) return -2;
-
- //cuid = resp.arg[1];
- memcpy(enc_random_b,resp.d.asBytes+1,8);
-
- des3_set2key_dec(&ctx, key);
- // context, mode, length, IV, input, output
- des3_crypt_cbc( &ctx, DES_DECRYPT, sizeof(random_b), iv , enc_random_b , random_b);
-
- rol(random_b,8);
- memcpy(rnd_ab ,random_a,8);
- memcpy(rnd_ab+8,random_b,8);
-
- des3_set2key_enc(&ctx, key);
- // context, mode, length, IV, input, output
- des3_crypt_cbc(&ctx, DES_ENCRYPT, sizeof(rnd_ab), enc_random_b, rnd_ab, rnd_ab);
-
- //Auth2
- c.cmd = CMD_MIFAREUC_AUTH2;
- c.arg[0] = switch_off_field;
- memcpy(c.d.asBytes, rnd_ab, 16);
- SendCommand(&c);
-
- if ( !WaitForResponseTimeout(CMD_ACK, &resp, 1500)) return -1;
- if ( !(resp.arg[0] & 0xff)) return -2;
-
- uint8_t enc_resp[8] = { 0 };
- uint8_t resp_random_a[8] = { 0 };
- memcpy(enc_resp, resp.d.asBytes+1, 8);
-
- des3_set2key_dec(&ctx, key);
- // context, mode, length, IV, input, output
- des3_crypt_cbc( &ctx, DES_DECRYPT, 8, enc_random_b, enc_resp, resp_random_a);
-
- if ( !memcmp(resp_random_a, random_a, 8))
- return 1;
- return 0;
-
- //PrintAndLog(" RndA :%s", sprint_hex(random_a, 8));
- //PrintAndLog(" enc(RndB) :%s", sprint_hex(enc_random_b, 8));
- //PrintAndLog(" RndB :%s", sprint_hex(random_b, 8));
- //PrintAndLog(" A+B :%s", sprint_hex(random_a_and_b, 16));
- //PrintAndLog(" enc(A+B) :%s", sprint_hex(random_a_and_b, 16));
- //PrintAndLog(" enc(RndA') :%s", sprint_hex(data2+1, 8));
-}
-
/**
A test function to validate that the polarssl-function works the same
was as the openssl-implementation.
@@ -1419,7 +1360,6 @@ int CmdHF14AMfUCRdBl(const char *Cmd)
hasPwd = TRUE;
}
}
- //uint8_t *key2 = SwapEndian64(key, 16, 8);
//Read Block
UsbCommand c = {CMD_MIFAREU_READBL, {blockNo}};