Merge branch 'master' into lf_emul

CHANGELOG.md

@@ -3,6 +3,18 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Fix 'hf mfdes enum' - now actually manages to enumerate files under all AID's. :smiley:  (@iceman1001)
+ - Fix 'hf mfdes info' - now detects DESFire light and work properly Wrapped commands :+1: (@iceman1001)
+ - :smiling_imp: support (@doegox)
+ - Additional colour changes as recommended by @iceman (@dunderhay)
+ - Change type colour for `hf 14a` card types (@dunderhay)
+ - Add colour to `hf mfdes` command (@dunderhay)
+ - Add 'HINTS' command.  Will turn off / on hint messages. Default mode is OFF.  (@iceman1001)
+ - Add colour to `hf 14a` and `hf mfu` commands (@dunderhay)
+ - Add colour to `lf hid` commands (@dunderhay)
+ - Change `script run hf_bruteforce -s start_id -e end_id -t timeout -x mifare_card_type` - The hf_bruteforce card script now requires Mifare type (mfc or mfu) (@dunderhay)
+ - Updated `hf_bruteforce.lua` script - added support for brute forcing Mifare Ultralight EV1 cards (@dunderhay)
+ - Added `hf mf personlize` - personalize the UID of a Mifare Classic EV1 card (@pwpiwi)
  - Change - hint texts added to all lf clone commands (@iceman1001)
  - Change `lf keri demod` - adjusted the internal id. (@mwalker33)
  - Added seamless integration with cryptohelper (@iceman1001)
@@ -431,6 +443,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Added `hf mf mad` and `hf mfp mad` MAD decode, check and print commands (@merlokk)
  - Added `script run luxeodump` (@0xdrrb)
  - Fix `lf hitag reader 02` - print all bytes (@bosb)
+ - Fix hitag S simulation (still not working), write, add example HITAG S 256  (@bosb)
 
 
 ### Fixed

appveyor.yml

@@ -24,7 +24,7 @@ init:
     Add-AppveyorMessage -Message "[$env:APPVEYOR_REPO_COMMIT_SHORT]$env:appveyor_repo_name($env:APPVEYOR_REPO_BRANCH)" -Category Information -Details "repository: $env:appveyor_repo_name branch: $env:APPVEYOR_REPO_BRANCH release: $releasename"
 
 
-    iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
+    # iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
 clone_script:
 - ps: >-
     Write-Host "Removing ProxSpace..." -NoNewLine
@@ -409,4 +409,4 @@ on_success:
 on_failure:
 - ps: Write-Host "Build error." -ForegroundColor Red
 on_finish:
-- ps: $blockRdp = $false; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
+- ps: # $blockRdp = $false; iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))

armsrc/Standalone/lf_icehid.c

@@ -7,6 +7,7 @@
 //-----------------------------------------------------------------------------
 // main code for HID collector aka IceHID by Iceman
 //-----------------------------------------------------------------------------
+#include <inttypes.h>
 #include "standalone.h" // standalone definitions
 #include "proxmark3_arm.h"
 #include "appmain.h"
@@ -105,7 +106,7 @@ uint32_t IceEM410xdemod() {
     memset(entry, 0, sizeof(entry));
 
     if (size == 128) {
-        sprintf((char *)entry, "EM XL TAG ID: %06lx%08lx%08lx - (%05ld_%03ld_%08ld)\n",
+        sprintf((char *)entry, "EM XL TAG ID: %06"PRIx32"%08"PRIx32"%08"PRIx32" - (%05"PRIu32"_%03"PRIu32"_%08"PRIu32")\n",
                 hi,
                 (uint32_t)(lo >> 32),
                 (uint32_t)lo,
@@ -113,7 +114,7 @@ uint32_t IceEM410xdemod() {
                 (uint32_t)((lo >> 16LL) & 0xFF),
                 (uint32_t)(lo & 0xFFFFFF));
     } else {
-        sprintf((char *)entry, "EM TAG ID: %02lx%08lx - (%05ld_%03ld_%08ld)\n",
+        sprintf((char *)entry, "EM TAG ID: %02"PRIx32"%08"PRIx32" - (%05"PRIu32"_%03"PRIu32"_%08"PRIu32")\n",
                 (uint32_t)(lo >> 32),
                 (uint32_t)lo,
                 (uint32_t)(lo & 0xFFFF),
@@ -160,16 +161,16 @@ uint32_t IceAWIDdemod() {
         uint8_t fac = bytebits_to_byte(dest + 9, 8);
         uint32_t cardnum = bytebits_to_byte(dest + 17, 16);
         uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen);
-        sprintf((char *)entry, "AWID bit len: %d, FC: %d, Card: %ld - Wiegand: %lx, Raw: %08lx%08lx%08lx\n", fmtLen, fac, cardnum, code1, rawHi2, rawHi, rawLo);
+        sprintf((char *)entry, "AWID bit len: %d, FC: %d, Card: %"PRIu32" - Wiegand: %"PRIx32", Raw: %08"PRIx32"%08"PRIx32"%08"PRIx32"\n", fmtLen, fac, cardnum, code1, rawHi2, rawHi, rawLo);
     } else {
         uint32_t cardnum = bytebits_to_byte(dest + 8 + (fmtLen - 17), 16);
         if (fmtLen > 32) {
             uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen - 32);
             uint32_t code2 = bytebits_to_byte(dest + 8 + (fmtLen - 32), 32);
-            sprintf((char *)entry, "AWID bit len: %d -unk bit len - Card: %ld - Wiegand: %lx%08lx, Raw: %08lx%08lx%08lx\n", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo);
+            sprintf((char *)entry, "AWID bit len: %d -unk bit len - Card: %"PRIu32" - Wiegand: %"PRIx32"%08"PRIx32", Raw: %08"PRIx32"%08"PRIx32"%08"PRIx32"\n", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo);
         } else {
             uint32_t code1 = bytebits_to_byte(dest + 8, fmtLen);
-            sprintf((char *)entry, "AWID bit len: %d -unk bit len - Card: %ld - Wiegand: %lx, Raw: %08lx%08lx%08lx\n", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo);
+            sprintf((char *)entry, "AWID bit len: %d -unk bit len - Card: %"PRIu32" - Wiegand: %"PRIx32", Raw: %08"PRIx32"%08"PRIx32"%08"PRIx32"\n", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo);
         }
     }
 
@@ -209,7 +210,7 @@ uint32_t IceIOdemod() {
     uint8_t entry[64];
     memset(entry, 0, sizeof(entry));
 
-    sprintf((char *)entry, "IO Prox XSF(%02d)%02x:%05d (%08lx%08lx)\n"
+    sprintf((char *)entry, "IO Prox XSF(%02u)%02x:%05u (%08"PRIx32"%08"PRIx32")\n"
             , version
             , facilitycode
             , number
@@ -249,7 +250,7 @@ uint32_t IceHIDDemod() {
         // go over previously decoded manchester data and decode into usable tag ID
         if (hi2 != 0) { //extra large HID tags  88/192 bits
 
-            sprintf((char *)entry, "HID large: %lx%08lx%08lx (%ld)\n",
+            sprintf((char *)entry, "HID large: %"PRIx32"%08"PRIx32"%08"PRIx32" (%"PRIu32")\n",
                     hi2,
                     hi,
                     lo,
@@ -296,7 +297,7 @@ uint32_t IceHIDDemod() {
                 fac = ((hi & 0xF) << 12) | (lo >> 20);
             }
 
-            sprintf((char *)entry, "HID: %lx%08lx (%ld) Format: %d bit FC: %ld Card: %ld\n",
+            sprintf((char *)entry, "HID: %"PRIx32"%08"PRIx32" (%"PRIu32") Format: %d bit FC: %"PRIu32" Card: %"PRIu32"\n",
                     hi,
                     lo,
                     (lo >> 1) & 0xFFFF,

armsrc/appmain.c

@@ -42,6 +42,7 @@
 #include "Standalone/standalone.h"
 #include "util.h"
 #include "ticks.h"
+#include "commonutil.h"
 
 #ifdef WITH_LCD
 #include "LCD.h"
@@ -1247,6 +1248,17 @@ static void PacketReceived(PacketCommandNG *packet) {
 //            SniffMifare(packet->oldarg[0]);
 //            break;
 //        }
+        case CMD_HF_MIFARE_PERSONALIZE_UID: {
+            struct p {
+                uint8_t keytype;
+                uint8_t pers_option;
+                uint8_t key[6];
+            } PACKED;
+            struct p *payload = (struct p *) packet->data.asBytes;
+            uint64_t authkey = bytes_to_num(payload->key, 6);
+            MifarePersonalizeUID(payload->keytype, payload->pers_option, authkey);
+            break;
+        }
         case CMD_HF_MIFARE_SETMOD: {
             MifareSetMod(packet->data.asBytes);
             break;

armsrc/hitag2.c

@@ -544,7 +544,7 @@ bool hitag1_authenticate(uint8_t *rx, const size_t rxlen, uint8_t *tx, size_t *t
                 // will receive 32-bit configuration page
             } else if (bSelecting) {
                 // Initiate auth
-                tx[0] = 0xa0 | key_no >> 4; // WRCPAGE
+                tx[0] = 0xa0 | (key_no); // WRCPAGE
                 tx[1] = blocknr << 4;
                 crc = hitag_crc(tx, 12);
                 tx[1] |= crc >> 4;
@@ -1401,7 +1401,6 @@ void ReaderHitag(hitag_function htf, hitag_data *htd) {
         // hitagS settings
         t_wait_1 = 204;
         t_wait_2 = 128;
-        /*tag_size = 256;*/
         flipped_bit = 0;
         tag_size = 8;
         DBG DbpString("Configured for hitagS reader");

armsrc/hitag2crack.c

@@ -40,8 +40,7 @@ bool hitag2_crack(uint8_t *response, uint8_t *nrarhex) {
     uint8_t *spaceptr = NULL;
 
     // get uid as hexstring
-    if(!hitag2_get_uid(uidhex))
-    {
+    if (!hitag2_get_uid(uidhex)) {
         UserMessage("Cannot get UID\r\n");
         return false;
     }
@@ -51,35 +50,30 @@ bool hitag2_crack(uint8_t *response, uint8_t *nrarhex) {
 
     // convert nR and aR hexstrings to binarray
     spaceptr = strchr(nrarhex, ' ');
-    if (!spaceptr)
-    {
+    if (!spaceptr) {
         UserMessage("Please supply a valid nR aR pair\r\n");
         return false;
     }
     *spaceptr = 0x00;
 
-    if (hextobinarray(nrar, nrarhex) != 32)
-    {
+    if (hextobinarray(nrar, nrarhex) != 32) {
         UserMessage("nR is not 32 bits long\r\n");
         return false;
     }
 
-    if (hextobinarray(nrar + 32, spaceptr + 1) != 32)
-    {
+    if (hextobinarray(nrar + 32, spaceptr + 1) != 32) {
         UserMessage("aR is not 32 bits long\r\n");
         return false;
     }
 
     // find a valid encrypted command
-    if (!hitag2crack_find_valid_e_cmd(e_firstcmd, nrar))
-    {
+    if (!hitag2crack_find_valid_e_cmd(e_firstcmd, nrar)) {
         UserMessage("Cannot find a valid encrypted command\r\n");
         return false;
     }
 
     // find the 'read page 0' command and recover key stream
-    if (!hitag2crack_find_e_page0_cmd(keybits, e_firstcmd, nrar, uid))
-    {
+    if (!hitag2crack_find_e_page0_cmd(keybits, e_firstcmd, nrar, uid)) {
         UserMessage("Cannot find encrypted 'read page0' command\r\n");
         return false;
     }
@@ -88,14 +82,10 @@ bool hitag2_crack(uint8_t *response, uint8_t *nrarhex) {
     response[0] = 0x00;
 
     // read all pages using key stream
-    for (i=0; i<8; i++)
-    {
-        if (hitag2crack_read_page(pagehex, i, nrar, keybits))
-        {
+    for (i = 0; i < 8; i++) {
+        if (hitag2crack_read_page(pagehex, i, nrar, keybits)) {
             sprintf(temp, "%1d: %s\r\n", i, pagehex);
-        }
-        else
-        {
+        } else {
             sprintf(temp, "%1d:\r\n", i);
         }
         // add page string to response
@@ -175,64 +165,49 @@ bool hitag2crack_find_e_page0_cmd(uint8_t keybits[], uint8_t e_firstcmd[], uint8
 
     UserMessage("Finding 'read page 0' command:");
     // we're going to brute the missing 4 bits of the valid encrypted command
-    for (a=0; a<2; a++)
-    {
-        for (b=0; b<2; b++)
-        {
-            for (c=0; c<2; c++)
-            {
-                for (d=0; d<2; d++)
-                {
+    for (a = 0; a < 2; a++) {
+        for (b = 0; b < 2; b++) {
+            for (c = 0; c < 2; c++) {
+                for (d = 0; d < 2; d++) {
                     // create our guess by bit flipping the pattern of bits
                     // representing the inverted bit and the 3 page bits
                     // in both the non-inverted and inverted parts of the
                     // encrypted command.
                     memcpy(guess, e_firstcmd, 10);
-                    if (a)
-                    {
+                    if (a) {
                         guess[5] = !guess[5];
                         guess[0] = !guess[0];
                     }
-                    if (b)
-                    {
+                    if (b) {
                         guess[7] = !guess[7];
                         guess[2] = !guess[2];
                     }
-                    if (c)
-                    {
+                    if (c) {
                         guess[8] = !guess[8];
                         guess[3] = !guess[3];
                     }
-                    if (d)
-                    {
+                    if (d) {
                         guess[9] = !guess[9];
                         guess[4] = !guess[4];
                     }
 
                     // try the guess
-                    if (hitag2crack_send_e_cmd(responsestr, nrar, guess, 10))
-                    {
+                    if (hitag2crack_send_e_cmd(responsestr, nrar, guess, 10)) {
                         // check if it was valid
-                        if (strcmp(responsestr, ERROR_RESPONSE) != 0)
-                        {
+                        if (strcmp(responsestr, ERROR_RESPONSE) != 0) {
                             // convert response to binarray
                             hextobinarray(e_uid, responsestr);
                             // test if the guess was 'read page 0' command
-                            if (hitag2crack_test_e_p0cmd(keybits, nrar, guess, uid, e_uid))
-                            {
+                            if (hitag2crack_test_e_p0cmd(keybits, nrar, guess, uid, e_uid)) {
 
                                 return true;
                             }
-                        }
-                        else
-                        {
+                        } else {
 #ifdef RFIDLER_DEBUG
                             UserMessage("hitag2crack_find_e_page0_cmd:\r\n hitag2crack_send_e_cmd returned ERROR_RESPONSE\r\n");
 #endif
                         }
-                    }
-                    else
-                    {
+                    } else {
 #ifdef RFIDLER_DEBUG
                         UserMessage("hitag2crack_find_e_page0_cmd:\r\n hitag2crack_send_e_cmd failed\r\n");
 #endif
@@ -279,8 +254,7 @@ bool hitag2crack_test_e_p0cmd(uint8_t *keybits, uint8_t *nrar, uint8_t *e_cmd, u
     hitag2crack_xor(keybits, plainbits, cipherbits, 42);
 
     // create extended cmd -> 4 * READP0CMD = 40 bits
-    for (i=0; i<4; i++)
-    {
+    for (i = 0; i < 4; i++) {
         binstringtobinarray(ext_cmd + (i * 10), READP0CMD);
     }
 
@@ -288,16 +262,12 @@ bool hitag2crack_test_e_p0cmd(uint8_t *keybits, uint8_t *nrar, uint8_t *e_cmd, u
     hitag2crack_xor(e_ext_cmd, ext_cmd, keybits, 40);
 
     // send extended encrypted cmd
-    if (hitag2crack_send_e_cmd(responsestr, nrar, e_ext_cmd, 40))
-    {
+    if (hitag2crack_send_e_cmd(responsestr, nrar, e_ext_cmd, 40)) {
         // test if it was valid
-        if (strcmp(responsestr, ERROR_RESPONSE) != 0)
-        {
+        if (strcmp(responsestr, ERROR_RESPONSE) != 0) {
             return true;
         }
-    }
-    else
-    {
+    } else {
 #ifdef RFIDLER_DEBUG
         UserMessage("hitag2crack_test_e_p0cmd:\r\n hitag2crack_send_e_cmd failed\r\n");
 #endif
@@ -330,26 +300,22 @@ bool hitag2crack_read_page(uint8_t *responsestr, uint8_t pagenum, uint8_t *nrar,
     uint8_t response[32];
     int i;
 
-    if ((pagenum < 0) || (pagenum > 7))
-    {
+    if (pagenum > 7) {
         UserMessage("hitag2crack_read_page:\r\n invalid pagenum\r\n");
         return false;
     }
 
     // create cmd
     binstringtobinarray(cmd, READP0CMD);
-    if (pagenum & 0x1)
-    {
+    if (pagenum & 0x1) {
         cmd[9] = !cmd[9];
         cmd[4] = !cmd[4];
     }
-    if (pagenum & 0x2)
-    {
+    if (pagenum & 0x2) {
         cmd[8] = !cmd[8];
         cmd[3] = !cmd[3];
     }
-    if (pagenum & 0x4)
-    {
+    if (pagenum & 0x4) {
         cmd[7] = !cmd[7];
         cmd[2] = !cmd[2];
     }
@@ -358,11 +324,9 @@ bool hitag2crack_read_page(uint8_t *responsestr, uint8_t pagenum, uint8_t *nrar,
     hitag2crack_xor(e_cmd, cmd, keybits, 10);
 
     // send encrypted command
-    if (hitag2crack_send_e_cmd(e_responsestr, nrar, e_cmd, 10))
-    {
+    if (hitag2crack_send_e_cmd(e_responsestr, nrar, e_cmd, 10)) {
         // check if it is valid
-        if (strcmp(e_responsestr, ERROR_RESPONSE) != 0)
-        {
+        if (strcmp(e_responsestr, ERROR_RESPONSE) != 0) {
             // convert to binarray
             hextobinarray(e_response, e_responsestr);
             // decrypt response
@@ -370,14 +334,10 @@ bool hitag2crack_read_page(uint8_t *responsestr, uint8_t pagenum, uint8_t *nrar,
             // convert to hexstring
             binarraytohex(responsestr, response, 32);
             return true;
-        }
-        else
-        {
+        } else {
             UserMessage("hitag2crack_read_page:\r\n hitag2crack_send_e_cmd returned ERROR_RESPONSE\r\n");
         }
-    }
-    else
-    {
+    } else {
         UserMessage("hitag2crack_read_page:\r\n hitag2crack_send_e_cmd failed\r\n");
     }
 
@@ -391,14 +351,13 @@ bool hitag2crack_read_page(uint8_t *responsestr, uint8_t pagenum, uint8_t *nrar,
 // cmd is the binarray of the encrypted command to send;
 // len is the length of the encrypted command.
 bool hitag2crack_send_e_cmd(uint8_t *responsestr, uint8_t *nrar, uint8_t *cmd, int len) {
-    uint8_t tmp[37];
+//    uint8_t tmp[37];
     uint8_t uid[9];
     uint8_t e_page3str[9];
     int ret = 0;
 
     // get the UID
-    if(!hitag2_get_uid(uid))
-    {
+    if (!hitag2_get_uid(uid)) {
         UserMessage("hitag2crack_send_e_cmd:\r\n cannot get UID\r\n");
         return false;
     }
@@ -407,22 +366,19 @@ bool hitag2crack_send_e_cmd(uint8_t *responsestr, uint8_t *nrar, uint8_t *cmd, i
     CryptoActive = false;
 
     // get the UID again
-    if(!hitag2_get_uid(uid))
-    {
+    if (!hitag2_get_uid(uid)) {
         UserMessage("hitag2crack_send_e_cmd:\r\n cannot get UID (2nd time)\r\n");
         return false;
     }
 
     // send nrar and receive (useless) encrypted page 3 value
-    if (!hitag2crack_tx_rx(e_page3str, nrar, 64, RWD_STATE_WAKING, false))
-    {
+    if (!hitag2crack_tx_rx(e_page3str, nrar, 64, RWD_STATE_WAKING, false)) {
         UserMessage("hitag2crack_send_e_cmd:\r\n tx/rx nrar failed\r\n");
         return false;
     }
 
     // send encrypted command
-    if (!hitag2crack_tx_rx(responsestr, cmd, len, RWD_STATE_WAKING, false))
-    {
+    if (!hitag2crack_tx_rx(responsestr, cmd, len, RWD_STATE_WAKING, false)) {
 #ifdef RFIDLER_DEBUG
         UserMessage("hitag2crack_send_e_cmd:\r\n tx/rx cmd failed\r\n");
 #endif
@@ -444,8 +400,7 @@ bool hitag2crack_tx_rx(uint8_t *responsestr, uint8_t *msg, int len, int state, b
     // START_AUTH kills active crypto session
     CryptoActive = false;
 
-    if(!rwd_send(msg, len, reset, BLOCK, state, RFIDlerConfig.FrameClock, 0, RFIDlerConfig.RWD_Wait_Switch_RX_TX, RFIDlerConfig.RWD_Zero_Period, RFIDlerConfig.RWD_One_Period, RFIDlerConfig.RWD_Gap_Period, RFIDlerConfig.RWD_Wait_Switch_TX_RX))
-    {
+    if (!rwd_send(msg, len, reset, BLOCK, state, RFIDlerConfig.FrameClock, 0, RFIDlerConfig.RWD_Wait_Switch_RX_TX, RFIDlerConfig.RWD_Zero_Period, RFIDlerConfig.RWD_One_Period, RFIDlerConfig.RWD_Gap_Period, RFIDlerConfig.RWD_Wait_Switch_TX_RX)) {
         UserMessage("hitag2crack_tx_rx: rwd_send failed\r\n");
         return false;
     }
@@ -455,11 +410,9 @@ bool hitag2crack_tx_rx(uint8_t *responsestr, uint8_t *msg, int len, int state, b
     ret = read_ask_data(RFIDlerConfig.FrameClock, RFIDlerConfig.DataRate, tmp, 37, RFIDlerConfig.Sync, RFIDlerConfig.SyncBits, RFIDlerConfig.Timeout, ONESHOT_READ, BINARY);
 
     // check if response was a valid length (5 sync bits + 32 bits response)
-    if (ret == 37)
-    {
+    if (ret == 37) {
         // check sync bits
-        if (memcmp(tmp, Hitag2Sync, 5) != 0)
-        {
+        if (memcmp(tmp, Hitag2Sync, 5) != 0) {
             UserMessage("hitag2crack_tx_rx: no sync\r\n");
             return false;
         }
@@ -467,9 +420,7 @@ bool hitag2crack_tx_rx(uint8_t *responsestr, uint8_t *msg, int len, int state, b
         // convert response to hexstring
         binarraytohex(responsestr, tmp + 5, 32);
         return true;
-    } 
-    else
-    {
+    } else {
 #ifdef RFIDLER_DEBUG
         UserMessage("hitag2crack_tx_rx: wrong rx len\r\n");
 #endif
@@ -489,16 +440,14 @@ bool hitag2crack_rng_init(uint8_t *response, uint8_t *input) {
     // extract vals from input
     dataptr = input;
     spaceptr = strchr(dataptr, ' ');
-    if (!spaceptr)
-    {
+    if (!spaceptr) {
         UserMessage("/r/nformat is 'sharedkey UID nR' in hex\r\n");
         return false;
     }
 
     *spaceptr = 0x00;
 
-    if (strlen(dataptr) != 12)
-    {
+    if (strlen(dataptr) != 12) {
         UserMessage("/r/nsharedkey should be 48 bits long (12 hexchars)\r\n");
         return false;
     }
@@ -507,15 +456,13 @@ bool hitag2crack_rng_init(uint8_t *response, uint8_t *input) {
 
     dataptr = spaceptr + 1;
     spaceptr = strchr(dataptr, ' ');
-    if (!spaceptr)
-    {
+    if (!spaceptr) {
         UserMessage("/r/nno UID\r\n");
         return false;
     }
 
     *spaceptr = 0x00;
-    if (strlen(dataptr) != 8)
-    {
+    if (strlen(dataptr) != 8) {
         UserMessage("/r/nUID should be 32 bits long (8 hexchars)\r\n");
         return false;
     }
@@ -524,8 +471,7 @@ bool hitag2crack_rng_init(uint8_t *response, uint8_t *input) {
 
     dataptr = spaceptr + 1;
 
-    if (strlen(dataptr) != 8)
-    {
+    if (strlen(dataptr) != 8) {
         UserMessage("/r/nnR should be 32 bits long (8 hexchars)\r\n");
         return false;
     }
@@ -546,8 +492,7 @@ bool hitag2crack_decrypt_hex(uint8_t *response, uint8_t *hex) {
     uint8_t binstr[33];
     uint32_t binulong;
 
-    if (strlen(hex) != 8)
-    {
+    if (strlen(hex) != 8) {
         UserMessage("/r/nhex must be 32bits (8 hex chars)\r\n");
         return false;
     }
@@ -572,8 +517,7 @@ bool hitag2crack_decrypt_bin(uint8_t *response, uint8_t *e_binstr) {
     int len;
 
     len = strlen(e_binstr);
-    if (len > 32)
-    {
+    if (len > 32) {
         UserMessage("\r\nbinary string must be <= 32 bits\r\n");
         return false;
     }
@@ -607,14 +551,14 @@ bool hitag2_keystream(uint8_t *response, uint8_t *nrarhex) {
     uint8_t uid[32];
     uint8_t nrar[64];
     uint8_t e_firstcmd[10];
-    uint8_t e_page0cmd[10];
+//    uint8_t e_page0cmd[10];
 //    uint8_t keybits[2080];
     uint8_t *keybits = DataBuff;
     uint8_t keybitshex[67];
     int kslen;
     int ksoffset;
-    uint8_t pagehex[9];
-    uint8_t temp[20];
+//    uint8_t pagehex[9];
+//    uint8_t temp[20];
     int i;
     uint8_t *spaceptr = NULL;
 
@@ -627,8 +571,7 @@ bool hitag2_keystream(uint8_t *response, uint8_t *nrarhex) {
     */
 
     // get uid as hexstring
-    if(!hitag2_get_uid(uidhex))
-    {
+    if (!hitag2_get_uid(uidhex)) {
         UserMessage("Cannot get UID\r\n");
         return false;
     }
@@ -638,35 +581,30 @@ bool hitag2_keystream(uint8_t *response, uint8_t *nrarhex) {
 
     // convert nR and aR hexstrings to binarray
     spaceptr = strchr(nrarhex, ' ');
-    if (!spaceptr)
-    {
+    if (!spaceptr) {
         UserMessage("Please supply a valid nR aR pair\r\n");
         return false;
     }
     *spaceptr = 0x00;
 
-    if (hextobinarray(nrar, nrarhex) != 32)
-    {
+    if (hextobinarray(nrar, nrarhex) != 32) {
         UserMessage("nR is not 32 bits long\r\n");
         return false;
     }
 
-    if (hextobinarray(nrar + 32, spaceptr + 1) != 32)
-    {
+    if (hextobinarray(nrar + 32, spaceptr + 1) != 32) {
         UserMessage("aR is not 32 bits long\r\n");
         return false;
     }
 
     // find a valid encrypted command
-    if (!hitag2crack_find_valid_e_cmd(e_firstcmd, nrar))
-    {
+    if (!hitag2crack_find_valid_e_cmd(e_firstcmd, nrar)) {
         UserMessage("Cannot find a valid encrypted command\r\n");
         return false;
     }
 
     // find the 'read page 0' command and recover key stream
-    if (!hitag2crack_find_e_page0_cmd(keybits, e_firstcmd, nrar, uid))
-    {
+    if (!hitag2crack_find_e_page0_cmd(keybits, e_firstcmd, nrar, uid)) {
         UserMessage("Cannot find encrypted 'read page0' command\r\n");
         return false;
     }
@@ -675,30 +613,25 @@ bool hitag2_keystream(uint8_t *response, uint8_t *nrarhex) {
     // increasing lengths to acquire 2048 bits of key stream.
     kslen = 40;
 
-    while (kslen < 2048)
-    {
+    while (kslen < 2048) {
         ksoffset = 0;
-        if (!hitag2crack_send_auth(nrar))
-        {
+        if (!hitag2crack_send_auth(nrar)) {
             UserMessage("hitag2crack_send_auth failed\r\n");
             return false;
         }
         // while we have at least 52 bits of keystream, consume it with
         // extended read page 0 commands. 52 = 10 (min command len) +
         // 32 (response) + 10 (min command len we'll send)
-        while ((kslen - ksoffset) >= 52)
-        {
+        while ((kslen - ksoffset) >= 52) {
             // consume the keystream, updating ksoffset as we go
-            if (!hitag2crack_consume_keystream(keybits, kslen, &ksoffset, nrar))
-            {
+            if (!hitag2crack_consume_keystream(keybits, kslen, &ksoffset, nrar)) {
                 UserMessage("hitag2crack_consume_keystream failed\r\n");
                 return false;
             }
         }
         // send an extended command to retrieve more keystream, updating kslen
         // as we go
-        if (!hitag2crack_extend_keystream(keybits, &kslen, ksoffset, nrar, uid))
-        {
+        if (!hitag2crack_extend_keystream(keybits, &kslen, ksoffset, nrar, uid)) {
             UserMessage("hitag2crack_extend_keystream failed\r\n");
             return false;
         }
@@ -706,8 +639,7 @@ bool hitag2_keystream(uint8_t *response, uint8_t *nrarhex) {
 
     }
 
-    for (i=0; i<2048; i+=256)
-    {
+    for (i = 0; i < 2048; i += 256) {
         binarraytohex(keybitshex, keybits + i, 256);
         UserMessage("%s\r\n", keybitshex);
     }
@@ -724,8 +656,7 @@ bool hitag2crack_send_auth(uint8_t *nrar) {
     uint8_t e_page3str[9];
 
     // get the UID
-    if(!hitag2_get_uid(uid))
-    {
+    if (!hitag2_get_uid(uid)) {
         UserMessage("hitag2crack_send_auth:\r\n cannot get UID\r\n");
         return false;
     }
@@ -734,15 +665,13 @@ bool hitag2crack_send_auth(uint8_t *nrar) {
     CryptoActive = false;
 
     // get the UID again
-    if(!hitag2_get_uid(uid))
-    {
+    if (!hitag2_get_uid(uid)) {
         UserMessage("hitag2crack_send_auth:\r\n cannot get UID (2nd time)\r\n");
         return false;
     }
 
     // send nrar and receive (useless) encrypted page 3 value
-    if (!hitag2crack_tx_rx(e_page3str, nrar, 64, RWD_STATE_WAKING, false))
-    {
+    if (!hitag2crack_tx_rx(e_page3str, nrar, 64, RWD_STATE_WAKING, false)) {
         UserMessage("hitag2crack_send_auth:\r\n tx/rx nrar failed\r\n");
         return false;
     }
@@ -767,15 +696,13 @@ bool hitag2crack_consume_keystream(uint8_t *keybits, int kslen, int *ksoffset, u
     // 42 = 32 bit response + 10 bit command reserved for next command.  conlen
     // cannot be longer than 510 bits to fit into the small RWD buffer.
     conlen = kslen - *ksoffset - 42;
-    if (conlen < 10)
-    {
+    if (conlen < 10) {
         UserMessage("hitag2crack_consume_keystream:\r\n conlen < 10\r\n");
         return false;
     }
 
     // sanitise conlen
-    if (conlen > 510)
-    {
+    if (conlen > 510) {
         conlen = 510;
     }
 
@@ -783,8 +710,7 @@ bool hitag2crack_consume_keystream(uint8_t *keybits, int kslen, int *ksoffset, u
     numcmds = conlen / 10;
 
     // build extended command
-    for (i=0; i<numcmds; i++)
-    {
+    for (i = 0; i < numcmds; i++) {
         binstringtobinarray(ext_cmd + (i * 10), READP0CMD);
     }
 
@@ -792,15 +718,13 @@ bool hitag2crack_consume_keystream(uint8_t *keybits, int kslen, int *ksoffset, u
     hitag2crack_xor(e_ext_cmd, ext_cmd, keybits + *ksoffset, numcmds * 10);
 
     // send encrypted command
-    if (!hitag2crack_tx_rx(responsestr, e_ext_cmd, numcmds * 10, RWD_STATE_WAKING, false))
-    {
+    if (!hitag2crack_tx_rx(responsestr, e_ext_cmd, numcmds * 10, RWD_STATE_WAKING, false)) {
         UserMessage("hitag2crack_consume_keystream:\r\n tx/rx cmd failed\r\n");
         return false;
     }
 
     // test response
-    if (strcmp(responsestr, ERROR_RESPONSE) == 0)
-    {
+    if (strcmp(responsestr, ERROR_RESPONSE) == 0) {
         UserMessage("hitag2crack_consume_keystream:\r\n got error response from card\r\n");
         return false;
     }
@@ -828,8 +752,7 @@ bool hitag2crack_extend_keystream(uint8_t *keybits, int *kslen, int ksoffset, ui
 
     // calc number of command iterations to send
     cmdlen = *kslen - ksoffset;
-    if (cmdlen < 10)
-    {
+    if (cmdlen < 10) {
         UserMessage("hitag2crack_extend_keystream:\r\n cmdlen < 10\r\n");
         return false;
     }
@@ -837,8 +760,7 @@ bool hitag2crack_extend_keystream(uint8_t *keybits, int *kslen, int ksoffset, ui
     numcmds = cmdlen / 10;
 
     // build extended command
-    for (i=0; i<numcmds; i++)
-    {
+    for (i = 0; i < numcmds; i++) {
         binstringtobinarray(ext_cmd + (i * 10), READP0CMD);
     }
 
@@ -846,15 +768,13 @@ bool hitag2crack_extend_keystream(uint8_t *keybits, int *kslen, int ksoffset, ui
     hitag2crack_xor(e_ext_cmd, ext_cmd, keybits + ksoffset, numcmds * 10);
 
     // send extended encrypted cmd
-    if (!hitag2crack_tx_rx(responsestr, e_ext_cmd, numcmds * 10, RWD_STATE_WAKING, false))
-    {
+    if (!hitag2crack_tx_rx(responsestr, e_ext_cmd, numcmds * 10, RWD_STATE_WAKING, false)) {
         UserMessage("hitag2crack_extend_keystream:\r\n tx/rx cmd failed\r\n");
         return false;
     }
 
     // test response
-    if (strcmp(responsestr, ERROR_RESPONSE) == 0)
-    {
+    if (strcmp(responsestr, ERROR_RESPONSE) == 0) {
         UserMessage("hitag2crack_extend_keystream:\r\n got error response from card\r\n");
         return false;
     }
@@ -878,17 +798,13 @@ bool hitag2_reader(uint8_t *response, uint8_t *key, bool interactive) {
 
     response[0] = '\0';
     // auth to tag
-    if (hitag2_crypto_auth(tmp, key))
-    {
+    if (hitag2_crypto_auth(tmp, key)) {
         // read tag, one page at a time
-        for (i= 0; i <= 7; ++i)
-        {
-            if(!read_tag(tmp, i, i))
-            {
+        for (i = 0; i <= 7; ++i) {
+            if (!read_tag(tmp, i, i)) {
                 // if read fails, it could be because of auth,
                 // so try to reauth
-                if (!hitag2_crypto_auth(tmp, key))
-                {
+                if (!hitag2_crypto_auth(tmp, key)) {
                     // if we can't reauth, it's a real failure
                     return false;
                 }
@@ -899,25 +815,19 @@ bool hitag2_reader(uint8_t *response, uint8_t *key, bool interactive) {
             strcat(response, tmp);
         }
 
-        if (interactive)
-            {
+        if (interactive) {
             tmp[8] = '\0';
-                for(i= 0; i <= 7 ; ++i)
-                {
+            for (i = 0; i <= 7 ; ++i) {
                 UserMessageNum("%d: ", i);
                 memcpy(tmp, response + (i * 8), 8);
                 UserMessage("%s\r\n", tmp);
             }
             UserMessage("%s", "\r\n");
-            }
-            else
-            {
+        } else {
             hitag2_nvm_store_tag(response);
         }
         return true;
-    }
-    else
-    {
+    } else {
         return false;
     }
 }

armsrc/hitag2crack.h

@@ -19,9 +19,9 @@ bool hitag2crack_tx_rx(uint8_t *responsestr, uint8_t *msg, int len, int state, b
 
 bool hitag2crack_rng_init(uint8_t *response, uint8_t *input);
 bool hitag2crack_decrypt_hex(uint8_t *response, uint8_t *hex);
-bool hitag2crack_decrypt_bin(uint8_t *response, uint8_t *hex);
+bool hitag2crack_decrypt_bin(uint8_t *response, uint8_t *e_binstr);
 bool hitag2crack_encrypt_hex(uint8_t *response, uint8_t *hex);
-bool hitag2crack_encrypt_bin(uint8_t *response, uint8_t *hex);
+bool hitag2crack_encrypt_bin(uint8_t *response, uint8_t *e_binstr);
 
 bool hitag2_keystream(uint8_t *response, uint8_t *nrarhex);
 bool hitag2crack_send_auth(uint8_t *nrar);

armsrc/hitagS.c

@@ -10,6 +10,7 @@
 //-----------------------------------------------------------------------------
 // Some code was copied from Hitag2.c
 //-----------------------------------------------------------------------------
+// bosb 2020
 
 #include "hitagS.h"
 
@@ -23,6 +24,7 @@
 #include "string.h"
 #include "commonutil.h"
 #include "hitag2_crypto.h"
+#include "lfadc.h"
 
 #define CRC_PRESET 0xFF
 #define CRC_POLYNOM 0x1D
@@ -50,6 +52,22 @@ size_t blocknr;
 bool end = false;
 //#define SENDBIT_TEST
 
+/* array index 3 2 1 0 // bytes in sim.bin file are 0 1 2 3 
+// UID is 0 1 2 3 // tag.uid is 3210 
+// datasheet HitagS_V11.pdf bytes in tables printed 3 2 1 0
+
+#db# UID: 5F C2 11 84
+#db# conf0: C9 conf1: 00 conf2: 00
+                3  2  1  0
+#db# Page[ 0]: 84 11 C2 5F uid
+#db# Page[ 1]: AA 00 00 C9 conf, HITAG S 256
+#db# Page[ 2]: 4E 4F 54 48
+#db# Page[ 3]: 52 4B 49 4D
+#db# Page[ 4]: 00 00 00 00
+#db# Page[ 5]: 00 00 00 00
+#db# Page[ 6]: 00 00 00 00
+#db# Page[ 7]: 4B 4F 5F 57 */
+
 #define ht2bs_4a(a,b,c,d)   (~(((a|b)&c)^(a|d)^b))
 #define ht2bs_4b(a,b,c,d)   (~(((d|c)&(a^b))^(d|a|b)))
 #define ht2bs_5c(a,b,c,d,e) (~((((((c^e)|d)&a)^b)&(c^b))^(((d^e)|a)&((d^b)|c))))
@@ -86,7 +104,7 @@ bool end = false;
 #define HITAG_T_TAG_CAPTURE_THREE_HALF 41
 #define HITAG_T_TAG_CAPTURE_FOUR_HALF  57
 
-#define DEBUG 0
+#define DBGLEVEL 0
 
 /*
  * Implementation of the crc8 calculation from Hitag S
@@ -207,6 +225,22 @@ static void hitag_send_bit(int bit) {
 }
 
 static void hitag_send_frame(const uint8_t *frame, size_t frame_len) {
+    if (DBGLEVEL >= DBG_EXTENDED)
+        Dbprintf("hitag_send_frame: (%i) %02X %02X %02X %02X", frame_len, frame[0], frame[1], frame[2], frame[3]);
+    // The beginning of the frame is hidden in some high level; pause until our bits will have an effect
+    AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    HIGH(GPIO_SSC_DOUT);
+    switch (m) {
+        case AC4K:
+        case MC8K:
+            while (AT91C_BASE_TC0->TC_CV < T0 * 40) {}; //FADV
+            break;
+        case AC2K:
+        case MC4K:
+            while (AT91C_BASE_TC0->TC_CV < T0 * 20) {}; //STD + ADV
+            break;
+    }
+
     // SOF - send start of frame
     for (size_t i = 0; i < sof_bits; i++) {
         hitag_send_bit(1);
@@ -299,6 +333,25 @@ static int check_select(uint8_t *rx, uint32_t uid) {
     return 0;
 }
 
+void hitagS_set_frame_modulation() {
+    switch (tag.mode) {
+        case HT_STANDARD:
+            sof_bits = 1;
+            m = MC4K;
+            break;
+        case HT_ADVANCED:
+            sof_bits = 6;
+            m = MC4K;
+            break;
+        case HT_FAST_ADVANCED:
+            sof_bits = 6;
+            m = MC8K;
+            break;
+        default:
+            break;
+    }
+}
+
 /*
  * handles all commands from a reader
  */
@@ -318,20 +371,28 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
     switch (rxlen) {
         case 5: {
             //UID request with a selected response protocol mode
+            if (DBGLEVEL >= DBG_EXTENDED)
+                Dbprintf("UID request: length: %i first byte: %02x", rxlen, rx[0]);
             tag.pstate = HT_READY;
             tag.tstate = HT_NO_OP;
             if ((rx[0] & 0xf0) == 0x30) {
+                if (DBGLEVEL >= DBG_EXTENDED)
+                    Dbprintf("HT_STANDARD");
                 tag.mode = HT_STANDARD;
                 sof_bits = 1;
                 m = AC2K;
             }
             if ((rx[0] & 0xf0) == 0xc0) {
                 tag.mode = HT_ADVANCED;
+                if (DBGLEVEL >= DBG_EXTENDED)
+                    Dbprintf("HT_ADVANCED");
                 sof_bits = 3;
                 m = AC2K;
             }
 
             if ((rx[0] & 0xf0) == 0xd0) {
+                if (DBGLEVEL >= DBG_EXTENDED)
+                    Dbprintf("HT_FAST_ADVANCED");
                 tag.mode = HT_FAST_ADVANCED;
                 sof_bits = 3;
                 m = AC4K;
@@ -344,29 +405,18 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
         break;
         case 45: {
             //select command from reader received
+            if (DBGLEVEL >= DBG_EXTENDED)
+                DbpString("SELECT");
             if (check_select(rx, tag.uid) == 1) {
+                if (DBGLEVEL >= DBG_EXTENDED)
+                    DbpString("SELECT match");
                 //if the right tag was selected
                 *txlen = 32;
-                switch (tag.mode) {
-                    case HT_STANDARD:
-                        sof_bits = 1;
-                        m = MC4K;
-                        break;
-                    case HT_ADVANCED:
-                        sof_bits = 6;
-                        m = MC4K;
-                        break;
-                    case HT_FAST_ADVANCED:
-                        sof_bits = 6;
-                        m = MC8K;
-                        break;
-                    default:
-                        break;
-                }
+                hitagS_set_frame_modulation();
 
                 //send configuration
                 for (int i = 0; i < 4; i++)
-                    tx[i] = (tag.pages[0][1] >> (i * 8)) & 0xff;
+                    tx[i] = tag.pages[1][i];
                 tx[3] = 0xff;
                 if (tag.mode != HT_STANDARD) {
                     *txlen = 40;
@@ -390,22 +440,7 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
             Dbprintf(",{0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X}",
                      rx[0], rx[1], rx[2], rx[3], rx[4], rx[5], rx[6], rx[7]);
 
-            switch (tag.mode) {
-                case HT_STANDARD:
-                    sof_bits = 1;
-                    m = MC4K;
-                    break;
-                case HT_ADVANCED:
-                    sof_bits = 6;
-                    m = MC4K;
-                    break;
-                case HT_FAST_ADVANCED:
-                    sof_bits = 6;
-                    m = MC8K;
-                    break;
-                default:
-                    break;
-            }
+            hitagS_set_frame_modulation();
 
             for (int i = 0; i < 4; i++)
                 _hitag2_byte(&state);
@@ -438,7 +473,10 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
              }
              */
         }
+        break;
         case 40:
+            if (DBGLEVEL >= DBG_EXTENDED)
+                Dbprintf("WRITE");
             //data received to be written
             if (tag.tstate == HT_WRITING_PAGE_DATA) {
                 tag.tstate = HT_NO_OP;
@@ -448,44 +486,14 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
                 *txlen = 2;
                 tx[0] = 0x40;
                 page_to_be_written = 0;
-                switch (tag.mode) {
-                    case HT_STANDARD:
-                        sof_bits = 1;
-                        m = MC4K;
-                        break;
-                    case HT_ADVANCED:
-                        sof_bits = 6;
-                        m = MC4K;
-                        break;
-                    case HT_FAST_ADVANCED:
-                        sof_bits = 6;
-                        m = MC8K;
-                        break;
-                    default:
-                        break;
-                }
+                hitagS_set_frame_modulation();
             } else if (tag.tstate == HT_WRITING_BLOCK_DATA) {
                 tag.pages[page_to_be_written / 4][page_to_be_written % 4] = (rx[0]
                                                                             << 24) + (rx[1] << 16) + (rx[2] << 8) + rx[3];
                 //send ack
                 *txlen = 2;
                 tx[0] = 0x40;
-                switch (tag.mode) {
-                    case HT_STANDARD:
-                        sof_bits = 1;
-                        m = MC4K;
-                        break;
-                    case HT_ADVANCED:
-                        sof_bits = 6;
-                        m = MC4K;
-                        break;
-                    case HT_FAST_ADVANCED:
-                        sof_bits = 6;
-                        m = MC8K;
-                        break;
-                    default:
-                        break;
-                }
+                hitagS_set_frame_modulation();
                 page_to_be_written++;
                 block_data_left--;
                 if (block_data_left == 0) {
@@ -500,29 +508,14 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
                 //send page data
                 uint8_t page = ((rx[0] & 0x0f) * 16) + ((rx[1] & 0xf0) / 16);
                 *txlen = 32;
-                tx[0] = (tag.pages[page / 4][page % 4]) & 0xff;
-                tx[1] = (tag.pages[page / 4][page % 4] >> 8) & 0xff;
-                tx[2] = (tag.pages[page / 4][page % 4] >> 16) & 0xff;
-                tx[3] = (tag.pages[page / 4][page % 4] >> 24) & 0xff;
+                tx[0] = tag.pages[page][0];
+                tx[1] = tag.pages[page][1];
+                tx[2] = tag.pages[page][2];
+                tx[3] = tag.pages[page][3];
                 if (tag.LKP && page == 1)
                     tx[3] = 0xff;
 
-                switch (tag.mode) {
-                    case HT_STANDARD:
-                        sof_bits = 1;
-                        m = MC4K;
-                        break;
-                    case HT_ADVANCED:
-                        sof_bits = 6;
-                        m = MC4K;
-                        break;
-                    case HT_FAST_ADVANCED:
-                        sof_bits = 6;
-                        m = MC8K;
-                        break;
-                    default:
-                        break;
-                }
+                hitagS_set_frame_modulation();
 
                 if (tag.mode != HT_STANDARD) {
                     //add crc8
@@ -543,29 +536,13 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
                 *txlen = 32 * 4;
                 //send page,...,page+3 data
                 for (int i = 0; i < 4; i++) {
-                    tx[0 + i * 4] = (tag.pages[page / 4][page % 4]) & 0xff;
-                    tx[1 + i * 4] = (tag.pages[page / 4][page % 4] >> 8) & 0xff;
-                    tx[2 + i * 4] = (tag.pages[page / 4][page % 4] >> 16) & 0xff;
-                    tx[3 + i * 4] = (tag.pages[page / 4][page % 4] >> 24) & 0xff;
-                    page++;
+                    tx[0 + i * 4] = tag.pages[page + 0 + i * 4][0];
+                    tx[1 + i * 4] = tag.pages[page + 1 + i * 4][1];
+                    tx[2 + i * 4] = tag.pages[page + 2 + i * 4][2];
+                    tx[3 + i * 4] = tag.pages[page + 3 + i * 4][3];
                 }
 
-                switch (tag.mode) {
-                    case HT_STANDARD:
-                        sof_bits = 1;
-                        m = MC4K;
-                        break;
-                    case HT_ADVANCED:
-                        sof_bits = 6;
-                        m = MC4K;
-                        break;
-                    case HT_FAST_ADVANCED:
-                        sof_bits = 6;
-                        m = MC8K;
-                        break;
-                    default:
-                        break;
-                }
+                hitagS_set_frame_modulation();
 
                 if (tag.mode != HT_STANDARD) {
                     //add crc8
@@ -576,29 +553,12 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
                     tx[16] = crc;
                 }
 
-                if ((page - 4) % 4 != 0 || (tag.LKP && (page - 4) == 0)) {
+                if ((page) % 4 != 0 || (tag.LKP && (page) == 0)) {
                     sof_bits = 0;
                     *txlen = 0;
                 }
             } else if ((rx[0] & 0xf0) == 0x80) { //write page
                 uint8_t page = ((rx[0] & 0x0f) * 16) + ((rx[1] & 0xf0) / 16);
-
-                switch (tag.mode) {
-                    case HT_STANDARD:
-                        sof_bits = 1;
-                        m = MC4K;
-                        break;
-                    case HT_ADVANCED:
-                        sof_bits = 6;
-                        m = MC4K;
-                        break;
-                    case HT_FAST_ADVANCED:
-                        sof_bits = 6;
-                        m = MC8K;
-                        break;
-                    default:
-                        break;
-                }
                 if ((tag.LCON && page == 1)
                         || (tag.LKP && (page == 2 || page == 3))) {
                     //deny
@@ -613,22 +573,7 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
 
             } else if ((rx[0] & 0xf0) == 0x90) { //write block
                 uint8_t page = ((rx[0] & 0x0f) * 6) + ((rx[1] & 0xf0) / 16);
-                switch (tag.mode) {
-                    case HT_STANDARD:
-                        sof_bits = 1;
-                        m = MC4K;
-                        break;
-                    case HT_ADVANCED:
-                        sof_bits = 6;
-                        m = MC4K;
-                        break;
-                    case HT_FAST_ADVANCED:
-                        sof_bits = 6;
-                        m = MC8K;
-                        break;
-                    default:
-                        break;
-                }
+                hitagS_set_frame_modulation();
                 if (page % 4 != 0 || page == 0) {
                     //deny
                     *txlen = 0;
@@ -644,7 +589,8 @@ static void hitagS_handle_reader_command(uint8_t *rx, const size_t rxlen,
         }
         break;
         default:
-
+            if (DBGLEVEL >= DBG_EXTENDED)
+                Dbprintf("unknown rxlen: (%i) %02X %02X %02X %02X ...", rxlen, rx[0], rx[1], rx[2], rx[3]);
             break;
     }
 }
@@ -722,7 +668,7 @@ static int hitagS_handle_tag_auth(hitag_function htf, uint64_t key, uint64_t NrA
                        | (uid[30] << 1)
                        | uid[31];
 
-        if (DEBUG)
+        if (DBGLEVEL >= DBG_EXTENDED)
             Dbprintf("UID: %02X %02X %02X %02X", uid1, uid2, uid3, uid4);
 
         tag.uid = (uid4 << 24 | uid3 << 16 | uid2 << 8 | uid1);
@@ -816,7 +762,7 @@ static int hitagS_handle_tag_auth(hitag_function htf, uint64_t key, uint64_t NrA
         tag.LCK1 = response_bit[26];
         tag.LCK0 = response_bit[27];
 
-        if (DEBUG)
+        if (DBGLEVEL >= DBG_EXTENDED)
             Dbprintf("conf0: %02X conf1: %02X conf2: %02X", conf_pages[0], conf_pages[1], conf_pages[2]);
 
         if (tag.auth == 1) {
@@ -839,7 +785,7 @@ static int hitagS_handle_tag_auth(hitag_function htf, uint64_t key, uint64_t NrA
                     tx[5] = auth_ks[1];
                     tx[6] = auth_ks[2];
                     tx[7] = auth_ks[3];
-                    if (DEBUG)
+                    if (DBGLEVEL >= DBG_EXTENDED)
                         Dbprintf("%02X %02X %02X %02X %02X %02X %02X %02X", tx[0],
                                  tx[1], tx[2], tx[3], tx[4], tx[5], tx[6], tx[7]);
                 } else if (htf == 01 || htf == 03) { //RHTS_CHALLENGE //WHTS_CHALLENGE
@@ -864,7 +810,7 @@ static int hitagS_handle_tag_auth(hitag_function htf, uint64_t key, uint64_t NrA
         calc_crc(&crc, ((rx[1] & 0x0f) * 16 + ((rx[2] & 0xf0) / 16)), 8);
         calc_crc(&crc, ((rx[2] & 0x0f) * 16 + ((rx[3] & 0xf0) / 16)), 8);
         calc_crc(&crc, ((rx[3] & 0x0f) * 16 + ((rx[4] & 0xf0) / 16)), 8);
-        if (DEBUG) {
+        if (DBGLEVEL >= DBG_EXTENDED) {
             Dbprintf("UID:::%X", tag.uid);
             Dbprintf("RND:::%X", rnd);
         }
@@ -884,7 +830,7 @@ static int hitagS_handle_tag_auth(hitag_function htf, uint64_t key, uint64_t NrA
                 pwdl1 = ((rx[3] & 0x0f) * 16 + ((rx[4] & 0xf0) / 16)) ^ _hitag2_byte(&state);
             }
 
-            if (DEBUG)
+            if (DBGLEVEL >= DBG_EXTENDED)
                 Dbprintf("pwdh0 %02X pwdl0 %02X pwdl1 %02X", pwdh0, pwdl0, pwdl1);
 
             //Dbprintf("%X %02X", rnd, ((rx[4] & 0x0f) * 16) + ((rx[5] & 0xf0) / 16));
@@ -930,28 +876,30 @@ void SimulateHitagSTag(bool tag_mem_supplied, uint8_t *data) {
     tag.pstate = HT_READY;
     tag.tstate = HT_NO_OP;
 
+    // read tag data into memory
+    if (tag_mem_supplied) {
         for (i = 0; i < 16; i++)
             for (j = 0; j < 4; j++)
                 tag.pages[i][j] = 0x0;
 
-    // read tag data into memory
-    if (tag_mem_supplied) {
         DbpString("Loading hitagS memory...");
         memcpy((uint8_t *)tag.pages, data, 4 * 64);
+    } else {
+        // use the last read tag
     }
 
-    tag.uid = (uint32_t)tag.pages[0];
-    tag.key = (intptr_t)tag.pages[3];
+    tag.uid = (tag.pages[0][3] << 24 | tag.pages[0][2] << 16 | tag.pages[0][1] << 8 | tag.pages[0][0]);
+    tag.key = (tag.pages[3][3] << 24 | tag.pages[3][2] << 16 | tag.pages[3][1] << 8 | tag.pages[3][0]);
     tag.key <<= 16;
-    tag.key += ((tag.pages[2][0]) << 8) + tag.pages[2][1];
-    tag.pwdl0 = tag.pages[2][3];
-    tag.pwdl1 = tag.pages[2][2];
-    tag.pwdh0 = tag.pages[1][0];
+    tag.key += ((tag.pages[2][3]) << 8) + tag.pages[2][2];
+    tag.pwdl0 = tag.pages[2][0];
+    tag.pwdl1 = tag.pages[2][1];
+    tag.pwdh0 = tag.pages[1][3];
     //con0
     tag.max_page = 64;
-    if ((tag.pages[1][3] & 0x2) == 0 && (tag.pages[1][3] & 0x1) == 1)
+    if ((tag.pages[1][0] & 0x2) == 0 && (tag.pages[1][0] & 0x1) == 1)
         tag.max_page = 8;
-    if ((tag.pages[1][3] & 0x2) == 0 && (tag.pages[1][3] & 0x1) == 0)
+    if ((tag.pages[1][0] & 0x2) == 0 && (tag.pages[1][0] & 0x1) == 0)
         tag.max_page = 0;
     if (DBGLEVEL >= DBG_EXTENDED)
         for (i = 0; i < tag.max_page; i++)
@@ -962,41 +910,42 @@ void SimulateHitagSTag(bool tag_mem_supplied, uint8_t *data) {
                      tag.pages[i][0] & 0xff);
     //con1
     tag.auth = 0;
-    if ((tag.pages[1][2] & 0x80) == 0x80)
+    if ((tag.pages[1][1] & 0x80) == 0x80)
         tag.auth = 1;
     tag.LCON = 0;
-    if ((tag.pages[1][2] & 0x2) == 0x02)
+    if ((tag.pages[1][1] & 0x2) == 0x02)
         tag.LCON = 1;
     tag.LKP = 0;
-    if ((tag.pages[1][2] & 0x1) == 0x01)
+    if ((tag.pages[1][1] & 0x1) == 0x01)
         tag.LKP = 1;
     //con2
     //0=read write 1=read only
     tag.LCK7 = 0;
-    if ((tag.pages[1][1] & 0x80) == 0x80)
+    if ((tag.pages[1][2] & 0x80) == 0x80)
         tag.LCK7 = 1;
     tag.LCK6 = 0;
-    if ((tag.pages[1][1] & 0x40) == 0x040)
+    if ((tag.pages[1][2] & 0x40) == 0x040)
         tag.LCK6 = 1;
     tag.LCK5 = 0;
-    if ((tag.pages[1][1] & 0x20) == 0x20)
+    if ((tag.pages[1][2] & 0x20) == 0x20)
         tag.LCK5 = 1;
     tag.LCK4 = 0;
-    if ((tag.pages[1][1] & 0x10) == 0x10)
+    if ((tag.pages[1][2] & 0x10) == 0x10)
         tag.LCK4 = 1;
     tag.LCK3 = 0;
-    if ((tag.pages[1][1] & 0x8) == 0x08)
+    if ((tag.pages[1][2] & 0x8) == 0x08)
         tag.LCK3 = 1;
     tag.LCK2 = 0;
-    if ((tag.pages[1][1] & 0x4) == 0x04)
+    if ((tag.pages[1][2] & 0x4) == 0x04)
         tag.LCK2 = 1;
     tag.LCK1 = 0;
-    if ((tag.pages[1][1] & 0x2) == 0x02)
+    if ((tag.pages[1][2] & 0x2) == 0x02)
         tag.LCK1 = 1;
     tag.LCK0 = 0;
-    if ((tag.pages[1][1] & 0x1) == 0x01)
+    if ((tag.pages[1][2] & 0x1) == 0x01)
         tag.LCK0 = 1;
 
+
     // Set up simulator mode, frequency divisor which will drive the FPGA
     // and analog mux selection.
     FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
@@ -1100,12 +1049,13 @@ void SimulateHitagSTag(bool tag_mem_supplied, uint8_t *data) {
                 LogTrace(tx, nbytes(txlen), 0, 0, NULL, false);
             }
 
+            // Enable and reset external trigger in timer for capturing future frames
+            AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
+            
             // Reset the received frame and response timing info
             memset(rx, 0x00, sizeof(rx));
             response = 0;
 
-            // Enable and reset external trigger in timer for capturing future frames
-            AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
             LED_B_OFF();
         }
         // Reset the frame length
@@ -1114,22 +1064,92 @@ void SimulateHitagSTag(bool tag_mem_supplied, uint8_t *data) {
         overflow += (AT91C_BASE_TC1->TC_CV / T0);
         // Reset the timer to restart while-loop that receives frames
         AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
+
     }
 
-    LEDsoff();
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     set_tracing(false);
-    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-
+    lf_finalize();
     // release allocated memory from BigBuff.
     BigBuf_free();
 
-    StartTicks();
-
     DbpString("Sim Stopped");
 }
 
+void hitagS_receive_frame(uint8_t *rx, size_t *rxlen, int *response) {
+
+    // Reset values for receiving frames
+    memset(rx, 0x00, HITAG_FRAME_LEN * sizeof(uint8_t));
+    *rxlen = 0;
+    int lastbit = 1;
+    bool bSkip = true;
+    int tag_sof = 1;
+    *response = 0;
+    uint32_t errorCount = 0;
+
+    // Receive frame, watch for at most T0*EOF periods
+    while (AT91C_BASE_TC1->TC_CV < T0 * HITAG_T_WAIT_MAX) {
+        // Check if falling edge in tag modulation is detected
+        if (AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) {
+            // Retrieve the new timing values
+            int ra = (AT91C_BASE_TC1->TC_RA / T0);
+
+            // Reset timer every frame, we have to capture the last edge for timing
+            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+
+            LED_B_ON();
+
+            // Capture tag frame (manchester decoding using only falling edges)
+            if (ra >= HITAG_T_EOF) {
+                if (*rxlen != 0) {
+                    //DbpString("wierd1?");
+                }
+                // Capture the T0 periods that have passed since last communication or field drop (reset)
+                // We always recieve a 'one' first, which has the falling edge after a half period |-_|
+                *response = ra - HITAG_T_TAG_HALF_PERIOD;
+            } else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
+                // Manchester coding example |-_|_-|-_| (101)
+                rx[(*rxlen) / 8] |= 0 << (7 - ((*rxlen) % 8));
+                (*rxlen)++;
+                rx[(*rxlen) / 8] |= 1 << (7 - ((*rxlen) % 8));
+                (*rxlen)++;
+            } else if (ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) {
+                // Manchester coding example |_-|...|_-|-_| (0...01)
+                rx[(*rxlen) / 8] |= 0 << (7 - ((*rxlen) % 8));
+                (*rxlen)++;
+                // We have to skip this half period at start and add the 'one' the second time
+                if (!bSkip) {
+                    rx[(*rxlen) / 8] |= 1 << (7 - ((*rxlen) % 8));
+                    (*rxlen)++;
+                }
+                lastbit = !lastbit;
+                bSkip = !bSkip;
+            } else if (ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) {
+                // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
+                if (tag_sof) {
+                    // Ignore bits that are transmitted during SOF
+                    tag_sof--;
+                } else {
+                    // bit is same as last bit
+                    rx[(*rxlen) / 8] |= lastbit << (7 - ((*rxlen) % 8));
+                    (*rxlen)++;
+                }
+            } else {
+                // Ignore wierd value, is to small to mean anything
+                errorCount++;
+            }
+        }
+
+        // if we saw over 100 wierd values break it probably isn't hitag...
+        if (errorCount > 100) break;
+
+        // We can break this loop if we received the last bit from a frame
+        if (AT91C_BASE_TC1->TC_CV > T0 * HITAG_T_EOF) {
+            if ((*rxlen) > 0)
+                break;
+        }
+    }
+}
+
 /*
  * Authenticates to the Tag with the given key or challenge.
  * If the key was given the password will be decrypted.
@@ -1149,7 +1169,6 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
     uint8_t *tx = txbuf;
     size_t txlen = 0;
     int lastbit = 1;
-    int reset_sof = 1;
     int t_wait = HITAG_T_WAIT_MAX;
     bool bStop = false;
     int pageNum = 0;
@@ -1164,6 +1183,9 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
     uint64_t NrAr = 0;
     uint8_t key_[6];
 
+    tag.pstate = HT_READY;
+    tag.tstate = HT_NO_OP;
+
     switch (htf) {
         case RHTSF_CHALLENGE: {
             DbpString("Authenticating using nr,ar pair:");
@@ -1238,10 +1260,8 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
 
     // synchronized startup procedure
     while (AT91C_BASE_TC0->TC_CV > 0); // wait until TC0 returned to zero
-
     // Reset the received frame, frame count and timing info
     t_wait = 200;
-
     while (!bStop && !BUTTON_PRESS() && !data_available())  {
 
         WDT_HIT();
@@ -1381,85 +1401,12 @@ void ReadHitagS(hitag_function htf, hitag_data *htd) {
             LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, 0, NULL, true);
         }
 
-        // Reset values for receiving frames
-        memset(rx, 0x00, sizeof(rx));
-        rxlen = 0;
-        lastbit = 1;
-        bool bSkip = true;
-        int tag_sof = reset_sof;
-        response = 0;
-
-        // Receive frame, watch for at most T0*EOF periods
-        while (AT91C_BASE_TC1->TC_CV < T0 * HITAG_T_WAIT_MAX) {
-            // Check if falling edge in tag modulation is detected
-            if (AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) {
-                // Retrieve the new timing values
-                int ra = (AT91C_BASE_TC1->TC_RA / T0);
-
-                // Reset timer every frame, we have to capture the last edge for timing
-                AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-
-                LED_B_ON();
-
-                // Capture tag frame (manchester decoding using only falling edges)
-                if (ra >= HITAG_T_EOF) {
-                    if (rxlen != 0) {
-                        //DbpString("wierd1?");
-                    }
-                    // Capture the T0 periods that have passed since last communication or field drop (reset)
-                    // We always recieve a 'one' first, which has the falling edge after a half period |-_|
-                    response = ra - HITAG_T_TAG_HALF_PERIOD;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
-                    // Manchester coding example |-_|_-|-_| (101)
-                    rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
-                    rxlen++;
-                    rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
-                    rxlen++;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) {
-                    // Manchester coding example |_-|...|_-|-_| (0...01)
-                    rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
-                    rxlen++;
-                    // We have to skip this half period at start and add the 'one' the second time
-                    if (!bSkip) {
-                        rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
-                        rxlen++;
-                    }
-                    lastbit = !lastbit;
-                    bSkip = !bSkip;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) {
-                    // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
-                    if (tag_sof) {
-                        // Ignore bits that are transmitted during SOF
-                        tag_sof--;
-                    } else {
-                        // bit is same as last bit
-                        rx[rxlen / 8] |= lastbit << (7 - (rxlen % 8));
-                        rxlen++;
-                    }
-                } else {
-                    // Ignore wierd value, is to small to mean anything
-                }
-            }
-
-            // We can break this loop if we received the last bit from a frame
-            if (AT91C_BASE_TC1->TC_CV > T0 * HITAG_T_EOF) {
-                if (rxlen > 0)
-                    break;
-            }
-        }
+        hitagS_receive_frame(rx, &rxlen, &response);
     }
     end = false;
-
-    LEDsoff();
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     set_tracing(false);
 
-    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-
-    StartTicks();
-
+    lf_finalize();
     reply_old(CMD_ACK, bSuccessful, 0, 0, 0, 0);
 }
 
@@ -1479,7 +1426,6 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
     uint8_t *tx = txbuf;
     size_t txlen = 0;
     int lastbit;
-    int reset_sof;
     int t_wait = HITAG_T_WAIT_MAX;
     bool bStop;
     unsigned char crc;
@@ -1555,6 +1501,7 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
     AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 
     // Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
+    AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
     // external trigger rising edge, load RA on falling edge of TIOA.
     AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK
                              | AT91C_TC_ETRGEDG_FALLING
@@ -1570,7 +1517,6 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
     // Reset the received frame, frame count and timing info
     lastbit = 1;
     bStop = false;
-    reset_sof = 1;
     t_wait = 200;
 
     while (!bStop && !BUTTON_PRESS() && !data_available()) {
@@ -1670,87 +1616,13 @@ void WritePageHitagS(hitag_function htf, hitag_data *htd, int page) {
             LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, 0, NULL, true);
         }
 
-        // Reset values for receiving frames
-        memset(rx, 0x00, sizeof(rx));
-        rxlen = 0;
-        lastbit = 1;
-        bool bSkip = true;
-        int tag_sof = reset_sof;
-        response = 0;
-        uint32_t errorCount = 0;
+        hitagS_receive_frame(rx, &rxlen, &response);
 
-        // Receive frame, watch for at most T0*EOF periods
-        while (AT91C_BASE_TC1->TC_CV < T0 * HITAG_T_WAIT_MAX) {
-            // Check if falling edge in tag modulation is detected
-            if (AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) {
-                // Retrieve the new timing values
-                int ra = (AT91C_BASE_TC1->TC_RA / T0);
-
-                // Reset timer every frame, we have to capture the last edge for timing
-                AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-
-                LED_B_ON();
-
-                // Capture tag frame (manchester decoding using only falling edges)
-                if (ra >= HITAG_T_EOF) {
-                    if (rxlen != 0) {
-                        //DbpString("wierd1?");
-                    }
-                    // Capture the T0 periods that have passed since last communication or field drop (reset)
-                    // We always recieve a 'one' first, which has the falling edge after a half period |-_|
-                    response = ra - HITAG_T_TAG_HALF_PERIOD;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
-                    // Manchester coding example |-_|_-|-_| (101)
-                    rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
-                    rxlen++;
-                    rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
-                    rxlen++;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) {
-                    // Manchester coding example |_-|...|_-|-_| (0...01)
-                    rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
-                    rxlen++;
-                    // We have to skip this half period at start and add the 'one' the second time
-                    if (!bSkip) {
-                        rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
-                        rxlen++;
-                    }
-                    lastbit = !lastbit;
-                    bSkip = !bSkip;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) {
-                    // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
-                    if (tag_sof) {
-                        // Ignore bits that are transmitted during SOF
-                        tag_sof--;
-                    } else {
-                        // bit is same as last bit
-                        rx[rxlen / 8] |= lastbit << (7 - (rxlen % 8));
-                        rxlen++;
-                    }
-                } else {
-                    // Ignore wierd value, is to small to mean anything
-                    errorCount++;
-                }
-            }
-
-            // if we saw over 100 wierd values break it probably isn't hitag...
-            if (errorCount > 100) break;
-
-            // We can break this loop if we received the last bit from a frame
-            if (AT91C_BASE_TC1->TC_CV > T0 * HITAG_T_EOF) {
-                if (rxlen > 0)
-                    break;
-            }
-        }
     }
     end = false;
-    LEDsoff();
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     set_tracing(false);
 
-    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-
-    StartTicks();
+    lf_finalize();
 
     reply_old(CMD_ACK, bSuccessful, 0, 0, 0, 0);
 }
@@ -1773,7 +1645,7 @@ void check_challenges(bool file_given, uint8_t *data) {
     size_t rxlen = 0;
     uint8_t txbuf[HITAG_FRAME_LEN];
     int t_wait = HITAG_T_WAIT_MAX;
-    int lastbit, reset_sof, STATE = 0;;
+    int lastbit, STATE = 0;;
     bool bStop;
     int response_bit[200];
     unsigned char mask = 1;
@@ -1834,7 +1706,6 @@ void check_challenges(bool file_given, uint8_t *data) {
     // Reset the received frame, frame count and timing info
     lastbit = 1;
     bStop = false;
-    reset_sof = 1;
     t_wait = 200;
 
     if (file_given) {
@@ -1984,85 +1855,10 @@ void check_challenges(bool file_given, uint8_t *data) {
             LogTrace(tx, nbytes(txlen), HITAG_T_WAIT_2, 0, NULL, true);
         }
 
-        // Reset values for receiving frames
-        memset(rx, 0x00, sizeof(rx));
-        rxlen = 0;
-        lastbit = 1;
-        bool bSkip = true;
-        int tag_sof = reset_sof;
-        response = 0;
-
-        // Receive frame, watch for at most T0*EOF periods
-        while (AT91C_BASE_TC1->TC_CV < T0 * HITAG_T_WAIT_MAX) {
-            // Check if falling edge in tag modulation is detected
-            if (AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) {
-                // Retrieve the new timing values
-                int ra = (AT91C_BASE_TC1->TC_RA / T0);
-
-                // Reset timer every frame, we have to capture the last edge for timing
-                AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-
-                LED_B_ON();
-
-                // Capture tag frame (manchester decoding using only falling edges)
-                if (ra >= HITAG_T_EOF) {
-                    if (rxlen != 0) {
-                        //DbpString("wierd1?");
-                    }
-                    // Capture the T0 periods that have passed since last communication or field drop (reset)
-                    // We always recieve a 'one' first, which has the falling edge after a half period |-_|
-                    response = ra - HITAG_T_TAG_HALF_PERIOD;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
-                    // Manchester coding example |-_|_-|-_| (101)
-                    rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
-                    rxlen++;
-                    rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
-                    rxlen++;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) {
-                    // Manchester coding example |_-|...|_-|-_| (0...01)
-                    rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
-                    rxlen++;
-                    // We have to skip this half period at start and add the 'one' the second time
-                    if (!bSkip) {
-                        rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
-                        rxlen++;
-                    }
-                    lastbit = !lastbit;
-                    bSkip = !bSkip;
-                } else if (ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) {
-                    // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
-                    if (tag_sof) {
-                        // Ignore bits that are transmitted during SOF
-                        tag_sof--;
-                    } else {
-                        // bit is same as last bit
-                        rx[rxlen / 8] |= lastbit << (7 - (rxlen % 8));
-                        rxlen++;
-                    }
-                } else {
-                    // Ignore wierd value, is to small to mean anything
-                }
+        hitagS_receive_frame(rx, &rxlen, &response);
     }
 
-            // We can break this loop if we received the last bit from a frame
-            if (AT91C_BASE_TC1->TC_CV > T0 * HITAG_T_EOF) {
-                if (rxlen > 0)
-                    break;
-            }
-        }
-    }
-
-    LEDsoff();
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     set_tracing(false);
-
-    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-
-    StartTicks();
-
+    lf_finalize();
     reply_old(CMD_ACK, bSuccessful, 0, 0, 0, 0);
 }
-
-
-

armsrc/lfops.c

@@ -1291,7 +1291,7 @@ void CmdHIDdemodFSK(int findone, uint32_t *high, uint32_t *low, int ledcontrol)
                     cardnum = (lo >> 1) & 0x7FFFF;
                     fac = ((hi & 0xF) << 12) | (lo >> 20);
                 }
-                Dbprintf("TAG ID: " _YELLOW_("%x%08x (%d)") "- Format Len: " _YELLOW_("%d") "bit - FC: " _YELLOW_("%d") "- Card: "_YELLOW_("%d"),
+                Dbprintf("TAG ID: " _GREEN_("%x%08x (%d)") "- Format Len: " _GREEN_("%d") "bit - FC: " _GREEN_("%d") "- Card: "_GREEN_("%d"),
                          hi,
                          lo,
                          (lo >> 1) & 0xFFFF,
@@ -2399,13 +2399,13 @@ void SendForward(uint8_t fwd_bit_count) {
     TurnReadLF_off(EM_START_GAP);
     TurnReadLFOn(18 * 8);
 
-    // now start writting with bitbanging the antenna.
+    // now start writting with bitbanging the antenna. (each bit should be 32*8 total length)
     while (fwd_bit_sz-- > 0) { //prepare next bit modulation
         if (((*fwd_write_ptr++) & 1) == 1) {
             WaitUS(32 * 8);
         } else {
             TurnReadLF_off(23 * 8);
-            TurnReadLFOn(18 * 8);
+            TurnReadLFOn(32-23 * 8);
         }
     }
 }

armsrc/mifarecmd.c

@@ -1805,6 +1805,63 @@ void MifareChkKeys_file(uint8_t *fn) {
 #endif
 }
 
+//-----------------------------------------------------------------------------
+// MIFARE Personalize UID. Only for Mifare Classic EV1 7Byte UID
+//-----------------------------------------------------------------------------
+void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint64_t key) {
+
+    uint16_t isOK = PM3_EUNDEF;
+    uint8_t uid[10];
+    uint32_t cuid;
+    struct Crypto1State mpcs = {0, 0};
+    struct Crypto1State *pcs;
+    pcs = &mpcs;
+
+    iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
+    clear_trace();
+    set_tracing(true);
+
+    LED_A_ON();
+
+    while (true) {
+        if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("Can't select card");
+            break;
+        }
+
+        uint8_t block_number = 0;
+        if (mifare_classic_auth(pcs, cuid, block_number, keyType, key, AUTH_FIRST)) {
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("Auth error");
+            break;
+        }
+
+        uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
+        uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
+        int len = mifare_sendcmd_short(pcs, true, MIFARE_EV1_PERSONAL_UID, perso_option, receivedAnswer, receivedAnswerPar, NULL);
+        if (len != 1 || receivedAnswer[0] != CARD_ACK) {
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("Cmd Error: %02x", receivedAnswer[0]);
+            break;;
+        }
+
+        if (mifare_classic_halt(pcs, cuid)) {
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("Halt error");
+            break;
+        }
+        isOK = PM3_SUCCESS;
+        break;
+    }
+
+    crypto1_deinit(pcs);
+
+    LED_B_ON();
+    reply_ng(CMD_HF_MIFARE_PERSONALIZE_UID, isOK, NULL, 0);
+    LED_B_OFF();
+
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    LEDsoff();
+}
+
+
 //-----------------------------------------------------------------------------
 // Work with emulator memory
 //
@@ -2276,23 +2333,23 @@ void MifareSetMod(uint8_t *datain) {
 
     while (true) {
         if (!iso14443a_select_card(uid, NULL, &cuid, true, 0, true)) {
-            if (DBGLEVEL >= 1) Dbprintf("Can't select card");
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("Can't select card");
             break;
         }
 
         if (mifare_classic_auth(pcs, cuid, 0, 0, ui64Key, AUTH_FIRST)) {
-            if (DBGLEVEL >= 1) Dbprintf("Auth error");
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("Auth error");
             break;
         }
 
         int respLen;
         if (((respLen = mifare_sendcmd_short(pcs, CRYPT_ALL, 0x43, mod, receivedAnswer, receivedAnswerPar, NULL)) != 1) || (receivedAnswer[0] != 0x0a)) {
-            if (DBGLEVEL >= 1) Dbprintf("SetMod error; response[0]: %hhX, len: %d", receivedAnswer[0], respLen);
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("SetMod error; response[0]: %hhX, len: %d", receivedAnswer[0], respLen);
             break;
         }
 
         if (mifare_classic_halt(pcs, cuid)) {
-            if (DBGLEVEL >= 1) Dbprintf("Halt error");
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("Halt error");
             break;
         }
 
@@ -2304,7 +2361,6 @@ void MifareSetMod(uint8_t *datain) {
 
     LED_B_ON();
     reply_ng(CMD_HF_MIFARE_SETMOD, isOK, NULL, 0);
-
     LED_B_OFF();
 
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

armsrc/mifarecmd.h

@@ -45,6 +45,8 @@ void MifareCIdent();  // is "magic chinese" card?
 void MifareHasStaticNonce();  // Has the tag a static nonce?
 
 void MifareSetMod(uint8_t *datain);
+void MifarePersonalizeUID(uint8_t keyType, uint8_t perso_option, uint64_t key);
+
 void MifareUSetPwd(uint8_t arg0, uint8_t *datain);
 void OnSuccessMagic();
 void OnErrorMagic(uint8_t reason);

armsrc/mifaredesfire.c

@@ -14,6 +14,8 @@
 #include "crc16.h"
 #include "mbedtls/aes.h"
 #include "commonutil.h"
+#include "util.h"
+#include "mifare.h"
 
 #define MAX_APPLICATION_COUNT 28
 #define MAX_FILE_COUNT 16
@@ -31,8 +33,11 @@ static  uint8_t deselect_cmd[] = {0xc2, 0xe0, 0xb4};
 /*                                       PCB   CID   CMD    PAYLOAD    */
 //static uint8_t __res[MAX_FRAME_SIZE];
 
+
 bool InitDesfireCard() {
 
+    pcb_blocknum = 0;
+
     iso14a_card_select_t card;
 
     iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
@@ -46,28 +51,14 @@ bool InitDesfireCard() {
     return true;
 }
 
-// ARG0 flag enums
-enum  {
-    NONE       = 0x00,
-    INIT       = 0x01,
-    DISCONNECT = 0x02,
-    CLEARTRACE = 0x04,
-    BAR        = 0x08,
-} CmdOptions ;
-
 void MifareSendCommand(uint8_t arg0, uint8_t arg1, uint8_t *datain) {
 
-    /* ARG0 contains flags.
-        0x01 = init card.
-        0x02 = Disconnect
-        0x03
-    */
     uint8_t flags = arg0;
     size_t datalen = arg1;
     uint8_t resp[RECEIVE_SIZE];
     memset(resp, 0, sizeof(resp));
 
-    if (DBGLEVEL >= 4) {
+    if (DBGLEVEL >= DBG_EXTENDED) {
         Dbprintf(" flags : %02X", flags);
         Dbprintf(" len   : %02X", datalen);
         print_result(" RX    : ", datain, datalen);
@@ -77,34 +68,41 @@ void MifareSendCommand(uint8_t arg0, uint8_t arg1, uint8_t *datain) {
         clear_trace();
 
     if (flags & INIT) {
-        if (!InitDesfireCard())
+        if (!InitDesfireCard()) {
             return;
         }
+    }
 
     int len = DesfireAPDU(datain, datalen, resp);
-    if (DBGLEVEL >= 4)
-        print_result("ERR <--: ", resp, len);
+    if (DBGLEVEL >= DBG_EXTENDED)
+        print_result("RESP <--: ", resp, len);
 
     if (!len) {
         OnError(2);
         return;
     }
 
-    // reset the pcb_blocknum,
-    pcb_blocknum = 0;
-
     if (flags & DISCONNECT)
         OnSuccess();
 
-    reply_old(CMD_ACK, 1, len, 0, resp, len);
+    reply_mix(CMD_ACK, 1, len, 0, resp, len);
 }
 
 void MifareDesfireGetInformation() {
 
+    LEDsoff();
+
     int len = 0;
     iso14a_card_select_t card;
     uint8_t resp[PM3_CMD_DATA_SIZE] = {0x00};
-    uint8_t dataout[PM3_CMD_DATA_SIZE] = {0x00};
+
+    struct p {
+        uint8_t isOK;
+        uint8_t uid[7];
+        uint8_t versionHW[7];
+        uint8_t versionSW[7];
+        uint8_t details[14];
+    } PACKED payload;
     
     /*
         1 = PCB                 1
@@ -122,60 +120,64 @@ void MifareDesfireGetInformation() {
     // card select - information
     if (!iso14443a_select_card(NULL, &card, NULL, true, 0, false)) {
         if (DBGLEVEL >= DBG_ERROR) DbpString("Can't select card");
-        OnError(1);
+        payload.isOK = 1;  // 2 == can not select
+        reply_ng(CMD_HF_DESFIRE_INFO, PM3_ESOFT, (uint8_t *)&payload, sizeof(payload));
+        switch_off();
         return;
     }
 
     if (card.uidlen != 7) {
         if (DBGLEVEL >= DBG_ERROR) Dbprintf("Wrong UID size. Expected 7byte got %d", card.uidlen);
-        OnError(2);
+        payload.isOK = 2;  // 2 == WRONG UID
+        reply_ng(CMD_HF_DESFIRE_INFO, PM3_ESOFT, (uint8_t *)&payload, sizeof(payload));
+        switch_off();
         return;
     }
-
-    memcpy(dataout, card.uid, 7);
+    // add uid.
+    memcpy(payload.uid, card.uid, sizeof(card.uid));
 
     LED_A_ON();
-    LED_B_OFF();
-    LED_C_OFF();
-
-    uint8_t cmd[] = {GET_VERSION};
+    uint8_t cmd[] = {GET_VERSION, 0x00, 0x00, 0x00};
     size_t cmd_len = sizeof(cmd);
 
     len =  DesfireAPDU(cmd, cmd_len, resp);
     if (!len) {
         print_result("ERROR <--: ", resp, len);
-        OnError(3);
+        payload.isOK = 3;  // 3 == DOESNT ANSWER TO GET_VERSION
+        reply_ng(CMD_HF_DESFIRE_INFO, PM3_ESOFT, (uint8_t *)&payload, sizeof(payload));
+        switch_off();
         return;
     }
 
-    LED_A_OFF();
-    LED_B_ON();
-    memcpy(dataout + 7, resp + 3, 7);
+    memcpy(payload.versionHW, resp + 1, sizeof(payload.versionHW));
 
     // ADDITION_FRAME 1
     cmd[0] = ADDITIONAL_FRAME;
     len =  DesfireAPDU(cmd, cmd_len, resp);
     if (!len) {
         print_result("ERROR <--: ", resp, len);
-        OnError(3);
+        payload.isOK = 3;  // 3 == DOESNT ANSWER TO GET_VERSION
+        reply_ng(CMD_HF_DESFIRE_INFO, PM3_ESOFT, (uint8_t *)&payload, sizeof(payload));
+        switch_off();
         return;
     }
-
-    LED_B_OFF();
-    LED_C_ON();
-    memcpy(dataout + 7 + 7, resp + 3, 7);
+    memcpy(payload.versionSW, resp + 1,  sizeof(payload.versionSW));
 
     // ADDITION_FRAME 2
     len =  DesfireAPDU(cmd, cmd_len, resp);
     if (!len) {
         print_result("ERROR <--: ", resp, len);
-        OnError(3);
+        payload.isOK = 3;  // 3 == DOESNT ANSWER TO GET_VERSION
+        reply_ng(CMD_HF_DESFIRE_INFO, PM3_ESOFT, (uint8_t *)&payload, sizeof(payload));
+        switch_off();
         return;
     }
 
-    memcpy(dataout + 7 + 7 + 7, resp + 3, 14);
+    memcpy(payload.details, resp + 1,  sizeof(payload.details));
 
-    reply_old(CMD_ACK, 1, 0, 0, dataout, sizeof(dataout));
+    LED_B_ON();
+    reply_ng(CMD_HF_DESFIRE_INFO, PM3_SUCCESS, (uint8_t *)&payload, sizeof(payload));
+    LED_B_OFF();
     
     // reset the pcb_blocknum,
     pcb_blocknum = 0;
@@ -467,7 +469,7 @@ void MifareDES_Auth1(uint8_t arg0, uint8_t arg1, uint8_t arg2,  uint8_t *datain)
 
             // dekryptera tagnonce.
             if (mbedtls_aes_setkey_dec(&ctx, key->data, 128) != 0) {
-                if (DBGLEVEL >= 4) {
+                if (DBGLEVEL >= DBG_EXTENDED) {
                     DbpString("mbedtls_aes_setkey_dec failed");
                 }
                 OnError(7);
@@ -480,7 +482,7 @@ void MifareDES_Auth1(uint8_t arg0, uint8_t arg1, uint8_t arg2,  uint8_t *datain)
             memcpy(both + 16, decRndB, 16);
             uint8_t encBoth[32] = {0x00};
             if (mbedtls_aes_setkey_enc(&ctx, key->data, 128) != 0) {
-                if (DBGLEVEL >= 4) {
+                if (DBGLEVEL >= DBG_EXTENDED) {
                     DbpString("mbedtls_aes_setkey_enc failed");
                 }
                 OnError(7);
@@ -517,7 +519,7 @@ void MifareDES_Auth1(uint8_t arg0, uint8_t arg1, uint8_t arg2,  uint8_t *datain)
     }
 
     OnSuccess();
-    reply_old(CMD_ACK, 1, len, 0, resp, len);
+    reply_mix(CMD_ACK, 1, len, 0, resp, len);
 }
 
 // 3 different ISO ways to send data to a DESFIRE (direct, capsuled, capsuled ISO)
@@ -534,19 +536,19 @@ int DesfireAPDU(uint8_t *cmd, size_t cmd_len, uint8_t *dataout) {
 
     wrappedLen = CreateAPDU(cmd, cmd_len, wCmd);
 
-    if (DBGLEVEL >= 4)
+    if (DBGLEVEL >= DBG_EXTENDED)
         print_result("WCMD <--: ", wCmd, wrappedLen);
 
     ReaderTransmit(wCmd, wrappedLen, NULL);
 
     len = ReaderReceive(resp, par);
     if (!len) {
-        if (DBGLEVEL >= 4) Dbprintf("fukked");
+        if (DBGLEVEL >= DBG_EXTENDED) Dbprintf("fukked");
         return false; //DATA LINK ERROR
     }
     // if we received an I- or R(ACK)-Block with a block number equal to the
     // current block number, toggle the current block number
-    else if (len >= 4 // PCB+CID+CRC = 4 bytes
+    if (len >= 4 // PCB+CID+CRC = 4 bytes
              && ((resp[0] & 0xC0) == 0 // I-Block
                  || (resp[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0
              && (resp[0] & 0x01) == pcb_blocknum) { // equal block numbers
@@ -565,15 +567,22 @@ size_t CreateAPDU(uint8_t *datain, size_t len, uint8_t *dataout) {
     uint8_t cmd[cmdlen];
     memset(cmd, 0, cmdlen);
 
-    cmd[0] = 0x0A;  //  0x0A = send cid,  0x02 = no cid.
+    cmd[0] = 0x02;  //  0x0A = send cid,  0x02 = no cid.
     cmd[0] |= pcb_blocknum; // OR the block number into the PCB
-    cmd[1] = 0x00;  //  CID: 0x00 //TODO: allow multiple selected cards
+
+    if (DBGLEVEL >= DBG_EXTENDED) Dbprintf("pcb_blocknum %d == %d ", pcb_blocknum, cmd[0] );
+
+    cmd[1] = 0x90;  //  CID: 0x00 //TODO: allow multiple selected cards
 
     memcpy(cmd + 2, datain, len);
     AddCrc14A(cmd, len + 2);
     
+/*
+hf 14a apdu -sk 90 60 00 00 00
+hf 14a apdu -k 90 AF 00 00 00
+hf 14a apdu 90AF000000
+*/
     memcpy(dataout, cmd, cmdlen);
-
     return cmdlen;
 }
 

armsrc/util.h

@@ -13,6 +13,11 @@
 
 #include "common.h"
 
+// PRIx64 definition missing with gcc-arm-none-eabi v8?
+#ifndef PRIx64
+    #define PRIx64 "llx"
+#endif
+
 // Basic macros
 
 #ifndef SHORT_COIL

client/cmdhf.c

@@ -178,7 +178,7 @@ int CmdHFTune(const char *Cmd) {
     if (cmdp == 'h') return usage_hf_tune();
     int iter =  param_get32ex(Cmd, 0, 0, 10);
 
-    PrintAndLogEx(SUCCESS, "Measuring HF antenna, click " _GREEN_("pm3 button") "or press " _GREEN_("Enter") "to exit");
+    PrintAndLogEx(INFO, "Measuring HF antenna, click " _GREEN_("pm3 button") "or press " _GREEN_("Enter") "to exit");
     PacketResponseNG resp;
     clearCommandBuffer();
 
@@ -218,7 +218,7 @@ int CmdHFTune(const char *Cmd) {
         return PM3_ETIMEOUT;
     }
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(SUCCESS, "Done.");
+    PrintAndLogEx(INFO, "Done.");
     return PM3_SUCCESS;
 }
 

client/cmdhf14a.c

@@ -189,9 +189,9 @@ static int usage_hf_14a_sim(void) {
     PrintAndLogEx(NORMAL, "    e     : (Optional) Fill simulator keys from found keys");
     PrintAndLogEx(NORMAL, "    v     : (Optional) Verbose");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "          hf 14a sim t 1 u 11223344 x");
-    PrintAndLogEx(NORMAL, "          hf 14a sim t 1 u 11223344");
-    PrintAndLogEx(NORMAL, "          hf 14a sim t 1 u 11223344556677");
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 11223344 x"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 11223344"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 11223344556677"));
 //  PrintAndLogEx(NORMAL, "          hf 14a sim t 1 u 11223445566778899AA\n");
     return 0;
 }
@@ -202,7 +202,7 @@ static int usage_hf_14a_sniff(void) {
     PrintAndLogEx(NORMAL, "c - triggered by first data from card");
     PrintAndLogEx(NORMAL, "r - triggered by first 7-bit request from reader (REQ,WUP,...)");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        hf 14a sniff c r");
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf 14a sniff c r"));
     return 0;
 }
 static int usage_hf_14a_raw(void) {
@@ -230,7 +230,6 @@ static int usage_hf_14a_reader(void) {
 
 static int CmdHF14AList(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
-    //PrintAndLogEx(NORMAL, "Deprecated command, use 'hf list 14a' instead");
     CmdTraceList("14a");
     return 0;
 }
@@ -261,7 +260,7 @@ int Hf14443_4aGetCardData(iso14a_card_select_t *card) {
         return 1;
     }
 
-    PrintAndLogEx(SUCCESS, " UID: %s", sprint_hex(card->uid, card->uidlen));
+    PrintAndLogEx(SUCCESS, " UID: " _GREEN_("%s"), sprint_hex(card->uid, card->uidlen));
     PrintAndLogEx(SUCCESS, "ATQA: %02x %02x", card->atqa[1], card->atqa[0]);
     PrintAndLogEx(SUCCESS, " SAK: %02x [%" PRIu64 "]", card->sak, resp.oldarg[0]);
     if (card->ats_len < 3) { // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
@@ -340,12 +339,12 @@ static int CmdHF14AReader(const char *Cmd) {
             return 1;
         }
 
-        PrintAndLogEx(SUCCESS, " UID : %s", sprint_hex(card.uid, card.uidlen));
-        PrintAndLogEx(SUCCESS, "ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
-        PrintAndLogEx(SUCCESS, " SAK : %02x [%" PRIu64 "]", card.sak, resp.oldarg[0]);
+        PrintAndLogEx(SUCCESS, " UID: " _GREEN_("%s"), sprint_hex(card.uid, card.uidlen));
+        PrintAndLogEx(SUCCESS, "ATQA: " _GREEN_("%02x %02x"), card.atqa[1], card.atqa[0]);
+        PrintAndLogEx(SUCCESS, " SAK: " _GREEN_("%02x [%" PRIu64 "]"), card.sak, resp.oldarg[0]);
 
         if (card.ats_len >= 3) { // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
-            PrintAndLogEx(SUCCESS, " ATS : %s", sprint_hex(card.ats, card.ats_len));
+            PrintAndLogEx(SUCCESS, " ATS: " _GREEN_("%s"), sprint_hex(card.ats, card.ats_len));
         }
 
         if (!disconnectAfter) {
@@ -354,14 +353,14 @@ static int CmdHF14AReader(const char *Cmd) {
     }
 
     if (disconnectAfter) {
-        if (!silent) PrintAndLogEx(SUCCESS, "field dropped.");
+        if (!silent) PrintAndLogEx(INFO, "field dropped.");
     }
 
     return 0;
 }
 
 static int CmdHF14AInfo(const char *Cmd) {
-    bool verbose = false;
+    bool verbose = true;
     bool do_nack_test = false;
     bool do_aid_search = false;
 
@@ -467,7 +466,7 @@ int CmdHF14ASim(const char *Cmd) {
                         break;
                 }
                 if (!errors) {
-                    PrintAndLogEx(SUCCESS, "Emulating ISO/IEC 14443 type A tag with %d byte UID (%s)", uidlen, sprint_hex(uid, uidlen));
+                    PrintAndLogEx(SUCCESS, "Emulating " _YELLOW_("ISO/IEC 14443 type A tag")"with " _GREEN_("%d byte UID (%s)"), uidlen, sprint_hex(uid, uidlen));
                     useUIDfromEML = false;
                 }
                 cmdp += 2;
@@ -485,7 +484,7 @@ int CmdHF14ASim(const char *Cmd) {
                 cmdp++;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+                PrintAndLogEx(WARNING, "Unknown parameter " _RED_("'%c'"), param_getchar(Cmd, cmdp));
                 errors = true;
                 break;
         }
@@ -511,7 +510,7 @@ int CmdHF14ASim(const char *Cmd) {
     SendCommandNG(CMD_HF_ISO14443A_SIMULATE, (uint8_t *)&payload, sizeof(payload));
     PacketResponseNG resp;
 
-    PrintAndLogEx(SUCCESS, "press pm3-button to abort simulation");
+    PrintAndLogEx(INFO, "Press pm3-button to abort simulation");
     bool keypress = kbd_enter_pressed();
     while (!keypress) {
 
@@ -1281,11 +1280,19 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
         return select_status;
     }
 
-    PrintAndLogEx(SUCCESS, " UID : %s", sprint_hex(card.uid, card.uidlen));
-    PrintAndLogEx(SUCCESS, "ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
-    PrintAndLogEx(SUCCESS, " SAK : %02x [%" PRIu64 "]", card.sak, resp.oldarg[0]);
+    if (verbose) {
+        PrintAndLogEx(SUCCESS, "-- ISO14443-a Information -----------------------------------");
+        PrintAndLogEx(SUCCESS, "-------------------------------------------------------------");
+    }
+    PrintAndLogEx(SUCCESS, " UID: " _GREEN_("%s"), sprint_hex(card.uid, card.uidlen));
+    PrintAndLogEx(SUCCESS, "ATQA: " _GREEN_("%02x %02x"), card.atqa[1], card.atqa[0]);
+    PrintAndLogEx(SUCCESS, " SAK: " _GREEN_("%02x [%" PRIu64 "]"), card.sak, resp.oldarg[0]);
 
     bool isMifareClassic = true;
+    bool isMifareDesfire = false;
+    bool isMifarePlus = false;
+    bool isMifareUltralight = false;
+
     switch (card.sak) {
         case 0x00:
             isMifareClassic = false;
@@ -1294,10 +1301,12 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
             DropField();
 
             uint32_t tagT = GetHF14AMfU_Type();
-            if (tagT != UL_ERROR)
+            if (tagT != UL_ERROR) {
                 ul_print_type(tagT, 0);
-            else
+                isMifareUltralight = true;
+            } else {
                 PrintAndLogEx(SUCCESS, "TYPE: Possible AZTEK (iso14443a compliant)");
+            }
 
             // reconnect for further tests
             clearCommandBuffer();
@@ -1314,49 +1323,55 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
             }
             break;
         case 0x01:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP TNP3xxx Activision Game Appliance");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP TNP3xxx Activision Game Appliance"));
             break;
         case 0x04:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE (various !DESFire !DESFire EV1)");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE (various !DESFire !DESFire EV1)"));
             isMifareClassic = false;
+            isMifareDesfire = true;
             break;
         case 0x08:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE CLASSIC 1k | Plus 2k SL1 | 1k Ev1"));
             break;
         case 0x09:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE Mini 0.3k");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE Mini 0.3k"));
             break;
         case 0x0A:
-            PrintAndLogEx(SUCCESS, "TYPE : FM11RF005SH (Shanghai Metro)");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("FM11RF005SH (Shanghai Metro)"));
             break;
         case 0x10:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE Plus 2k SL2");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE Plus 2k SL2"));
+            isMifarePlus = true;
             break;
         case 0x11:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE Plus 4k SL2");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE Plus 4k SL2"));
+            isMifarePlus = true;
             break;
         case 0x18:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE Classic 4k | Plus 4k SL1 | 4k Ev1");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE Classic 4k | Plus 4k SL1 | 4k Ev1"));
             break;
         case 0x20:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"));
             isMifareClassic = false;
+            isMifareDesfire = true;
+            isMifarePlus = true;
             break;
         case 0x24:
-            PrintAndLogEx(SUCCESS, "TYPE : NXP MIFARE DESFire | DESFire EV1");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("NXP MIFARE DESFire | DESFire EV1"));
             isMifareClassic = false;
+            isMifareDesfire = true;
             break;
         case 0x28:
-            PrintAndLogEx(SUCCESS, "TYPE : JCOP31 or JCOP41 v2.3.1");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("JCOP31 or JCOP41 v2.3.1"));
             break;
         case 0x38:
-            PrintAndLogEx(SUCCESS, "TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("Nokia 6212 or 6131 MIFARE CLASSIC 4K"));
             break;
         case 0x88:
-            PrintAndLogEx(SUCCESS, "TYPE : Infineon MIFARE CLASSIC 1K");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("Infineon MIFARE CLASSIC 1K"));
             break;
         case 0x98:
-            PrintAndLogEx(SUCCESS, "TYPE : Gemplus MPCOS");
+            PrintAndLogEx(SUCCESS, "TYPE: " _YELLOW_("Gemplus MPCOS"));
             break;
         default:
             ;
@@ -1364,7 +1379,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
 
     // Double & triple sized UID, can be mapped to a manufacturer.
     if (card.uidlen > 4) {
-        PrintAndLogEx(SUCCESS, "MANUFACTURER : %s", getTagInfo(card.uid[0]));
+        PrintAndLogEx(SUCCESS, "MANUFACTURER: " _YELLOW_("%s"), getTagInfo(card.uid[0]));
     }
 
     // try to request ATS even if tag claims not to support it
@@ -1461,9 +1476,15 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
                 switch (card.ats[pos + 2] & 0xf0) {
                     case 0x10:
                         PrintAndLogEx(SUCCESS, "                     1x -> MIFARE DESFire");
+                        isMifareDesfire = true;
+                        isMifareClassic = false;
+                        isMifarePlus = false;
                         break;
                     case 0x20:
                         PrintAndLogEx(SUCCESS, "                     2x -> MIFARE Plus");
+                        isMifarePlus = true;
+                        isMifareDesfire = false;
+                        isMifareClassic = false;
                         break;
                 }
                 switch (card.ats[pos + 2] & 0x0f) {
@@ -1590,22 +1611,32 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
     if (isMifareClassic) {
         int res = detect_classic_prng();
         if (res == 1)
-            PrintAndLogEx(SUCCESS, "Prng detection: " _GREEN_("WEAK"));
+            PrintAndLogEx(SUCCESS, "Prng detection: " _GREEN_("weak"));
         else if (res == 0)
-            PrintAndLogEx(SUCCESS, "Prng detection: " _YELLOW_("HARD"));
+            PrintAndLogEx(SUCCESS, "Prng detection: " _YELLOW_("hard"));
         else
-            PrintAndLogEx(FAILED, "prng detection:  " _RED_("Fail"));
+            PrintAndLogEx(FAILED, "prng detection:  " _RED_("fail"));
 
         if (do_nack_test)
-            detect_classic_nackbug(!verbose);
+            detect_classic_nackbug(false);
 
         res = detect_classic_static_nonce();
         if (res == 1)
-            PrintAndLogEx(SUCCESS, "Static nonce detected");
+            PrintAndLogEx(SUCCESS, "Static nonce: " _YELLOW_("yes") );
         if (res == 2 && verbose)
-            PrintAndLogEx(SUCCESS, "Static nonce detection failed");
+            PrintAndLogEx(SUCCESS, "Static nonce:  " _RED_("fail"));
     }
 
+    if (isMifareUltralight) {
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu info`"));
+    }
+    if (isMifarePlus) {
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfp info`"));
+    }
+    if (isMifareDesfire) {
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfdes info`"));
+    }
+
+
     return select_status;
 }
-

client/cmdhf14b.c

@@ -1142,4 +1142,3 @@ int readHF14B(bool verbose) {
     if (verbose) PrintAndLogEx(FAILED, "no 14443-B tag found");
     return 0;
 }
-

client/cmdhficlass.c

@@ -785,7 +785,7 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
                 return usage_hf_iclass_decrypt();
             case 'd':
                 if (param_gethex(Cmd, cmdp + 1, enc_data, 16)) {
-                    PrintAndLogEx(ERR, "data must be 16 HEX symbols");
+                    PrintAndLogEx(ERR, "Data must be 16 HEX symbols");
                     errors = true;
                     break;
                 }
@@ -794,7 +794,7 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
                 break;
             case 'f':
                 if (param_getstr(Cmd, cmdp + 1, filename, sizeof(filename)) == 0) {
-                    PrintAndLogEx(WARNING, "no filename found after f");
+                    PrintAndLogEx(WARNING, "No filename found after f");
                     errors = true;
                     break;
                 }
@@ -864,18 +864,24 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
 
         BLOCK79ENCRYPTION aa1_encryption = (decrypted[(6 * 8) + 7] & 0x03);
 
-        for (uint16_t blocknum = 0; blocknum < applimit; ++blocknum) {
+        uint32_t limit = MIN(applimit, decryptedlen / 8);
+
+        if (decryptedlen / 8 != applimit) {
+            PrintAndLogEx(WARNING, "Actual file len " _YELLOW_("%u") "vs HID app-limit len " _YELLOW_("%u"), decryptedlen, applimit * 8);
+            PrintAndLogEx(INFO, "Setting limit to " _GREEN_("%u"), limit * 8);
+        }
+        uint8_t numblocks4userid = GetNumberBlocksForUserId(decrypted + (6 * 8));
+
+        for (uint16_t blocknum = 0; blocknum < limit; ++blocknum) {
 
             uint8_t idx = blocknum * 8;
             memcpy(enc_data, decrypted + idx, 8);
 
-            // block 7 or higher,  and not empty 0xFF
-            // look inside block 6 to determine if aa1 is encrypted.
-            if (blocknum > 6 && memcmp(enc_data, empty, 8) != 0) {
-
             if (aa1_encryption == RFU || aa1_encryption == None)
                 continue;
                 
+            // Decrypted block 7,8,9 if configured.
+            if (blocknum > 6 && blocknum <= 6 + numblocks4userid && memcmp(enc_data, empty, 8) != 0) {
                 if (use_sc) {
                     Decrypt(enc_data, decrypted + idx);
                 } else {
@@ -885,7 +891,12 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
         }
 
         //Use the first block (CSN) for filename
-        char *fptr = calloc(42, sizeof(uint8_t));
+        char *fptr = calloc(50, sizeof(uint8_t));
+        if (!fptr) {
+            PrintAndLogEx(WARNING, "Failed to allocate memory");
+            free(decrypted);
+            return PM3_EMALLOC;
+        }
         strcat(fptr, "hf-iclass-");
         FillFileNameByUID(fptr, hdr->csn, "-data-decrypted", sizeof(hdr->csn));
 
@@ -893,9 +904,9 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
         saveFileEML(fptr, decrypted, decryptedlen, 8);
         saveFileJSON(fptr, jsfIclass, decrypted, decryptedlen);
 
+        PrintAndLogEx(INFO, "Following output skips CSN / block0");
         printIclassDumpContents(decrypted, 1, (decryptedlen / 8), decryptedlen);
 
-
         // decode block 6
         if (memcmp(decrypted + (8 * 6), empty, 8) != 0) {
             if (use_sc) {
@@ -1251,7 +1262,7 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
         if (kbd_enter_pressed()) {
             PrintAndLogEx(WARNING, "\n[!] aborted via keyboard!\n");
             DropField();
-            return 0;
+            return PM3_EOPABORTED;
         }
 
         if (WaitForResponseTimeout(CMD_ACK, &resp, 2000))
@@ -1343,8 +1354,8 @@ static int CmdHFiClassReader_Dump(const char *Cmd) {
 
     // print the dump
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "------+--+-------------------------+");
-    PrintAndLogEx(NORMAL, "CSN   |00| %s|", sprint_hex(tag_data, 8));
+    PrintAndLogEx(INFO, "------+--+-------------------------+");
+    PrintAndLogEx(INFO, "CSN   |00| %s|", sprint_hex(tag_data, 8));
     printIclassDumpContents(tag_data, 1, (gotBytes / 8), gotBytes);
 
     if (filename[0] == 0) {

client/cmdhflto.c

@@ -298,7 +298,8 @@ static int CmdHfLTOReadBlock(const char *Cmd) {
                 end_blk = param_get8(Cmd, cmdp + 1);
                 if (end_blk < st_blk) {
                     errors = true;
-                    break;                                                                                                                                                                                                                                   }
+                    break;
+                }
                 cmdp += 2;
                 break;
 
@@ -523,7 +524,7 @@ static int CmdHfLTODump(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-int restoreLTO(uint8_t *dump_data, bool verbose) {
+int restoreLTO(uint8_t *dump, bool verbose) {
 
     clearCommandBuffer();
     lto_switch_on_field();
@@ -544,13 +545,13 @@ int restoreLTO(uint8_t *dump_data, bool verbose) {
     for (uint8_t blk = 2; blk < 255; blk++) {
 
         for (int i = 0; i < 32; i++) {
-            blkData[i] = dump_data[i + blk * 32];
+            blkData[i] = dump[i + blk * 32];
         }
 
         ret_val = lto_wrbl(blk, blkData, verbose);
 
         if (ret_val == PM3_SUCCESS) {
-             PrintAndLogEx(SUCCESS, "BLK %03d: " _YELLOW_("write success"), blk);
+            PrintAndLogEx(SUCCESS, "Block %03d - " _YELLOW_("write success"), blk);
         } else {
             lto_switch_off_field();
             return ret_val;

client/cmdhfmf.c

@@ -3129,7 +3129,7 @@ out:
 }
 
 sector_t *k_sector = NULL;
-uint8_t k_sectorsCount = 16;
+uint8_t k_sectorsCount = 40;
 
 void showSectorTable() {
     if (k_sector != NULL) {
@@ -4798,6 +4798,95 @@ static int CmdHFMFNDEF(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+int CmdHFMFPersonalize(const char *cmd) {
+
+    CLIParserInit("hf mf personalize",
+                  "Personalize the UID of a Mifare Classic EV1 card. This is only possible if it is a 7Byte UID card and if it is not already personalized.",
+                  "Usage:\n\thf mf personalize UIDF0                        -> double size UID according to ISO/IEC14443-3\n"
+                  "\thf mf personalize UIDF1                        -> double size UID according to ISO/IEC14443-3, optional usage of selection process shortcut\n"
+                  "\thf mf personalize UIDF2                        -> single size random ID according to ISO/IEC14443-3\n"
+                  "\thf mf personalize UIDF3                        -> single size NUID according to ISO/IEC14443-3\n"
+                  "\thf mf personalize -t B -k B0B1B2B3B4B5 UIDF3   -> use key B = 0xB0B1B2B3B4B5 instead of default key A\n");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("tT",  "keytype", "<A|B>",                     "key type (A or B) to authenticate sector 0 (default: A)"),
+        arg_str0("kK",  "key",     "<key (hex 6 Bytes)>",       "key to authenticate sector 0 (default: FFFFFFFFFFFF)"),
+        arg_str1(NULL,  NULL,      "<UIDF0|UIDF1|UIDF2|UIDF3>", "Personalization Option"),
+        arg_param_end
+    };
+    CLIExecWithReturn(cmd, argtable, true);
+
+    char keytypestr[2] = "a";
+    uint8_t keytype = 0x00;
+    int keytypestr_len;
+    int res = CLIParamStrToBuf(arg_get_str(1), (uint8_t *)keytypestr, 1, &keytypestr_len);
+    str_lower(keytypestr);
+
+    if (res || (keytypestr[0] != 'a' && keytypestr[0] != 'b')) {
+        PrintAndLogEx(ERR, "ERROR: not a valid key type. Key type must be A or B");
+        CLIParserFree();
+        return PM3_EINVARG;
+    }
+    if (keytypestr[0] == 'b') {
+        keytype = 0x01;
+    }
+
+    uint8_t key[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+    int key_len;
+    res = CLIParamHexToBuf(arg_get_str(2), key, 6, &key_len);
+    if (res || (!res && key_len > 0 && key_len != 6)) {
+        PrintAndLogEx(ERR, "ERROR: not a valid key. Key must be 12 hex digits");
+        CLIParserFree();
+        return PM3_EINVARG;
+    }
+
+    char pers_optionstr[6];
+    int opt_len;
+    uint8_t pers_option;
+    res = CLIParamStrToBuf(arg_get_str(3), (uint8_t *)pers_optionstr, 5, &opt_len);
+    str_lower(pers_optionstr);
+
+    if (res || (!res && opt_len > 0 && opt_len != 5)
+            || (strncmp(pers_optionstr, "uidf0", 5) && strncmp(pers_optionstr, "uidf1", 5) && strncmp(pers_optionstr, "uidf2", 5) && strncmp(pers_optionstr, "uidf3", 5))) {
+        PrintAndLogEx(ERR, "ERROR: invalid personalization option. Must be one of UIDF0, UIDF1, UIDF2, or UIDF3");
+        CLIParserFree();
+        return PM3_EINVARG;
+    }
+    if (!strncmp(pers_optionstr, "uidf0", 5)) {
+        pers_option = MIFARE_EV1_UIDF0;
+    } else if (!strncmp(pers_optionstr, "uidf1", 5)) {
+        pers_option = MIFARE_EV1_UIDF1;
+    } else if (!strncmp(pers_optionstr, "uidf2", 5)) {
+        pers_option = MIFARE_EV1_UIDF2;
+    } else {
+        pers_option = MIFARE_EV1_UIDF3;
+    }
+
+    CLIParserFree();
+
+    clearCommandBuffer();
+
+    struct {
+        uint8_t keytype;
+        uint8_t pers_option;
+        uint8_t key[6];
+    } PACKED payload;
+    payload.keytype = keytype;
+    payload.pers_option = pers_option;
+
+    memcpy(payload.key, key, 6);
+
+    SendCommandNG(CMD_HF_MIFARE_PERSONALIZE_UID, (uint8_t *)&payload, sizeof(payload));
+
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_HF_MIFARE_PERSONALIZE_UID, &resp, 2500)) return PM3_ETIMEOUT;
+
+    PrintAndLogEx(SUCCESS, "Personalization %s", resp.status == PM3_SUCCESS ? "SUCCEEDED" : "FAILED");
+
+    return PM3_SUCCESS;
+}
+
 static int CmdHF14AMfList(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
     return CmdTraceList("mf");
@@ -4845,7 +4934,7 @@ static command_t CommandTable[] = {
     {"-----------", CmdHelp,                IfPm3Iso14443a,  ""},
     {"mad",         CmdHF14AMfMAD,          IfPm3Iso14443a,  "Checks and prints MAD"},
     {"ndef",        CmdHFMFNDEF,            IfPm3Iso14443a,  "Prints NDEF records from card"},
-
+    {"personalize", CmdHFMFPersonalize,     IfPm3Iso14443a,  "Personalize UID (Mifare Classic EV1 only)"},
     {"ice",         CmdHF14AMfice,          IfPm3Iso14443a,  "collect MIFARE Classic nonces to file"},
     {NULL, NULL, NULL, NULL}
 };

client/cmdhfmfdes.c

@@ -17,6 +17,9 @@
 #include "ui.h"
 #include "cmdhf14a.h"
 #include "mbedtls/des.h"
+#include "crypto/libpcrypto.h"
+#include "protocols.h"
+#include "mifare.h"         // desfire raw command options
 
 uint8_t key_zero_data[16] = { 0x00 };
 uint8_t key_ones_data[16] = { 0x01 };
@@ -25,19 +28,339 @@ uint8_t key_picc_data[16] = { 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x
 
 static int CmdHelp(const char *Cmd);
 
+//ICEMAN: Turn on field method?
+//none
+static int test_desfire_authenticate() {
+    uint8_t c[] = {AUTHENTICATE, 0x00, 0x00, 0x01, 0x00, 0x00};  // 0x0A, KEY 0
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c));
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
+        DropField();
+        return PM3_ETIMEOUT;
+    }
+    if (resp.length == 13)
+        return PM3_SUCCESS;
+    return PM3_ESOFT;
+}
+// none
+static int test_desfire_authenticate_iso() {
+    uint8_t c[] = {AUTHENTICATE_ISO, 0x00, 0x00, 0x01, 0x00, 0x00};  // 0x1A, KEY 0
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c));
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
+        DropField();
+        return PM3_ETIMEOUT;
+    }
+    if (resp.length >= 13)
+        return PM3_SUCCESS;
+    return PM3_ESOFT;
+}
+//none
+static int test_desfire_authenticate_aes() {
+    uint8_t c[] = {AUTHENTICATE_AES, 0x00, 0x00, 0x01, 0x00, 0x00};  // 0xAA, KEY 0
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c));
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
+        DropField();
+        return PM3_ETIMEOUT;
+    }
+    if (resp.length >= 13)
+        return PM3_SUCCESS;
+    return PM3_ESOFT;
+}
+
+// --- FREE MEM
+static int desfire_print_freemem(uint32_t free_mem) {
+    PrintAndLogEx(SUCCESS, "   Available free memory on card         : " _GREEN_("%d bytes"), free_mem);
+    return PM3_SUCCESS;
+}
+
+// init / disconnect
+static int get_desfire_freemem(uint32_t *free_mem) {
+    uint8_t c[] = {GET_FREE_MEMORY, 0x00, 0x00, 0x00};  // 0x6E
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, (INIT | DISCONNECT), sizeof(c), 0, c, sizeof(c));
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+        return PM3_ETIMEOUT;
+    }
+    
+    if (resp.length == 8) {
+        *free_mem = le24toh(resp.data.asBytes + 1);
+        return PM3_SUCCESS;
+    }
+
+    *free_mem = 0;
+    return PM3_ESOFT;
+}
+
+
+// --- GET SIGNATURE
+static int desfire_print_signature(uint8_t *uid, uint8_t *signature, size_t signature_len) {
+    #define PUBLIC_DESFIRE_ECDA_KEYLEN 57
+
+    // ref:  MIFARE Desfire Originality Signature Validation
+    uint8_t nxp_desfire_keys[1][PUBLIC_DESFIRE_ECDA_KEYLEN] = {
+        // DESFire Light
+        {
+            0x04, 0x0E, 0x98, 0xE1, 0x17, 0xAA, 0xA3, 0x64,
+            0x57, 0xF4, 0x31, 0x73, 0xDC, 0x92, 0x0A, 0x87,
+            0x57, 0x26, 0x7F, 0x44, 0xCE, 0x4E, 0xC5, 0xAD,
+            0xD3, 0xC5, 0x40, 0x75, 0x57, 0x1A, 0xEB, 0xBF,
+            0x7B, 0x94, 0x2A, 0x97, 0x74, 0xA1, 0xD9, 0x4A,
+            0xD0, 0x25, 0x72, 0x42, 0x7E, 0x5A, 0xE0, 0xA2,
+            0xDD, 0x36, 0x59, 0x1B, 0x1F, 0xB3, 0x4F, 0xCF, 0x3D
+        }
+        // DESFire Ev2
+        
+    };
+
+    uint8_t public_key = 0;
+    int res = ecdsa_signature_r_s_verify(MBEDTLS_ECP_DP_SECP224R1, nxp_desfire_keys[public_key], uid, 7, signature, signature_len, false);
+    bool is_valid = (res == 0);
+
+    PrintAndLogEx(INFO, "  Tag Signature");
+    PrintAndLogEx(INFO, "  IC signature public key name  : NXP DESFire Light");
+    PrintAndLogEx(INFO, "  IC signature public key value : %s", sprint_hex(nxp_desfire_keys[public_key], 16));
+    PrintAndLogEx(INFO, "                                : %s", sprint_hex(nxp_desfire_keys[public_key] + 16, 16));
+    PrintAndLogEx(INFO, "                                : %s", sprint_hex(nxp_desfire_keys[public_key] + 32, 16));
+    PrintAndLogEx(INFO, "                                : %s", sprint_hex(nxp_desfire_keys[public_key] + 48, PUBLIC_DESFIRE_ECDA_KEYLEN - 48));
+    PrintAndLogEx(INFO, "      Elliptic curve parameters : NID_secp224r1");
+    PrintAndLogEx(INFO, "               TAG IC Signature : %s", sprint_hex(signature, 16));
+    PrintAndLogEx(INFO, "                                : %s", sprint_hex(signature + 16, 16));
+    PrintAndLogEx(INFO, "                                : %s", sprint_hex(signature + 32, 16));
+    PrintAndLogEx(INFO, "                                : %s", sprint_hex(signature + 48, signature_len - 48));
+    PrintAndLogEx( (is_valid) ? SUCCESS : WARNING, "  Signature verified %s", (is_valid) ? _GREEN_("successful") : _RED_("failed"));
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    return PM3_SUCCESS;
+}
+
+// init / disconnect
+static int get_desfire_signature(uint8_t *signature, size_t *signature_len) {
+    uint8_t c[] = {MFDES_READSIG, 0x00, 0x00, 0x01, 0x00, 0x00};  // 0x3C
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, (INIT | DISCONNECT), sizeof(c), 0, c, sizeof(c));
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500))
+        return PM3_ETIMEOUT;
+
+    if (resp.length == 61) {
+        memcpy(signature, resp.data.asBytes + 1, 56);
+        *signature_len = 56;
+        return PM3_SUCCESS;
+    } else {
+        *signature_len = 0;
+        return PM3_ESOFT;        
+    }
+}
+
+
+// --- KEY SETTING
+static int desfire_print_keysetting(uint8_t key_settings, uint8_t num_keys) {
+
+    PrintAndLogEx(SUCCESS, "     AID Key settings           : %02x", key_settings);
+    PrintAndLogEx(SUCCESS, "     Max number of keys in AID  : %d", num_keys);
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");   
+    PrintAndLogEx(SUCCESS, "  Changekey Access rights");
+
+    // Access rights.
+    uint8_t rights = (key_settings >> 4 & 0x0F);
+    switch (rights) {
+        case 0x0:
+            PrintAndLogEx(SUCCESS, "  -- AMK authentication is necessary to change any key (default)");
+            break;
+        case 0xE:
+            PrintAndLogEx(SUCCESS, "  -- Authentication with the key to be changed (same KeyNo) is necessary to change a key");
+            break;
+        case 0xF:
+            PrintAndLogEx(SUCCESS, "  -- All keys (except AMK,see Bit0) within this application are frozen");
+            break;
+        default:
+            PrintAndLogEx(SUCCESS, "  -- Authentication with the specified key is necessary to change any key.\nA change key and a PICC master key (CMK) can only be changed after authentication with the master key.\nFor keys other then the master or change key, an authentication with the same key is needed.");
+            break;
+    }
+
+    PrintAndLogEx(SUCCESS, "   [0x08] Configuration changeable       : %s", (key_settings & (1 << 3)) ? _GREEN_("YES") : "NO");
+    PrintAndLogEx(SUCCESS, "   [0x04] AMK required for create/delete : %s", (key_settings & (1 << 2)) ? "NO" : "YES");
+    PrintAndLogEx(SUCCESS, "   [0x02] Directory list access with AMK : %s", (key_settings & (1 << 1)) ? "NO" : "YES");
+    PrintAndLogEx(SUCCESS, "   [0x01] AMK is changeable              : %s", (key_settings & (1 << 0)) ? _GREEN_("YES") : "NO");    
+    return PM3_SUCCESS;
+}
+
+// none
+static int get_desfire_keysettings(uint8_t *key_settings, uint8_t *num_keys) {
+    PacketResponseNG resp;
+    uint8_t c[] = {MFDES_GET_KEY_SETTINGS, 0x00, 0x00, 0x00};  // 0x45
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c));
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+        PrintAndLogEx(WARNING, _RED_("   Timed-out"));
+        return PM3_ETIMEOUT;
+    }
+
+    uint8_t isOK  = resp.oldarg[0] & 0xFF;
+    if (isOK == false) {
+        return PM3_ESOFT;
+    }
+    
+    if (resp.data.asBytes[1] == 0x91 && resp.data.asBytes[2] == 0xae) {
+        PrintAndLogEx(WARNING, _RED_("   authentication error"));
+        return PM3_ESOFT;
+    }
+//    PrintAndLogEx(INFO, "ICE: KEYSETTING resp :: %s", sprint_hex(resp.data.asBytes, resp.length));
+    *key_settings = resp.data.asBytes[1];
+    *num_keys = resp.data.asBytes[2];
+    return PM3_SUCCESS;
+}
+
+// --- KEY VERSION
+static int desfire_print_keyversion(uint8_t key_idx, uint8_t key_version) {
+    PrintAndLogEx(SUCCESS, " Key [%u]  Version : %d (0x%02x)", key_idx, key_version, key_version);
+    return PM3_SUCCESS;
+}
+
+// none
+static int get_desfire_keyversion(uint8_t curr_key, uint8_t *num_versions) {
+    PacketResponseNG resp;
+    uint8_t c[] = {MFDES_GET_KEY_VERSION, 0x00, 0x00, 0x01, curr_key, 0x00};  // 0x64
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c));
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+        PrintAndLogEx(WARNING, _RED_("   Timed-out"));
+        return PM3_ETIMEOUT;
+    }
+
+    uint8_t isOK  = resp.oldarg[0] & 0xFF;
+    if (isOK == false) {
+        return PM3_ESOFT;
+    }
+    
+    if ( resp.data.asBytes[1] == 0x91 && resp.data.asBytes[2] == 0x40) {
+        return PM3_ESOFT;
+    }
+    
+    *num_versions = resp.data.asBytes[1];
+    return PM3_SUCCESS;
+}
+
+
+// init
+static int get_desfire_select_application(uint8_t *aid) {
+    if (aid == NULL) return PM3_ESOFT;
+
+    uint8_t c[] = {SELECT_APPLICATION, 0x00, 0x00, 0x03, aid[0], aid[1], aid[2], 0x00};  // 0x5a
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT, sizeof(c), 0, c, sizeof(c));
+
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 3000)) {
+        PrintAndLogEx(WARNING, _RED_("   timed-out"));
+        return PM3_ETIMEOUT;
+    }
+
+    uint8_t isOK  = resp.oldarg[0] & 0xff;
+    if (!isOK) {
+        PrintAndLogEx(WARNING, "   Can't select AID: " _RED_("%s"), sprint_hex(aid, 3));
+        return PM3_ESOFT;
+    }
+    
+    if (resp.data.asBytes[1] == 0x91 && resp.data.asBytes[2] == 0x00) {
+        return PM3_SUCCESS;
+    }
+
+    return PM3_ESOFT;
+}
+
+
+// init / disconnect
+static int get_desfire_appids(uint8_t *dest, uint8_t *app_ids_len) {
+
+    uint8_t c[] = {GET_APPLICATION_IDS, 0x00, 0x00, 0x00}; //0x6a
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT | CLEARTRACE | DISCONNECT , sizeof(c), 0, c, sizeof(c));
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+        return PM3_ETIMEOUT;
+    }
+
+    uint8_t isOK  = resp.oldarg[0] & 0xff;
+    if (!isOK) {
+        PrintAndLogEx(WARNING, _RED_("Command unsuccessful"));
+        return PM3_ESOFT;
+    }
+
+    *app_ids_len = resp.length - 5;
+    
+    // resp.length - 2crc, 2status, 1pcb...
+    memcpy(dest, resp.data.asBytes + 1, *app_ids_len);
+    
+    if (resp.data.asBytes[resp.length - 3] == MFDES_ADDITIONAL_FRAME) {
+
+        c[0] = MFDES_ADDITIONAL_FRAME; //0xAF
+        SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c));
+
+        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+            return PM3_ETIMEOUT;
+        }
+
+        isOK  = resp.oldarg[0] & 0xff;
+        if (!isOK) {
+            PrintAndLogEx(WARNING, _RED_("Command unsuccessful"));
+            return PM3_ESOFT;
+        }
+        
+        memcpy(dest + *app_ids_len, resp.data.asBytes + 1, resp.length - 5);
+        
+        *app_ids_len += (resp.length - 5); 
+    }   
+    return PM3_SUCCESS;
+}
+
+
+// none
+static int get_desfire_fileids(uint8_t *dest, uint8_t *file_ids_len) {
+    uint8_t c[] = {MFDES_GET_FILE_IDS, 0x00, 0x00, 0x00};  // 0x6f
+    SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(c), 0, c, sizeof(c));
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+        PrintAndLogEx(WARNING, _RED_("   Timed-out"));
+        return PM3_ETIMEOUT;
+    }
+
+    uint8_t isOK  = resp.oldarg[0] & 0xff;
+    if (!isOK) {
+        PrintAndLogEx(WARNING, _RED_("Command unsuccessful"));
+        return PM3_ESOFT;
+    }
+
+    if (resp.data.asBytes[resp.length - 4] == 0x91 && resp.data.asBytes[resp.length - 3] == 0x00) {
+        *file_ids_len = resp.length - 5;
+        memcpy(dest, resp.data.asBytes + 1, *file_ids_len);
+        return PM3_SUCCESS;
+    }
+
+    return PM3_ESOFT;
+}
+
 static int CmdHF14ADesInfo(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
 
     SendCommandNG(CMD_HF_DESFIRE_INFO, NULL, 0);
     PacketResponseNG resp;
 
-    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+    if (!WaitForResponseTimeout(CMD_HF_DESFIRE_INFO, &resp, 1500)) {
         PrintAndLogEx(WARNING, "Command execute timeout");
+        DropField();
         return PM3_ETIMEOUT;
     }
-    uint8_t isOK  = resp.oldarg[0] & 0xff;
-    if (!isOK) {
-        switch (resp.oldarg[1]) {
+    
+    struct p {
+        uint8_t isOK;
+        uint8_t uid[7];
+        uint8_t versionHW[7];
+        uint8_t versionSW[7];
+        uint8_t details[14];
+    } PACKED;
+
+    struct p *package = (struct p *) resp.data.asBytes;
+    
+    if (resp.status != PM3_SUCCESS) {
+        
+        switch (package->isOK) {
             case 1:
                 PrintAndLogEx(WARNING, "Can't select card");
                 break;
@@ -46,49 +369,77 @@ static int CmdHF14ADesInfo(const char *Cmd) {
                 break;
             case 3:
             default:
-                PrintAndLogEx(WARNING, "Command unsuccessful");
+                PrintAndLogEx(WARNING, _RED_("Command unsuccessful"));
                 break;
         }
         return PM3_ESOFT;
     }
+
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "-- Desfire Information --------------------------------------");
-    PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
-    PrintAndLogEx(NORMAL, "  UID                : %s", sprint_hex(resp.data.asBytes, 7));
-    PrintAndLogEx(NORMAL, "  Batch number       : %s", sprint_hex(resp.data.asBytes + 28, 5));
-    PrintAndLogEx(NORMAL, "  Production date    : week %02x, 20%02x", resp.data.asBytes[33], resp.data.asBytes[34]);
-    PrintAndLogEx(NORMAL, "  -----------------------------------------------------------");
-    PrintAndLogEx(NORMAL, "  Hardware Information");
-    PrintAndLogEx(NORMAL, "      Vendor Id      : %s", getTagInfo(resp.data.asBytes[7]));
-    PrintAndLogEx(NORMAL, "      Type           : 0x%02X", resp.data.asBytes[8]);
-    PrintAndLogEx(NORMAL, "      Subtype        : 0x%02X", resp.data.asBytes[9]);
-    PrintAndLogEx(NORMAL, "      Version        : %s", getVersionStr(resp.data.asBytes[10], resp.data.asBytes[11]));
-    PrintAndLogEx(NORMAL, "      Storage size   : %s", getCardSizeStr(resp.data.asBytes[12]));
-    PrintAndLogEx(NORMAL, "      Protocol       : %s", getProtocolStr(resp.data.asBytes[13]));
-    PrintAndLogEx(NORMAL, "  -----------------------------------------------------------");
-    PrintAndLogEx(NORMAL, "  Software Information");
-    PrintAndLogEx(NORMAL, "      Vendor Id      : %s", getTagInfo(resp.data.asBytes[14]));
-    PrintAndLogEx(NORMAL, "      Type           : 0x%02X", resp.data.asBytes[15]);
-    PrintAndLogEx(NORMAL, "      Subtype        : 0x%02X", resp.data.asBytes[16]);
-    PrintAndLogEx(NORMAL, "      Version        : %d.%d", resp.data.asBytes[17], resp.data.asBytes[18]);
-    PrintAndLogEx(NORMAL, "      storage size   : %s", getCardSizeStr(resp.data.asBytes[19]));
-    PrintAndLogEx(NORMAL, "      Protocol       : %s", getProtocolStr(resp.data.asBytes[20]));
-    PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
+    PrintAndLogEx(INFO, "-- Mifare DESFire Tag Information ---------------------------");
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    PrintAndLogEx(SUCCESS, "  UID                : " _GREEN_("%s"), sprint_hex(package->uid, sizeof(package->uid)));
+    PrintAndLogEx(SUCCESS, "  Batch number       : " _GREEN_("%s"), sprint_hex(package->details + 7, 5));
+    PrintAndLogEx(SUCCESS, "  Production date    : week " _GREEN_("%02x") "/ " _GREEN_("20%02x"), package->details[12], package->details[13]);
+    PrintAndLogEx(INFO, "  -----------------------------------------------------------");
+    PrintAndLogEx(INFO, "  Hardware Information");
+    PrintAndLogEx(SUCCESS, "      Vendor Id      : " _YELLOW_("%s"), getTagInfo(package->versionHW[0]));
+    PrintAndLogEx(SUCCESS, "      Type           : " _YELLOW_("0x%02X"), package->versionHW[1]);
+    PrintAndLogEx(SUCCESS, "      Subtype        : " _YELLOW_("0x%02X"), package->versionHW[2]);
+    PrintAndLogEx(SUCCESS, "      Version        : %s", getVersionStr(package->versionHW[3], package->versionHW[4]));
+    PrintAndLogEx(SUCCESS, "      Storage size   : %s", getCardSizeStr(package->versionHW[5]));
+    PrintAndLogEx(SUCCESS, "      Protocol       : %s", getProtocolStr(package->versionHW[6]));
+    PrintAndLogEx(INFO, "  -----------------------------------------------------------");
+    PrintAndLogEx(INFO, "  Software Information");
+    PrintAndLogEx(SUCCESS, "      Vendor Id      : " _YELLOW_("%s"), getTagInfo(package->versionSW[0]));
+    PrintAndLogEx(SUCCESS, "      Type           : " _YELLOW_("0x%02X"), package->versionSW[1]);
+    PrintAndLogEx(SUCCESS, "      Subtype        : " _YELLOW_("0x%02X"), package->versionSW[2]);
+    PrintAndLogEx(SUCCESS, "      Version        : " _YELLOW_("%d.%d"),  package->versionSW[3], package->versionSW[4]);
+    PrintAndLogEx(SUCCESS, "      storage size   : %s", getCardSizeStr(package->versionSW[5]));
+    PrintAndLogEx(SUCCESS, "      Protocol       : %s", getProtocolStr(package->versionSW[6]));
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+
+    PrintAndLogEx(INFO, "Card capabilities");
+    uint8_t major = package->versionSW[3];
+    uint8_t minor = package->versionSW[4];
+    if (major == 0 && minor == 4)
+        PrintAndLogEx(INFO, "\t0.4 - DESFire MF3ICD40, No support for APDU (only native commands)");
+    if (major == 0 && minor == 5)
+        PrintAndLogEx(INFO, "\t0.5 - DESFire MF3ICD40, Support for wrapping commands inside ISO 7816 style APDUs");
+    if (major == 0 && minor == 6)
+        PrintAndLogEx(INFO, "\t0.6 - DESFire MF3ICD40, Add ISO/IEC 7816 command set compatibility");
+    if (major == 1 && minor == 3)
+        PrintAndLogEx(INFO, "\t1.3 - DESFire Ev1, Support extended APDU commands");
+    if (major == 1 && minor == 4)
+        PrintAndLogEx(INFO, "\t1.4 - DESFire Ev1, N/A information about this version. report to iceman!");
+    if (major == 2 && minor == 0)
+        PrintAndLogEx(INFO, "\t2.0 - DESFire Ev2, Originality check, proximity check");
+
+    if (major == 0 && minor == 2)
+        PrintAndLogEx(INFO, "\t0.2 - DESFire Light, Originality check, ");
+
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    
+    // Signature originality check
+    uint8_t signature[56] = {0};
+    size_t signature_len = 0;
+    
+    if (get_desfire_signature(signature, &signature_len) == PM3_SUCCESS) 
+        desfire_print_signature(package->uid, signature, signature_len);
 
     // Master Key settings
-    getKeySettings(NULL);
+    uint8_t master_aid[3] = {0x00, 0x00, 0x00};
+    getKeySettings(master_aid);
 
     // Free memory on card
-    uint8_t data[1] = {GET_FREE_MEMORY};
-    SendCommandOLD(CMD_HF_DESFIRE_COMMAND, (INIT | DISCONNECT), 0x01, 0, data, sizeof(data));
-    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500))
-        return PM3_ETIMEOUT;
-
-    uint8_t tmp[3];
-    memcpy(tmp, resp.data.asBytes + 3, 3);
-
-    PrintAndLogEx(NORMAL, "   Available free memory on card       : %d bytes", le24toh(tmp));
-    PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
+    PrintAndLogEx(INFO, "  Free memory");
+    uint32_t free_mem = 0;
+    if (get_desfire_freemem(&free_mem) == PM3_SUCCESS) {
+        desfire_print_freemem(free_mem);
+    } else {
+        PrintAndLogEx(SUCCESS, "   Card doesn't support 'free mem' cmd");
+    }
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
 
     /*
         Card Master key (CMK)        0x00 AID = 00 00 00 (card level)
@@ -105,6 +456,7 @@ static int CmdHF14ADesInfo(const char *Cmd) {
 
     */
 
+    DropField();
     return PM3_SUCCESS;
 }
 
@@ -116,7 +468,7 @@ static int CmdHF14ADesInfo(const char *Cmd) {
 */
 char *getCardSizeStr(uint8_t fsize) {
 
-    static char buf[30] = {0x00};
+    static char buf[40] = {0x00};
     char *retStr = buf;
 
     uint16_t usize = 1 << ((fsize >> 1) + 1);
@@ -124,37 +476,39 @@ char *getCardSizeStr(uint8_t fsize) {
 
     // is  LSB set?
     if (fsize & 1)
-        sprintf(retStr, "0x%02X (%d - %d bytes)", fsize, usize, lsize);
+        sprintf(retStr, "0x%02X ( " _YELLOW_("%d - %d bytes") ")", fsize, usize, lsize);
     else
-        sprintf(retStr, "0x%02X (%d bytes)", fsize, lsize);
+        sprintf(retStr, "0x%02X ( " _YELLOW_("%d bytes") ")", fsize, lsize);
     return buf;
 }
 
 char *getProtocolStr(uint8_t id) {
 
-    static char buf[30] = {0x00};
+    static char buf[40] = {0x00};
     char *retStr = buf;
 
     if (id == 0x05)
-        sprintf(retStr, "0x%02X (ISO 14443-3, 14443-4)", id);
+        sprintf(retStr, "0x%02X ( " _YELLOW_("ISO 14443-3, 14443-4") ")", id);
     else
-        sprintf(retStr, "0x%02X (Unknown)", id);
+        sprintf(retStr, "0x%02X ( " _YELLOW_("Unknown") ")", id);
     return buf;
 }
 
 char *getVersionStr(uint8_t major, uint8_t minor) {
 
-    static char buf[30] = {0x00};
+    static char buf[40] = {0x00};
     char *retStr = buf;
 
     if (major == 0x00)
-        sprintf(retStr, "%d.%d (Desfire MF3ICD40)", major, minor);
+        sprintf(retStr, "%x.%x ( " _YELLOW_("DESFire MF3ICD40") ")", major, minor);
     else if (major == 0x01 && minor == 0x00)
-        sprintf(retStr, "%d.%d (Desfire EV1)", major, minor);
+        sprintf(retStr, "%x.%x ( " _YELLOW_("DESFire EV1") ")", major, minor);
     else if (major == 0x12 && minor == 0x00)
-        sprintf(retStr, "%d.%d (Desfire EV2)", major, minor);
+        sprintf(retStr, "%x.%x ( " _YELLOW_("DESFire EV2") ")", major, minor);
+    else if (major == 0x30 && minor == 0x00)
+        sprintf(retStr, "%x.%x ( " _YELLOW_("DESFire Light") ")", major, minor);
     else
-        sprintf(retStr, "%d.%d (Unknown)", major, minor);
+        sprintf(retStr, "%x.%x ( " _YELLOW_("Unknown") ")", major, minor);
     return buf;
 }
 
@@ -162,279 +516,201 @@ void getKeySettings(uint8_t *aid) {
 
     char messStr[512] = {0x00};
     const char *str = messStr;
-    uint8_t isOK = 0;
-    PacketResponseNG resp;
 
-    //memset(messStr, 0x00, 512);
+    if (memcmp(aid, "\x00\x00\x00", 3) == 0) {
         
-    if (aid == NULL) {
-        PrintAndLogEx(NORMAL, " CMK - PICC, Card Master Key settings ");
-        PrintAndLogEx(NORMAL, "");
-        {
-            uint8_t data[1] = {GET_KEY_SETTINGS};  // 0x45
-            SendCommandOLD(CMD_HF_DESFIRE_COMMAND, INIT | DISCONNECT, sizeof(data), 0, data, sizeof(data));
-        }
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {return;}
-        isOK  = resp.oldarg[0] & 0xff;
-        if (!isOK) {
-            PrintAndLogEx(WARNING, "   Can't select master application");
+        // CARD MASTER KEY 
+        PrintAndLogEx(INFO, "  CMK - PICC, Card Master Key settings");
+        PrintAndLogEx(INFO, "-------------------------------------------------------------");
+
+        if (get_desfire_select_application(aid) != PM3_SUCCESS) {
+            PrintAndLogEx(WARNING, _RED_("   Can't select AID"));
+            DropField();
             return;
         }
 
-        str = (resp.data.asBytes[3] & (1 << 3)) ? "YES" : "NO";
-        PrintAndLogEx(NORMAL, "   [0x08] Configuration changeable       : %s", str);
-        str = (resp.data.asBytes[3] & (1 << 2)) ? "NO" : "YES";
-        PrintAndLogEx(NORMAL, "   [0x04] CMK required for create/delete : %s", str);
-        str = (resp.data.asBytes[3] & (1 << 1)) ? "NO" : "YES";
-        PrintAndLogEx(NORMAL, "   [0x02] Directory list access with CMK : %s", str);
-        str = (resp.data.asBytes[3] & (1 << 0)) ? "YES" : "NO";
-        PrintAndLogEx(NORMAL, "   [0x01] CMK is changeable              : %s", str);
-
-        {
-            uint8_t data[2] = {GET_KEY_VERSION, 0};  // 0x64
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT | DISCONNECT, sizeof(data), 0, data, sizeof(data));
-        }
-
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) { return; }
-        isOK  = resp.oldarg[0] & 0xff;
-        if (!isOK) {
-            PrintAndLogEx(WARNING, "   Can't read key-version");
-            return;
-        }
-        PrintAndLogEx(NORMAL, "");
-        PrintAndLogEx(NORMAL, "   Max number of keys       : %d", resp.data.asBytes[4]);
-        PrintAndLogEx(NORMAL, "   Master key Version       : %d (0x%02x)", resp.data.asBytes[3], resp.data.asBytes[3]);
-        PrintAndLogEx(NORMAL, "   ----------------------------------------------------------");
-
-        {
-            uint8_t data[2] = {AUTHENTICATE, 0};  // 0x0A, KEY 0
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT | DISCONNECT, sizeof(data), 0, data, sizeof(data));
-        }
-
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {return;}
-        isOK  = resp.data.asBytes[2] & 0xff;
-        PrintAndLogEx(NORMAL, "   [0x0A] Authenticate      : %s", (isOK == 0xAE) ? "NO" : "YES");
-
-        {
-            uint8_t data[2] = {AUTHENTICATE_ISO, 0};  // 0x1A, KEY 0
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT | DISCONNECT, sizeof(data), 0, data, sizeof(data));
-        }
-
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {return;}
-        isOK  = resp.data.asBytes[2] & 0xff;
-        PrintAndLogEx(NORMAL, "   [0x1A] Authenticate ISO  : %s", (isOK == 0xAE) ? "NO" : "YES");
-
-        {
-            uint8_t data[2] = {AUTHENTICATE_AES, 0};  // 0xAA, KEY 0
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT | DISCONNECT, sizeof(data), 0, data, sizeof(data));
-        }
-
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {return;}
-        isOK  = resp.data.asBytes[2] & 0xff;
-        PrintAndLogEx(NORMAL, "   [0xAA] Authenticate AES  : %s", (isOK == 0xAE) ? "NO" : "YES");
-        PrintAndLogEx(NORMAL, "");
-        PrintAndLogEx(NORMAL, "   ----------------------------------------------------------");
+        // KEY Settings - AMK
+        uint8_t num_keys = 0;
+        uint8_t key_setting = 0;        
+        if (get_desfire_keysettings(&key_setting, &num_keys) == PM3_SUCCESS) {
+            // number of Master keys (0x01)
+            PrintAndLogEx(SUCCESS, "   Number of Masterkeys                  : " _YELLOW_("%u"), (num_keys & 0x3F) );
 
+            PrintAndLogEx(SUCCESS, "   [0x08] Configuration changeable       : %s", (key_setting & (1 << 3)) ? _GREEN_("YES") : "NO");
+            PrintAndLogEx(SUCCESS, "   [0x04] CMK required for create/delete : %s", (key_setting & (1 << 2)) ? _GREEN_("YES") : "NO");
+            PrintAndLogEx(SUCCESS, "   [0x02] Directory list access with CMK : %s", (key_setting & (1 << 1)) ? _GREEN_("YES") : "NO");
+            PrintAndLogEx(SUCCESS, "   [0x01] CMK is changeable              : %s", (key_setting & (1 << 0)) ? _GREEN_("YES") : "NO");
         } else {
-        PrintAndLogEx(NORMAL, " AMK - Application Master Key settings");
-
-        // SELECT AID
-        {
-            uint8_t data[4] = {SELECT_APPLICATION};  // 0x5a
-            memcpy(data + 1, aid, 3);
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT | CLEARTRACE, sizeof(data), 0, data, sizeof(data));
-        }
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
-            PrintAndLogEx(WARNING, "   Timed-out");
-            return;
-        }
-        isOK  = resp.oldarg[0] & 0xff;
-        if (!isOK) {
-            PrintAndLogEx(WARNING, "   Can't select AID: %s", sprint_hex(aid, 3));
-            return;
+            PrintAndLogEx(WARNING, _RED_("   Can't read Application Master key settings"));
         }
 
-        // KEY SETTINGS
-        {
-            uint8_t data[1] = {GET_KEY_SETTINGS};  // 0x45
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(data), 0, data, sizeof(data));
-        }
 
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
-            return;
-        }
-        isOK  = resp.oldarg[0] & 0xff;
-        if (!isOK) {
-            PrintAndLogEx(WARNING, "   Can't read Application Master key settings");
-        } else {
-            // Access rights.
-            uint8_t rights = (resp.data.asBytes[3] >> 4 & 0xff);
-            switch (rights) {
-                case 0x00:
-                    str = "AMK authentication is necessary to change any key (default)";
+        memset(messStr, 0x00, sizeof(messStr));
+        str = "   Operation of PICC master key          : " _YELLOW_("%s");
+        
+        // 2 MSB denotes 
+        switch (num_keys >> 6) {
+            case 0:
+                PrintAndLogEx(SUCCESS, str, "(3)DES");
                 break;
-                case 0x0e:
-                    str = "Authentication with the key to be changed (same KeyNo) is necessary to change a key";
+            case 1:
+                PrintAndLogEx(SUCCESS, str, "3K3DES");
                 break;
-                case 0x0f:
-                    str = "All keys (except AMK,see Bit0) within this application are frozen";
+            case 2:
+                PrintAndLogEx(SUCCESS, str, "AES");
                 break;
             default:
-                    str = "Authentication with the specified key is necessary to change any key. A change key and a PICC master key (CMK) can only be changed after authentication with the master key. For keys other then the master or change key, an authentication with the same key is needed.";
                 break;
         }
-            PrintAndLogEx(NORMAL, "Changekey Access rights");
-            PrintAndLogEx(NORMAL, "-- %s", str);
-            PrintAndLogEx(NORMAL, "");
-            // same as CMK
-            str = (resp.data.asBytes[3] & (1 << 3)) ? "YES" : "NO";
-            PrintAndLogEx(NORMAL, "   0x08 Configuration changeable       : %s", str);
-            str = (resp.data.asBytes[3] & (1 << 2)) ? "NO" : "YES";
-            PrintAndLogEx(NORMAL, "   0x04 AMK required for create/delete : %s", str);
-            str = (resp.data.asBytes[3] & (1 << 1)) ? "NO" : "YES";
-            PrintAndLogEx(NORMAL, "   0x02 Directory list access with AMK : %s", str);
-            str = (resp.data.asBytes[3] & (1 << 0)) ? "YES" : "NO";
-            PrintAndLogEx(NORMAL, "   0x01 AMK is changeable              : %s", str);
+
+        uint8_t cmk_num_versions = 0;
+        if (get_desfire_keyversion(0, &cmk_num_versions) == PM3_SUCCESS) {
+            PrintAndLogEx(SUCCESS, "   PICC Master key Version               : " _YELLOW_("%d (0x%02x)"), cmk_num_versions, cmk_num_versions);
+            PrintAndLogEx(INFO, "   ----------------------------------------------------------");
+        }
+
+        // Authentication tests
+        int res = test_desfire_authenticate();
+        if (res == PM3_ETIMEOUT) return;
+        PrintAndLogEx(SUCCESS, "   [0x0A] Authenticate      : %s", (res == PM3_SUCCESS) ? _YELLOW_("YES") : "NO");
+
+        res = test_desfire_authenticate_iso();
+        if (res == PM3_ETIMEOUT) return;
+        PrintAndLogEx(SUCCESS, "   [0x1A] Authenticate ISO  : %s", (res == PM3_SUCCESS) ? _YELLOW_("YES") : "NO");
+
+        res = test_desfire_authenticate_aes();
+        if (res == PM3_ETIMEOUT) return;
+        PrintAndLogEx(SUCCESS, "   [0xAA] Authenticate AES  : %s", (res == PM3_SUCCESS) ? _YELLOW_("YES") : "NO");
+
+        PrintAndLogEx(INFO, "-------------------------------------------------------------");
+
+    } else {
+        
+        // AID - APPLICATION MASTER KEYS
+        PrintAndLogEx(SUCCESS, " AMK - Application Master Key settings");
+        PrintAndLogEx(INFO, " ----------------------------------------------------------");
+
+        if (get_desfire_select_application(aid) != PM3_SUCCESS) {
+            PrintAndLogEx(WARNING, _RED_("   Can't select AID"));
+            DropField();
+            return;
+        }
+
+        // KEY Settings - AMK
+        uint8_t num_keys = 0;
+        uint8_t key_setting = 0;        
+        if (get_desfire_keysettings(&key_setting, &num_keys) == PM3_SUCCESS) {
+            desfire_print_keysetting(key_setting, num_keys);
+        } else {
+            PrintAndLogEx(WARNING, _RED_("   Can't read Application Master key settings"));
         }
 
         // KEY VERSION  - AMK
-        {
-            uint8_t data[2] = {GET_KEY_VERSION, 0};  // 0x64
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(data), 0, data, sizeof(data));
-        }
-
-        if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
-            PrintAndLogEx(WARNING, "   Timed-out");
-            return;
-        }
-
-        int numOfKeys;
-
-        isOK  = resp.oldarg[0] & 0xff;
-        if (isOK == false) {
-            PrintAndLogEx(WARNING, "   Can't read Application Master key version. Trying all keys");
-            //numOfKeys = MAX_NUM_KEYS;
+        uint8_t num_version = 0;        
+        if (get_desfire_keyversion(0, &num_version) == PM3_SUCCESS) {
+            PrintAndLogEx(INFO, "-------------------------------------------------------------");
+            PrintAndLogEx(INFO, "  Application keys");
+            desfire_print_keyversion(0, num_version);
         } else {
-            numOfKeys = resp.data.asBytes[4];
-            PrintAndLogEx(NORMAL, "");
-            PrintAndLogEx(NORMAL, "     Max number of keys  : %d", numOfKeys);
-            PrintAndLogEx(NORMAL, "     Application Master key Version  : %d (0x%02x)", resp.data.asBytes[3], resp.data.asBytes[3]);
-            PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
+            PrintAndLogEx(WARNING, "   Can't read AID master key version. Trying all keys");
         }
 
-        // LOOP over numOfKeys that we got before.
         // From 0x01 to numOfKeys.  We already got 0x00. (AMK)
-        // TODO (iceman)
-        /*
-                for (int i = 0x01; i <= 0x0f; ++i) {
+        num_keys &= 0x3F;
+        if (num_keys > 1) {
+            for (uint8_t i = 0x01; i < num_keys; ++i) {
+                if (get_desfire_keyversion(i, &num_version) == PM3_SUCCESS) {
+                    desfire_print_keyversion(i, num_version);
+                } else {
+                    PrintAndLogEx(WARNING, "   Can't read key %d  (0x%02x) version", i, i);
                 }
-        */
             }
         }
+        PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    }
+    
+    DropField();
+}
 
 static int CmdHF14ADesEnumApplications(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
 
-    uint8_t isOK = 0x00;
+//    uint8_t isOK = 0x00;
     uint8_t aid[3];
-    {
-        uint8_t data[1] = {GET_APPLICATION_IDS}; //0x6a
-        SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT | DISCONNECT, sizeof(data), 0, data, sizeof(data));
-    }
-    PacketResponseNG resp;
+    uint8_t app_ids[78] = {0};
+    uint8_t app_ids_len = 0;
     
-    if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
-        return PM3_ETIMEOUT;
-    }
+    uint8_t file_ids[33] = {0};
+    uint8_t file_ids_len = 0;
     
-    isOK  = resp.oldarg[0] & 0xff;
-    if (!isOK) {
-        PrintAndLogEx(NORMAL, "Command unsuccessful");
+    if (get_desfire_appids(app_ids, &app_ids_len) != PM3_SUCCESS) {
+        PrintAndLogEx(ERR, "Can't get list of applications on tag");
         return PM3_ESOFT;
     }
+    
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "-- Desfire Enumerate Applications ---------------------------");
-    PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
+    PrintAndLogEx(INFO, "-- Mifare DESFire Enumerate applications --------------------");
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    PrintAndLogEx(SUCCESS, " Tag report " _GREEN_("%d") "application%c", app_ids_len / 3, (app_ids_len == 3) ? ' ' : 's'); 
         
-    PacketResponseNG respAid;
-    PacketResponseNG respFiles;
+    for (int i = 0; i < app_ids_len; i += 3) {
 
-    uint8_t num = 0;
-    int max = resp.oldarg[1] - 3 - 2;
+        aid[0] = app_ids[i];
+        aid[1] = app_ids[i + 1];
+        aid[2] = app_ids[i + 2];
         
-    for (int i = 3; i <= max; i += 3) {
-        PrintAndLogEx(NORMAL, " Aid %d : %02X %02X %02X ", num, resp.data.asBytes[i], resp.data.asBytes[i + 1], resp.data.asBytes[i + 2]);
-        num++;
+        PrintAndLogEx(SUCCESS, " AID %d : " _GREEN_("%02X %02X %02X"), i, app_ids[i], app_ids[i+1], app_ids[i+2]);
 
-        aid[0] = resp.data.asBytes[i];
-        aid[1] = resp.data.asBytes[i + 1];
-        aid[2] = resp.data.asBytes[i + 2];
         getKeySettings(aid);
 
-        // Select Application
-        {
-            uint8_t data[4] = {SELECT_APPLICATION};  // 0x5a
-            memcpy(data + 1, &resp.data.asBytes[i], 3);
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, INIT, sizeof(data), 0, data, sizeof(data));
-        }
-
-        if (!WaitForResponseTimeout(CMD_ACK, &respAid, 1500)) {
-            PrintAndLogEx(WARNING, "   Timed-out");
-            continue;
-        }
-        isOK  = respAid.data.asBytes[2] & 0xff;
-        if (isOK != 0x00) {
-            PrintAndLogEx(WARNING, "   Can't select AID: %s", sprint_hex(resp.data.asBytes + i, 3));
-            continue;
-        }
-
         // Get File IDs
-        {
-            uint8_t data[1] = {GET_FILE_IDS};  // 0x6f
-            SendCommandMIX(CMD_HF_DESFIRE_COMMAND, NONE, sizeof(data), 0, data, sizeof(data));
-        }
-
-        if (!WaitForResponseTimeout(CMD_ACK, &respFiles, 1500)) {
-            PrintAndLogEx(WARNING, "   Timed-out");
-            continue;
-        } else {
-            isOK  = respFiles.data.asBytes[2] & 0xff;
-            if (!isOK) {
-                PrintAndLogEx(WARNING, "   Can't get file ids ");
-            } else {
-                int respfileLen = resp.oldarg[1] - 3 - 2;
-                for (int j = 0; j < respfileLen; ++j) {
-                    PrintAndLogEx(NORMAL, "   Fileid %d :", resp.data.asBytes[j + 3]);
-                }
+        if (get_desfire_fileids(file_ids, &file_ids_len) == PM3_SUCCESS) {
+            PrintAndLogEx(SUCCESS, " Tag report " _GREEN_("%d") "file%c", file_ids_len, (file_ids_len == 1) ? ' ' : 's');             
+            for (int i = 0; i < file_ids_len; ++i) {
+                PrintAndLogEx(SUCCESS, "   Fileid %d (0x%02x)", file_ids[i], file_ids[i]);
             }
         }
 
+/*
         // Get ISO File IDs
         {
-            uint8_t data[1] = {GET_ISOFILE_IDS};  // 0x61
+            uint8_t data[] = {GET_ISOFILE_IDS, 0x00, 0x00, 0x00};  // 0x61
             SendCommandMIX(CMD_HF_DESFIRE_COMMAND, DISCONNECT, sizeof(data), 0, data, sizeof(data));
         }
 
         if (!WaitForResponseTimeout(CMD_ACK, &respFiles, 1500)) {
-            PrintAndLogEx(WARNING, "   Timed-out");
+            PrintAndLogEx(WARNING, _RED_("   Timed-out"));
             continue;
         } else {
             isOK  = respFiles.data.asBytes[2] & 0xff;
             if (!isOK) {
-                PrintAndLogEx(WARNING, "   Can't get ISO file ids ");
+                PrintAndLogEx(WARNING, _RED_("   Can't get ISO file ids"));
             } else {
                 int respfileLen = resp.oldarg[1] - 3 - 2;
                 for (int j = 0; j < respfileLen; ++j) {
-                    PrintAndLogEx(NORMAL, " ISO  Fileid %d :", resp.data.asBytes[j + 3]);
+                    PrintAndLogEx(SUCCESS, " ISO  Fileid %d :", resp.data.asBytes[j + 3]);
                 }
             }
         }
+        */
     }
-    PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    DropField();
     return PM3_SUCCESS;
 }
+/*
+         uint8_t cmd[3 + 16] = {0xa8, 0x90, 0x90, 0x00};
+                int res = ExchangeRAW14a(cmd, sizeof(cmd), false, false, data, sizeof(data), &datalen, false);
 
-// MIAFRE DesFire Authentication
+                if (!res && datalen > 1 && data[0] == 0x09) {
+                    SLmode = 0;
+                }
+                
+*/
+
+
+
+// MIAFRE DESFire Authentication
 //
 #define BUFSIZE 256
 static int CmdHF14ADesAuth(const char *Cmd) {
@@ -457,8 +733,8 @@ static int CmdHF14ADesAuth(const char *Cmd) {
         PrintAndLogEx(NORMAL, "                 1 = DES 2 = 3DES 3 = 3K3DES 4 = AES");
         PrintAndLogEx(NORMAL, "");
         PrintAndLogEx(NORMAL, "Examples:");
-        PrintAndLogEx(NORMAL, "         hf mfdes auth 1 1 0 11223344");
-        PrintAndLogEx(NORMAL, "         hf mfdes auth 3 4 0 404142434445464748494a4b4c4d4e4f");
+        PrintAndLogEx(NORMAL, _YELLOW_("         hf mfdes auth 1 1 0 11223344"));
+        PrintAndLogEx(NORMAL, _YELLOW_("         hf mfdes auth 3 4 0 404142434445464748494a4b4c4d4e4f"));
         return PM3_SUCCESS;
     }
     uint8_t cmdAuthMode = param_get8(Cmd, 0);
@@ -531,18 +807,17 @@ static int CmdHF14ADesAuth(const char *Cmd) {
     if (isOK) {
         uint8_t *session_key = resp.data.asBytes;
 
-        PrintAndLogEx(NORMAL, "  Key        :%s", sprint_hex(key, keylength));
-        PrintAndLogEx(NORMAL, "  SESSION    :%s", sprint_hex(session_key, keylength));
-        PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
+        PrintAndLogEx(SUCCESS, "  Key        : " _GREEN_("%s"), sprint_hex(key, keylength));
+        PrintAndLogEx(SUCCESS, "  SESSION    : " _GREEN_("%s"), sprint_hex(session_key, keylength));
+        PrintAndLogEx(INFO, "-------------------------------------------------------------");
         //PrintAndLogEx(NORMAL, "  Expected   :B5 21 9E E8 1A A7 49 9D 21 96 68 7E 13 97 38 56");
     } else {
-        PrintAndLogEx(NORMAL, "Client command failed.");
+        PrintAndLogEx(WARNING, _RED_("Client command failed."));
     }
-    PrintAndLogEx(NORMAL, "-------------------------------------------------------------");
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
     return PM3_SUCCESS;
 }
 
-
 static command_t CommandTable[] = {
     {"help",    CmdHelp,                     AlwaysAvailable, "This help"},
     {"info",    CmdHF14ADesInfo,             IfPm3Iso14443a,  "Tag information"},
@@ -564,4 +839,3 @@ int CmdHFMFDes(const char *Cmd) {
     clearCommandBuffer();
     return CmdsParse(CommandTable, Cmd);
 }
-

client/cmdhfmfdes.h

@@ -19,16 +19,6 @@ char *getProtocolStr(uint8_t id);
 char *getVersionStr(uint8_t major, uint8_t minor);
 void getKeySettings(uint8_t *aid);
 
-// Command options for Desfire behavior.
-enum  {
-    NONE       =    0x00,
-    INIT       =    0x01,
-    DISCONNECT =    0x02,
-    CLEARTRACE =    0x04,
-    BAR        =    0x08,
-} CmdOptions ;
-
-
 #define CREATE_APPLICATION          0xca
 #define DELETE_APPLICATION          0xda
 #define GET_APPLICATION_IDS         0x6a

client/cmdhfmfp.c

@@ -39,6 +39,10 @@ static int CmdHFMFPInfo(const char *Cmd) {
     if (Cmd && strlen(Cmd) > 0)
         PrintAndLogEx(WARNING, "command don't have any parameters.\n");
 
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-- Mifare Plus Tag Information ------------------------------");
+    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    
     // info about 14a part
     infoHF14A(false, false, false);
 
@@ -54,61 +58,107 @@ static int CmdHFMFPInfo(const char *Cmd) {
     uint64_t select_status = resp.oldarg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
 
     if (select_status == 1 || select_status == 2) {
-        PrintAndLogEx(NORMAL, "----------------------------------------------");
-        PrintAndLogEx(NORMAL, "Mifare Plus info:");
+
+        PrintAndLogEx(INFO, "-------------------------------------------------------------");
+        PrintAndLogEx(INFO, " Fingerprint");
         
         // MIFARE Type Identification Procedure
         // https://www.nxp.com/docs/en/application-note/AN10833.pdf
         uint16_t ATQA = card.atqa[0] + (card.atqa[1] << 8);
-        if (ATQA == 0x0004) PrintAndLogEx(INFO, "ATQA: Mifare Plus 2k 4bUID");
-        if (ATQA == 0x0002) PrintAndLogEx(INFO, "ATQA: Mifare Plus 4k 4bUID");
-        if (ATQA == 0x0044) PrintAndLogEx(INFO, "ATQA: Mifare Plus 2k 7bUID");
-        if (ATQA == 0x0042) PrintAndLogEx(INFO, "ATQA: Mifare Plus 4k 7bUID");
+       
+        bool isPlus = false;
+        
+        if (ATQA == 0x0004) {
+            PrintAndLogEx(INFO, "  ATQA - " _GREEN_("Mifare Plus 2K") "  (4b UID)");
+            isPlus = true;
+        }
+        if (ATQA == 0x0002) {
+            PrintAndLogEx(INFO, "  ATQA - " _GREEN_("Mifare Plus 4K") "  (4b UID)");
+            isPlus = true;
+        }
+        if (ATQA == 0x0044) {
+            PrintAndLogEx(INFO, "  ATQA - " _GREEN_("Mifare Plus 2K") "  (7b UID)");
+            isPlus = true;
+        }
+        if (ATQA == 0x0042) {
+            PrintAndLogEx(INFO, "  ATQA - " _GREEN_("Mifare Plus 4K") "  (7b UID)");
+            isPlus = true;
+        }
 
         uint8_t SLmode = 0xff;
+        if (isPlus) {
             if (card.sak == 0x08) {
-            PrintAndLogEx(INFO, "SAK: Mifare Plus 2k 7bUID");
+                PrintAndLogEx(INFO, "   SAK - " _GREEN_("Mifare Plus 2K 7b UID"));
                 if (select_status == 2) SLmode = 1;
             }
             if (card.sak == 0x18) {
-            PrintAndLogEx(INFO, "SAK: Mifare Plus 4k 7bUID");
+                PrintAndLogEx(INFO, "   SAK - " _GREEN_("Mifare Plus 4K 7b UID"));
                 if (select_status == 2) SLmode = 1;
             }
             if (card.sak == 0x10) {
-            PrintAndLogEx(INFO, "SAK: Mifare Plus 2k");
+                PrintAndLogEx(INFO, "   SAK - " _GREEN_("Mifare Plus 2K"));
                 if (select_status == 2) SLmode = 2;
             }
             if (card.sak == 0x11) {
-            PrintAndLogEx(INFO, "SAK: Mifare Plus 4k");
+                PrintAndLogEx(INFO, "   SAK - " _GREEN_("Mifare Plus 4K"));
                 if (select_status == 2) SLmode = 2;
             }
-        if (card.sak == 0x20) {
-            PrintAndLogEx(INFO, "SAK: Mifare Plus SL0/SL3 or Mifare desfire");
-            if (card.ats_len > 0) {
-                SLmode = 3;
+        }
 
+        if (card.sak == 0x20) {
+            PrintAndLogEx(INFO, "   SAK - " _GREEN_("Mifare Plus SL0/SL3") "or " _GREEN_("Mifare DESFire"));
+
+            if (card.ats_len > 0) {
+
+                SLmode = 3;
                 // check SL0
                 uint8_t data[250] = {0};
                 int datalen = 0;
                 // https://github.com/Proxmark/proxmark3/blob/master/client/luascripts/mifarePlus.lua#L161
                 uint8_t cmd[3 + 16] = {0xa8, 0x90, 0x90, 0x00};
                 int res = ExchangeRAW14a(cmd, sizeof(cmd), false, false, data, sizeof(data), &datalen, false);
+
+                if (memcmp(data, "\x67\x00", 2) == 0) {
+                    PrintAndLogEx(INFO, "\tMost likely a Mifare DESFire tag"); 
+                    PrintAndLogEx(HINT, "Hint:  Try " _YELLOW_("`hf mfdes info`"));
+                    DropField();
+                    return PM3_SUCCESS;
+                }
+
                 if (!res && datalen > 1 && data[0] == 0x09) {
                     SLmode = 0;
                 }
             }
         }
 
-        if (SLmode != 0xff)
-            PrintAndLogEx(INFO, "Mifare Plus SL mode: SL%d", SLmode);
+// How do we detect SL0 / SL1 / SL2 / SL3 modes?!?
+        PrintAndLogEx(INFO, "Security Level (SL)");
+        switch(SLmode) {
+            case 0: 
+                PrintAndLogEx(INFO, "SL 0: initial delivery configuration, used for card personalization");
+                break;
+            case 1:
+                PrintAndLogEx(INFO, "SL 1: backwards functional compatibility mode (with MIFARE Classic 1K / 4K) with an optional AES authentication");
+                break;
+            case 2: 
+                PrintAndLogEx(INFO, "SL 2: 3-Pass Authentication based on AES followed by MIFARE CRYPTO1 authentication, communication secured by MIFARE CRYPTO1");
+                break;
+            case 3: 
+                PrintAndLogEx(INFO, "SL 3: 3-Pass authentication based on AES, data manipulation commands secured by AES encryption and an AES based MACing method.");
+                break;
+            default: 
+                break;
+        }
+        
+        if (SLmode != 0xFF)
+            PrintAndLogEx(SUCCESS, "\tMifare Plus SL mode: " _YELLOW_("SL%d"), SLmode);
         else
-            PrintAndLogEx(WARNING, "Mifare Plus SL mode: unknown(");
+            PrintAndLogEx(WARNING, "\tMifare Plus SL mode: " _YELLOW_("unknown"));
     } else {
-        PrintAndLogEx(INFO, "Mifare Plus info not available.");
+        PrintAndLogEx(INFO, "\tMifare Plus info not available.");
     }
 
     DropField();
-
     return PM3_SUCCESS;
 }
 

client/cmdhfmfu.c

@@ -53,48 +53,51 @@ static int usage_hf_mfu_info(void) {
     PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       hf mfu info");
-    PrintAndLogEx(NORMAL, "       hf mfu info k 00112233445566778899AABBCCDDEEFF");
-    PrintAndLogEx(NORMAL, "       hf mfu info k AABBCCDD");
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu info"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu info k 00112233445566778899AABBCCDDEEFF"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu info k AABBCCDD"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
 static int usage_hf_mfu_dump(void) {
     PrintAndLogEx(NORMAL, "Reads all pages from Ultralight, Ultralight-C, Ultralight EV1");
     PrintAndLogEx(NORMAL, "NTAG 203, NTAG 210, NTAG 212, NTAG 213, NTAG 215, NTAG 216");
-    PrintAndLogEx(NORMAL, "and saves binary dump into the file `filename.bin` or `cardUID.bin`");
+    PrintAndLogEx(NORMAL, "and saves binary dump into the file " _YELLOW_("`filename.bin`") "or " _YELLOW_("`cardUID.bin`") );
     PrintAndLogEx(NORMAL, "It autodetects card type.\n");
     PrintAndLogEx(NORMAL, "Usage:  hf mfu dump k <key> l f <filename w/o .bin> p <page#> q <#pages>");
     PrintAndLogEx(NORMAL, "  Options :");
     PrintAndLogEx(NORMAL, "  k <key> : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]");
     PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
-    PrintAndLogEx(NORMAL, "  f <FN > : filename w/o .bin to save the dump as");
-    PrintAndLogEx(NORMAL, "  p <Pg > : starting Page number to manually set a page to start the dump at");
+    PrintAndLogEx(NORMAL, "  f <fn>  : " _YELLOW_("filename w/o .bin") "to save the dump as");
+    PrintAndLogEx(NORMAL, "  p <pg>  : starting Page number to manually set a page to start the dump at");
     PrintAndLogEx(NORMAL, "  q <qty> : number of Pages to manually set how many pages to dump");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       hf mfu dump");
-    PrintAndLogEx(NORMAL, "       hf mfu dump n myfile");
-    PrintAndLogEx(NORMAL, "       hf mfu dump k 00112233445566778899AABBCCDDEEFF");
-    PrintAndLogEx(NORMAL, "       hf mfu dump k AABBCCDD\n");
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump f myfile"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump k 00112233445566778899AABBCCDDEEFF"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump k AABBCCDD"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
 static int usage_hf_mfu_restore(void) {
     PrintAndLogEx(NORMAL, "Restore dumpfile onto card.");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu restore [h] [l] [s] k <key> n <filename w/o .bin> ");
+    PrintAndLogEx(NORMAL, "Usage:  hf mfu restore [h] [l] [s] k <key> n <filename w .bin> ");
     PrintAndLogEx(NORMAL, "  Options :");
     PrintAndLogEx(NORMAL, "  k <key> : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]");
     PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
-    PrintAndLogEx(NORMAL, "  s       : (optional) enable special write UID -MAGIC TAG ONLY-");
-    PrintAndLogEx(NORMAL, "  e       : (optional) enable special write version/signature -MAGIC NTAG 21* ONLY-");
-    PrintAndLogEx(NORMAL, "  r       : (optional) use the password found in dumpfile to configure tag. requires 'e' parameter to work");
-    PrintAndLogEx(NORMAL, "  f <FN>  : filename w/o .bin to restore");
+    PrintAndLogEx(NORMAL, "  s       : (optional) enable special write UID " _BLUE_("-MAGIC TAG ONLY-") );
+    PrintAndLogEx(NORMAL, "  e       : (optional) enable special write version/signature " _BLUE_("-MAGIC NTAG 21* ONLY-") );
+    PrintAndLogEx(NORMAL, "  r       : (optional) use the password found in dumpfile to configure tag. requires " _YELLOW_("'e'") "parameter to work");
+    PrintAndLogEx(NORMAL, "  f <fn>  : " _YELLOW_("filename w .bin") "to restore");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       hf mfu restore s f myfile");
-    PrintAndLogEx(NORMAL, "       hf mfu restore k AABBCCDD s f myfile\n");
-    PrintAndLogEx(NORMAL, "       hf mfu restore k AABBCCDD s e r f myfile\n");
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu restore s f myfile"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu restore k AABBCCDD s f myfile"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu restore k AABBCCDD s e r f myfile"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
@@ -107,9 +110,10 @@ static int usage_hf_mfu_rdbl(void) {
     PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       hf mfu rdbl b 0");
-    PrintAndLogEx(NORMAL, "       hf mfu rdbl b 0 k 00112233445566778899AABBCCDDEEFF");
-    PrintAndLogEx(NORMAL, "       hf mfu rdbl b 0 k AABBCCDD\n");
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu rdbl b 0"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu rdbl b 0 k 00112233445566778899AABBCCDDEEFF"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu rdbl b 0 k AABBCCDD"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
@@ -123,14 +127,15 @@ static int usage_hf_mfu_wrbl(void) {
     PrintAndLogEx(NORMAL, "  l        : (optional) swap entered key's endianness");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        hf mfu wrbl b 0 d 01234567");
-    PrintAndLogEx(NORMAL, "        hf mfu wrbl b 0 d 01234567 k AABBCCDD\n");
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu wrbl b 0 d 01234567"));
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu wrbl b 0 d 01234567 k AABBCCDD"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
 static int usage_hf_mfu_eload(void) {
-    PrintAndLogEx(NORMAL, "It loads emul dump from the file `filename.eml`");
-    PrintAndLogEx(NORMAL, "Hint: See script dumptoemul-mfu.lua to convert the .bin to the eml");
+    PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`") );
+    PrintAndLogEx(NORMAL, "Hint: See " _YELLOW_("`script run dumptoemul-mfu`") "to convert the .bin to the eml");
     PrintAndLogEx(NORMAL, "Usage:  hf mfu eload u <file name w/o `.eml`> [numblocks]");
     PrintAndLogEx(NORMAL, "  Options:");
     PrintAndLogEx(NORMAL, "    h          : this help");
@@ -138,8 +143,10 @@ static int usage_hf_mfu_eload(void) {
     PrintAndLogEx(NORMAL, "    [filename] : without `.eml` (required)");
     PrintAndLogEx(NORMAL, "    numblocks  : number of blocks to load from eml file (optional)");
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "  sample: hf mfu eload u filename");
-    PrintAndLogEx(NORMAL, "          hf mfu eload u filename 57");
+    PrintAndLogEx(NORMAL, "Examples:");
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu eload u filename"));
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu eload u filename 57"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
@@ -153,8 +160,9 @@ static int usage_hf_mfu_sim(void) {
     PrintAndLogEx(NORMAL, "    u <uid> : 4 or 7 byte UID (optional)");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        hf mfu sim t 7");
-    PrintAndLogEx(NORMAL, "        hf mfu sim t 7 u 1122344556677\n");
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu sim t 7"));
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu sim t 7 u 1122344556677"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
@@ -168,17 +176,19 @@ static int usage_hf_mfu_ucauth(void) {
     PrintAndLogEx(NORMAL, "      5 : all 0xff key");
     PrintAndLogEx(NORMAL, "      6 : 0x00-0xFF key");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       hf mfu cauth k");
-    PrintAndLogEx(NORMAL, "       hf mfu cauth k 3");
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu cauth k"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu cauth k 3"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
 static int usage_hf_mfu_ucsetpwd(void) {
+    PrintAndLogEx(NORMAL, "Set 3DES password on Mifare Ultralight-C tag.");
     PrintAndLogEx(NORMAL, "Usage:  hf mfu setpwd <password (32 hex symbols)>");
     PrintAndLogEx(NORMAL, "       [password] - (32 hex symbols)");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "         hf mfu setpwd 000102030405060708090a0b0c0d0e0f");
+    PrintAndLogEx(NORMAL, _YELLOW_("         hf mfu setpwd 000102030405060708090a0b0c0d0e0f"));
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
@@ -186,10 +196,11 @@ static int usage_hf_mfu_ucsetpwd(void) {
 static int usage_hf_mfu_ucsetuid(void) {
     PrintAndLogEx(NORMAL, "Usage:  hf mfu setuid <uid (14 hex symbols)>");
     PrintAndLogEx(NORMAL, "       [uid] - (14 hex symbols)");
-    PrintAndLogEx(NORMAL, "\nThis only works for Magic Ultralight tags.");
+    PrintAndLogEx(NORMAL, "\n");
+    PrintAndLogEx(NORMAL, "This only works for " _BLUE_("Magic Ultralight") "tags.");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "         hf mfu setuid 11223344556677");
+    PrintAndLogEx(NORMAL, _YELLOW_("         hf mfu setuid 11223344556677"));
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
@@ -201,8 +212,8 @@ static int usage_hf_mfu_gendiverse(void) {
     PrintAndLogEx(NORMAL, "    r       : read uid from tag");
     PrintAndLogEx(NORMAL, "    <uid>   : 4 byte UID (optional)");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        hf mfu gen r");
-    PrintAndLogEx(NORMAL, "        hf mfu gen 11223344");
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu gen r"));
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu gen 11223344"));
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
@@ -215,20 +226,21 @@ static int usage_hf_mfu_pwdgen(void) {
     PrintAndLogEx(NORMAL, "    r       : read uid from tag");
     PrintAndLogEx(NORMAL, "    <uid>   : 7 byte UID (optional)");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        hf mfu pwdgen r");
-    PrintAndLogEx(NORMAL, "        hf mfu pwdgen 11223344556677");
-    PrintAndLogEx(NORMAL, "        hf mfu pwdgen t");
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu pwdgen r"));
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu pwdgen 11223344556677"));
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu pwdgen t"));
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
 static int usage_hf_mfu_otp_tearoff(void) {
-    PrintAndLogEx(NORMAL, "Tear-off test against OTP block on MFU tags - More help sooner or later\n");
+    PrintAndLogEx(NORMAL, "Tear-off test against OTP block on MFU tags.");
     PrintAndLogEx(NORMAL, "Usage:  hf mfu otptear [h]");
     PrintAndLogEx(NORMAL, "Options:");
     PrintAndLogEx(NORMAL, "    h       : this help");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        hf mfu otptear");
+    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu otptear"));
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
@@ -284,26 +296,6 @@ uint8_t UL_MEMORY_ARRAY[ARRAYLEN(UL_TYPES_ARRAY)] = {
     MAX_ULEV1a_BLOCKS, MAX_NTAG_213,  MAX_NTAG_216,   MAX_UL_NANO_40,    MAX_NTAG_I2C_1K
 };
 
-static int ul_ev1_pwdgen_selftest() {
-
-    uint8_t uid1[] = {0x04, 0x11, 0x12, 0x11, 0x12, 0x11, 0x10};
-    uint32_t pwd1 = ul_ev1_pwdgenA(uid1);
-    PrintAndLogEx(NORMAL, "UID | %s | %08X | %s", sprint_hex(uid1, 7), pwd1, (pwd1 == 0x8432EB17) ? "OK" : "->8432EB17<-");
-
-    uint8_t uid2[] = {0x04, 0x1f, 0x98, 0xea, 0x1e, 0x3e, 0x81};
-    uint32_t pwd2 = ul_ev1_pwdgenB(uid2);
-    PrintAndLogEx(NORMAL, "UID | %s | %08X | %s", sprint_hex(uid2, 7), pwd2, (pwd2 == 0x5fd37eca) ? "OK" : "->5fd37eca<--");
-
-    uint8_t uid3[] = {0x04, 0x62, 0xB6, 0x8A, 0xB4, 0x42, 0x80};
-    uint32_t pwd3 = ul_ev1_pwdgenC(uid3);
-    PrintAndLogEx(NORMAL, "UID | %s | %08X | %s", sprint_hex(uid3, 7), pwd3, (pwd3 == 0x5a349515) ? "OK" : "->5a349515<--");
-
-    uint8_t uid4[] = {0x04, 0xC5, 0xDF, 0x4A, 0x6D, 0x51, 0x80};
-    uint32_t pwd4 = ul_ev1_pwdgenD(uid4);
-    PrintAndLogEx(NORMAL, "UID | %s | %08X | %s", sprint_hex(uid4, 7), pwd4, (pwd4 == 0x72B1EC61) ? "OK" : "->72B1EC61<--");
-    return PM3_SUCCESS;
-}
-
 //------------------------------------
 // get version nxp product type
 static char *getProductTypeStr(uint8_t id) {
@@ -527,43 +519,43 @@ static int ul_print_default(uint8_t *data) {
     uid[5] = data[6];
     uid[6] = data[7];
 
-    PrintAndLogEx(NORMAL, "       UID : %s ", sprint_hex(uid, 7));
-    PrintAndLogEx(NORMAL, "    UID[0] : %02X, %s",  uid[0], getTagInfo(uid[0]));
+    PrintAndLogEx(SUCCESS, "       UID: " _GREEN_("%s"), sprint_hex(uid, 7));
+    PrintAndLogEx(SUCCESS, "    UID[0]: %02X, %s",  uid[0], getTagInfo(uid[0]));
     if (uid[0] == 0x05 && ((uid[1] & 0xf0) >> 4) == 2) {   // is infineon and 66RxxP
         uint8_t chip = (data[8] & 0xC7); // 11000111  mask, bit 3,4,5 RFU
         switch (chip) {
             case 0xC2:
-                PrintAndLogEx(NORMAL, "   IC type : SLE 66R04P 770 Bytes");
+                PrintAndLogEx(SUCCESS, "   IC type: SLE 66R04P 770 Bytes");
                 break; //77 pages
             case 0xC4:
-                PrintAndLogEx(NORMAL, "   IC type : SLE 66R16P 2560 Bytes");
+                PrintAndLogEx(SUCCESS, "   IC type: SLE 66R16P 2560 Bytes");
                 break; //256 pages
             case 0xC6:
-                PrintAndLogEx(NORMAL, "   IC type : SLE 66R32P 5120 Bytes");
+                PrintAndLogEx(SUCCESS, "   IC type: SLE 66R32P 5120 Bytes");
                 break; //512 pages /2 sectors
         }
     }
     // CT (cascade tag byte) 0x88 xor SN0 xor SN1 xor SN2
     int crc0 = 0x88 ^ uid[0] ^ uid[1] ^ uid[2];
     if (data[3] == crc0)
-        PrintAndLogEx(NORMAL, "      BCC0 : %02X, Ok", data[3]);
+        PrintAndLogEx(SUCCESS, "      BCC0: %02X ( " _GREEN_("ok") ")", data[3]);
     else
         PrintAndLogEx(NORMAL, "      BCC0: %02X, crc should be %02X", data[3], crc0);
 
     int crc1 = uid[3] ^ uid[4] ^ uid[5] ^ uid[6];
     if (data[8] == crc1)
-        PrintAndLogEx(NORMAL, "      BCC1 : %02X, Ok", data[8]);
+        PrintAndLogEx(SUCCESS, "      BCC1: %02X ( " _GREEN_("ok") ")", data[8]);
     else
         PrintAndLogEx(NORMAL, "      BCC1: %02X, crc should be %02X", data[8], crc1);
 
-    PrintAndLogEx(NORMAL, "  Internal : %02X, %sdefault", data[9], (data[9] == 0x48) ? "" : "not ");
+    PrintAndLogEx(SUCCESS, "  Internal: %02X ( %s)", data[9], (data[9] == 0x48) ? _GREEN_("default") : _RED_("not default") );
 
-    PrintAndLogEx(NORMAL, "      Lock : %s - %s",
+    PrintAndLogEx(SUCCESS, "      Lock: %s - %s",
                   sprint_hex(data + 10, 2),
                   sprint_bin(data + 10, 2)
                  );
 
-    PrintAndLogEx(NORMAL, "OneTimePad : %s - %s\n",
+    PrintAndLogEx(SUCCESS, "OneTimePad : %s - %s\n",
                   sprint_hex(data + 12, 4),
                   sprint_bin(data + 12, 4)
                  );
@@ -648,10 +640,10 @@ static int ndef_print_CC(uint8_t *data) {
     PrintAndLogEx(NORMAL, "  Additional feature information");
     PrintAndLogEx(NORMAL, "  %02X", data[3]);
     PrintAndLogEx(NORMAL, "  00000000");
-    PrintAndLogEx(NORMAL, "  xxx      - %02X : RFU (%s)", msb3, (msb3 == 0) ? _GREEN_("OK") : _RED_("Fail"));
+    PrintAndLogEx(NORMAL, "  xxx      - %02X : RFU ( %s)", msb3, (msb3 == 0) ? _GREEN_("ok") : _RED_("fail"));
     PrintAndLogEx(NORMAL, "     x     - %02X : %s special frame", sf, (sf) ? "support" : "don\'t support");
     PrintAndLogEx(NORMAL, "      x    - %02X : %s lock block", lb, (lb) ? "support" : "don\'t support");
-    PrintAndLogEx(NORMAL, "       xx  - %02X : RFU (%s)", mlrule, (mlrule == 0) ? _GREEN_("OK") : _RED_("Fail"));
+    PrintAndLogEx(NORMAL, "       xx  - %02X : RFU ( %s)", mlrule, (mlrule == 0) ? _GREEN_("ok") : _RED_("fail"));
     PrintAndLogEx(NORMAL, "         x - %02X : IC %s multiple block reads", mbread, (mbread) ? "support" : "don\'t support");
     return PM3_SUCCESS;
 }
@@ -667,57 +659,57 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces) {
     char *spacer = spc + (10 - spaces);
 
     if (tagtype & UL)
-        PrintAndLogEx(NORMAL, "%sTYPE : MIFARE Ultralight (MF0ICU1) %s", spacer, (tagtype & MAGIC) ? "<magic>" : "");
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("MIFARE Ultralight (MF0ICU1) %s"), spacer, (tagtype & MAGIC) ? "<magic>" : "");
     else if (tagtype & UL_C)
-        PrintAndLogEx(NORMAL, "%sTYPE : MIFARE Ultralight C (MF0ULC) %s", spacer, (tagtype & MAGIC) ? "<magic>" : "");
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("MIFARE Ultralight C (MF0ULC) %s"), spacer, (tagtype & MAGIC) ? "<magic>" : "");
     else if (tagtype & UL_NANO_40)
-        PrintAndLogEx(NORMAL, "%sTYPE : MIFARE Ultralight Nano 40bytes (MF0UNH00)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("MIFARE Ultralight Nano 40bytes (MF0UNH00)"), spacer);
     else if (tagtype & UL_EV1_48)
-        PrintAndLogEx(NORMAL, "%sTYPE : MIFARE Ultralight EV1 48bytes (MF0UL1101)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("MIFARE Ultralight EV1 48bytes (MF0UL1101)"), spacer);
     else if (tagtype & UL_EV1_128)
-        PrintAndLogEx(NORMAL, "%sTYPE : MIFARE Ultralight EV1 128bytes (MF0UL2101)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("MIFARE Ultralight EV1 128bytes (MF0UL2101)"), spacer);
     else if (tagtype & UL_EV1)
-        PrintAndLogEx(NORMAL, "%sTYPE : MIFARE Ultralight EV1 UNKNOWN", spacer);
+        PrintAndLogEx(NORMAL, "%sTYPE: " _YELLOW_("MIFARE Ultralight EV1 UNKNOWN"), spacer);
     else if (tagtype & NTAG)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG UNKNOWN", spacer);
+        PrintAndLogEx(NORMAL, "%sTYPE: " _YELLOW_("NTAG UNKNOWN"), spacer);
     else if (tagtype & NTAG_203)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 203 144bytes (NT2H0301F0DT)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 203 144bytes (NT2H0301F0DT)"), spacer);
     else if (tagtype & NTAG_210)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 210 48bytes (NT2L1011G0DU)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 210 48bytes (NT2L1011G0DU)"), spacer);
     else if (tagtype & NTAG_212)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 212 128bytes (NT2L1211G0DU)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 212 128bytes (NT2L1211G0DU)"), spacer);
     else if (tagtype & NTAG_213)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 213 144bytes (NT2H1311G0DU)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 213 144bytes (NT2H1311G0DU)"), spacer);
     else if (tagtype & NTAG_213_F)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 213F 144bytes (NT2H1311F0DTL)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 213F 144bytes (NT2H1311F0DTL)"), spacer);
     else if (tagtype & NTAG_215)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 215 504bytes (NT2H1511G0DU)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 215 504bytes (NT2H1511G0DU)"), spacer);
     else if (tagtype & NTAG_216)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 216 888bytes (NT2H1611G0DU)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 216 888bytes (NT2H1611G0DU)"), spacer);
     else if (tagtype & NTAG_216_F)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG 216F 888bytes (NT2H1611F0DTL)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG 216F 888bytes (NT2H1611F0DTL)"), spacer);
     else if (tagtype & NTAG_I2C_1K)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG I2C 888bytes (NT3H1101FHK)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG I2C 888bytes (NT3H1101FHK)"), spacer);
     else if (tagtype & NTAG_I2C_2K)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG I2C 1904bytes (NT3H1201FHK)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG I2C 1904bytes (NT3H1201FHK)"), spacer);
     else if (tagtype & NTAG_I2C_1K_PLUS)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG I2C plus 888bytes (NT3H2111FHK)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG I2C plus 888bytes (NT3H2111FHK)"), spacer);
     else if (tagtype & NTAG_I2C_2K_PLUS)
-        PrintAndLogEx(NORMAL, "%sTYPE : NTAG I2C plus 1912bytes (NT3H2211FHK)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("NTAG I2C plus 1912bytes (NT3H2211FHK)"), spacer);
     else if (tagtype & MY_D)
-        PrintAndLogEx(NORMAL, "%sTYPE : INFINEON my-d\x99 (SLE 66RxxS)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("INFINEON my-d\x99 (SLE 66RxxS)"), spacer);
     else if (tagtype & MY_D_NFC)
-        PrintAndLogEx(NORMAL, "%sTYPE : INFINEON my-d\x99 NFC (SLE 66RxxP)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("INFINEON my-d\x99 NFC (SLE 66RxxP)"), spacer);
     else if (tagtype & MY_D_MOVE)
-        PrintAndLogEx(NORMAL, "%sTYPE : INFINEON my-d\x99 move (SLE 66R01P)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("INFINEON my-d\x99 move (SLE 66R01P)"), spacer);
     else if (tagtype & MY_D_MOVE_NFC)
-        PrintAndLogEx(NORMAL, "%sTYPE : INFINEON my-d\x99 move NFC (SLE 66R01P)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("INFINEON my-d\x99 move NFC (SLE 66R01P)"), spacer);
     else if (tagtype & MY_D_MOVE_LEAN)
-        PrintAndLogEx(NORMAL, "%sTYPE : INFINEON my-d\x99 move lean (SLE 66R01L)", spacer);
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("INFINEON my-d\x99 move lean (SLE 66R01L)"), spacer);
     else if (tagtype & FUDAN_UL)
-        PrintAndLogEx(NORMAL, "%sTYPE : FUDAN Ultralight Compatible (or other compatible) %s", spacer, (tagtype & MAGIC) ? "<magic>" : "");
+        PrintAndLogEx(SUCCESS, "%sTYPE: " _YELLOW_("FUDAN Ultralight Compatible (or other compatible) %s"), spacer, (tagtype & MAGIC) ? "<magic>" : "");
     else
-        PrintAndLogEx(NORMAL, "%sTYPE : Unknown %06x", spacer, tagtype);
+        PrintAndLogEx(NORMAL, "%sTYPE: " _YELLOW_("Unknown %06x"), spacer, tagtype);
     return PM3_SUCCESS;
 }
 
@@ -845,7 +837,7 @@ static int ulev1_print_configuration(uint32_t tagtype, uint8_t *data, uint8_t st
     if (authlim == 0)
         PrintAndLogEx(NORMAL, "                    - Unlimited password attempts");
     else
-        PrintAndLogEx(NORMAL, "                    - Max number of password attempts is %d", authlim);
+        PrintAndLogEx(NORMAL, "                    - Max number of password attempts is " _YELLOW_("%d"), authlim);
 
     PrintAndLogEx(NORMAL, "                    - NFC counter %s", (nfc_cnf_en) ? "enabled" : "disabled");
     PrintAndLogEx(NORMAL, "                    - NFC counter %s", (nfc_cnf_prot_pwd) ? "not protected" : "password protection enabled");
@@ -883,12 +875,12 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     int res = ecdsa_signature_r_s_verify(MBEDTLS_ECP_DP_SECP128R1, public_keys[public_key], uid, 7, signature, signature_len, false);
     bool is_valid = (res == 0);
 
-    PrintAndLogEx(NORMAL, "\n--- Tag Signature");
-    PrintAndLogEx(NORMAL, "IC signature public key name  : NXP NTAG21x (2013)");
-    PrintAndLogEx(NORMAL, "IC signature public key value : %s", sprint_hex(public_keys[public_key], PUBLIC_ECDA_KEYLEN));
-    PrintAndLogEx(NORMAL, "    Elliptic curve parameters : NID_secp128r1");
-    PrintAndLogEx(NORMAL, "             TAG IC Signature : %s", sprint_hex(signature, signature_len));
-    PrintAndLogEx(NORMAL, "Signature verified %s", (is_valid) ? _GREEN_("successful") : _RED_("failed"));
+    PrintAndLogEx(INFO, "\n--- Tag Signature");
+    PrintAndLogEx(INFO, "IC signature public key name  : NXP NTAG21x (2013)");
+    PrintAndLogEx(INFO, "IC signature public key value : %s", sprint_hex(public_keys[public_key], PUBLIC_ECDA_KEYLEN));
+    PrintAndLogEx(INFO, "    Elliptic curve parameters : NID_secp128r1");
+    PrintAndLogEx(INFO, "             TAG IC Signature : %s", sprint_hex(signature, signature_len));
+    PrintAndLogEx(SUCCESS, "Signature verified %s", (is_valid) ? _GREEN_("successful") : _RED_("failed"));
     return PM3_SUCCESS;
 }
 
@@ -1110,7 +1102,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
                 cmdp++;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
                 errors = true;
                 break;
         }
@@ -1271,7 +1263,8 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
         // 1-7 = limit. No automatic tries then.
         // hasAuthKey,  if we was called with key, skip test.
         if (!authlim && !hasAuthKey) {
-            PrintAndLogEx(NORMAL, "\n--- Known EV1/NTAG passwords.");
+            PrintAndLogEx(NORMAL, "");
+            PrintAndLogEx(SUCCESS, _GREEN_("--- Known EV1/NTAG passwords ---"));
             // test pwd gen A
             num_to_bytes(ul_ev1_pwdgenA(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
@@ -1322,7 +1315,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
                     if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
                 }
             }
-            if (len < 1) PrintAndLogEx(WARNING, "password not known");
+            if (len < 1) PrintAndLogEx(WARNING, _YELLOW_("password not known"));
         }
     }
 out:
@@ -1395,7 +1388,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
                 cmdp += 2;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
                 errors = true;
                 break;
         }
@@ -1509,7 +1502,7 @@ static int CmdHF14AMfURdBl(const char *Cmd) {
                 cmdp++;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
                 errors = true;
                 break;
         }
@@ -1779,7 +1772,7 @@ static int CmdHF14AMfUDump(const char *Cmd) {
                 manualPages = true;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
                 errors = true;
                 break;
         }
@@ -2020,7 +2013,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
                 read_key = true;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
                 errors = true;
                 break;
         }
@@ -2565,7 +2558,7 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
     char cmdp = tolower(param_getchar(Cmd, 0));
     if (strlen(Cmd) == 0  || cmdp == 'h') return usage_hf_mfu_pwdgen();
 
-    if (cmdp == 't') return ul_ev1_pwdgen_selftest();
+    if (cmdp == 't') return generator_selftest();
 
     if (cmdp == 'r') {
         // read uid from tag
@@ -2671,4 +2664,3 @@ int CmdHFMFUltra(const char *Cmd) {
     clearCommandBuffer();
     return CmdsParse(CommandTable, Cmd);
 }
-

client/cmdlf.c

@@ -253,7 +253,7 @@ static int CmdLFTune(const char *Cmd) {
     //Validations
     if (errors) return usage_lf_tune();
 
-    PrintAndLogEx(SUCCESS, "Measuring LF antenna at " _YELLOW_("%.2f") "kHz, click " _GREEN_("pm3 button") "or press " _GREEN_("Enter") "to exit", LF_DIV2FREQ(divisor));
+    PrintAndLogEx(INFO, "Measuring LF antenna at " _YELLOW_("%.2f") "kHz, click " _GREEN_("pm3 button") "or press " _GREEN_("Enter") "to exit", LF_DIV2FREQ(divisor));
 
     uint8_t params[] = {1, 0};
     params[1] = divisor;
@@ -295,7 +295,7 @@ static int CmdLFTune(const char *Cmd) {
         return PM3_ETIMEOUT;
     }
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(SUCCESS, "Done.");
+    PrintAndLogEx(INFO, "Done.");
     return PM3_SUCCESS;
 }
 
@@ -1189,7 +1189,7 @@ static bool CheckChipType(bool getDeviceData) {
     uint32_t word = 0;
     if (EM4x05IsBlock0(&word)) {
         PrintAndLogEx(SUCCESS, "Chipset detection: " _GREEN_("EM4x05/EM4x69"));
-        PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf em 4x05`") "commands");
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 4x05`") "commands");
         retval = true;
         goto out;
     }
@@ -1197,7 +1197,7 @@ static bool CheckChipType(bool getDeviceData) {
     //check for t55xx chip...
     if (tryDetectP1(true)) {
         PrintAndLogEx(SUCCESS, "Chipset detection: " _GREEN_("T55xx"));
-        PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf t55xx`") "commands");
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf t55xx`") "commands");
         retval = true;
     }
 
@@ -1351,7 +1351,7 @@ static command_t CommandTable[] = {
     {"fdx",         CmdLFFdx,           AlwaysAvailable, "{ FDX-B RFIDs...             }"},
     {"gallagher",   CmdLFGallagher,     AlwaysAvailable, "{ GALLAGHER RFIDs...         }"},
     {"gproxii",     CmdLFGuard,         AlwaysAvailable, "{ Guardall Prox II RFIDs...  }"},
-    {"hid",         CmdLFHID,           AlwaysAvailable, "{ HID RFIDs...               }"},
+    {"hid",         CmdLFHID,           AlwaysAvailable, "{ HID Prox RFIDs...          }"},
     {"hitag",       CmdLFHitag,         AlwaysAvailable, "{ Hitag CHIPs...             }"},
     {"indala",      CmdLFINDALA,        AlwaysAvailable, "{ Indala RFIDs...            }"},
     {"io",          CmdLFIO,            AlwaysAvailable, "{ ioProx RFIDs...            }"},

client/cmdlfawid.c

@@ -424,7 +424,7 @@ static int CmdAWIDClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf awid read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf awid read`") "to verify");
     return res;
 }
 

client/cmdlfem4x.c

@@ -701,7 +701,7 @@ static int CmdEM410xWrite(const char *Cmd) {
 
     SendCommandMIX(CMD_LF_EM410X_WRITE, card, (uint32_t)(id >> 32), (uint32_t)id, NULL, 0);
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf em 410x_read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 410x_read`") "to verify");
     return PM3_SUCCESS;
 }
 
@@ -1041,7 +1041,7 @@ static int CmdEM4x50Write(const char *Cmd) {
     PrintAndLogEx(NORMAL, "no implemented yet");
 //
 //    PrintAndLogEx(SUCCESS, "Done");
-//    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf em 4x50_read`") "to verify");    
+//    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 4x50_read`") "to verify");
     return PM3_SUCCESS;
 }
 
@@ -1442,7 +1442,7 @@ static int CmdEM4x05Write(const char *Cmd) {
         PrintAndLogEx(SUCCESS, "Success writing to tag");
 
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf em 4x05_read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 4x05_read`") "to verify");
     return status;
 }
 static int CmdEM4x05Wipe(const char *Cmd) {

client/cmdlffdx.c

@@ -303,7 +303,7 @@ static int CmdFdxClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf fdx read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf fdx read`") "to verify");
     return res;
 }
 

client/cmdlfgallagher.c

@@ -180,7 +180,7 @@ static int CmdGallagherClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf gallagher read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf gallagher read`") "to verify");
     return res;
 }
 

client/cmdlfguard.c

@@ -187,7 +187,10 @@ static int CmdGuardClone(const char *Cmd) {
     PrintAndLogEx(INFO, "Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
     print_blocks(blocks,  ARRAYLEN(blocks));
 
-    return clone_t55xx_tag(blocks, ARRAYLEN(blocks));
+    int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
+    PrintAndLogEx(SUCCESS, "Done");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf gprox read`") "to verify");
+    return res;
 }
 
 static int CmdGuardSim(const char *Cmd) {

client/cmdlfhid.c

@@ -50,7 +50,7 @@ static int usage_lf_hid_watch(void) {
     PrintAndLogEx(NORMAL, "Usage:  lf hid watch");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf hid watch");
+    PrintAndLogEx(NORMAL, _YELLOW_("        lf hid watch"));
     return PM3_SUCCESS;
 }
 static int usage_lf_hid_sim(void) {
@@ -62,11 +62,11 @@ static int usage_lf_hid_sim(void) {
     PrintAndLogEx(NORMAL, "       h   - This help");
     PrintAndLogEx(NORMAL, "       ID  - HID id");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf hid sim 2006ec0c86");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf hid sim 2006ec0c86"));
     return PM3_SUCCESS;
 }
 static int usage_lf_hid_clone(void) {
-    PrintAndLogEx(NORMAL, "Clone HID to T55x7.  Tag must be on antenna. ");
+    PrintAndLogEx(NORMAL, "Clone HID to T55x7. " _BLUE_("Tag must be on antenna!"));
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Usage:  lf hid clone [h] [l] ID");
     PrintAndLogEx(NORMAL, "Options:");
@@ -74,8 +74,8 @@ static int usage_lf_hid_clone(void) {
     PrintAndLogEx(NORMAL, "       l   - 84bit ID");
     PrintAndLogEx(NORMAL, "       ID  - HID id");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf hid clone 2006ec0c86");
-    PrintAndLogEx(NORMAL, "      lf hid clone l 2006ec0c86");
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf hid clone 2006ec0c86"));
+    PrintAndLogEx(NORMAL, _YELLOW_("      lf hid clone l 2006ec0c86"));
     return PM3_SUCCESS;
 }
 static int usage_lf_hid_brute(void) {
@@ -97,9 +97,9 @@ static int usage_lf_hid_brute(void) {
     PrintAndLogEx(NORMAL, "       down              :  direction to decrement card number. (default is both directions)");
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "       lf hid brute w H10301 f 224");
-    PrintAndLogEx(NORMAL, "       lf hid brute w H10301 f 21 d 2000");
-    PrintAndLogEx(NORMAL, "       lf hid brute v w H10301 f 21 c 200 d 2000");
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf hid brute w H10301 f 224"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf hid brute w H10301 f 21 d 2000"));
+    PrintAndLogEx(NORMAL, _YELLOW_("       lf hid brute v w H10301 f 21 c 200 d 2000"));
     return PM3_SUCCESS;
 }
 
@@ -162,7 +162,7 @@ static int CmdHIDDemod(const char *Cmd) {
     uint8_t bits[GraphTraceLen];
     size_t size = getFromGraphBuf(bits);
     if (size == 0) {
-        PrintAndLogEx(DEBUG, "DEBUG: Error - HID not enough samples");
+        PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID not enough samples"));
         return PM3_ESOFT;
     }
     //get binary from fsk wave
@@ -171,17 +171,17 @@ static int CmdHIDDemod(const char *Cmd) {
     if (idx < 0) {
 
         if (idx == -1)
-            PrintAndLogEx(DEBUG, "DEBUG: Error - HID not enough samples");
+            PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID not enough samples"));
         else if (idx == -2)
-            PrintAndLogEx(DEBUG, "DEBUG: Error - HID just noise detected");
+            PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID just noise detected"));
         else if (idx == -3)
-            PrintAndLogEx(DEBUG, "DEBUG: Error - HID problem during FSK demod");
+            PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID problem during FSK demod"));
         else if (idx == -4)
-            PrintAndLogEx(DEBUG, "DEBUG: Error - HID preamble not found");
+            PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID preamble not found"));
         else if (idx == -5)
-            PrintAndLogEx(DEBUG, "DEBUG: Error - HID error in Manchester data, size %zu", size);
+            PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID error in Manchester data, size %zu"), size);
         else
-            PrintAndLogEx(DEBUG, "DEBUG: Error - HID error demoding fsk %d", idx);
+            PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID error demoding fsk %d"), idx);
 
         return PM3_ESOFT;
     }
@@ -190,12 +190,12 @@ static int CmdHIDDemod(const char *Cmd) {
     setClockGrid(50, waveIdx + (idx * 50));
 
     if (hi2 == 0 && hi == 0 && lo == 0) {
-        PrintAndLogEx(DEBUG, "DEBUG: Error - HID no values found");
+        PrintAndLogEx(DEBUG, "DEBUG: Error - " _RED_("HID no values found"));
         return PM3_ESOFT;
     }
 
     if (hi2 != 0) { //extra large HID tags
-        PrintAndLogEx(SUCCESS, "HID Prox TAG ID: %x%08x%08x (%u)", hi2, hi, lo, (lo >> 1) & 0xFFFF);
+        PrintAndLogEx(SUCCESS, "HID Prox TAG ID: " _GREEN_("%x%08x%08x (%u)"), hi2, hi, lo, (lo >> 1) & 0xFFFF);
     } else {  //standard HID tags <38 bits
         uint8_t fmtLen = 0;
         uint32_t cc = 0;
@@ -241,9 +241,9 @@ static int CmdHIDDemod(const char *Cmd) {
             fc = ((hi & 0xF) << 12) | (lo >> 20);
         }
         if (fmtLen == 32 && (lo & 0x40000000)) { //if 32 bit and Kastle bit set
-            PrintAndLogEx(SUCCESS, "HID Prox TAG (Kastle format) ID: %x%08x (%u) - Format Len: 32bit - CC: %u - FC: %u - Card: %u", hi, lo, (lo >> 1) & 0xFFFF, cc, fc, cardnum);
+            PrintAndLogEx(SUCCESS, "HID Prox TAG (Kastle format) ID: " _GREEN_("%x%08x (%u)")"- Format Len: 32bit - CC: %u - FC: %u - Card: %u", hi, lo, (lo >> 1) & 0xFFFF, cc, fc, cardnum);
         } else {
-            PrintAndLogEx(SUCCESS, "HID Prox TAG ID: %x%08x (%u) - Format Len: %ubit - OEM: %03u - FC: %u - Card: %u",
+            PrintAndLogEx(SUCCESS, "HID Prox TAG ID: " _GREEN_("%x%08x (%u)")"- Format Len: " _GREEN_("%u bit")"- OEM: %03u - FC: " _GREEN_("%u")"- Card: " _GREEN_("%u"),
                           hi, lo, cardnum, fmtLen, oem, fc, cardnum);
         }
     }
@@ -268,6 +268,8 @@ static int CmdHIDWatch(const char *Cmd) {
     if (ctmp == 'h') return usage_lf_hid_watch();
     clearCommandBuffer();
     SendCommandNG(CMD_LF_HID_DEMOD, NULL, 0);
+    PrintAndLogEx(SUCCESS, "Watching for new HID cards - place tag on antenna");
+    PrintAndLogEx(INFO, "Press pm3-button to stop reading new cards");
     return PM3_SUCCESS;
 }
 
@@ -288,18 +290,18 @@ static int CmdHIDSim(const char *Cmd) {
             lo = (lo << 4) | (n & 0xf);
         }
 
-        PrintAndLogEx(INFO, "Simulating HID tag with long ID %x%08x%08x", hi2, hi, lo);
+        PrintAndLogEx(INFO, "Simulating HID tag with long ID: " _GREEN_("%x%08x%08x"), hi2, hi, lo);
         payload.longFMT = 1;
     } else {
         while (sscanf(&Cmd[i++], "%1x", &n) == 1) {
             hi = (hi << 4) | (lo >> 28);
             lo = (lo << 4) | (n & 0xf);
         }
-        PrintAndLogEx(SUCCESS, "Simulating HID tag with ID %x%08x", hi, lo);
+        PrintAndLogEx(SUCCESS, "Simulating HID tag with ID: " _GREEN_("%x%08x"), hi, lo);
         hi2 = 0;
     }
 
-    PrintAndLogEx(SUCCESS, "Press pm3-button to abort simulation");
+    PrintAndLogEx(INFO, "Press pm3-button to abort simulation");
 
     payload.hi2 = hi2;
     payload.hi = hi;
@@ -331,7 +333,7 @@ static int CmdHIDClone(const char *Cmd) {
             lo = (lo << 4) | (n & 0xf);
         }
 
-        PrintAndLogEx(INFO, "Preparing to clone HID tag with long ID %x%08x%08x", hi2, hi, lo);
+        PrintAndLogEx(INFO, "Preparing to clone HID tag with long ID: " _GREEN_("%x%08x%08x"), hi2, hi, lo);
 
         longid[0] = 1;
     } else {
@@ -339,14 +341,14 @@ static int CmdHIDClone(const char *Cmd) {
             hi = (hi << 4) | (lo >> 28);
             lo = (lo << 4) | (n & 0xf);
         }
-        PrintAndLogEx(INFO, "Preparing to clone HID tag with ID %x%08x", hi, lo);
+        PrintAndLogEx(INFO, "Preparing to clone HID tag with ID: " _GREEN_("%x%08x"), hi, lo);
         hi2 = 0;
     }
 
     clearCommandBuffer();
     SendCommandMIX(CMD_LF_HID_CLONE, hi2, hi, lo, longid, sizeof(longid));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf hid read`") "to verify");   
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf hid read`") "to verify");
     return PM3_SUCCESS;
 }
 
@@ -400,7 +402,7 @@ static int CmdHIDBrute(const char *Cmd) {
                 param_getstr(Cmd, cmdp + 1, format, sizeof(format));
                 format_idx = HIDFindCardFormat(format);
                 if (format_idx == -1) {
-                    PrintAndLogEx(WARNING, "Unknown format: %s", format);
+                    PrintAndLogEx(WARNING, "Unknown format: " _YELLOW_("%s"), format);
                     errors = true;
                 }
                 cmdp += 2;
@@ -431,7 +433,7 @@ static int CmdHIDBrute(const char *Cmd) {
                 cmdp++;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
+                PrintAndLogEx(WARNING, "Unknown parameter: " _YELLOW_("'%c'"), param_getchar(Cmd, cmdp));
                 errors = true;
                 break;
         }
@@ -460,7 +462,8 @@ static int CmdHIDBrute(const char *Cmd) {
             case 2:
                 PrintAndLogEx(INFO, "Brute-forcing direction: " _YELLOW_("DOWN"));
                 break;
-            default: break;
+            default:
+                break;
         }
     }
     PrintAndLogEx(INFO, "Brute-forcing HID reader");
@@ -518,7 +521,8 @@ static int CmdHIDBrute(const char *Cmd) {
             case 2:
                 exitloop = fin_low;
                 break;
-            default: break;
+            default:
+                break;
         }
 
     } while (exitloop == false);

client/cmdlfindala.c

@@ -28,6 +28,8 @@
 #include "protocols.h"  // t55 defines
 #include "cmdlft55xx.h" // verifywrite
 
+#define INDALA_ARR_LEN 64
+
 static int CmdHelp(const char *Cmd);
 
 //large 224 bit indala formats (different preamble too...)
@@ -140,7 +142,7 @@ static void decodeHeden2L(uint8_t *bits) {
     if (bits[offset +  7]) cardnumber += 16384;
     if (bits[offset + 23]) cardnumber += 32768;
 
-    PrintAndLogEx(SUCCESS, "\tHeden-2L    | %u", cardnumber);
+    PrintAndLogEx(SUCCESS, "\tHeden-2L    | " _YELLOW_("%u"), cardnumber);
 }
 
 // Indala 26 bit decode
@@ -192,7 +194,7 @@ static int CmdIndalaDemod(const char *Cmd) {
     if (DemodBufferLen == 64) {
         PrintAndLogEx(
             SUCCESS
-            , "Indala Found - bitlength %zu, Raw %x%08x"
+            , "Indala Found - bitlength %zu, Raw " _YELLOW_("%x%08x")
             , DemodBufferLen
             , uid1
             , uid2
@@ -244,14 +246,18 @@ static int CmdIndalaDemod(const char *Cmd) {
         checksum |= DemodBuffer[63] << 0; // b1
 
         PrintAndLogEx(NORMAL, "");
+        PrintAndLogEx(SUCCESS, "Fmt 26 bit FC " _YELLOW_("%u") ", CN " _YELLOW_("%u") ", checksum " _YELLOW_("%1d%1d")
+                      , fc
+                      , csn
+                      , checksum >> 1 & 0x01
+                      , checksum & 0x01
+                     );
+
         PrintAndLogEx(SUCCESS, "Possible de-scramble patterns");
         PrintAndLogEx(SUCCESS, "\tPrinted     | __%04d__ [0x%X]", p1, p1);
         PrintAndLogEx(SUCCESS, "\tInternal ID | %" PRIu64, foo);
         decodeHeden2L(DemodBuffer);
 
-        PrintAndLogEx(SUCCESS, "Fmt 26 bit  FC %u , CSN %u , checksum %1d%1d", fc, csn, checksum >> 1 & 0x01, checksum & 0x01);
-
-
     } else {
         uint32_t uid3 = bytebits_to_byte(DemodBuffer + 64, 32);
         uint32_t uid4 = bytebits_to_byte(DemodBuffer + 96, 32);
@@ -499,6 +505,7 @@ static int CmdIndalaSim(const char *Cmd) {
     uint8_t hexuid[100];
     int len = 0;
     param_gethex_ex(Cmd, 0, hexuid, &len);
+
     if (len > 28)
         return usage_lf_indala_sim();
 
@@ -542,49 +549,62 @@ static int CmdIndalaSim(const char *Cmd) {
 
 static int CmdIndalaClone(const char *Cmd) {
 
-    bool is_long_uid = false, got_cn = false;
+    bool is_long_uid = false, got_cn = false, got_26 = false;
     bool is_t5555 = false;
     int32_t cardnumber;
     uint32_t blocks[8] = {0};
     uint8_t max = 0;
     uint8_t data[7 * 4];
     int datalen = 0;
+    uint8_t fc = 0;
+    uint16_t cn = 0;
 
     CLIParserInit("lf indala clone",
                   "clone INDALA tag to T55x7 (or to q5/T5555)",
                   "Examples:\n"
-                  "\tlf indala clone -c 888\n"
+                  "\tlf indala clone --heden 888\n"
+                  "\tlf indala clone --fc 123 --cn 1337\n"
                   "\tlf indala clone -r a0000000a0002021\n"
                   "\tlf indala clone -l -r 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5");
 
     void *argtable[] = {
         arg_param_begin,
         arg_lit0("lL", "long",   "optional - long UID 224 bits"),
-        arg_int0("cC", "cn",   "<decimal>", "Cardnumber for Heden 2L format"),
+        arg_int0("cC", "heden",  "<decimal>", "Cardnumber for Heden 2L format"),
         arg_strx0("rR", "raw",   "<hex>", "raw bytes"),
         arg_lit0("qQ", "Q5",     "optional - specify write to Q5 (t5555 instead of t55x7)"),
+        arg_int0("", "fc",       "<decimal>", "Facility Code (26 bit format)"),
+        arg_int0("", "cn",      "<decimal>", "Cardnumber (26 bit format)"),
         arg_param_end
     };
     CLIExecWithReturn(Cmd, argtable, false);
 
     is_long_uid = arg_get_lit(1);
-    if (is_long_uid == false) {
-        cardnumber = arg_get_int_def(2, -1);
-        got_cn = (cardnumber != -1);
-    }
 
-    if (got_cn == false) {
+    // raw param
     CLIGetHexWithReturn(3, data, &datalen);
-    }
 
     is_t5555 = arg_get_lit(4);
 
+    if (is_long_uid == false) {
+
+        // Heden param
+        cardnumber = arg_get_int_def(2, -1);
+        got_cn = (cardnumber != -1);
+
+        // 26b FC/CN param
+        fc = arg_get_int_def(5, 0);
+        cn = arg_get_int_def(6, 0);
+        got_26 = (fc != 0 && cn != 0);
+    }
+
     CLIParserFree();
 
     if (is_long_uid) {
         // 224 BIT UID
         // config for Indala (RF/32;PSK2 with RF/2;Maxblock=7)
-        PrintAndLogEx(INFO, "Preparing to clone Indala 224bit tag with RawID %s", sprint_hex(data, datalen));
+        PrintAndLogEx(INFO, "Preparing to clone Indala 224bit tag");
+        PrintAndLogEx(INFO, "RawID %s", sprint_hex(data, datalen));
 
         if (is_t5555)
             blocks[0] = T5555_SET_BITRATE(32) | T5555_MODULATION_PSK2 | (7 << T5555_MAXBLOCK_SHIFT);
@@ -602,12 +622,41 @@ static int CmdIndalaClone(const char *Cmd) {
     } else {
         // 64 BIT UID
         if (got_cn) {
+            PrintAndLogEx(INFO, "Using Indala HEDEN cardnumber %u", cardnumber);
             encodeHeden2L(data, cardnumber);
             datalen = 8;
+        } else if (got_26) {
+
+            PrintAndLogEx(INFO, "Using Indala 26b FC %u CN %u", fc, cn);
+
+            // Used with the 26bit FC/CSN
+            uint8_t *bits = calloc(INDALA_ARR_LEN, sizeof(uint8_t));
+            if (bits == NULL) {
+                PrintAndLogEx(WARNING, "Failed to allocate memory");
+                return PM3_EMALLOC;
+            }
+
+            if (getIndalaBits(fc, cn, bits) != PM3_SUCCESS) {
+                PrintAndLogEx(ERR, "Error with tag bitstream generation.");
+                return PM3_ESOFT;
+            }
+
+            data[0] = bytebits_to_byte(bits, 8);
+            data[1] = bytebits_to_byte(bits + 8, 8);
+            data[2] = bytebits_to_byte(bits + 16, 8);
+            data[3] = bytebits_to_byte(bits + 24, 8);
+            data[4] = bytebits_to_byte(bits + 32, 8);
+            data[5] = bytebits_to_byte(bits + 40, 8);
+            data[6] = bytebits_to_byte(bits + 48, 8);
+            data[7] = bytebits_to_byte(bits + 56, 8);
+            datalen = 8;
+
+            free(bits);
         }
 
         // config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
-        PrintAndLogEx(INFO, "Preparing to clone Indala 64bit tag with RawID %s", sprint_hex(data, datalen));
+        PrintAndLogEx(INFO, "Preparing to clone Indala 64bit tag");
+        PrintAndLogEx(INFO, "RawID %s", sprint_hex(data, datalen));
 
         if (is_t5555)
             blocks[0] = T5555_SET_BITRATE(32) | T5555_MODULATION_PSK1 | (2 << T5555_MAXBLOCK_SHIFT);
@@ -622,7 +671,7 @@ static int CmdIndalaClone(const char *Cmd) {
     print_blocks(blocks, max);
     int res = clone_t55xx_tag(blocks, max);
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf indala read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf indala read`") "to verify");
     return res;
 }
 
@@ -647,6 +696,71 @@ int CmdLFINDALA(const char *Cmd) {
     return CmdsParse(CommandTable, Cmd);
 }
 
+int getIndalaBits(uint8_t fc, uint16_t cn, uint8_t *bits) {
+    // preamble
+    // is there a preamble?
+    bits[0] = 1;
+    bits[2] = 1;
+    bits[32] = 1;
+
+    // add fc
+    bits[57] = ((fc >> 7) & 1); // b8
+    bits[49] = ((fc >> 6) & 1); // b7
+    bits[44] = ((fc >> 5) & 1); // b6
+    bits[47] = ((fc >> 4) & 1); // b5
+    bits[48] = ((fc >> 3) & 1); // b4
+    bits[53] = ((fc >> 2) & 1); // b3
+    bits[39] = ((fc >> 1) & 1); // b2
+    bits[58] = (fc & 1);        // b1
+
+    // add cn
+    bits[42] = ((cn >> 15) & 1); // b16
+    bits[45] = ((cn >> 14) & 1); // b15 - c
+    bits[43] = ((cn >> 13) & 1); // b14
+    bits[40] = ((cn >> 12) & 1); // b13 - c
+    bits[52] = ((cn >> 11) & 1); // b12
+    bits[36] = ((cn >> 10) & 1); // b11
+    bits[35] = ((cn >> 9) & 1);  // b10 - c
+    bits[51] = ((cn >> 8) & 1);  // b9  - c
+    bits[46] = ((cn >> 7) & 1);  // b8
+    bits[33] = ((cn >> 6) & 1);  // b7  - c
+    bits[37] = ((cn >> 5) & 1);  // b6  - c
+    bits[54] = ((cn >> 4) & 1);  // b5
+    bits[56] = ((cn >> 3) & 1);  // b4
+    bits[59] = ((cn >> 2) & 1);  // b3  - c
+    bits[50] = ((cn >> 1) & 1);  // b2
+    bits[41] = (cn & 1);         // b1  - c
+
+    // checksum
+    uint8_t chk = 0;
+    //sum(y2, y4, y7, y8, y10, y11, y14, y16
+    chk += ((cn >> 14) & 1); //y2 == 75 - 30 = 45
+    chk += ((cn >> 12) & 1); //y4 == 70 - 30 = 40
+    chk += ((cn >> 9) & 1); //y7 == 65 - 30 = 35
+    chk += ((cn >> 8) & 1); //y8 == 81 - 30 = 51
+    chk += ((cn >> 6) & 1); //y10 == 63 - 30 = 33
+    chk += ((cn >> 5) & 1); //y11 == 67 - 30 = 37
+    chk += ((cn >> 2) & 1); //y14 == 89 - 30 = 59
+    chk += (cn & 1); //y16 == 71 - 30 = 41
+
+    if ((chk & 1) == 0) {
+        bits[62] = 0;
+        bits[63] = 1;
+    } else {
+        bits[62] = 1;
+        bits[63] = 0;
+    }
+
+    // add parity
+    bits[34] = 1; // p1  64 - 30 = 34
+    bits[38] = 1; // p2  68 - 30 = 38
+
+    // 92 = 62
+    // 93 = 63
+
+    return PM3_SUCCESS;
+}
+
 // redesigned by marshmellow adjusted from existing decode functions
 // indala id decoding
 int detectIndala(uint8_t *dest, size_t *size, uint8_t *invert) {

client/cmdlfindala.h

@@ -19,5 +19,6 @@ int detectIndala26(uint8_t *bitStream, size_t *size, uint8_t *invert);
 int detectIndala64(uint8_t *bitStream, size_t *size, uint8_t *invert);
 int detectIndala224(uint8_t *bitStream, size_t *size, uint8_t *invert);
 int demodIndala(void);
+int getIndalaBits(uint8_t fc, uint16_t cn, uint8_t *bits);
 
 #endif

client/cmdlfio.c

@@ -277,7 +277,7 @@ static int CmdIOProxClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf io read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf io read`") "to verify");
     return res;
 }
 

client/cmdlfkeri.c

@@ -59,20 +59,15 @@ typedef enum  {Scramble = 0,Descramble = 1} KeriMSScramble_t;
 static int CmdKeriMSScramble (KeriMSScramble_t Action, uint32_t *FC, uint32_t *ID, uint32_t *CardID)
 {
     // 255 = Not used/Unknown other values are the bit offset in the ID/FC values
-    uint8_t CardToID [] = { 255,255,255,255, 13, 12, 17,  5,255,  6,255, 18,  8,255,  0,  7,
-                             10,255,255, 11,  4,  1,255, 19,255, 20,  2,255,  3,  9,255,255 };
-    uint8_t CardToFC [] = { 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,
-                            255,255,  2,255,255,255,255,255,255,255,255,255,255,255,  1,255 };
+    uint8_t CardToID [] = { 255,255,255,255, 13, 12, 20,  5, 16,  6, 21, 17,  8,255,  0,  7,
+                             10, 15,255, 11,  4,  1,255, 18,255, 19,  2, 14,  3,  9,255,255 };
+
+    uint8_t CardToFC [] = { 255,255,255,255,255,255,255,255,255,255,255,255,255,  0,255,255,
+                            255,255,  2,255,255,255,  3,255,  4,255,255,255,255,255,  1,255 };
 
     uint8_t CardIdx; // 0 - 31
     bool BitState;
 
-    // Used to track known bit states - remove when all bit maps are known
-    char IDDecodeState[33] = {0x00};
-    char FCDecodeState[33] = {0x00};
-    memset (IDDecodeState,'-',32);
-    memset (FCDecodeState,'-',32);
-
     if (Action == Descramble) {
         *FC = 0;
         *ID = 0;
@@ -82,31 +77,12 @@ static int CmdKeriMSScramble (KeriMSScramble_t Action, uint32_t *FC, uint32_t *I
             // Card ID
             if (CardToID[CardIdx] < 32) {
                 *ID = *ID | (BitState << CardToID[CardIdx]);
-                // Remove when all bits are known
-                IDDecodeState[31-CardToID[CardIdx]] = '0'+BitState;
             }
             // Card FC
             if (CardToFC[CardIdx] < 32) {
                 *FC = *FC | (BitState << CardToFC[CardIdx]);
-                // Remove when all bits are known
-                FCDecodeState[31-CardToFC[CardIdx]] = '0'+BitState;
             }
         }
-
-        // Patch for bit order group unknown - remove when all Keri MS Bits maps are known
-        // Reverse order for easy mapping for unknowns
-        // I know that these bit groups are a in the correct location, unknown order.
-        if (IDDecodeState[31-17] == '1') IDDecodeState[31-17] = '?';
-        if (IDDecodeState[31-18] == '1') IDDecodeState[31-18] = '?';
-        if (IDDecodeState[31-19] == '1') IDDecodeState[31-19] = '?';
-        if (IDDecodeState[31-20] == '1') IDDecodeState[31-20] = '?';
-    
-        if (FCDecodeState[31- 1] == '1') FCDecodeState[31- 1] = '?';
-        if (FCDecodeState[31- 2] == '1') FCDecodeState[31- 2] = '?';
-
-        PrintAndLogEx(SUCCESS, "Partial Keri MS decode");
-        PrintAndLogEx(SUCCESS, "BitState ID : %s",IDDecodeState);
-        PrintAndLogEx(SUCCESS, "BitState FC : %s",FCDecodeState);
     }
 
     if (Action == Scramble)
@@ -144,7 +120,7 @@ static int CmdKeriMSScramble (KeriMSScramble_t Action, uint32_t *FC, uint32_t *I
         *CardID = *CardID | Parity;
 
         // Bit 31 was fixed but not in check/parity bits
-        *CardID |= (1 << 31); 
+        *CardID |= (uint32_t)(1 << 31);
 
         PrintAndLogEx(SUCCESS, "Scrambled FC : %d - Card ID : %d to RAW : E0000000%08X",*FC,*ID,*CardID);
     }
@@ -282,7 +258,7 @@ static int CmdKeriClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf keri read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf keri read`") "to verify");
     return res;
 }
 

client/cmdlfmotorola.c

@@ -179,7 +179,7 @@ static int CmdMotorolaClone(const char *Cmd) {
     print_blocks(blocks, ARRAYLEN(blocks));
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf motorola read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf motorola read`") "to verify");
     return res;
 }
 

client/cmdlfnedap.c

@@ -476,7 +476,7 @@ static int CmdLFNedapClone(const char *Cmd) {
         PrintAndLogEx(NORMAL, "");
     }
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf nedap read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf nedap read`") "to verify");
     return res;
 }
 

client/cmdlfnexwatch.c

@@ -160,7 +160,7 @@ static int CmdNexWatchClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf nexwatch read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf nexwatch read`") "to verify");
     return res;
 }
 

client/cmdlfnoralsy.c

@@ -171,7 +171,7 @@ static int CmdNoralsyClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf noralsy read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf noralsy read`") "to verify");
     return res;
 }
 

client/cmdlfpac.c

@@ -241,7 +241,7 @@ static int CmdPacClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf pac read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf pac read`") "to verify");
     return res;
 }
 

client/cmdlfparadox.c

@@ -171,7 +171,7 @@ static int CmdParadoxClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf paradox read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf paradox read`") "to verify");
     return res;
 }
 

client/cmdlfpcf7931.c

@@ -151,7 +151,7 @@ static int CmdLFPCF7931Write(const char *Cmd) {
     SendCommandMIX(CMD_LF_PCF7931_WRITE, block, bytepos, data, buf, sizeof(buf));
 
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf pcf7931 read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf pcf7931 read`") "to verify");
     return PM3_SUCCESS;
 }
 

client/cmdlfpresco.c

@@ -138,7 +138,7 @@ static int CmdPrescoClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf presco read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf presco read`") "to verify");
     return res;
 }
 

client/cmdlfpyramid.c

@@ -252,7 +252,7 @@ static int CmdPyramidClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf pyramid read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf pyramid read`") "to verify");
     return res;
 }
 

client/cmdlfsecurakey.c

@@ -170,7 +170,7 @@ static int CmdSecurakeyClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf securakey read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf securakey read`") "to verify");
     return res;
 }
 

client/cmdlfti.c

@@ -297,7 +297,7 @@ static int CmdTIWrite(const char *Cmd) {
     clearCommandBuffer();
     SendCommandMIX(CMD_LF_TI_WRITE, arg0, arg1, arg2, NULL, 0);
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf ti read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf ti read`") "to verify");
     return PM3_SUCCESS;
 }
 

client/cmdlfverichip.c

@@ -123,7 +123,7 @@ static int CmdVerichipClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf verichip read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf verichip read`") "to verify");
     return res;
 }
 

client/cmdlfviking.c

@@ -118,7 +118,7 @@ static int CmdVikingClone(const char *Cmd) {
         return PM3_ETIMEOUT;
     }
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf viking read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf viking read`") "to verify");
     return resp.status;
 }
 

client/cmdlfvisa2000.c

@@ -186,7 +186,7 @@ static int CmdVisa2kClone(const char *Cmd) {
 
     int res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
     PrintAndLogEx(SUCCESS, "Done");
-    PrintAndLogEx(INFO, "Hint: try " _YELLOW_("`lf visa2000 read`") "to verify");
+    PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf visa2000 read`") "to verify");
     return res;
 }
 

client/cmdmain.c

@@ -36,9 +36,23 @@
 #include "cmdwiegand.h"   // wiegand commands
 #include "ui.h"
 #include "util_posix.h"
+#include "commonutil.h"   // ARRAYLEN
 
 static int CmdHelp(const char *Cmd);
 
+static int usage_hints(void) {
+    PrintAndLogEx(NORMAL, "Turn on/off hints");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "Usage:  hints [h] <0|1>");
+    PrintAndLogEx(NORMAL, "Options:");
+    PrintAndLogEx(NORMAL, "       h          This help");
+    PrintAndLogEx(NORMAL, "       <0|1>      off or on");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "Examples:");
+    PrintAndLogEx(NORMAL, "       hints 1");
+    return PM3_SUCCESS;
+}
+
 static int usage_msleep(void) {
     PrintAndLogEx(NORMAL, "Sleep for given amount of milliseconds");
     PrintAndLogEx(NORMAL, "");
@@ -78,6 +92,70 @@ static void AppendDate(char *s, size_t slen, char *fmt) {
         strftime(s, slen, fmt, ct);
 }
 
+static int lf_search_plus(const char *Cmd) {
+
+    sample_config oldconfig;
+    memset(&oldconfig, 0, sizeof(sample_config));
+
+    int retval = lf_getconfig(&oldconfig);
+
+    if (retval != PM3_SUCCESS) {
+        PrintAndLogEx(ERR, "failed to get current device config");
+        return retval;
+    }
+
+    // Divisor : frequency(khz)
+    // 95      88      47      31      23
+    // 125.00  134.83  250.00  375.00  500.00
+
+    int16_t default_divisor[] = {95, 88, 47, 31, 23};
+
+    /*
+      default LF config is set to:
+      decimation = 1
+      bits_per_sample = 8
+      averaging = YES
+      divisor = 95 (125kHz)
+      trigger_threshold = 0
+      samples_to_skip = 0
+      verbose = YES
+    */
+    sample_config config = {
+        .decimation = 1,
+        .bits_per_sample = 8,
+        .averaging = 1,
+        .trigger_threshold = 0,
+        .samples_to_skip = 0,
+        .verbose = false
+    };
+
+    // Iteration defaults
+    for (int i = 0; i < ARRAYLEN(default_divisor); ++i) {
+
+        if (kbd_enter_pressed()) {
+            PrintAndLogEx(INFO, "Keyboard pressed. Done.");
+            break;
+        }
+        // Try to change config!
+        uint32_t d;
+        d = config.divisor = default_divisor[i];
+        PrintAndLogEx(INFO, "-->  trying  ( " _GREEN_("%d.%02d kHz")")", 12000 / (d + 1), ((1200000 + (d + 1) / 2) / (d + 1)) - ((12000 / (d + 1)) * 100));
+
+        retval = lf_config(&config);
+        if (retval != PM3_SUCCESS)
+            break;
+
+        // The config for pm3 is changed, we can trying search!
+        retval = CmdLFfind(Cmd);
+        if (retval == PM3_SUCCESS)
+            break;
+
+    }
+
+    lf_config(&oldconfig);
+    return retval;
+}
+
 static int CmdAuto(const char *Cmd) {
     char ctmp = tolower(param_getchar(Cmd, 0));
     if (ctmp == 'h') return usage_auto();
@@ -90,8 +168,12 @@ static int CmdAuto(const char *Cmd) {
     if (ret == PM3_SUCCESS)
         return ret;
 
+    ret = lf_search_plus("");
+    if (ret == PM3_SUCCESS)
+        return ret;
+
     PrintAndLogEx(INFO, "Failed both LF / HF SEARCH,");
-    PrintAndLogEx(INFO, "Trying 'lf read' and save a trace for you...");
+    PrintAndLogEx(INFO, "Trying " _YELLOW_("`lf read`") "and save a trace for you");
 
     CmdPlot("");
     lf_read(false, 40000);
@@ -109,6 +191,33 @@ int CmdRem(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static int CmdHints(const char *Cmd) {
+    uint32_t ms = 0;
+    char ctmp = tolower(param_getchar(Cmd, 0));
+    if (ctmp == 'h') return usage_hints();
+
+    if (strlen(Cmd) > 1){     
+       str_lower((char *)Cmd);
+       if (str_startswith(Cmd, "of")) {
+            session.show_hints = false;
+       } else {
+            session.show_hints = true;
+       }      
+    } else if (strlen(Cmd) == 1) {
+        if (param_getchar(Cmd, 0) != 0x00) {
+            ms = param_get32ex(Cmd, 0, 0, 10);
+            if (ms == 0) {
+                session.show_hints = false;
+            } else {
+                session.show_hints = true;
+            }
+        }
+    }
+    
+    PrintAndLogEx(INFO, "Hints are %s", (session.show_hints) ? "ON" : "OFF");
+    return PM3_SUCCESS;
+}
+
 static int CmdMsleep(const char *Cmd) {
     uint32_t ms = 0;
     char ctmp = tolower(param_getchar(Cmd, 0));
@@ -149,6 +258,7 @@ static command_t CommandTable[] = {
     {"usart",   CmdUsart,     IfPm3FpcUsartFromUsb,    "{ USART commands... }"},
     {"wiegand", CmdWiegand,   AlwaysAvailable,         "{ Wiegand format manipulation... }"},
     {"",        CmdHelp,      AlwaysAvailable,         ""},
+    {"hints",   CmdHints,     AlwaysAvailable,         "Turn hints on / off"},
     {"msleep",  CmdMsleep,    AlwaysAvailable,         "Add a pause in milliseconds"},
     {"rem",     CmdRem,       AlwaysAvailable,         "Add a text line in log file"},
     {"quit",    CmdQuit,      AlwaysAvailable,         ""},

client/dictionaries/mfc_default_keys.dic

@@ -1076,7 +1076,7 @@ f0f0172066b2
 f3864fcca693
 f3f0172066b2
 fc9839273862
-
+#
 # various hotel keys
 34D3C568B348
 91FF18E63887
@@ -1084,3 +1084,27 @@ fc9839273862
 354A787087F1
 4a306e62e9b6
 B9C874AE63D0
+#
+# Data from offical repo
+f00dfeedd0d0
+0bb31dc123e5
+7578bf2c66a9
+cd212889c3ed
+6936c035ae1b
+c6c866aa421e
+590bd659cdd2
+aa734d2f40e0
+09800ff94aaf
+5a12f83326e7
+c554ef6a6015
+0d8ca561bdf3
+b8937130b6ba
+d7744a1a0c44
+82908b57ef4f
+fe04ecfe5577
+# comfort inn hotel
+4d57414c5648
+4d48414c5648
+# 
+# unknown hotel key
+6d9b485a4845

client/emojis_alt.h

@@ -0,0 +1,15 @@
+#ifndef EMOJIS_ALT_H__
+#define EMOJIS_ALT_H__
+
+typedef struct emoji_alt_s {
+    const char *alias;
+    const char *alttext;
+} emoji_alt_t;
+// emoji_alt_t array are expected to be NULL terminated
+
+static emoji_alt_t EmojiAltTable[] = {
+    {":wink:", ";)"},
+    {NULL, NULL}
+};
+
+#endif

client/emojis_scrap_github.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+
+# Mostly derived from https://github.com/mrowa44/emojify Copyright (c) 2015 Justyna Rachowicz
+
+from urllib.request import urlopen
+import json
+
+
+EMOJI_JSON_URL = 'https://raw.githubusercontent.com/github/gemoji/master/db/emoji.json'
+
+def print_emoji(emoji_json):
+    for alias in emoji_json['aliases']:
+        print('    {{":{0}:", "{1}"}}, // {2}'.format(alias, 
+
+''.join('\\x{:02x}'.format(b) for b in emoji_json['emoji'].encode('utf8')),
+
+emoji_json['emoji']))
+
+print(
+"""#ifndef EMOJIS_H__
+#define EMOJIS_H__
+
+typedef struct emoji_s {
+    const char *alias;
+    const char *emoji;
+} emoji_t;
+// emoji_t array are expected to be NULL terminated
+
+static emoji_t EmojiTable[] = {""")
+
+with urlopen(EMOJI_JSON_URL) as conn:
+    emojis_json = json.loads(conn.read().decode('utf-8'))
+    for emoji_json in emojis_json:
+        print_emoji(emoji_json)
+
+print("""    {NULL, NULL}
+};
+#endif""")

client/fileutils.c

@@ -70,7 +70,7 @@ struct wave_info_t {
         char tag[4];
         uint32_t size;
     } PACKED audio_data;
-} PACKED wave_info;
+} PACKED;
 
 /**
  * @brief checks if a file exists

client/luascripts/hf-writer.lua

@@ -0,0 +1,231 @@
+local utils = require('utils')
+local getopt = require('getopt')
+local read14a = require('read14a')
+
+--[[
+---Suggestions of improvement:
+--- Add support another types of dumps: BIN, JSON
+--- Maybe it will be not only as `mfc_gen3_writer`, like a universal dump manager.
+--- Add undependence from the operation system. At the moment code not working in Linux.
+--- Add more chinesse backdoors RAW commands for UID changing (find RAW for the 4 byte familiar chinese card, from native it soft: http://bit.ly/39VIDsU)
+--- Hide system messages when you writing a dumps, replace it to some of like [#####----------] 40%
+
+-- iceman notes:
+--  doesn't take consideration filepaths for dump files.
+--  doesn't allow A keys for authenticating when writing
+--  doesn't verify that card is magic gen3.
+--  doesn't take several versions of same dump ( -1, -2, -3 ) styles.
+--]]
+
+copyright = ''
+author = 'Winds'
+version = 'v1.0.0'
+desc = [[
+    The script gives you a easy way to write your *.eml dumps onto normal MFC and magic Gen3 cards.
+
+    Works with both 4 and 7 bytes NXP MIFARE Classic 1K cards.
+    The script also has the possibility to change UID and permanent lock uid on magic Gen3 cards.
+    
+    It supports the following functionality.
+
+    1. Write it to the same  of current card UID.
+    2. Write it to magic Gen3 card.
+    3. Change uid to match dump on magic Gen3 card.
+    4. Permanent lock UID on magic Gen3 card.
+    5. Erase all data at the card and set the FF FF FF FF FF FF keys, and Access Conditions to 78778800.
+    
+    Script works in a wizard styled way.
+]]
+example = [[
+    1. script run mfc_gen3_writer
+]]
+usage = [[
+    Select your *.eml dump from list to write to the card.
+]]
+
+-- Some globals
+local DEBUG = false -- the debug flag
+
+-------------------------------
+-- Some utilities
+-------------------------------
+
+---
+-- A debug printout-function
+local function dbg(args)
+    if not DEBUG then return end
+    if type(args) == 'table' then
+        local i = 1
+        while args[i] do
+            dbg(args[i])
+            i = i+1
+        end
+    else
+        print('###', args)
+    end
+end
+---
+-- This is only meant to be used when errors occur
+local function oops(err)
+    print('ERROR:', err)
+    core.clearCommandBuffer()
+    return nil, err
+end
+---
+-- Usage help
+local function help()
+    print(copyright)
+    print(author)
+    print(version)
+    print(desc)
+    print('Example usage')
+    print(example)
+    print(usage)
+end
+---
+-- GetUID
+local function GetUID()
+    return read14a.read(true, true).uid
+end
+---
+-- 
+local function dropfield()
+    read14a.disconnect()
+    core.clearCommandBuffer()
+end
+---
+-- Wait for tag (MFC)
+local function wait()
+    read14a.waitFor14443a()
+end
+---
+--
+local function main(args)
+
+    -- Arguments for the script
+    for o, a in getopt.getopt(args, 'hd') do
+        if o == 'h' then return help() end
+        if o == 'd' then DEBUG = true end
+    end
+
+    local files = {} -- Array for eml files
+    local b_keys = {} -- Array for B keys
+    local eml = {} -- Array for data in block 32
+    local num_dumps = 0 -- num of found eml dump files
+
+    local tab = string.rep('-', 64)
+    --
+    wait()
+    print(tab)
+
+    local length = 25
+    local e = 16
+    -- Detect 7 byte card
+    if string.len(GetUID()) == 14 then 
+        length = 31
+        e = 22
+    end 
+    dropfield()
+
+    ---List all EML files in /client
+    local dumpEML = "find '.' -iname '*dump.eml' -type f"
+    local p = assert(io.popen(dumpEML))    
+    for _ in p:lines() do
+    
+        -- The length of eml file
+        if string.len(_) == length then 
+            num_dumps = num_dumps + 1
+             -- cut UID from eml file
+            files[num_dumps] = string.sub(_, 9, e)
+            print(' '..num_dumps..' | '..files[num_dumps])
+        end
+    end 
+    p.close()
+
+    if num_dumps == 0 then return oops("Didn't find any dump files") end
+
+    print(tab)
+    print(' Your card has UID '..GetUID())
+    print('')
+    print(' Select which dump to write (1 until '..num_dumps..')')
+    print(tab)
+    io.write(' --> ')
+
+    local no = tonumber(io.read())
+    print(tab)
+    print(' You have been selected card dump ' .. no .. ', with UID : '..files[no])  
+
+    --- Load eml file
+    local dumpfile = assert(io.open('./hf-mf-' .. files[no] .. '-dump.eml', 'r'))
+    for _ in dumpfile:lines() do table.insert(eml, _); end
+    dumpfile.close()
+
+    --- Extract B key from EML file    
+    local b = 0
+    for i = 1, #eml do
+        if (i % 4 == 0) then
+            repeat
+                b = b + 1
+                -- Cut key from block
+                b_keys[b] = string.sub(eml[i], (#eml[i] - 11), #eml[i]) 
+            until b % 4 == 0
+        end
+    end 
+    print(tab)
+    dbg(b_keys)
+    dbg(eml)
+
+    --- Change UID on certain version of magic Gen3 card.  
+    if (utils.confirm(' Change UID ?') == true) then
+        wait()
+        --core.console('hf 14a raw -s -c -t 2000 90f0cccc10'..tostring(eml[1]))
+        print('hf 14a raw -s -c -t 2000 90f0cccc10'..tostring(eml[1]))
+        print(tab)
+        print(' The new card UID : ' .. GetUID())
+    end 
+    print(tab)  
+    
+    --- Lock UID
+    if (utils.confirm(' Permanent lock UID ? (card can never change uid again) ') == true) then
+        wait()
+        core.console('hf 14a raw -s -c -t 2000 90fd111100')
+    end 
+    print(tab)
+    
+    --- Writing blocks
+    local default_key = 'FFFFFFFFFFFF'
+    local default_key_blk = 'FFFFFFFFFFFF78778800FFFFFFFFFFFF'
+    local empty = string.rep('0', 32)
+    local cmd_wrbl = 'hf mf wrbl %d B %s %s'
+
+    if (utils.confirm(' Are you using a empty card with default key?') == true) then
+        wait()
+        for i = 1, #eml do
+            core.console(string.format(cmd_wrbl, (i-1), default_key, eml[i]))
+        end
+    else
+        print(tab)
+        if (utils.confirm(' Delete ALL data and write all keys to 0x'..default_key..' ?') == true) then
+            wait()
+            for i = 1, #eml do
+                if (i % 4 == 0) then
+                    core.console(string.format(cmd_wrbl, (i-1), b_keys[i], default_key_blk))
+                else
+                    core.console(string.format(cmd_wrbl, (i-1), b_keys[i], empty))
+                end
+            end
+        else
+            print(tab)
+            print('Writing to card')
+            wait()
+            for i = 1, #eml do
+                core.console(string.format(cmd_wrbl, (i-1), b_keys[i], eml[i]))
+            end
+        end
+    end
+    dropfield()
+    print(tab)
+    print('Done')
+end
+
+main(args)

client/luascripts/hf_bruteforce.lua

@@ -1,27 +1,34 @@
--- Run me like this: proxmark3 /dev/rfcomm0 -l ./hf_bruteforce.lua
+-- Run me like this (connected via USB): ./pm3 -l hf_bruteforce.lua
+-- Run me like this (connected via Blueshark addon): ./client/proxmark3 /dev/rfcomm0 -l ./hf_bruteforce.lua
 
 local getopt = require('getopt')
 
 copyright = ''
-author = 'Keld Norman'
-version = 'v1.0.0'
-desc = [[
-
-]]
-example = [[
-    --  (the above example would bruteforce card number, starting at 1, ending at 10, and waiting 1 second between each card)
-
-    script run hf_bruteforce -s 1 -e 10 -t 1000
-]]
+author = 'Daniel Underhay (updated), Keld Norman(original)'
+version = 'v2.0.0'
 usage = [[
 
-script run hf_bruteforce -s start_id -e end_id -t timeout -d direction
+pm3 --> script run hf_bruteforce -s start_id -e end_id -t timeout -x mifare_card_type
 
 Arguments:
     -h       this help
     -s       0-0xFFFFFFFF         start id
     -e       0-0xFFFFFFFF         end id
     -t       0-99999, pause       timeout (ms) between cards (use the word 'pause' to wait for user input)
+    -x       mfc, mfu             mifare type: mfc for Mifare Classic (default) or mfu for Mifare Ultralight EV1
+
+
+Example:
+
+pm3 --> script run hf_bruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
+
+Bruteforce a 4 byte UID Mifare classic card number, starting at 11223344, ending at 11223346.
+
+
+pm3 --> script run hf_bruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
+
+Bruteforce a 7 byte UID Mifare Ultralight card number, starting at 11223344556677, ending at 11223344556679.
+
 ]]
 
 
@@ -60,37 +67,45 @@ local function help()
     print(usage)
 end
 ---
--- Exit message
-local function exitMsg(msg)
+--- Print user message
+local function msg(msg)
  print( string.rep('--',20) )
+ print('')
  print(msg)
+ print('')
  print( string.rep('--',20) )
- print()
 end
 ---
 -- Start
 local function main(args)
 
-    print( string.rep('--',20) )
-    print( string.rep('--',20) )
-    print()
     local timeout = 0
     local start_id = 0
-    local end_id = 0xFFFFFFFF
+    local end_id = 0xFFFFFFFFFFFFFF
+    local mftype = 'mfc'
 
-    for o, a in getopt.getopt(args, 'e:s:t:h') do
+    for o, a in getopt.getopt(args, 'e:s:t:x:h') do
         if o == 's' then start_id = a end
         if o == 'e' then end_id = a end
         if o == 't' then timeout = a end
+        if o == 'x' then mftype = a end
         if o == 'h' then return print(usage) end
     end
 
     -- template
-	local command = 'hf 14a sim t 1 u %08X'
+    local command = ''
 
-	print(' Bruteforcing MFC card numbers from 00000000 to FFFFFFFF using delay: '..timeout)
-    print('')
-    print( string.rep('--',20) )
+    if mftype == 'mfc' then
+        command = 'hf 14a sim t 1 u %14X'
+        msg('Bruteforcing Mifare Classic card numbers')
+    elseif mftype == 'mfu' then
+        command = 'hf 14a sim t 2 u %14X'
+        msg('Bruteforcing Mifare Ultralight card numbers')
+    else
+        return print(usage)
+    end
+
+    if command == '' then return print(usage) end
 
     for n = start_id, end_id do
         local c = string.format( command, n )
@@ -102,4 +117,3 @@ local function main(args)
 
 end
 main(args)
-

client/mifare/mifarehost.c

@@ -152,7 +152,7 @@ int mfDarkside(uint8_t blockno, uint8_t key_type, uint64_t *key) {
         if (*key != UINT64_C(-1)) {
             break;
         } else {
-            PrintAndLogEx(FAILED, "all candidate keys failed. Restarting darkside attack");
+            PrintAndLogEx(FAILED, "all key candidates failed. Restarting darkside attack");
             free(last_keylist);
             last_keylist = keylist;
             first_run = true;
@@ -345,7 +345,7 @@ int mfKeyBrute(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint64_t *resultk
         // copy candidatekeys to test key block
         memcpy(keyBlock, candidates + i, KEYBLOCK_SIZE);
 
-        // check a block of generated candidate keys.
+        // check a block of generated key candidates.
         if (mfCheckKeys(blockNo, keyType, true, KEYS_IN_BLOCK, keyBlock, &key64) == PM3_SUCCESS) {
             *resultkey = key64;
             found = true;
@@ -510,7 +510,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
     uint32_t keycnt = statelists[0].len;
     if (keycnt == 0) goto out;
 
-    PrintAndLogEx(SUCCESS, "Found " _YELLOW_("%u") "candidate keys", keycnt);
+    PrintAndLogEx(SUCCESS, "Found " _YELLOW_("%u") "key candidates", keycnt);
 
     memset(resultKey, 0, 6);
     uint64_t key64 = -1;
@@ -544,10 +544,10 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBlockNo,
             return -5;
         }
 
-        float bruteforce_per_second = (float)KEYS_IN_BLOCK / (msclock() - start_time) * 1000.0;
-
-        if ( i + 1 % 10 == 0)
+//        if (i + 1 % 10 == 0) {
+        float bruteforce_per_second = (float)(i + max_keys) / ((msclock() - start_time) / 1000.0);
         PrintAndLogEx(INFO, "%6d/%u keys | %5.1f keys/sec | worst case %6.1f seconds remaining", i, keycnt, bruteforce_per_second, (keycnt - i) / bruteforce_per_second);
+//        }
 
     }
 
@@ -644,7 +644,7 @@ int mfStaticNested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBl
     uint32_t keycnt = statelists[0].len;
     if (keycnt == 0) goto out;
 
-    PrintAndLogEx(SUCCESS, "Found " _YELLOW_("%u") "candidate keys", keycnt);
+    PrintAndLogEx(SUCCESS, "Found " _YELLOW_("%u") "key candidates", keycnt);
 
     memset(resultKey, 0, 6);
     uint64_t key64 = -1;
@@ -689,7 +689,7 @@ int mfStaticNested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBl
             num_to_bytes(key64, 6, p_keyblock + j * 6);
         }
 
-        // check a block of generated candidate keys.
+        // check a block of generated key candidates.
         if (IfPm3Flash()) {
             // upload to flash.
             res = flashmem_spiffs_load(destfn, mem, 5 + (chunk * 6));
@@ -723,8 +723,8 @@ int mfStaticNested(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBl
         }
 
 //        if (i%10 == 0) {
-            float bruteforce_per_second = (float)i + max_keys_chunk / (msclock() - start_time) * 1000.0;
-            PrintAndLogEx(INFO, "Chunk %6u/%u keys | %5.1f keys/sec | worst case %6.1f seconds remaining", i, keycnt, bruteforce_per_second, (keycnt-i) / bruteforce_per_second);
+        float bruteforce_per_second = (float)(i + max_keys_chunk) / ((msclock() - start_time) / 1000.0);
+        PrintAndLogEx(INFO, "%6u/%u keys | %5.1f keys/sec | worst case %6.1f seconds remaining", i, keycnt, bruteforce_per_second, (keycnt - i) / bruteforce_per_second);
 //        }
     }
 
@@ -1316,6 +1316,8 @@ int detect_classic_nackbug(bool verbose) {
     SendCommandNG(CMD_HF_MIFARE_NACK_DETECT, NULL, 0);
     PacketResponseNG resp;
 
+    PrintAndLogEx(INFO, "Checking for NACK bug");
+
     if (verbose)
         PrintAndLogEx(SUCCESS, "press pm3-button on the Proxmark3 device to abort both Proxmark3 and client.\n");
 
@@ -1358,16 +1360,16 @@ int detect_classic_nackbug(bool verbose) {
                     return PM3_SUCCESS;
                 }
                 case  2 :
-                    PrintAndLogEx(SUCCESS, _GREEN_("always leak NACK detected"));
+                    PrintAndLogEx(SUCCESS, "NACK test: " _GREEN_("always leak NACK"));
                     return PM3_SUCCESS;
                 case  1 :
-                    PrintAndLogEx(SUCCESS, _GREEN_("NACK bug detected"));
+                    PrintAndLogEx(SUCCESS, "NACK test: " _GREEN_("detected"));
                     return PM3_SUCCESS;
                 case  0 :
-                    PrintAndLogEx(SUCCESS, "No NACK bug detected");
+                    PrintAndLogEx(SUCCESS, "NACK test: " _GREEN_("no bug"));
                     return PM3_SUCCESS;
                 default :
-                    PrintAndLogEx(ERR, "errorcode from device [%i]", ok);
+                    PrintAndLogEx(ERR, "errorcode from device " _RED_("[%i]"), ok);
                     return PM3_EUNDEF;
             }
             break;

client/proxgui.h

@@ -56,7 +56,6 @@ extern size_t g_DemodStartIdx;
 extern bool showDemod;
 extern uint8_t g_debugMode;
 
-
 #ifndef FILE_PATH_SIZE
 #define FILE_PATH_SIZE 1000
 #endif

client/proxmark3.c

@@ -36,14 +36,14 @@ static void showBanner(void) {
     PrintAndLogEx(NORMAL, "  " _BLUE_("██████╗ ███╗   ███╗ ████╗ "));
     PrintAndLogEx(NORMAL, "  " _BLUE_("██╔══██╗████╗ ████║   ══█║"));
     PrintAndLogEx(NORMAL, "  " _BLUE_("██████╔╝██╔████╔██║ ████╔╝"));
-    PrintAndLogEx(NORMAL, "  " _BLUE_("██╔═══╝ ██║╚██╔╝██║   ══█║") "    iceman@icesql.net");
+    PrintAndLogEx(NORMAL, "  " _BLUE_("██╔═══╝ ██║╚██╔╝██║   ══█║") "    :snowflake:  iceman@icesql.net :coffee:");
     PrintAndLogEx(NORMAL, "  " _BLUE_("██║     ██║ ╚═╝ ██║ ████╔╝") "   https://github.com/rfidresearchgroup/proxmark3/");
     PrintAndLogEx(NORMAL, "  " _BLUE_("╚═╝     ╚═╝     ╚═╝ ╚═══╝ ") "pre-release v4.0");
 #else
     PrintAndLogEx(NORMAL, "  ======. ===.   ===. ====.");
     PrintAndLogEx(NORMAL, "  ==...==.====. ====.   ..=.");
     PrintAndLogEx(NORMAL, "  ======..==.====.==. ====..");
-    PrintAndLogEx(NORMAL, "  ==..... ==..==..==.   ..=.    iceman@icesql.net");
+    PrintAndLogEx(NORMAL, "  ==..... ==..==..==.   ..=.    iceman@icesql.net :coffee:");
     PrintAndLogEx(NORMAL, "  ==.     ==. ... ==. ====..   https://github.com/rfidresearchgroup/proxmark3/");
     PrintAndLogEx(NORMAL, "  ...     ...     ... .....  pre-release v4.0");
 #endif
@@ -58,7 +58,11 @@ static void showBanner(void) {
 static int check_comm(void) {
     // If communications thread goes down. Device disconnected then this should hook up PM3 again.
     if (IsCommunicationThreadDead() && session.pm3_present) {
+        if (session.supports_colors)
+            rl_set_prompt(PROXPROMPT_OFFLINE_COLOR);
+        else
             rl_set_prompt(PROXPROMPT_OFFLINE);
+
         rl_forced_update_display();
         CloseProxmark();
         PrintAndLogEx(INFO, "Running in " _YELLOW_("OFFLINE") "mode. Use "_YELLOW_("\"hw connect\"") "to reconnect\n");
@@ -150,7 +154,7 @@ main_loop(char *script_cmds_file, char *script_cmd, bool stayInCommandLoop) {
     // loops every time enter is pressed...
     while (1) {
         bool printprompt = false;
-        const char *prompt = PROXPROMPT_CON;
+        const char *prompt = (session.supports_colors) ? PROXPROMPT_CON_COLOR : PROXPROMPT_CON;
 
 check_script:
         // If there is a script file
@@ -214,11 +218,11 @@ check_script:
                     rl_event_hook = check_comm;
                     if (session.pm3_present) {
                         if (conn.send_via_fpc_usart == false)
-                            prompt = PROXPROMPT_USB;
+                            prompt = (session.supports_colors) ? PROXPROMPT_USB_COLOR : PROXPROMPT_USB;
                         else
-                            prompt = PROXPROMPT_FPC;
+                            prompt = (session.supports_colors) ? PROXPROMPT_FPC_COLOR : PROXPROMPT_FPC;
                     } else {
-                        prompt = PROXPROMPT_OFFLINE;
+                        prompt = (session.supports_colors) ? PROXPROMPT_OFFLINE_COLOR : PROXPROMPT_OFFLINE;
                     }
                     cmd = readline(prompt);
                     fflush(NULL);
@@ -756,6 +760,7 @@ int main(int argc, char *argv[]) {
     }
 
     session.supports_colors = DetectWindowsAnsiSupport();
+    session.emoji_mode = ALTTEXT;
 
     session.stdinOnTTY = isatty(STDIN_FILENO);
     session.stdoutOnTTY = isatty(STDOUT_FILENO);
@@ -766,8 +771,10 @@ int main(int argc, char *argv[]) {
     // For info, grep --color=auto is doing sth like this, plus test getenv("TERM") != "dumb":
     //   struct stat tmp_stat;
     //   if ((fstat (STDOUT_FILENO, &tmp_stat) == 0) && (S_ISCHR (tmp_stat.st_mode)) && isatty(STDIN_FILENO))
-    if (session.stdinOnTTY && session.stdoutOnTTY)
+    if (session.stdinOnTTY && session.stdoutOnTTY) {
         session.supports_colors = true;
+        session.emoji_mode = EMOJI;
+    }
 #endif
     // Let's take a baudrate ok for real UART, USB-CDC & BT don't use that info anyway
     if (speed == 0)

client/proxmark3.h

@@ -15,9 +15,17 @@
 #include "common.h"
 
 #define PROXPROMPT_CON "[con] pm3 --> "
+#define PROXPROMPT_CON_COLOR "[\001\033[1;32m\002con\001\033[0m\002] pm3 --> "
+
 #define PROXPROMPT_USB "[usb] pm3 --> "
+#define PROXPROMPT_USB_COLOR "[\001\033[1;32m\002usb\001\033[0m\002] pm3 --> "
+
 #define PROXPROMPT_FPC "[fpc] pm3 --> "
+#define PROXPROMPT_FPC_COLOR "[\001\033[1;32m\002fpc\001\033[0m\002] pm3 --> "
+
 #define PROXPROMPT_OFFLINE "[offline] pm3 --> "
+#define PROXPROMPT_OFFLINE_COLOR "[\001\033[1;31m\002offline\001\033[0m\002] pm3 --> "
+
 #define PROXHISTORY "history.txt"
 #define PROXLOG "log_%Y%m%d.txt"
 #define MAX_NESTED_CMDSCRIPT 10

client/ui.c

@@ -31,6 +31,8 @@
 # include <direct.h>    // _mkdir
 #endif
 #include <time.h>
+#include "emojis.h"
+#include "emojis_alt.h"
 session_arg_t session;
 
 double CursorScaleFactor = 1;
@@ -128,38 +130,60 @@ void PrintAndLogEx(logLevel_t level, const char *fmt, ...) {
     if (g_debugMode == 0 && level == DEBUG)
         return;
     
-    char prefix[20] = {0};
+    // skip HINT messages if client has hints turned off i.e. 'HINT 0'
+    if (session.show_hints == false && level == HINT)
+        return;
+
+    char prefix[40] = {0};
     char buffer[MAX_PRINT_BUFFER] = {0};
-    char buffer2[MAX_PRINT_BUFFER + 20] = {0};
+    char buffer2[MAX_PRINT_BUFFER + sizeof(prefix)] = {0};
     char *token = NULL;
     char *tmp_ptr = NULL;
     FILE *stream = stdout;
     const char *spinner[] = {_YELLOW_("[\\]"), _YELLOW_("[|]"), _YELLOW_("[/]"), _YELLOW_("[-]")};
+    const char *spinner_emoji[] = {" :clock1: ", " :clock2: ", " :clock3: ", " :clock4: ", " :clock5: ", " :clock6: ",
+                                   " :clock7: ", " :clock8: ", " :clock9: ", " :clock10: ", " :clock11: ", " :clock12: "};
     switch (level) {
         case ERR:
+            if (session.emoji_mode == EMOJI)
+                strncpy(prefix,  _RED_("[!!]") " :rotating_light: ", sizeof(prefix) - 1);
+            else
                 strncpy(prefix, _RED_("[!!]"), sizeof(prefix) - 1);
             stream = stderr;
             break;
         case FAILED:
+            if (session.emoji_mode == EMOJI)
+                strncpy(prefix, _RED_("[-]") " :no_entry: ", sizeof(prefix) - 1);
+            else
                 strncpy(prefix, _RED_("[-]"), sizeof(prefix) - 1);
             break;
         case DEBUG:
             strncpy(prefix, _BLUE_("[#]"), sizeof(prefix) - 1);
-            break;
+        case HINT:
         case SUCCESS:
             strncpy(prefix, _GREEN_("[+]"), sizeof(prefix) - 1);
             break;
         case WARNING:
+            if (session.emoji_mode == EMOJI)
+                strncpy(prefix, _CYAN_("[!]") " :warning:  ", sizeof(prefix) - 1);
+            else
                 strncpy(prefix, _CYAN_("[!]"), sizeof(prefix) - 1);
             break;
         case INFO:
             strncpy(prefix, _YELLOW_("[=]"), sizeof(prefix) - 1);
             break;
         case INPLACE:
+            if (session.emoji_mode == EMOJI) {
+                strncpy(prefix, spinner_emoji[PrintAndLogEx_spinidx], sizeof(prefix) - 1);
+                PrintAndLogEx_spinidx++;
+                if (PrintAndLogEx_spinidx >= ARRAYLEN(spinner_emoji))
+                    PrintAndLogEx_spinidx = 0;
+            } else {
                 strncpy(prefix, spinner[PrintAndLogEx_spinidx], sizeof(prefix) - 1);
                 PrintAndLogEx_spinidx++;
-            if (PrintAndLogEx_spinidx == ARRAYLEN(spinner))
+                if (PrintAndLogEx_spinidx >= ARRAYLEN(spinner))
                     PrintAndLogEx_spinidx = 0;
+            }
             break;
         case NORMAL:
             // no prefixes for normal
@@ -202,9 +226,11 @@ void PrintAndLogEx(logLevel_t level, const char *fmt, ...) {
     } else {
         snprintf(buffer2, sizeof(buffer2), "%s%s", prefix, buffer);
         if (level == INPLACE) {
-            char buffer3[MAX_PRINT_BUFFER + 20] = {0};
+            char buffer3[sizeof(buffer2)] = {0};
+            char buffer4[sizeof(buffer2)] = {0};
             memcpy_filter_ansi(buffer3, buffer2, sizeof(buffer2), !session.supports_colors);
-            fprintf(stream, "\r%s", buffer3);
+            memcpy_filter_emoji(buffer4, buffer3, sizeof(buffer3), session.emoji_mode);
+            fprintf(stream, "\r%s", buffer4);
             fflush(stream);
         } else {
             fPrintAndLog(stream, "%s", buffer2);
@@ -220,6 +246,7 @@ static void fPrintAndLog(FILE *stream, const char *fmt, ...) {
     static int logging = 1;
     char buffer[MAX_PRINT_BUFFER] = {0};
     char buffer2[MAX_PRINT_BUFFER] = {0};
+    char buffer3[MAX_PRINT_BUFFER] = {0};
     // lock this section to avoid interlacing prints from different threads
     pthread_mutex_lock(&print_lock);
 
@@ -276,7 +303,8 @@ static void fPrintAndLog(FILE *stream, const char *fmt, ...) {
     bool filter_ansi = !session.supports_colors;
     memcpy_filter_ansi(buffer2, buffer, sizeof(buffer), filter_ansi);
     if (g_printAndLog & PRINTANDLOG_PRINT) {
-        fprintf(stream, "%s", buffer2);
+        memcpy_filter_emoji(buffer3, buffer2, sizeof(buffer2), session.emoji_mode);
+        fprintf(stream, "%s", buffer3);
         fprintf(stream, "          "); // cleaning prompt
         fprintf(stream, "\n");
     }
@@ -293,10 +321,11 @@ static void fPrintAndLog(FILE *stream, const char *fmt, ...) {
 #endif
 
     if ((g_printAndLog & PRINTANDLOG_LOG) && logging && logfile) {
+        memcpy_filter_emoji(buffer3, buffer2, sizeof(buffer2), ALTTEXT);
         if (filter_ansi) { // already done
-            fprintf(logfile, "%s\n", buffer2);
+            fprintf(logfile, "%s\n", buffer3);
         } else {
-            memcpy_filter_ansi(buffer, buffer2, sizeof(buffer2), true);
+            memcpy_filter_ansi(buffer, buffer3, sizeof(buffer3), true);
             fprintf(logfile, "%s\n", buffer);
         }
         fflush(logfile);
@@ -351,6 +380,102 @@ void memcpy_filter_ansi(void *dest, const void *src, size_t n, bool filter) {
     }
 }
 
+static bool emojify_token(const char *token, uint8_t token_length, const char **emojified_token, uint8_t *emojified_token_length, emojiMode_t mode) {
+    int i = 0;
+    while (EmojiTable[i].alias && EmojiTable[i].emoji) {
+        if ((strlen(EmojiTable[i].alias) == token_length) && (0 == memcmp(EmojiTable[i].alias, token, token_length))) {
+            switch (mode) {
+                case EMOJI: {
+                    *emojified_token = EmojiTable[i].emoji;
+                    *emojified_token_length = strlen(EmojiTable[i].emoji);
+                    break;
+                }
+                case ALTTEXT: {
+                    int j = 0;
+                    *emojified_token_length = 0;
+                    while (EmojiAltTable[j].alias && EmojiAltTable[i].alttext) {
+                        if ((strlen(EmojiAltTable[j].alias) == token_length) && (0 == memcmp(EmojiAltTable[j].alias, token, token_length))) {
+                            *emojified_token = EmojiAltTable[j].alttext;
+                            *emojified_token_length = strlen(EmojiAltTable[j].alttext);
+                            break;
+                        }
+                        ++j;
+                    }
+                    break;
+                }
+                default: {// ERASE
+                    *emojified_token_length = 0;
+                    break;
+                }
+            }
+            return true;
+        }
+        ++i;
+    }
+    return false;
+}
+
+static bool token_charset(uint8_t c) {
+    if ((c >= '0') && (c <= '9')) return true;
+    if ((c >= 'a') && (c <= 'z')) return true;
+    if ((c >= 'A') && (c <= 'Z')) return true;
+    if ((c == '_') || (c == '+') || (c == '-')) return true;
+    return false;
+}
+
+void memcpy_filter_emoji(void *dest, const void *src, size_t n, emojiMode_t mode) {
+    if (mode == ALIAS) {
+        memcpy(dest, src, n);
+    } else {
+        // tokenize emoji
+        const char *emojified_token = NULL;
+        uint8_t emojified_token_length = 0;
+        char *current_token = NULL;
+        uint8_t current_token_length=0;
+        char current_char;
+        char *rdest = (char *)dest;
+        char *rsrc = (char *)src;
+        uint16_t si = 0;
+        for (uint16_t i = 0; i < n; i++) {
+            current_char = rsrc[i];
+
+            if (current_token_length == 0) {
+                // starting a new token.
+                if (current_char == ':') {
+                    current_token = rsrc + i;
+                    current_token_length = 1;
+                } else { // not starting a new token.
+                    rdest[si++] = current_char;
+                }
+            } else {
+                // finishing the current token.
+                if (current_char == ':') {
+                    // nothing changed? we still need the ending ':' as it might serve for an upcoming emoji
+                    if (! emojify_token(current_token, current_token_length + 1, &emojified_token, &emojified_token_length, mode)) {
+                        memcpy(rdest + si, current_token, current_token_length);
+                        si += current_token_length;
+                        current_token = rsrc + i;
+                        current_token_length = 1;
+                    } else {
+                        memcpy(rdest + si, emojified_token, emojified_token_length);
+                        si += emojified_token_length;
+                        current_token_length = 0;
+                    }
+                } else if (token_charset(current_char)) { // continuing the current token.
+                    current_token_length++;
+                } else { // dropping the current token.
+                    current_token_length++;
+                    memcpy(rdest + si, current_token, current_token_length);
+                    si += current_token_length;
+                    current_token_length = 0;
+                }
+            }
+        }
+        memcpy(rdest + si, current_token, current_token_length);
+        si += current_token_length;
+    }
+}
+
 void iceIIR_Butterworth(int *data, const size_t len) {
 
     int *output = (int *) calloc(sizeof(int) * len, sizeof(uint8_t));

client/ui.h

@@ -17,12 +17,17 @@
 
 #define _USE_MATH_DEFINES
 
+typedef enum logLevel {NORMAL, SUCCESS, INFO, FAILED, WARNING, ERR, DEBUG, INPLACE, HINT} logLevel_t;
+typedef enum emojiMode {ALIAS, EMOJI, ALTTEXT, ERASE} emojiMode_t;
+
 typedef struct {
     bool stdinOnTTY;
     bool stdoutOnTTY;
     bool supports_colors;
+    emojiMode_t emoji_mode;
     bool pm3_present;
     bool help_dump_mode;
+    bool show_hints;
 } session_arg_t;
 
 extern session_arg_t session;
@@ -31,7 +36,6 @@ extern session_arg_t session;
 #define M_PI 3.14159265358979323846264338327
 #endif
 #define MAX_PRINT_BUFFER 2048
-typedef enum logLevel {NORMAL, SUCCESS, INFO, FAILED, WARNING, ERR, DEBUG, INPLACE} logLevel_t;
 
 void ShowGui(void);
 void HideGraphWindow(void);
@@ -41,6 +45,7 @@ void PrintAndLogOptions(const char *str[][2], size_t size, size_t space);
 void PrintAndLogEx(logLevel_t level, const char *fmt, ...);
 void SetFlushAfterWrite(bool value);
 void memcpy_filter_ansi(void *dest, const void *src, size_t n, bool filter);
+void memcpy_filter_emoji(void *dest, const void *src, size_t n, emojiMode_t mode);
 
 extern double CursorScaleFactor;
 extern int PlotGridX, PlotGridY, PlotGridXdefault, PlotGridYdefault, GridOffset;

common/cardhelper.c

@@ -18,6 +18,7 @@
 #define CARD_INS_DECRYPT    0x01
 #define CARD_INS_ENCRYPT    0x02
 #define CARD_INS_DECODE     0x06
+#define CARD_INS_NUMBLOCKS  0x07
 static uint8_t cmd[] = {0x96, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 
 // look for CryptoHelper
@@ -64,6 +65,7 @@ bool Encrypt(uint8_t *src, uint8_t *dest){
     return executeCrypto(CARD_INS_ENCRYPT, src, dest);
 }
 
+// Call with block6
 void DecodeBlock6(uint8_t *src) {
     int resp_len = 0;
     uint8_t resp[254] = {0};
@@ -81,3 +83,12 @@ void DecodeBlock6(uint8_t *src) {
     PrintAndLogEx(SUCCESS, "%.*s", resp_len - 11, resp + 9);
 }
 
+// Call with block6
+uint8_t GetNumberBlocksForUserId(uint8_t *src) {
+    int resp_len = 0;
+    uint8_t resp[254] = {0};
+    uint8_t c[] = {0x96, CARD_INS_NUMBLOCKS, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+    memcpy(c + 5, src, 8);
+    ExchangeAPDUSC(true, c, sizeof(c), false, true, resp, sizeof(resp), &resp_len);
+    return resp[8];
+}

common/cardhelper.h

@@ -18,4 +18,5 @@ bool IsCryptoHelperPresent(void);
 bool Encrypt(uint8_t *src, uint8_t *dest);
 bool Decrypt(uint8_t *src, uint8_t *dest);
 void DecodeBlock6(uint8_t *src);
+uint8_t GetNumberBlocksForUserId(uint8_t *src);
 #endif

common/generator.c

@@ -34,7 +34,7 @@
 // XYZ 3D printing
 // Vinglock
 //------------------------------------
-static void transform_D(uint8_t *ru) {
+void transform_D(uint8_t* ru) {
 
     const uint32_t c_D[] = {
         0x6D835AFC, 0x7D15CD97, 0x0942B409, 0x32F9C923, 0xA811FB02, 0x64F121E8,
@@ -49,16 +49,16 @@ static void transform_D(uint8_t *ru) {
 	uint8_t p = 0;
 	uint32_t v1 = ((ru[3] << 24) | (ru[2] << 16) | (ru[1] << 8) | ru[0]) + c_D[p++];
 	uint32_t v2 = ((ru[7] << 24) | (ru[6] << 16) | (ru[5] << 8) | ru[4]) + c_D[p++];
-
-    for (i = 0; i < 12; i += 2) {
-        uint32_t xor1 = v1 ^ v2;
-        uint32_t t1 = ROTL(xor1, v2 & 0x1F) + c_D[p++];
-        uint32_t xor2 = v2 ^ t1;
-        uint32_t t2 = ROTL(xor2, t1 & 0x1F) + c_D[p++];
-        uint32_t xor3 = t1 ^ t2;
-        uint32_t xor4 = t2 ^ v1;
-        v1 = ROTL(xor3, t2 & 0x1F) + c_D[p++];
-        v2 = ROTL(xor4, v1 & 0x1F) + c_D[p++];
+	for (i = 0; i < 12; i += 2)
+	{
+                uint32_t tempA = v1 ^ v2;
+		uint32_t t1 = PM3_ROTL(tempA, v2 & 0x1F) + c_D[p++];
+                uint32_t tempB = v2 ^ t1;
+		uint32_t t2 = PM3_ROTL(tempB, t1 & 0x1F) + c_D[p++];
+                tempA = t1 ^ t2;
+		v1 = PM3_ROTL(tempA, t2 & 0x1F) + c_D[p++];
+                tempB = t2 ^ v1;
+		v2 = PM3_ROTL(tempB, v1 & 0x1F) + c_D[p++];
 	}
 
 	//Re-use ru
@@ -130,17 +130,23 @@ uint32_t ul_ev1_pwdgenC(uint8_t *uid) {
 
 // XYZ 3d printing pwd generation algo nickname D.
 uint32_t ul_ev1_pwdgenD(uint8_t *uid) {
+
     uint8_t i;
-    uint8_t r = (uid[1] + uid[3] + uid[5]) & 7; // rotation offset
-    uint8_t ru[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; // rotated UID
+    // rotation offset
+    uint8_t r = (uid[1] + uid[3] + uid[5]) & 7;
+
+    // rotated UID
+    uint8_t ru[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 
     for (i = 0; i < 7; i++)
         ru[(i + r) & 7] = uid[i];
 
     transform_D(ru);
 
+    // offset    
+    r = (ru[0] + ru[2] + ru[4] + ru[6]) & 3;
+
     // calc key    
     uint32_t pwd = 0;
-    r = (ru[0] + ru[2] + ru[4] + ru[6]) & 3; // offset
     for (i = 0; i < 4; i++)
         pwd = ru[i + r] + (pwd << 8);
 
@@ -412,43 +418,56 @@ int mfc_algo_sky_all(uint8_t *uid, uint8_t *keys) {
 //------------------------------------
 int generator_selftest() {
 
-    PrintAndLogEx(SUCCESS, "Generators selftest");
-    PrintAndLogEx(SUCCESS, "-------------------");
+#define NUM_OF_TEST     5
 
-    bool success;
+    PrintAndLogEx(INFO, "PWD / KEY generator selftest");
+    PrintAndLogEx(INFO, "----------------------------");
+
+    bool success = false;
+    uint8_t testresult = 0;
 
     uint8_t uid1[] = {0x04, 0x11, 0x12, 0x11, 0x12, 0x11, 0x10};
     uint32_t pwd1 = ul_ev1_pwdgenA(uid1);
     success = (pwd1 == 0x8432EB17);
-    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X | %s", sprint_hex(uid1, 7), pwd1, success ? "OK" : "->8432EB17<-");
+    if (success) 
+        testresult++;
+    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X - %s", sprint_hex(uid1, 7), pwd1, success ? "OK" : "->8432EB17<-");
 
     uint8_t uid2[] = {0x04, 0x1f, 0x98, 0xea, 0x1e, 0x3e, 0x81};
     uint32_t pwd2 = ul_ev1_pwdgenB(uid2);
     success = (pwd2 == 0x5fd37eca);
-    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X | %s", sprint_hex(uid2, 7), pwd2, success ? "OK" : "->5fd37eca<--");
+    if (success) 
+        testresult++;
+    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X - %s", sprint_hex(uid2, 7), pwd2, success ? "OK" : "->5fd37eca<--");
 
     uint8_t uid3[] = {0x04, 0x62, 0xB6, 0x8A, 0xB4, 0x42, 0x80};
     uint32_t pwd3 = ul_ev1_pwdgenC(uid3);
     success = (pwd3 == 0x5a349515);
-    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X | %s", sprint_hex(uid3, 7), pwd3, success ? "OK" : "->5a349515<--");
+    if (success) 
+        testresult++;
+    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X - %s", sprint_hex(uid3, 7), pwd3, success ? "OK" : "->5a349515<--");
 
     uint8_t uid4[] = {0x04, 0xC5, 0xDF, 0x4A, 0x6D, 0x51, 0x80};
     uint32_t pwd4 = ul_ev1_pwdgenD(uid4);
     success = (pwd4 == 0x72B1EC61);
-    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X | %s", sprint_hex(uid4, 7), pwd4, success ? "OK" : "->72B1EC61<--");
+    if (success) 
+        testresult++;
+    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %08X - %s", sprint_hex(uid4, 7), pwd4, success ? "OK" : "->72B1EC61<--");
 
 //    uint8_t uid5[] = {0x11, 0x22, 0x33, 0x44};
 //    uint64_t key1 = mfc_algo_a(uid5);
 //    success = (key1 == 0xD1E2AA68E39A);
-//    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %"PRIx64" | %s", sprint_hex(uid5, 4), key1, success ? "OK" : "->D1E2AA68E39A<--");
+//    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %"PRIx64" - %s", sprint_hex(uid5, 4), key1, success ? "OK" : "->D1E2AA68E39A<--");
 
     uint8_t uid6[] = {0x74, 0x57, 0xCA, 0xA9};
     uint64_t key6 = 0;
     mfc_algo_sky_one(uid6, 15, 0, &key6);
     success = (key6 == 0x82c7e64bc565);
-    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s | %"PRIx64" | %s", sprint_hex(uid6, 4), key6, success ? "OK" : "->82C7E64BC565<--");
+    if (success) 
+        testresult++;
+    PrintAndLogEx(success ? SUCCESS : WARNING, "UID | %s          | %"PRIx64" - %s", sprint_hex(uid6, 4), key6, success ? "OK" : "->82C7E64BC565<--");
 
-    PrintAndLogEx(SUCCESS, "-------------------");
+    PrintAndLogEx(SUCCESS, "------------------- Selftest %s", (testresult == NUM_OF_TEST) ? "OK" : "fail");
     return PM3_SUCCESS;
 }
 

doc/cheatsheet.md

@@ -277,6 +277,29 @@ pm3 --> hf mf dump
 pm3 --> hf mf restore 1 u 4A6CE843 k hf-mf-A29558E4-key.bin f hf-mf-A29558E4-data.bin
 ```
 
+Read Mifare Ultralight EV1
+```
+pm3 --> hf mfu info
+```
+
+Clone Mifare Ultralight EV1 Sequence
+```
+pm3 --> hf mfu dump k FFFFFFFF
+pm3 --> script run dumptoemul-mfu -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml
+pm3 --> hf mfu eload u hf-mfu-XXXX-dump.eml
+pm3 --> hf mfu sim t 7 u hf-mfu-XXXX-dump.eml
+```
+
+Bruteforce Mifare Classic card numbers from 11223344 to 11223346
+```
+pm3 --> script run hf_bruteforce -s 0x11223344 -e 0x11223346 -t 1000 -x mfc
+```
+
+Bruteforce Mifare Ultralight EV1 card numbers from 11223344556677 to 11223344556679
+```
+pm3 --> script run hf_bruteforce -s 0x11223344556677 -e 0x11223344556679 -t 1000 -x mfu
+```
+
 ## Wiegand manipulation
 ^[Top](#top)
 

doc/md/Installation_Instructions/Mac-OS-X-Homebrew-Installation-Instructions.md

@@ -33,7 +33,7 @@ brew upgrade --fetch-HEAD proxmark3
 
 ## Flash the BOOTROM & FULLIMAGE
 
-With your Proxmark3 unplugged from your machine, press and hold the button on your Proxmark3 as you plug it into a USB port. You can release the button, two of the four LEDs should stay on. You're un bootloader mode, ready for the next step. In case the two LEDs don't stay on when you're releasing the button, you've an old bootloader, start over and keep the button pressed during the whole flashing procedure.
+With your Proxmark3 unplugged from your machine, press and hold the button on your Proxmark3 as you plug it into a USB port. You can release the button, two of the four LEDs should stay on. You're in bootloader mode, ready for the next step. In case the two LEDs don't stay on when you're releasing the button, you've an old bootloader, start over and keep the button pressed during the whole flashing procedure.
 
 In principle, the helper script `pm3-flash-all` should auto-detect your port, so you can just try:
 

include/common.h

@@ -64,8 +64,8 @@ extern int DBGLEVEL;
 # define ROTR(x,n) (((uintmax_t)(x) >> (n)) | ((uintmax_t)(x) << ((sizeof(x) * 8) - (n))))
 #endif
 
-#ifndef ROTL
-# define ROTL(x,n) (((uintmax_t)(x) << (n)) | ((uintmax_t)(x) >> ((sizeof(x) * 8) - (n))))
+#ifndef PM3_ROTL
+# define PM3_ROTL(x,n) (((uintmax_t)(x) << (n)) | ((uintmax_t)(x) >> ((sizeof(x) * 8) - (n))))
 #endif
 
 // endian change for 64bit

include/mifare.h

@@ -70,6 +70,16 @@ typedef struct {
     uint32_t ProxToAirDuration;
     uint8_t  par; // enough for precalculated parity of 8 Byte responses
 } PACKED tag_response_info_t;
+
+// DESFIRE_RAW flag enums
+typedef enum DESFIRE_COMMAND {
+    NONE         = 0x00,
+    INIT         = 0x01,
+    DISCONNECT   = 0x02,
+    CLEARTRACE   = 0x04,
+    BAR          = 0x10,
+} desfire_command_t;
+
 //-----------------------------------------------------------------------------
 // ISO 14443B
 //-----------------------------------------------------------------------------

include/pm3_cmd.h

@@ -505,6 +505,8 @@ typedef struct {
 
 #define CMD_HF_MIFARE_SNIFF                                               0x0630
 #define CMD_HF_MIFARE_MFKEY                                               0x0631
+#define CMD_HF_MIFARE_PERSONALIZE_UID                                     0x0632
+
 //ultralightC
 #define CMD_HF_MIFAREUC_AUTH                                              0x0724
 //0x0725 and 0x0726 no longer used

include/protocols.h

@@ -163,6 +163,10 @@ ISO 7816-4 Basic interindustry commands. For command APDU's.
 
 #define MIFARE_EV1_PERSONAL_UID     0x40
 #define MIFARE_EV1_SETMODE          0x43
+#define MIFARE_EV1_UIDF0            0x00
+#define MIFARE_EV1_UIDF1            0x40
+#define MIFARE_EV1_UIDF2            0x20
+#define MIFARE_EV1_UIDF3            0x60
 
 #define MIFARE_ULC_WRITE            0xA2
 #define MIFARE_ULC_COMP_WRITE       0xA0
@@ -381,6 +385,8 @@ ISO 7816-4 Basic interindustry commands. For command APDU's.
 #define MFDES_CHANGE_KEY                0xc4
 #define MFDES_GET_KEY_VERSION           0x64
 #define MFDES_AUTHENTICATION_FRAME      0xAF
+#define MFDES_ADDITIONAL_FRAME          0xAF
+#define MFDES_READSIG                   0x3C
 
 // LEGIC Commands
 #define LEGIC_MIM_22                    0x0D

pm3test.sh

@@ -95,6 +95,7 @@ while true; do
 
   printf "\n${C_BLUE}Testing data manipulation:${C_NC}\n"
   if ! CheckExecute "reveng test" "./client/proxmark3 -c 'reveng -w 8 -s 01020304e3 010204039d'" "CRC-8/SMBUS"; then break; fi
+  if ! CheckExecute "mfu pwdgen test" "./client/proxmark3 -c 'hf mfu pwdgen t'" "Selftest OK"; then break; fi
   
   printf "\n${C_BLUE}Testing LF:${C_NC}\n"
   if ! CheckExecute "lf em4x05 test" "./client/proxmark3 -c 'data load traces/em4x05.pm3;lf search'" "FDX-B ID found"; then break; fi
@@ -120,6 +121,7 @@ while true; do
   if ! CheckExecute "findbits test" "tools/findbits.py 73 0110010101110011" "Match at bit 9: 011001010"; then break; fi
   if ! CheckExecute "findbits_test test" "tools/findbits_test.py 2>&1" "OK"; then break; fi
   if ! CheckExecute "pm3_eml_mfd test" "tools/pm3_eml_mfd_test.py 2>&1" "OK"; then break; fi
+  
   printf "\n${C_GREEN}Tests [OK]${C_NC}\n\n"
   exit 0
 done

tools/hitag2crack/crack2/hitagcrypto.c

@@ -228,19 +228,17 @@ static uint32_t hitag2_crypt(uint64_t x);
 #define pickbits1_2_1(S, A, B, C)  ( ((S >> A) & 1) | ((S >> (B - 1)) & 6) | \
                                    ((S >> (C - 3)) & 8) )
 
-
-static uint32_t hitag2_crypt(uint64_t s)
-{
+static uint32_t hitag2_crypt(uint64_t x) {
     const uint32_t ht2_function4a = 0x2C79;	// 0010 1100 0111 1001
     const uint32_t ht2_function4b = 0x6671;	// 0110 0110 0111 0001
     const uint32_t ht2_function5c = 0x7907287B;	// 0111 1001 0000 0111 0010 1000 0111 1011
     uint32_t bitindex;
 
-    bitindex =  (ht2_function4a >> pickbits2_2 (s, 1, 4)) & 1;
-    bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2 (s, 7, 11, 13)) & 0x02;
-    bitindex |= ((ht2_function4b << 2) >> pickbits1x4 (s, 16, 20, 22, 25)) & 0x04;
-    bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1 (s, 27, 30, 32)) & 0x08;
-    bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(s, 33, 42, 45)) & 0x10;
+    bitindex = (ht2_function4a >> pickbits2_2(x, 1, 4)) & 1;
+    bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2(x, 7, 11, 13)) & 0x02;
+    bitindex |= ((ht2_function4b << 2) >> pickbits1x4(x, 16, 20, 22, 25)) & 0x04;
+    bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1(x, 27, 30, 32)) & 0x08;
+    bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(x, 33, 42, 45)) & 0x10;
 
     DEBUG_PRINTF("hitag2_crypt bitindex = %02x\n", bitindex);
     return (ht2_function5c >> bitindex) & 1;
@@ -253,8 +251,7 @@ static uint32_t hitag2_crypt(uint64_t s)
  * uint32_t serialnum  - 32 bit tag serial number
  * uint32_t initvector - 32 bit random IV from reader, part of tag authentication
  */
-void hitag2_init(Hitag_State* pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector)
-{
+void hitag2_init(Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector) {
     // init state, from serial number and lowest 16 bits of shared key
     uint64_t state = ((sharedkey & 0xFFFF) << 32) | serialnum;
 
@@ -338,8 +335,7 @@ void hitag2_init(Hitag_State* pstate, uint64_t sharedkey, uint32_t serialnum, ui
  * Hitag_State* pstate - in/out, internal cipher state after initialisation
  * uint32_t steps      - number of bits requested, (capped at 32)
  */
-uint32_t hitag2_nstep(Hitag_State* pstate, uint32_t steps)
-{
+uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps) {
     uint64_t state = pstate->shiftreg;
     uint32_t result = 0;
     uint64_t lfsr = pstate->lfsr;
@@ -471,8 +467,7 @@ unsigned hitag2_verifytest()
 
 #ifdef UNIT_TEST
 
-int main(int argc, char* argv[])
-{
+int main(int argc, char *argv[]) {
     unsigned pass = hitag2_verifytest();
 
     printf("Crypto Verify test = %s\n\n", pass ? "PASS" : "FAIL");

tools/hitag2crack/crack2/ht2crack2buildtable.c

@@ -53,8 +53,7 @@ uint64_t d2[48];
 int nsteps2;
 
 // create table entry
-void create_table(struct table *t, int d1, int d2)
-{
+void create_table(struct table *t, int d1, int d2) {
     if (!t) {
         printf("create_table: t is NULL\n");
         exit(1);
@@ -83,8 +82,7 @@ void create_table(struct table *t, int d1, int d2)
 
 
 // create all table entries
-void create_tables(struct table *t)
-{
+void create_tables(struct table *t) {
     int i, j;
 
     if (!t) {
@@ -101,8 +99,7 @@ void create_tables(struct table *t)
 
 
 // free the table memory
-void free_tables(struct table *t)
-{
+void free_tables(struct table *t) {
     int i;
     struct table *ttmp;
 
@@ -120,8 +117,7 @@ void free_tables(struct table *t)
 
 
 // write (partial) table to file
-void writetable(struct table *t1)
-{
+void writetable(struct table *t1) {
     int fd;
 
     if (debug) printf("writetable %s\n", t1->path);
@@ -146,18 +142,17 @@ void writetable(struct table *t1)
 
 
 // store value in table
-void store(unsigned char *data)
-{
-    unsigned char d1, d2;
+void store(unsigned char *data) {
+    unsigned char d_1, d_2;
     int offset;
     struct table *t1;
 
     // use the first two bytes as an index
-    d1 = data[0];
-    d2 = data[1];
-    offset = (d1 * 0x100) + d2;
+    d_1 = data[0];
+    d_2 = data[1];
+    offset = (d_1 * 0x100) + d_2;
 
-    if (debug) printf("store, d1=%02X, d2=%02X, offset = %d\n", d1, d2, offset);
+    if (debug) printf("store, d1=%02X, d2=%02X, offset = %d\n", d_1, d_2, offset);
 
     // get pointer to table entry
     t1 = t + offset;
@@ -199,8 +194,7 @@ void store(unsigned char *data)
 }
 
 // writes the ks (keystream) and s (state)
-void write_ks_s(uint32_t ks1, uint32_t ks2, uint64_t shiftreg)
-{
+void write_ks_s(uint32_t ks1, uint32_t ks2, uint64_t shiftreg) {
     unsigned char buf[16];
 
     // create buffer
@@ -215,8 +209,7 @@ void write_ks_s(uint32_t ks1, uint32_t ks2, uint64_t shiftreg)
 
 
 // builds the di table for jumping
-void builddi(int steps, int table)
-{
+void builddi(int steps, int table) {
     uint64_t statemask;
     int i;
     Hitag_State mystate;
@@ -248,8 +241,7 @@ void builddi(int steps, int table)
 }
 
 // jump function - quickly jumps a load of steps
-void jumpnsteps(Hitag_State *hstate, int table)
-{
+void jumpnsteps(Hitag_State *hstate, int table) {
     uint64_t output = 0;
     uint64_t bitmask;
     int i;
@@ -285,8 +277,7 @@ void jumpnsteps(Hitag_State *hstate, int table)
 
 
 // thread to build a part of the table
-void *buildtable(void *d)
-{
+void *buildtable(void *d) {
     Hitag_State hstate;
     Hitag_State hstate2;
     unsigned long i;
@@ -343,8 +334,7 @@ void *buildtable(void *d)
 
 
 // make 'table/' (unsorted) and 'sorted/' dir structures
-void makedirs()
-{
+void makedirs() {
     char path[32];
     int i;
 
@@ -371,16 +361,14 @@ void makedirs()
     }
 }
 
-static int datacmp(const void *p1, const void *p2, void *dummy)
-{
-    unsigned char *d1 = (unsigned char *)p1;
-    unsigned char *d2 = (unsigned char *)p2;
+static int datacmp(const void *p1, const void *p2, void *dummy) {
+    unsigned char *d_1 = (unsigned char *)p1;
+    unsigned char *d_2 = (unsigned char *)p2;
 
-    return memcmp(d1, d2, DATASIZE);
+    return memcmp(d_1, d_2, DATASIZE);
 }
 
-void *sorttable(void *d)
-{
+void *sorttable(void *d) {
     int i, j;
     int fdin;
     int fdout;
@@ -464,8 +452,7 @@ void *sorttable(void *d)
     return NULL;
 }
 
-int main(int argc, char *argv[])
-{
+int main(int argc, char *argv[]) {
     pthread_t threads[NUM_BUILD_THREADS];
     void *status;
     long i;

tools/hitag2crack/crack2/ht2crack2gentest.c

@@ -6,8 +6,7 @@
 #include "ht2crack2utils.h"
 
 
-int makerandom(char *hex, unsigned int len, int fd)
-{
+int makerandom(char *hex, unsigned int len, int fd) {
     unsigned char raw[32];
     int i;
 
@@ -34,8 +33,7 @@ int makerandom(char *hex, unsigned int len, int fd)
 }
 
 
-int main(int argc, char *argv[])
-{
+int main(int argc, char *argv[]) {
     Hitag_State hstate;
     char key[32];
     char uid[32];

tools/hitag2crack/crack2/ht2crack2search.c

@@ -17,16 +17,14 @@ struct rngdata {
 
 
 
-static int datacmp(const void *p1, const void *p2)
-{
+static int datacmp(const void *p1, const void *p2) {
     unsigned char *d1 = (unsigned char *)p1;
     unsigned char *d2 = (unsigned char *)p2;
 
     return memcmp(d1, d2, DATASIZE - 6);
 }
 
-int loadrngdata(struct rngdata *r, char *file)
-{
+int loadrngdata(struct rngdata *r, char *file) {
     int fd;
     int i, j;
     int nibble;
@@ -93,8 +91,7 @@ int loadrngdata(struct rngdata *r, char *file)
     return 1;
 }
 
-int makecand(unsigned char *c, struct rngdata *r, int bitoffset)
-{
+int makecand(unsigned char *c, struct rngdata *r, int bitoffset) {
     int bytenum;
     int bitnum;
     int i;
@@ -120,8 +117,7 @@ int makecand(unsigned char *c, struct rngdata *r, int bitoffset)
 
 
 // test the candidate against the next or previous rng data
-int testcand(unsigned char *f, unsigned char *rt, int fwd)
-{
+int testcand(unsigned char *f, unsigned char *rt, int fwd) {
     Hitag_State hstate;
     int i;
     uint32_t ks1;
@@ -159,8 +155,7 @@ int testcand(unsigned char *f, unsigned char *rt, int fwd)
     }
 }
 
-int searchcand(unsigned char *c, unsigned char *rt, int fwd, unsigned char *m, unsigned char *s)
-{
+int searchcand(unsigned char *c, unsigned char *rt, int fwd, unsigned char *m, unsigned char *s) {
     int fd;
     struct stat filestat;
     char file[64];
@@ -228,8 +223,7 @@ int searchcand(unsigned char *c, unsigned char *rt, int fwd, unsigned char *m, u
 
 }
 
-int findmatch(struct rngdata *r, unsigned char *outmatch, unsigned char *outstate, int *bitoffset)
-{
+int findmatch(struct rngdata *r, unsigned char *outmatch, unsigned char *outstate, int *bitoffset) {
     int i;
     int bitlen;
     unsigned char cand[6];
@@ -283,8 +277,7 @@ int findmatch(struct rngdata *r, unsigned char *outmatch, unsigned char *outstat
 
 
 
-void rollbackrng(Hitag_State *hstate, unsigned char *s, int offset)
-{
+void rollbackrng(Hitag_State *hstate, unsigned char *s, int offset) {
     int i;
 
     if (!s) {
@@ -313,8 +306,7 @@ void rollbackrng(Hitag_State *hstate, unsigned char *s, int offset)
 
 }
 
-uint64_t recoverkey(Hitag_State *hstate, char *uidstr, char *nRstr)
-{
+uint64_t recoverkey(Hitag_State *hstate, char *uidstr, char *nRstr) {
     uint64_t key;
     uint64_t keyupper;
     uint32_t uid;
@@ -364,8 +356,7 @@ uint64_t recoverkey(Hitag_State *hstate, char *uidstr, char *nRstr)
 }
 
 
-int main(int argc, char *argv[])
-{
+int main(int argc, char *argv[]) {
     Hitag_State hstate;
     struct rngdata rng;
     int bitoffset = 0;

tools/hitag2crack/crack2/ht2crack2utils.c

@@ -1,13 +1,11 @@
 #include "ht2crack2utils.h"
 
 // writes a value into a buffer as a series of bytes
-void writebuf(unsigned char *buf, uint64_t val, unsigned int len)
-{
+void writebuf(unsigned char *buf, uint64_t val, unsigned int len) {
     int i;
     char c;
 
-    for (i=len-1; i>=0; i--)
-    {
+    for (i = len - 1; i >= 0; i--) {
         c = val & 0xff;
         buf[i] = c;
         val = val >> 8;
@@ -17,8 +15,7 @@ void writebuf(unsigned char *buf, uint64_t val, unsigned int len)
 
 
 /* simple hexdump for testing purposes */
-void shexdump(unsigned char *data, int data_len)
-{
+void shexdump(unsigned char *data, int data_len) {
     int i;
 
     if (!data || (data_len <= 0)) {
@@ -39,8 +36,7 @@ void shexdump(unsigned char *data, int data_len)
 
 
 
-void printbin(unsigned char *c)
-{
+void printbin(unsigned char *c) {
     int i, j;
     unsigned char x;
 
@@ -60,8 +56,7 @@ void printbin(unsigned char *c)
 }
 
 
-void printbin2(uint64_t val, unsigned int size)
-{
+void printbin2(uint64_t val, unsigned int size) {
     int i;
     uint64_t mask = 1;
 
@@ -78,8 +73,7 @@ void printbin2(uint64_t val, unsigned int size)
 }
 
 
-void printstate(Hitag_State *hstate)
-{
+void printstate(Hitag_State *hstate) {
     printf("shiftreg =\t");
     printbin2(hstate->shiftreg, 48);
     printf("\n");
@@ -89,8 +83,7 @@ void printstate(Hitag_State *hstate)
 
 
 // convert hex char to binary
-unsigned char hex2bin(unsigned char c)
-{
+unsigned char hex2bin(unsigned char c) {
     if ((c >= '0') && (c <= '9')) {
         return (c - '0');
     } else if ((c >= 'a') && (c <= 'f')) {
@@ -103,8 +96,7 @@ unsigned char hex2bin(unsigned char c)
 }
 
 // return a single bit from a value
-int bitn(uint64_t x, int bit)
-{
+int bitn(uint64_t x, int bit) {
     uint64_t bitmask = 1;
 
     bitmask = bitmask << bit;
@@ -118,8 +110,7 @@ int bitn(uint64_t x, int bit)
 
 
 // the sub-function R that rollback depends upon
-int fnR(uint64_t x)
-{
+int fnR(uint64_t x) {
     // renumbered bits because my state is 0-47, not 1-48
     return (bitn(x, 1) ^ bitn(x, 2) ^ bitn(x, 5) ^ bitn(x, 6) ^ bitn(x, 7) ^
             bitn(x, 15) ^ bitn(x, 21) ^ bitn(x, 22) ^ bitn(x, 25) ^ bitn(x, 29) ^ bitn(x, 40) ^
@@ -127,8 +118,7 @@ int fnR(uint64_t x)
 }
 
 // the rollback function that lets us go backwards in time
-void rollback(Hitag_State *hstate, unsigned int steps)
-{
+void rollback(Hitag_State *hstate, unsigned int steps) {
     int i;
 
     for (i = 0; i < steps; i++) {
@@ -139,24 +129,20 @@ void rollback(Hitag_State *hstate, unsigned int steps)
 
 
 // the three filter sub-functions that feed fnf
-int fa(unsigned int i)
-{
+int fa(unsigned int i) {
     return bitn(0x2C79, i);
 }
 
-int fb(unsigned int i)
-{
+int fb(unsigned int i) {
     return bitn(0x6671, i);
 }
 
-int fc(unsigned int i)
-{
+int fc(unsigned int i) {
     return bitn(0x7907287B, i);
 }
 
 // the filter function that generates a bit of output from the prng state
-int fnf(uint64_t s)
-{
+int fnf(uint64_t s) {
     unsigned int x1, x2, x3, x4, x5, x6;
 
     x1 = (bitn(s,  2) << 0) | (bitn(s,  3) << 1) | (bitn(s,  5) << 2) | (bitn(s,  6) << 3);
@@ -171,8 +157,7 @@ int fnf(uint64_t s)
 }
 
 // builds the lfsr for the prng (quick calcs for hitag2_nstep())
-void buildlfsr(Hitag_State *hstate)
-{
+void buildlfsr(Hitag_State *hstate) {
     uint64_t state = hstate->shiftreg;
     uint64_t temp;
 

tools/hitag2crack/crack2/utilpart.c

@@ -142,8 +142,7 @@ rtccTime	RTC_time;			// time structure
 rtccDate	RTC_date;			// date structure
 
 // convert byte-reversed 8 digit hex to unsigned long
-unsigned long hexreversetoulong(BYTE *hex)
-{
+unsigned long hexreversetoulong(BYTE *hex) {
     unsigned long ret = 0L;
     unsigned int x;
     BYTE i;
@@ -151,8 +150,7 @@ unsigned long hexreversetoulong(BYTE *hex)
     if (strlen(hex) != 8)
         return 0L;
 
-    for(i= 0 ; i < 4 ; ++i)
-    {
+    for (i = 0 ; i < 4 ; ++i) {
         if (sscanf(hex, "%2X", &x) != 1)
             return 0L;
         ret += ((unsigned long) x) << i * 8;
@@ -162,8 +160,7 @@ unsigned long hexreversetoulong(BYTE *hex)
 }
 
 // convert byte-reversed 12 digit hex to unsigned long
-unsigned long long hexreversetoulonglong(BYTE *hex)
-{
+unsigned long long hexreversetoulonglong(BYTE *hex) {
     unsigned long long ret = 0LL;
     BYTE tmp[9];
 

tools/hitag2crack/crack3/hitagcrypto.c

@@ -229,18 +229,17 @@ static uint32_t hitag2_crypt(uint64_t x);
                                    ((S >> (C - 3)) & 8) )
 
 
-static uint32_t hitag2_crypt(uint64_t s)
-{
+static uint32_t hitag2_crypt(uint64_t x) {
     const uint32_t ht2_function4a = 0x2C79;	// 0010 1100 0111 1001
     const uint32_t ht2_function4b = 0x6671;	// 0110 0110 0111 0001
     const uint32_t ht2_function5c = 0x7907287B;	// 0111 1001 0000 0111 0010 1000 0111 1011
     uint32_t bitindex;
 
-    bitindex =  (ht2_function4a >> pickbits2_2 (s, 1, 4)) & 1;
-    bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2 (s, 7, 11, 13)) & 0x02;
-    bitindex |= ((ht2_function4b << 2) >> pickbits1x4 (s, 16, 20, 22, 25)) & 0x04;
-    bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1 (s, 27, 30, 32)) & 0x08;
-    bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(s, 33, 42, 45)) & 0x10;
+    bitindex = (ht2_function4a >> pickbits2_2(x, 1, 4)) & 1;
+    bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2(x, 7, 11, 13)) & 0x02;
+    bitindex |= ((ht2_function4b << 2) >> pickbits1x4(x, 16, 20, 22, 25)) & 0x04;
+    bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1(x, 27, 30, 32)) & 0x08;
+    bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(x, 33, 42, 45)) & 0x10;
 
     DEBUG_PRINTF("hitag2_crypt bitindex = %02x\n", bitindex);
     return (ht2_function5c >> bitindex) & 1;
@@ -253,8 +252,7 @@ static uint32_t hitag2_crypt(uint64_t s)
  * uint32_t serialnum  - 32 bit tag serial number
  * uint32_t initvector - 32 bit random IV from reader, part of tag authentication
  */
-void hitag2_init(Hitag_State* pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector)
-{
+void hitag2_init(Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector) {
     // init state, from serial number and lowest 16 bits of shared key
     uint64_t state = ((sharedkey & 0xFFFF) << 32) | serialnum;
 
@@ -338,8 +336,7 @@ void hitag2_init(Hitag_State* pstate, uint64_t sharedkey, uint32_t serialnum, ui
  * Hitag_State* pstate - in/out, internal cipher state after initialisation
  * uint32_t steps      - number of bits requested, (capped at 32)
  */
-uint32_t hitag2_nstep(Hitag_State* pstate, uint32_t steps)
-{
+uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps) {
     uint64_t state = pstate->shiftreg;
     uint32_t result = 0;
     uint64_t lfsr = pstate->lfsr;
@@ -469,8 +466,7 @@ unsigned hitag2_verifytest()
 
 #ifdef UNIT_TEST
 
-int main(int argc, char* argv[])
-{
+int main(int argc, char *argv[]) {
     unsigned pass = hitag2_verifytest();
 
     printf("Crypto Verify test = %s\n\n", pass ? "PASS" : "FAIL");

tools/hitag2crack/crack3/ht2crack3.c

@@ -1,6 +1,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <pthread.h>
+#include <inttypes.h>
 
 #include "HardwareProfile.h"
 #include "rfidler.h"
@@ -34,8 +35,7 @@ struct threaddata {
     uint64_t klowerrange;
 };
 
-void printbin(uint64_t val)
-{
+void printbin(uint64_t val) {
     int i;
 
     for (i = 0; i < 64; i++) {
@@ -48,8 +48,7 @@ void printbin(uint64_t val)
     }
 }
 
-void printstate(Hitag_State *hstate)
-{
+void printstate(Hitag_State *hstate) {
     printf("shiftreg =\t");
     printbin(hstate->shiftreg);
     printf("\n");
@@ -70,8 +69,7 @@ void printstate(Hitag_State *hstate)
                                    ((S >> (C - 3)) & 8) )
 
 
-static uint32_t hitag2_crypt(uint64_t s)
-{
+static uint32_t hitag2_crypt(uint64_t s) {
     const uint32_t ht2_function4a = 0x2C79; // 0010 1100 0111 1001
     const uint32_t ht2_function4b = 0x6671; // 0110 0110 0111 0001
     const uint32_t ht2_function5c = 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011
@@ -89,8 +87,7 @@ static uint32_t hitag2_crypt(uint64_t s)
 
 // this function is a modification of the filter function f, based heavily
 // on the hitag2_crypt function in Rfidler
-int fnP(uint64_t klowery)
-{
+int fnP(uint64_t klowery) {
     const uint32_t ht2_function4a = 0x2C79; // 0010 1100 0111 1001
     const uint32_t ht2_function4b = 0x6671; // 0110 0110 0111 0001
     const uint32_t ht2_function4p = 0xAE83; // 1010 1110 1000 0011
@@ -109,8 +106,7 @@ int fnP(uint64_t klowery)
 }
 
 // comparison function for sorting/searching Tklower entries
-int Tk_cmp(const void *v1, const void *v2)
-{
+int Tk_cmp(const void *v1, const void *v2) {
     const struct Tklower *Tk1 = (struct Tklower *)v1;
     const struct Tklower *Tk2 = (struct Tklower *)v2;
 
@@ -148,8 +144,7 @@ int is_kmiddle_badguess(uint64_t z, struct Tklower *Tk, int max, int aR0) {
 }
 
 // function to test if a partial key is valid
-int testkey(uint64_t *out, uint64_t uid, uint64_t pkey, uint64_t nR, uint64_t aR)
-{
+int testkey(uint64_t *out, uint64_t uid, uint64_t pkey, uint64_t nR, uint64_t aR) {
     uint64_t kupper;
     uint64_t key;
     Hitag_State hstate;
@@ -205,8 +200,7 @@ int testkey(uint64_t *out, uint64_t uid, uint64_t pkey, uint64_t nR, uint64_t aR
 // effectively work out candidates for the lower 34 bits of the key.
 
 
-void *crack(void *d)
-{
+void *crack(void *d) {
     struct threaddata *data = (struct threaddata *)d;
     uint64_t uid;
     struct nRaR *TnRaR;
@@ -250,7 +244,7 @@ void *crack(void *d)
 
     // find keys
     for (klower = data->klowerstart; klower < (data->klowerstart + data->klowerrange); klower++) {
-        printf("trying klower = 0x%05lx\n", klower);
+        printf("trying klower = 0x%05"PRIx64"\n", klower);
         // build table
         count = 0;
         for (y = 0; y < 0x40000; y++) {
@@ -311,7 +305,7 @@ void *crack(void *d)
 
             if ((found) && (!badguess)) {
                 // brute
-                printf("possible partial key found: 0x%012lx\n", ((uint64_t)kmiddle << 16) | klower);
+                printf("possible partial key found: 0x%012"PRIx64"\n", ((uint64_t)kmiddle << 16) | klower);
 
                 if (testkey(&foundkey, uid, (kmiddle << 16 | klower), TnRaR[0].nR, TnRaR[0].aR) &&
                         testkey(&foundkey, uid, (kmiddle << 16 | klower), TnRaR[1].nR, TnRaR[1].aR)) {
@@ -331,8 +325,7 @@ void *crack(void *d)
 
     return NULL;
 }
-int main(int argc, char *argv[])
-{
+int main(int argc, char *argv[]) {
     FILE *fp;
     int i;
     pthread_t threads[NUM_THREADS];
@@ -389,14 +382,14 @@ int main(int argc, char *argv[])
     while (getline(&buf, &lenbuf, fp) > 0) {
         buft1 = strchr(buf, ' ');
         if (!buft1) {
-            printf("invalid file input on line %d\n", numnrar + 1);
+            printf("invalid file input on line %u\n", numnrar + 1);
             exit(1);
         }
         *buft1 = 0x00;
         buft1++;
         buft2 = strchr(buft1, '\n');
         if (!buft2) {
-            printf("no CR on line %d\n", numnrar + 1);
+            printf("no CR on line %u\n", numnrar + 1);
             exit(1);
         }
         *buft2 = 0x00;
@@ -414,7 +407,7 @@ int main(int argc, char *argv[])
     fclose(fp);
     fp = NULL;
 
-    printf("Loaded %d NrAr pairs\n", numnrar);
+    printf("Loaded %u NrAr pairs\n", numnrar);
 
     // create table of thread data
     tdata = (struct threaddata *)malloc(sizeof(struct threaddata) * NUM_THREADS);

tools/hitag2crack/crack3/ht2test.c

@@ -9,8 +9,7 @@
 
 
 
-int main(int argc, char *argv[])
-{
+int main(int argc, char *argv[]) {
     Hitag_State hstate;
     FILE *fp;
     char *line = NULL;

tools/hitag2crack/crack3/utilpart.c

@@ -142,8 +142,7 @@ rtccTime	RTC_time;			// time structure
 rtccDate	RTC_date;			// date structure
 
 // convert byte-reversed 8 digit hex to unsigned long
-unsigned long hexreversetoulong(BYTE *hex)
-{
+unsigned long hexreversetoulong(BYTE *hex) {
     unsigned long ret = 0L;
     unsigned int x;
     BYTE i;
@@ -151,8 +150,7 @@ unsigned long hexreversetoulong(BYTE *hex)
     if (strlen(hex) != 8)
         return 0L;
 
-    for(i= 0 ; i < 4 ; ++i)
-    {
+    for (i = 0 ; i < 4 ; ++i) {
         if (sscanf(hex, "%2X", &x) != 1)
             return 0L;
         ret += ((unsigned long) x) << i * 8;
@@ -162,8 +160,7 @@ unsigned long hexreversetoulong(BYTE *hex)
 }
 
 // convert byte-reversed 12 digit hex to unsigned long
-unsigned long long hexreversetoulonglong(BYTE *hex)
-{
+unsigned long long hexreversetoulonglong(BYTE *hex) {
     unsigned long long ret = 0LL;
     BYTE tmp[9];
 

tools/hitag2crack/crack4/hitagcrypto.c

@@ -229,18 +229,17 @@ static uint32_t hitag2_crypt(uint64_t x);
                                    ((S >> (C - 3)) & 8) )
 
 
-static uint32_t hitag2_crypt(uint64_t s)
-{
+static uint32_t hitag2_crypt(uint64_t x) {
     const uint32_t ht2_function4a = 0x2C79;	// 0010 1100 0111 1001
     const uint32_t ht2_function4b = 0x6671;	// 0110 0110 0111 0001
     const uint32_t ht2_function5c = 0x7907287B;	// 0111 1001 0000 0111 0010 1000 0111 1011
     uint32_t bitindex;
 
-    bitindex =  (ht2_function4a >> pickbits2_2 (s, 1, 4)) & 1;
-    bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2 (s, 7, 11, 13)) & 0x02;
-    bitindex |= ((ht2_function4b << 2) >> pickbits1x4 (s, 16, 20, 22, 25)) & 0x04;
-    bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1 (s, 27, 30, 32)) & 0x08;
-    bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(s, 33, 42, 45)) & 0x10;
+    bitindex = (ht2_function4a >> pickbits2_2(x, 1, 4)) & 1;
+    bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2(x, 7, 11, 13)) & 0x02;
+    bitindex |= ((ht2_function4b << 2) >> pickbits1x4(x, 16, 20, 22, 25)) & 0x04;
+    bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1(x, 27, 30, 32)) & 0x08;
+    bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(x, 33, 42, 45)) & 0x10;
 
     DEBUG_PRINTF("hitag2_crypt bitindex = %02x\n", bitindex);
     return (ht2_function5c >> bitindex) & 1;
@@ -253,8 +252,7 @@ static uint32_t hitag2_crypt(uint64_t s)
  * uint32_t serialnum  - 32 bit tag serial number
  * uint32_t initvector - 32 bit random IV from reader, part of tag authentication
  */
-void hitag2_init(Hitag_State* pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector)
-{
+void hitag2_init(Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector) {
     // init state, from serial number and lowest 16 bits of shared key
     uint64_t state = ((sharedkey & 0xFFFF) << 32) | serialnum;
 
@@ -338,8 +336,7 @@ void hitag2_init(Hitag_State* pstate, uint64_t sharedkey, uint32_t serialnum, ui
  * Hitag_State* pstate - in/out, internal cipher state after initialisation
  * uint32_t steps      - number of bits requested, (capped at 32)
  */
-uint32_t hitag2_nstep(Hitag_State* pstate, uint32_t steps)
-{
+uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps) {
     uint64_t state = pstate->shiftreg;
     uint32_t result = 0;
     uint64_t lfsr = pstate->lfsr;
@@ -469,8 +466,7 @@ unsigned hitag2_verifytest()
 
 #ifdef UNIT_TEST
 
-int main(int argc, char* argv[])
-{
+int main(int argc, char *argv[]) {
     unsigned pass = hitag2_verifytest();
 
     printf("Crypto Verify test = %s\n\n", pass ? "PASS" : "FAIL");

tools/hitag2crack/crack4/ht2crack2utils.c

@@ -1,13 +1,11 @@
 #include "ht2crack2utils.h"
 
 // writes a value into a buffer as a series of bytes
-void writebuf(unsigned char *buf, uint64_t val, unsigned int len)
-{
+void writebuf(unsigned char *buf, uint64_t val, unsigned int len) {
     int i;
     char c;
 
-    for (i=len-1; i>=0; i--)
-    {
+    for (i = len - 1; i >= 0; i--) {
         c = val & 0xff;
         buf[i] = c;
         val = val >> 8;
@@ -17,8 +15,7 @@ void writebuf(unsigned char *buf, uint64_t val, unsigned int len)
 
 
 /* simple hexdump for testing purposes */
-void shexdump(unsigned char *data, int data_len)
-{
+void shexdump(unsigned char *data, int data_len) {
     int i;
 
     if (!data || (data_len <= 0)) {
@@ -39,8 +36,7 @@ void shexdump(unsigned char *data, int data_len)
 
 
 
-void printbin(unsigned char *c)
-{
+void printbin(unsigned char *c) {
     int i, j;
     unsigned char x;
 
@@ -60,8 +56,7 @@ void printbin(unsigned char *c)
 }
 
 
-void printbin2(uint64_t val, unsigned int size)
-{
+void printbin2(uint64_t val, unsigned int size) {
     int i;
     uint64_t mask = 1;
 
@@ -78,8 +73,7 @@ void printbin2(uint64_t val, unsigned int size)
 }
 
 
-void printstate(Hitag_State *hstate)
-{
+void printstate(Hitag_State *hstate) {
     printf("shiftreg =\t");
     printbin2(hstate->shiftreg, 48);
     printf("\n");
@@ -89,8 +83,7 @@ void printstate(Hitag_State *hstate)
 
 
 // convert hex char to binary
-unsigned char hex2bin(unsigned char c)
-{
+unsigned char hex2bin(unsigned char c) {
     if ((c >= '0') && (c <= '9')) {
         return (c - '0');
     } else if ((c >= 'a') && (c <= 'f')) {
@@ -103,8 +96,7 @@ unsigned char hex2bin(unsigned char c)
 }
 
 // return a single bit from a value
-int bitn(uint64_t x, int bit)
-{
+int bitn(uint64_t x, int bit) {
     uint64_t bitmask = 1;
 
     bitmask = bitmask << bit;
@@ -118,8 +110,7 @@ int bitn(uint64_t x, int bit)
 
 
 // the sub-function R that rollback depends upon
-int fnR(uint64_t x)
-{
+int fnR(uint64_t x) {
     // renumbered bits because my state is 0-47, not 1-48
     return (bitn(x, 1) ^ bitn(x, 2) ^ bitn(x, 5) ^ bitn(x, 6) ^ bitn(x, 7) ^
             bitn(x, 15) ^ bitn(x, 21) ^ bitn(x, 22) ^ bitn(x, 25) ^ bitn(x, 29) ^ bitn(x, 40) ^
@@ -127,8 +118,7 @@ int fnR(uint64_t x)
 }
 
 // the rollback function that lets us go backwards in time
-void rollback(Hitag_State *hstate, unsigned int steps)
-{
+void rollback(Hitag_State *hstate, unsigned int steps) {
     int i;
 
     for (i = 0; i < steps; i++) {
@@ -139,24 +129,20 @@ void rollback(Hitag_State *hstate, unsigned int steps)
 
 
 // the three filter sub-functions that feed fnf
-int fa(unsigned int i)
-{
+int fa(unsigned int i) {
     return bitn(0x2C79, i);
 }
 
-int fb(unsigned int i)
-{
+int fb(unsigned int i) {
     return bitn(0x6671, i);
 }
 
-int fc(unsigned int i)
-{
+int fc(unsigned int i) {
     return bitn(0x7907287B, i);
 }
 
 // the filter function that generates a bit of output from the prng state
-int fnf(uint64_t s)
-{
+int fnf(uint64_t s) {
     unsigned int x1, x2, x3, x4, x5, x6;
 
     x1 = (bitn(s,  2) << 0) | (bitn(s,  3) << 1) | (bitn(s,  5) << 2) | (bitn(s,  6) << 3);
@@ -171,8 +157,7 @@ int fnf(uint64_t s)
 }
 
 // builds the lfsr for the prng (quick calcs for hitag2_nstep())
-void buildlfsr(Hitag_State *hstate)
-{
+void buildlfsr(Hitag_State *hstate) {
     uint64_t state = hstate->shiftreg;
     uint64_t temp;
 

tools/hitag2crack/crack4/ht2crack4.c

@@ -93,8 +93,7 @@ uint64_t uid;
 int maxtablesize = 800000;
 uint64_t supplied_testkey = 0;
 
-void usage()
-{
+void usage() {
     printf("ht2crack4 - K Sheldrake, based on the work of Garcia et al\n\n");
     printf("Cracks a HiTag2 key using a small number (4 to 16) of encrypted\n");
     printf("nonce and challenge response pairs, using a fast correlation\n");
@@ -148,8 +147,7 @@ double pfnc[][16] = {
 
 
 /* hitag2_crypt works on the post-shifted form of the lfsr; this is the ref in rfidler code */
-static uint32_t hitag2_crypt(uint64_t s)
-{
+static uint32_t hitag2_crypt(uint64_t s) {
     uint32_t bitindex;
 
     bitindex = (ht2_function4a >> pickbits2_2(s, 1, 4)) & 1;
@@ -162,8 +160,7 @@ static uint32_t hitag2_crypt(uint64_t s)
 }
 
 /* ht2crypt works on the pre-shifted form of the lfsr; this is the ref in the paper */
-uint64_t ht2crypt(uint64_t s)
-{
+uint64_t ht2crypt(uint64_t s) {
     uint64_t bitindex;
 
     bitindex = (ht2_function4a >> pickbits2_2(s, 2, 5)) & 1;
@@ -177,8 +174,7 @@ uint64_t ht2crypt(uint64_t s)
 
 
 /* fnL is the feedback function for the reference code */
-uint64_t fnL(uint64_t x)
-{
+uint64_t fnL(uint64_t x) {
     return (bitn(x, 0) ^ bitn(x, 2) ^ bitn(x, 3) ^ bitn(x, 6) ^ bitn(x, 7) ^ bitn(x, 8) ^
             bitn(x, 16) ^ bitn(x, 22) ^ bitn(x, 23) ^ bitn(x, 26) ^ bitn(x, 30) ^ bitn(x, 41) ^
             bitn(x, 42) ^ bitn(x, 43) ^ bitn(x, 46) ^ bitn(x, 47));
@@ -191,13 +187,13 @@ uint64_t fnL(uint64_t x)
  * this is for pre-shifted lfsr */
 unsigned int packed_size[] = { 0,  0,  0,  1,  2,  2,  3,  4,  4,  5,  5,  5,  5,  6,  6,  7,  8,
                                8,  9,  9,  9,  9, 10, 10, 11, 11, 11, 12, 12, 13, 14, 14, 15,
-                              15, 16, 17, 17, 17, 17, 17, 17, 17, 17, 17, 18, 19, 19, 20, 20 };
+                               15, 16, 17, 17, 17, 17, 17, 17, 17, 17, 17, 18, 19, 19, 20, 20
+                             };
 
 
 /* f20 is the same as hitag2_crypt except it works on the packed version
  * of the state where all 20 relevant bits are squashed together */
-uint64_t f20(uint64_t y)
-{
+uint64_t f20(uint64_t y) {
     uint64_t bitindex;
 
     bitindex = (ht2_function4a >> (y & 0xf)) & 1;
@@ -211,8 +207,7 @@ uint64_t f20(uint64_t y)
 
 
 /* packstate packs the relevant bits from LFSR state into 20 bits for pre-shifted lfsr */
-uint64_t packstate(uint64_t s)
-{
+uint64_t packstate(uint64_t s) {
     uint64_t packed;
 
     packed =  pickbits2_2(s, 2, 5);
@@ -226,8 +221,7 @@ uint64_t packstate(uint64_t s)
 
 
 /* create_guess_table mallocs the tables */
-void create_guess_table()
-{
+void create_guess_table() {
     guesses = (struct guess *)malloc(sizeof(struct guess) * maxtablesize);
     if (!guesses) {
         printf("cannot malloc guess table\n");
@@ -238,8 +232,7 @@ void create_guess_table()
 
 /* init the guess table by reading in the encrypted nR,aR values and
  * setting the first 2^16 key guesses */
-void init_guess_table(char *filename, char *uidstr)
-{
+void init_guess_table(char *filename, char *uidstr) {
     unsigned int i, j;
     FILE *fp;
     char *buf = NULL;
@@ -277,14 +270,14 @@ void init_guess_table(char *filename, char *uidstr)
     while ((getline(&buf, &lenbuf, fp) > 0) && (num_nRaR < MAX_NONCES)) {
         buft1 = strchr(buf, ' ');
         if (!buft1) {
-            printf("invalid file input on line %d\n", num_nRaR + 1);
+            printf("invalid file input on line %u\n", num_nRaR + 1);
             exit(1);
         }
         *buft1 = 0x00;
         buft1++;
         buft2 = strchr(buft1, '\n');
         if (!buft2) {
-            printf("no CR on line %d\n", num_nRaR + 1);
+            printf("no CR on line %u\n", num_nRaR + 1);
             exit(1);
         }
         *buft2 = 0x00;
@@ -301,7 +294,7 @@ void init_guess_table(char *filename, char *uidstr)
     fclose(fp);
     fp = NULL;
 
-    fprintf(stderr, "Loaded %d nRaR pairs\n", num_nRaR);
+    fprintf(stderr, "Loaded %u nRaR pairs\n", num_nRaR);
 
     // set key and copy in enc_nR and ks values
     // set score to -1.0 to distinguish them from 0 scores
@@ -320,8 +313,7 @@ void init_guess_table(char *filename, char *uidstr)
 /* bit_score calculates the ratio of partial states that could generate
  * the resulting bit b to all possible states
  * size is the number of confirmed bits in the state */
-double bit_score(uint64_t s, uint64_t size, uint64_t b)
-{
+double bit_score(uint64_t s, uint64_t size, uint64_t b) {
     uint64_t packed;
     uint64_t chopped;
     unsigned int n;
@@ -404,8 +396,7 @@ double bit_score(uint64_t s, uint64_t size, uint64_t b)
  * bit_scores together until no bits remain. bit_scores are
  * multiplied by the number of relevant bits in the scored state
  * to give weight to more complete states. */
-double score(uint64_t s, unsigned int size, uint64_t ks, unsigned int kssize)
-{
+double score(uint64_t s, unsigned int size, uint64_t ks, unsigned int kssize) {
     double sc, sc2;
 
     if ((size == 1) || (kssize == 1)) {
@@ -436,8 +427,7 @@ double score(uint64_t s, unsigned int size, uint64_t ks, unsigned int kssize)
 
 
 /* score_traces runs score for each encrypted nonce */
-void score_traces(struct guess *g, unsigned int size)
-{
+void score_traces(struct guess *g, unsigned int size) {
     uint64_t lfsr;
     unsigned int i;
     double sc;
@@ -491,8 +481,7 @@ void score_all_traces(unsigned int size)
 */
 
 /* score_some_traces runs score_traces for every key guess in a section of the table */
-void *score_some_traces(void *data)
-{
+void *score_some_traces(void *data) {
     unsigned int i;
     struct thread_data *tdata = (struct thread_data *)data;
 
@@ -505,8 +494,7 @@ void *score_some_traces(void *data)
 
 
 /* score_all_traces runs score_traces for every key guess in the table */
-void score_all_traces(unsigned int size)
-{
+void score_all_traces(unsigned int size) {
     pthread_t threads[NUM_THREADS];
     void *status;
     struct thread_data tdata[NUM_THREADS];
@@ -528,7 +516,7 @@ void score_all_traces(unsigned int size)
     // start the threads
     for (i = 0; i < NUM_THREADS; i++) {
         if (pthread_create(&(threads[i]), NULL, score_some_traces, (void *)(tdata + i))) {
-            printf("cannot start thread %d\n", i);
+            printf("cannot start thread %u\n", i);
             exit(1);
         }
     }
@@ -536,7 +524,7 @@ void score_all_traces(unsigned int size)
     // wait for threads to end
     for (i = 0; i < NUM_THREADS; i++) {
         if (pthread_join(threads[i], &status)) {
-            printf("cannot join thread %d\n", i);
+            printf("cannot join thread %u\n", i);
             exit(1);
         }
     }
@@ -547,8 +535,7 @@ void score_all_traces(unsigned int size)
 
 
 /* cmp_guess is the comparison function for qsorting the guess table */
-int cmp_guess(const void *a, const void *b)
-{
+int cmp_guess(const void *a, const void *b) {
     struct guess *a1 = (struct guess *)a;
     struct guess *b1 = (struct guess *)b;
 
@@ -565,8 +552,7 @@ int cmp_guess(const void *a, const void *b)
 /* expand all guesses in first half of (sorted) table by
  * copying them into the second half and extending the copied
  * ones with an extra 1, leaving the first half with an extra 0 */
-void expand_guesses(unsigned int halfsize, unsigned int size)
-{
+void expand_guesses(unsigned int halfsize, unsigned int size) {
     unsigned int i, j;
 
     for (i = 0; i < halfsize; i++) {
@@ -581,8 +567,7 @@ void expand_guesses(unsigned int halfsize, unsigned int size)
 
 /* checks if the supplied test key is still in the table, which
  * is useful when testing different scoring methods */
-void check_supplied_testkey(unsigned int size)
-{
+void check_supplied_testkey(unsigned int size) {
     uint64_t partkey;
     unsigned int i;
 
@@ -590,7 +575,7 @@ void check_supplied_testkey(unsigned int size)
 
     for (i = 0; i < num_guesses; i++) {
         if (guesses[i].key == partkey) {
-            fprintf(stderr, " supplied test key score = %1.10f, position = %d\n", guesses[i].score, i);
+            fprintf(stderr, " supplied test key score = %1.10f, position = %u\n", guesses[i].score, i);
             return;
         }
     }
@@ -601,8 +586,7 @@ void check_supplied_testkey(unsigned int size)
 
 
 /* execute_round scores the guesses, sorts them and expands the good half */
-void execute_round(unsigned int size)
-{
+void execute_round(unsigned int size) {
     unsigned int halfsize;
 
     // score all the current guesses
@@ -630,27 +614,25 @@ void execute_round(unsigned int size)
 
 
 /* crack is the main cracking algo; it executes the rounds */
-void crack()
-{
+void crack() {
     unsigned int i;
     uint64_t revkey;
     uint64_t foundkey;
 
     for (i = 16; i <= 48; i++) {
-        fprintf(stderr, "round %2d, size=%2d\n", i-16, i);
+        fprintf(stderr, "round %2u, size=%2u\n", i - 16, i);
         execute_round(i);
 
         // print some metrics
         revkey = rev64(guesses[0].key);
         foundkey = ((revkey >> 40) & 0xff) | ((revkey >> 24) & 0xff00) | ((revkey >> 8) & 0xff0000) | ((revkey << 8) & 0xff000000) | ((revkey << 24) & 0xff00000000) | ((revkey << 40) & 0xff0000000000);
-        fprintf(stderr, " guess=%012" PRIx64 ", num_guesses = %d, top score=%1.10f, min score=%1.10f\n", foundkey, num_guesses, guesses[0].score, guesses[num_guesses - 1].score);
+        fprintf(stderr, " guess=%012" PRIx64 ", num_guesses = %u, top score=%1.10f, min score=%1.10f\n", foundkey, num_guesses, guesses[0].score, guesses[num_guesses - 1].score);
     }
 }
 
 
 /* test function to make sure I know how the LFSR works */
-void testkey(uint64_t key)
-{
+void testkey(uint64_t key) {
     uint64_t i;
     uint64_t b0to31 = 0;
     uint64_t ks = 0;
@@ -710,8 +692,7 @@ void testkey(uint64_t key)
 
 
 /* test function to generate test data */
-void gen_bitstreams_testks(struct guess *g, uint64_t key)
-{
+void gen_bitstreams_testks(struct guess *g, uint64_t key) {
     unsigned int i, j;
     uint64_t nRxorkey, lfsr, ks;
 
@@ -752,8 +733,7 @@ void gen_bitstreams_testks(struct guess *g, uint64_t key)
 
 
 /* test function */
-void test()
-{
+void test() {
     uint64_t lfsr;
     uint64_t packed;
 
@@ -765,7 +745,7 @@ void test()
         packed = packstate(lfsr);
 
         if (hitag2_crypt(lfsr) != f20(packed)) {
-            printf(" * * * FAIL: %3" PRIu64 ": 0x%012" PRIx64 " = %d, 0x%012" PRIx64 " = 0x%05" PRIx64 "\n", i, lfsr, hitag2_crypt(lfsr), packed, f20(packed));
+            printf(" * * * FAIL: %3" PRIu64 ": 0x%012" PRIx64 " = %u, 0x%012" PRIx64 " = 0x%05" PRIx64 "\n", i, lfsr, hitag2_crypt(lfsr), packed, f20(packed));
         }
     }
 
@@ -774,8 +754,7 @@ void test()
 
 
 /* check_key tests the potential key against an encrypted nonce, ks pair */
-int check_key(uint64_t key, uint64_t enc_nR, uint64_t ks)
-{
+int check_key(uint64_t key, uint64_t enc_nR, uint64_t ks) {
     Hitag_State hstate;
     uint64_t bits;
     int i;
@@ -794,8 +773,7 @@ int check_key(uint64_t key, uint64_t enc_nR, uint64_t ks)
 
 
 /* start up */
-int main(int argc, char *argv[])
-{
+int main(int argc, char *argv[]) {
     unsigned int i;
     uint64_t revkey;
     uint64_t foundkey;
@@ -843,7 +821,7 @@ int main(int argc, char *argv[])
     if ((tot_nRaR > 0) && (tot_nRaR <= num_nRaR)) {
         num_nRaR = tot_nRaR;
     }
-    fprintf(stderr, "Using %d nRaR pairs\n", num_nRaR);
+    fprintf(stderr, "Using %u nRaR pairs\n", num_nRaR);
 
     crack();
 

tools/hitag2crack/crack4/utilpart.c

@@ -142,8 +142,7 @@ rtccTime	RTC_time;			// time structure
 rtccDate	RTC_date;			// date structure
 
 // convert byte-reversed 8 digit hex to unsigned long
-unsigned long hexreversetoulong(BYTE *hex)
-{
+unsigned long hexreversetoulong(BYTE *hex) {
     unsigned long ret = 0L;
     unsigned int x;
     BYTE i;
@@ -151,8 +150,7 @@ unsigned long hexreversetoulong(BYTE *hex)
     if (strlen(hex) != 8)
         return 0L;
 
-    for(i= 0 ; i < 4 ; ++i)
-    {
+    for (i = 0 ; i < 4 ; ++i) {
         if (sscanf(hex, "%2X", &x) != 1)
             return 0L;
         ret += ((unsigned long) x) << i * 8;
@@ -162,8 +160,7 @@ unsigned long hexreversetoulong(BYTE *hex)
 }
 
 // convert byte-reversed 12 digit hex to unsigned long
-unsigned long long hexreversetoulonglong(BYTE *hex)
-{
+unsigned long long hexreversetoulonglong(BYTE *hex) {
     unsigned long long ret = 0LL;
     BYTE tmp[9];