diff --git a/CHANGELOG.md b/CHANGELOG.md
index bbdb1e03c..ef081137b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,8 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - 'hf mf sim' - bugs fix, refactoring (@mceloff)
+ - Mifare Ultralight/NTAG simulation. Add WRITE and COMPATIBLE_WRITE support (@mceloff)
  - *WIP* Add FPC usart with pm3 client: WITH_FPC_HOST. (@doegox)
  - Add '-b baudrate' option to the pm3 client. (@doegox)
  - Change 'lf t55xx info': tell if known configuration block0. (@iceman)
diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 881bfa0bd..6db229d0d 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -2350,7 +2350,7 @@ int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, bool send_chaining, void *data, u
             *res = data_bytes[0];
 
         // crc check
-        if (len >= 3 && !check_crc(CRC_14443_A, data_bytes, len)) {
+        if (len >= 3 && !CheckCrc14A(data_bytes, len)) {
             return -1;
         }
 
diff --git a/armsrc/mifareutil.c b/armsrc/mifareutil.c
index ddcdbc326..233b143fe 100644
--- a/armsrc/mifareutil.c
+++ b/armsrc/mifareutil.c
@@ -35,13 +35,17 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len) {
 }
 
 void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, uint16_t len, uint8_t *par) {
+    mf_crypto1_encryptEx(pcs, data, NULL, data, len, par);
+}
+
+void mf_crypto1_encryptEx(struct Crypto1State *pcs, uint8_t *data_in, uint8_t *keystream, uint8_t *data_out, uint16_t len, uint8_t *par) {
     uint8_t bt = 0;
     int i;
     par[0] = 0;
 
     for (i = 0; i < len; i++) {
-        bt = data[i];
-        data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];
+        bt = data_in[i];
+        data_out[i] = crypto1_byte(pcs, keystream ? keystream[i] : 0x00, 0) ^ data_in[i];
         if ((i & 0x0007) == 0)
             par[ i >> 3 ] = 0;
         par[ i >> 3 ] |= (((filter(pcs->odd) ^ oddparity8(bt)) & 0x01) << (7 - (i & 0x0007)));
diff --git a/armsrc/mifareutil.h b/armsrc/mifareutil.h
index d0fb5c37f..570af2629 100644
--- a/armsrc/mifareutil.h
+++ b/armsrc/mifareutil.h
@@ -69,6 +69,10 @@
 
 #define cardSTATE_TO_IDLE() cardSTATE = MFEMUL_IDLE; LED_B_OFF(); LED_C_OFF();
 
+#ifndef MifareBlockToSector
+#define MifareBlockToSector(block) (block < 128 ? block / 4 : (block - 128) / 16 + 32)
+#endif
+
 //functions
 int mifare_sendcmd(uint8_t cmd, uint8_t *data, uint8_t data_size, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
 int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing);
@@ -99,6 +103,7 @@ int mifare_desfire_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData);
 void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len);
 void mf_crypto1_decryptEx(struct Crypto1State *pcs, uint8_t *data_in, int len, uint8_t *data_out);
 void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, uint16_t len, uint8_t *par);
+void mf_crypto1_encryptEx(struct Crypto1State *pcs, uint8_t *data_in, uint8_t *keystream, uint8_t *data_out, uint16_t len, uint8_t *par);
 uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data);
 
 // Mifare memory structure