@PM3 master merges, Piwi fix for mfnested

@Marshmellow42 's fix for FDB

armsrc/BigBuf.h

@@ -24,15 +24,15 @@
 extern uint8_t *BigBuf_get_addr(void);
 extern uint8_t *BigBuf_get_EM_addr(void);
 extern uint16_t BigBuf_max_traceLen(void);
-void BigBuf_Clear(void);
+extern void BigBuf_Clear(void);
 extern uint8_t *BigBuf_malloc(uint16_t);
 extern void BigBuf_free(void);
 extern void BigBuf_free_keep_EM(void);
 
-uint16_t BigBuf_get_traceLen(void);
+extern uint16_t BigBuf_get_traceLen(void);
-void clear_trace();
+extern void clear_trace();
-void set_tracing(bool enable);
+extern void set_tracing(bool enable);
-bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
+extern bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
-int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader);
+extern int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader);
-uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length);
+extern uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length);
 #endif /* __BIGBUF_H */

armsrc/apps.h

@@ -130,7 +130,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 //void MifareUWriteBlockCompat(uint8_t arg0,uint8_t *datain);
 void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain);
 void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
-void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
+void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
 void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
 void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);
 void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain);

armsrc/iso14443b.c

@@ -16,9 +16,10 @@
 
 #include "iso14443crc.h"
 
-#define RECEIVE_SAMPLES_TIMEOUT 2000
+#define RECEIVE_SAMPLES_TIMEOUT 200000
-#define ISO14443B_DMA_BUFFER_SIZE 256
+#define ISO14443B_DMA_BUFFER_SIZE 512
 
+uint8_t PowerOn = TRUE;
 //=============================================================================
 // An ISO 14443 Type B tag. We listen for commands from the reader, using
 // a UART kind of thing that's implemented in software. When we get a
@@ -266,6 +267,7 @@ static void UartReset()
 	Uart.state = STATE_UNSYNCD;
 	Uart.byteCnt = 0;
 	Uart.bitCnt = 0;
+	memset(Uart.output, 0x00, MAX_FRAME_SIZE);
 }
 
 
@@ -321,10 +323,14 @@ static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len)
 //-----------------------------------------------------------------------------
 void SimulateIso14443bTag(void)
 {
-	// the only commands we understand is REQB, AFI=0, Select All, N=0:
+	// the only commands we understand is WUPB, AFI=0, Select All, N=1:
-	static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
+	static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB
-	// ... and REQB, AFI=0, Normal Request, N=0:
+	// ... and REQB, AFI=0, Normal Request, N=1:
-	static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF };
+	static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB
+	// ... and HLTB
+	static const uint8_t cmd3[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB
+	// ... and ATTRIB
+	static const uint8_t cmd4[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB
 
 	// ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922,
 	// supports only 106kBit/s in both directions, max frame size = 32Bytes,
@@ -333,6 +339,8 @@ void SimulateIso14443bTag(void)
 		0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22,
 		0x00, 0x21, 0x85, 0x5e, 0xd7
 	};
+	// response to HLTB and ATTRIB
+	static const uint8_t response2[] = {0x00, 0x78, 0xF0};
 
 	uint8_t parity[MAX_PARITY_SIZE];
 				
@@ -358,6 +366,12 @@ void SimulateIso14443bTag(void)
 	memcpy(resp1Code, ToSend, ToSendMax); 
 	uint16_t resp1CodeLen = ToSendMax;
 
+	// prepare the (other) tag answer:
+	CodeIso14443bAsTag(response2, sizeof(response2));
+	uint8_t *resp2Code = BigBuf_malloc(ToSendMax);
+	memcpy(resp2Code, ToSend, ToSendMax); 
+	uint16_t resp2CodeLen = ToSendMax;
+
 	// We need to listen to the high-frequency, peak-detected path.
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 	FpgaSetupSsc();
@@ -382,18 +396,33 @@ void SimulateIso14443bTag(void)
 			respLen = sizeof(response1);
 			respCode = resp1Code; 
 			respCodeLen = resp1CodeLen;
+		} else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0])
+			|| (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) {
+			resp = response2; 
+			respLen = sizeof(response2);
+			respCode = resp2Code; 
+			respCodeLen = resp2CodeLen;
 		} else {
 			Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd);
 			// And print whether the CRC fails, just for good measure
 			uint8_t b1, b2;
+			if (len >= 3){ // if crc exists
 			ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2);
 			if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) {
 				// Not so good, try again.
 				DbpString("+++CRC fail");
+		
 			} else {
 				DbpString("CRC passes");
 			}
-			break;
+			}
+			//get rid of compiler warning
+			respCodeLen = 0;
+			resp = response1;
+			respLen	= 0;
+			respCode = resp1Code;
+			//don't crash at new command just wait and see if reader will send other new cmds.
+			//break;
 		}
 
 		cmdsRecvd++;
@@ -446,7 +475,7 @@ void SimulateIso14443bTag(void)
 		// trace the response:
 		if (tracing) LogTrace(resp, respLen, 0, 0, parity, FALSE);			
 	}
-	//FpgaDisableSscDma();
+	FpgaDisableSscDma();
 }
 
 //=============================================================================
@@ -570,7 +599,7 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 			break;
 
 		case DEMOD_PHASE_REF_TRAINING:
-			if(Demod.posCount < 8) {
+			if(Demod.posCount < 10*2) {
 				CHECK_FOR_SUBCARRIER();
 				if (v > SUBCARRIER_DETECT_THRESHOLD) {
 					// set the reference phase (will code a logic '1') by averaging over 32 1/fs.
@@ -592,7 +621,8 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 				Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF;
 				Demod.posCount = 0;	// start of SOF sequence
 			} else {
-				if(Demod.posCount > 200/4) {	// maximum length of TR1 = 200 1/fs
+				//if(Demod.posCount > 200/4) {	// maximum length of TR1 = 200 1/fs
+				if(Demod.posCount > 25*2) {	// maximum length of TR1 = 200 1/fs
 					Demod.state = DEMOD_UNSYNCD;
 				}
 			}
@@ -603,10 +633,9 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 			Demod.posCount++;
 			MAKE_SOFT_DECISION();
 			if(v > 0) {
-				if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
+				if(Demod.posCount < 10*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges
 					Demod.state = DEMOD_UNSYNCD;
 				} else {
-					LED_C_ON(); // Got SOF
 					Demod.state = DEMOD_AWAITING_START_BIT;
 					Demod.posCount = 0;
 					Demod.len = 0;
@@ -616,7 +645,7 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 */
 				}
 			} else {
-				if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu)
+				if(Demod.posCount > 13*2) { // low phase of SOF too long (> 12 etu)
 					Demod.state = DEMOD_UNSYNCD;
 					LED_C_OFF();
 				}
@@ -664,6 +693,7 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 
 				Demod.bitCount++;
 				if(Demod.bitCount == 10) {
+					LED_C_ON();
 					uint16_t s = Demod.shiftReg;
 					if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0'
 						uint8_t b = (s >> 1);
@@ -688,7 +718,6 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq)
 			LED_C_OFF();
 			break;
 	}
-
 	return FALSE;
 }
 
@@ -724,26 +753,28 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 	// free all previous allocations first
 	BigBuf_free();
 
+	// And put the FPGA in the appropriate mode
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
+
 	// The response (tag -> reader) that we're receiving.
 	uint8_t *resp = BigBuf_malloc(MAX_FRAME_SIZE);
 
-	// The DMA buffer, used to stream samples from the FPGA
-	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
-
 	// Set up the demodulator for tag -> reader responses.
 	DemodInit(resp);
 	
-	// Setup and start DMA.
+	// The DMA buffer, used to stream samples from the FPGA
-	FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
+	int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE);
+
 
 	int8_t *upTo = dmaBuf;
 	lastRxCounter = ISO14443B_DMA_BUFFER_SIZE;
 
 	// Signal field is ON with the appropriate LED:
 	LED_D_ON();
-	// And put the FPGA in the appropriate mode
+
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
+	// Setup and start DMA.
-	SpinDelayUs(151); // T0 time between reader send,  tag answer.  151us.
+	FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE);
+
 	
 	for(;;) {
 		int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR;
@@ -778,7 +809,17 @@ static void GetSamplesFor14443bDemod(int n, bool quiet)
 
 	AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
 
-	if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ);
+	if (!quiet) {
+		Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d",
+			max,
+			samples, 
+			gotFrame, 
+			Demod.len, 
+			Demod.sumI, 
+			Demod.sumQ
+		);
+	}
+
 	//Tracing
 	if (tracing && Demod.len > 0) {
 		uint8_t parity[MAX_PARITY_SIZE];
@@ -805,6 +846,8 @@ static void TransmitFor14443b(void)
 	// Signal we are transmitting with the Green LED
 	LED_B_ON();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD);
+	if ( !PowerOn )
+		SpinDelay(200);
 	
 	for(c = 0; c < 10;) {
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
@@ -849,11 +892,11 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 	ToSendReset();
 
 	// Establish initial reference level
-	for(i = 0; i < 40; i++) {
+	for(i = 0; i < 80; i++) {
 		ToSendStuffBit(1);
 	}
 	// Send SOF
-	for(i = 0; i < 10; i++) {
+	for(i = 0; i < 11; i++) {
 		ToSendStuffBit(0);
 	}
 
@@ -876,7 +919,7 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 	}
 	// Send EOF
 	ToSendStuffBit(1);
-	for(i = 0; i < 10; i++) {
+	for(i = 0; i < 11; i++) {
 		ToSendStuffBit(0);
 	}
 	for(i = 0; i < 8; i++) {
@@ -885,7 +928,7 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 
 	// And then a little more, to make sure that the last character makes
 	// it out before we switch to rx mode.
-	for(i = 0; i < 24; i++) {
+	for(i = 0; i < 10; i++) {
 		ToSendStuffBit(1);
 	}
 
@@ -1212,7 +1255,9 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 	BigBuf_free();
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+	if ( !PowerOn ){
 		FpgaSetupSsc();
+	}
 	
 	if ( datalen == 0 && recv == 0 && powerfield == 0){
 		clear_trace();
@@ -1222,16 +1267,16 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u
 	}
 
 	if(recv) {
-		GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE);
+		GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, FALSE);
 		uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE);
 		cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen);
 	}
 	
 	if(!powerfield) {
 		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-		LED_D_OFF();
-	}
-	
 		FpgaDisableSscDma();
+		LED_D_OFF();
+		PowerOn = 0;
+	}
 }
 

armsrc/mifarecmd.c

@@ -637,8 +637,8 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 	// free eventually allocated BigBuf memory
 	BigBuf_free();
 
-	clear_trace();
+	if (calibrate) clear_trace();
-	set_tracing(false);
+	set_tracing(true);
 
 	// statistics on nonce distance
 	int16_t isOK = 0;
@@ -815,18 +815,18 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
 
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
-	set_tracing(TRUE);
 }
 
 //-----------------------------------------------------------------------------
 // MIFARE check keys. key count up to 85. 
 // 
 //-----------------------------------------------------------------------------
-void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
+void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 {
   // params
-	uint8_t blockNo = arg0;
+	uint8_t blockNo = arg0 & 0xff;
-	uint8_t keyType = arg1;
+	uint8_t keyType = (arg0 >> 8) & 0xff;
+	bool clearTrace = arg1;
 	uint8_t keyCount = arg2;
 	uint64_t ui64Key = 0;
 	
@@ -848,7 +848,7 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LED_C_OFF();
 	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 
-	clear_trace();
+	if (clearTrace) clear_trace();
 	set_tracing(TRUE);
 
 	for (i = 0; i < keyCount; i++) {

client/cmddata.c

@@ -26,8 +26,8 @@
 #include "crc16.h"
 
 uint8_t DemodBuffer[MAX_DEMOD_BUF_LEN];
-uint8_t g_debugMode;
+uint8_t g_debugMode=0;
-size_t DemodBufferLen;
+size_t DemodBufferLen=0;
 static int CmdHelp(const char *Cmd);
 
 //set the demod buffer with given array of binary (one bit per byte)
@@ -503,6 +503,7 @@ int ASKbiphaseDemod(const char *Cmd, bool verbose)
 	
 	uint8_t BitStream[MAX_DEMOD_BUF_LEN];
 	size_t size = getFromGraphBuf(BitStream);	  
+	//invert here inverts the ask raw demoded bits which has no effect on the demod, but we need the pointer
 	int errCnt = askdemod(BitStream, &size, &clk, &invert, maxErr, 0, 0);  
 	if ( errCnt < 0 || errCnt > maxErr ) {   
 		if (g_debugMode) PrintAndLog("DEBUG: no data or error found %d, clock: %d", errCnt, clk);  
@@ -1501,9 +1502,9 @@ int CmdFDXBdemodBI(const char *Cmd){
 	
 	setDemodBuf(BitStream, 128, preambleIndex);
 
-	// remove but don't verify parity. (pType = 2)
+	// remove marker bits (1's every 9th digit after preamble) (pType = 2)
 	size = removeParity(BitStream, preambleIndex + 11, 9, 2, 117);
-	if ( size <= 103 ) {
+	if ( size != 104 ) {
 		if (g_debugMode) PrintAndLog("Error removeParity:: %d", size);
 		return 0;
 	}

client/cmdhf14b.c

@@ -104,7 +104,8 @@ int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datal
 	}
 
 	*datalen = resp.arg[0];
-	if ( *datalen < 3 ) return 0;
+	if (verbose) PrintAndLog("received %u octets", *datalen);
+	if(*datalen<3) return 0;
 
 	memcpy(data, resp.d.asBytes, *datalen);
 	
@@ -128,16 +129,20 @@ int CmdHF14BCmdRaw (const char *Cmd) {
     bool reply = true;
     bool crc = false;
 	bool power = false;
+	bool select = false;
+	bool SRx = false;
     char buf[5]="";
     uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
     uint8_t datalen = 0;
     unsigned int temp;
     int i = 0;
     if (strlen(Cmd)<3) {
-        PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
+		PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
         PrintAndLog("       -r    do not read response");
         PrintAndLog("       -c    calculate and append CRC");
         PrintAndLog("       -p    leave the field on after receive");
+		PrintAndLog("       -s    active signal field ON with select");
+		PrintAndLog("       -ss   active signal field ON with select for SRx ST Microelectronics tags");
         return 0;    
     }
 
@@ -160,6 +165,14 @@ int CmdHF14BCmdRaw (const char *Cmd) {
                 case 'P': 
 					power = true;
                     break;
+				case 's':
+				case 'S':
+					select = true;
+					if (Cmd[i+2]=='s' || Cmd[i+2]=='S') {
+						SRx = true;
+						i++;
+					}
+					break;
                 default:
                     PrintAndLog("Invalid option");
                     return 0;
@@ -178,11 +191,12 @@ int CmdHF14BCmdRaw (const char *Cmd) {
                 sscanf(buf,"%x",&temp);
                 data[datalen++]=(uint8_t)(temp & 0xff);
                 *buf=0;
+				memset(buf, 0x00, sizeof(buf));
             }
             continue;
         }
         PrintAndLog("Invalid char on input");
-        return 1;
+		return 0;
     }
     if (datalen == 0)
     {
@@ -190,12 +204,65 @@ int CmdHF14BCmdRaw (const char *Cmd) {
       return 0;
     }
 
+	if (select){ //auto select 14b tag
+		uint8_t	cmd2[16];
+		bool crc2 = true;
+		uint8_t cmdLen;
+
+		if (SRx) {
+			// REQ SRx
+			cmdLen = 2;
+			cmd2[0] = 0x06;
+			cmd2[1] = 0x00;
+		} else {
+			// REQB
+			cmdLen = 3;
+			cmd2[0] = 0x05;
+			cmd2[1] = 0x00;
+			cmd2[2] = 0x08;
+		}
+		
+		// REQB
+		if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
+									  
+		PrintAndLog("REQB   : %s", sprint_hex(cmd2, 9));
+		
+		if ( SRx && (cmdLen != 3 || !crc2) ) return rawClose();
+		else if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return rawClose();
+		
+		uint8_t chipID = 0;
+		if (SRx) {
+			// select
+			chipID = cmd2[0];
+			cmd2[0] = 0x0E;
+			cmd2[1] = chipID;
+			cmdLen = 2;
+		} else {
+			// attrib
+			cmd2[0] = 0x1D; 
+			// UID from cmd2[1 - 4]
+			cmd2[5] = 0x00;
+			cmd2[6] = 0x08;
+			cmd2[7] = 0x01;
+			cmd2[8] = 0x00;
+			cmdLen = 9;
+		}
+		// wait		
+		
+		// attrib
+		if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
+		PrintAndLog("ATTRIB : %s", sprint_hex(cmd2, 3));
+		
+		if (cmdLen != 3 || !crc2) return rawClose();		
+		if (SRx && cmd2[0] != chipID) return rawClose();
+	
+	}
 	return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 }
 
 // print full atqb info
 static void print_atqb_resp(uint8_t *data){
-	PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
+	//PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 	PrintAndLog ("      App Data: %s", sprint_hex(data+5,4));
 	PrintAndLog ("      Protocol: %s", sprint_hex(data+9,3));
 	uint8_t BitRate = data[9];
@@ -216,14 +283,15 @@ static void print_atqb_resp(uint8_t *data){
 	else if (maxFrame == 8)	maxFrame = 256;
 	else maxFrame = 257;
 
-	PrintAndLog ("Max Frame Size: %d%s", maxFrame, (maxFrame == 257) ? "+ RFU" : "");
+	PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 
 	uint8_t protocolT = data[10] & 0xF;
 	PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
-	PrintAndLog ("Frame Wait Int: %d", data[11]>>4);
+	PrintAndLog ("Frame Wait Int: %u", data[11]>>4);
 	PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 	PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 	PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
+	PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported");
 
 	return;
 }
@@ -247,6 +315,71 @@ char *get_ST_Chip_Model(uint8_t data){
 	return retStr;
 }
 
+int print_ST_Lock_info(uint8_t model){
+	//assume connection open and tag selected...
+	uint8_t data[16] = {0x00};
+	uint8_t datalen = 2;
+	bool crc = true;
+	uint8_t resplen;
+	uint8_t	blk1;
+	data[0] = 0x08;
+
+	if (model == 0x2) { //SR176 has special command:
+		data[1] = 0xf;
+		resplen = 4;			
+	} else {
+		data[1] = 0xff;
+		resplen = 6;
+	}
+
+	//std read cmd
+	if (HF14BCmdRaw(true, &crc, true, data, &datalen, false)==0) return rawClose();
+
+	if (datalen != resplen || !crc) return rawClose();
+
+	PrintAndLog("Chip Write Protection Bits:");
+	// now interpret the data
+	switch (model){
+		case 0x0: //fall through (SRIX4K special)
+		case 0x3: //fall through (SRIx4K)
+		case 0x7: //             (SRI4K)
+			//only need data[3]
+			blk1 = 9;
+			PrintAndLog("   raw: %s",printBits(1,data+3));
+			PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
+			for (uint8_t i = 1; i<8; i++){
+				PrintAndLog("    %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
+				blk1++;
+			}
+			break;
+		case 0x4: //fall through (SRIX512)
+		case 0x6: //fall through (SRI512)
+		case 0xC: //             (SRT512)
+			//need data[2] and data[3]
+			blk1 = 0;
+			PrintAndLog("   raw: %s",printBits(2,data+2));
+			for (uint8_t b=2; b<4; b++){
+				for (uint8_t i=0; i<8; i++){
+					PrintAndLog("    %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
+					blk1++;
+				}
+			}
+			break;
+		case 0x2: //             (SR176)
+			//need data[2]
+			blk1 = 0;
+			PrintAndLog("   raw: %s",printBits(1,data+2));
+			for (uint8_t i = 0; i<8; i++){
+				PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
+				blk1+=2;
+			}
+			break;
+		default:
+			return rawClose();
+	}
+	return 1;
+}
+
 // print UID info from SRx chips (ST Microelectronics)
 static void print_st_general_info(uint8_t *data){
 	//uid = first 8 bytes in data
@@ -259,9 +392,9 @@ static void print_st_general_info(uint8_t *data){
 // 14b get and print UID only (general info)
 int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 	//05 00 00 = find one tag in field
-	//1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc
+	//1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
-	//a3 = ?  (resp 03 e2 c2)
+	//a3 = ?  (resp 03 [e2 c2])
-	//02 = ?  (resp 02 6a d3)
+	//02 = ?  (resp 02 [6a d3])
 	// 022b (resp 02 67 00 [29  5b])
 	// 0200a40400 (resp 02 67 00 [29 5b])
 	// 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
@@ -274,6 +407,7 @@ int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 	//03 = ?  (resp 03 [e3 c2])
 	//c2 = ?  (resp c2 [66 15])
 	//b2 = ?  (resp a3 [e9 67])		
+	//a2 = ?  (resp 02 [6a d3])
 	bool crc = true;
 	*datalen = 3;
 	//std read cmd
@@ -281,14 +415,36 @@ int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 	data[1] = 0x00;
 	data[2] = 0x08;
 
-	// response, crc, powerfield, data, len, verbose
+	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
-	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0;
 
-	if (data[0] != 0x50  || *datalen != 14 || !crc) return 0;
+	if (data[0] != 0x50 || *datalen != 14 || !crc) return rawClose();
 
 	PrintAndLog ("\n14443-3b tag found:");
 	PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 
+	uint8_t	cmd2[16];
+	uint8_t cmdLen = 3;
+	bool crc2 = true;
+
+	cmd2[0] = 0x1D; 
+	// UID from data[1 - 4]
+	cmd2[1] = data[1];
+	cmd2[2] = data[2];
+	cmd2[3] = data[3];
+	cmd2[4] = data[4];
+	cmd2[5] = 0x00;
+	cmd2[6] = 0x08;
+	cmd2[7] = 0x01;
+	cmd2[8] = 0x00;
+	cmdLen = 9;
+
+	// attrib
+	if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
+
+	if (cmdLen != 3 || !crc2) return rawClose();
+	// add attrib responce to data
+	data[14] = cmd2[0];
+	rawClose();
 	return 1;
 }
 
@@ -299,11 +455,12 @@ int HF14BStdInfo(uint8_t *data, uint8_t *datalen){
 	//add more info here
 	print_atqb_resp(data);
 
+
 	return 1;
 }
 
 // SRx get and print general info about SRx chip from UID
-int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
+int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){
 	bool crc = true;
 	*datalen = 2;
 	//wake cmd
@@ -323,7 +480,6 @@ int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
 	*datalen = 2;
 
 	//leave power on
-	// verbose on for now for testing - turn off when functional
 	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 
 	if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
@@ -332,11 +488,13 @@ int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
 	data[0] = 0x0B;
 	*datalen = 1;
 
-	//power off
+	//leave power on
-	// verbose on for now for testing - turn off when functional
+	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
-	if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0;
+
-	rawClose();
+	if (*datalen != 10 || !crc) return rawClose();
-	if (*datalen != 10 || !crc) return 0;
+
+	//power off ?
+	if (closeCon) rawClose();
 
 	PrintAndLog("\n14443-3b ST tag found:");
 	print_st_general_info(data);
@@ -345,10 +503,11 @@ int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
 
 // SRx get and print full info (needs more info...)
 int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){
-	if (!HF14B_ST_Reader(data, datalen)) return 0;
+	if (!HF14B_ST_Reader(data, datalen, false)) return 0;
 	
 	//add locking bit information here.
-
+	if (print_ST_Lock_info(data[5]>>2)) 
+		rawClose();
 
 	return 1;
 }
@@ -368,6 +527,7 @@ int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 			PrintAndLog ("\n14443-3b tag found:");
 			PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
 			PrintAndLog ("%s",sprint_hex(data,*datalen));
+			rawClose();
 			return 1;
 		}
 	}
@@ -381,6 +541,7 @@ int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 			PrintAndLog ("\n14443-3b tag found:");
 			PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
 			PrintAndLog ("%s",sprint_hex(data,*datalen));
+			rawClose();
 			return 1;
 		}
 	}
@@ -394,6 +555,7 @@ int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 			PrintAndLog ("\n14443-3b tag found:");
 			PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
 			PrintAndLog ("%s",sprint_hex(data,*datalen));
+			rawClose();
 			return 1;
 		}
 	}
@@ -434,7 +596,7 @@ int HF14BReader(bool verbose){
 	if (HF14BStdReader(data, &datalen)) return 1;
 
 	// try st 14b
-	if (HF14B_ST_Reader(data, &datalen)) return 1;
+	if (HF14B_ST_Reader(data, &datalen, true)) return 1;
 
 	// try unknown 14b read commands (to be identified later)
 	//   could be read of calypso, CEPAS, moneo, or pico pass.

client/cmdhfmf.c

@@ -19,7 +19,6 @@ int CmdHF14AMifare(const char *Cmd)
 	uint32_t nt = 0, nr = 0;
 	uint64_t par_list = 0, ks_list = 0, r_key = 0;
 	int16_t isOK = 0;
-	uint8_t keyBlock[8] = {0};
 
 	UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}};
 
@@ -75,22 +74,13 @@ start:
 	if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) {
 		isOK = 2;
 		PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt);	
-	} else {
-		printf("------------------------------------------------------------------\n");
-		PrintAndLog("Key found:%012"llx" \n", r_key);
-
-		num_to_bytes(r_key, 6, keyBlock);
-		isOK = mfCheckKeys(0, 0, 1, keyBlock, &r_key);
-	}
-	
-	if (!isOK) 
-		PrintAndLog("Found valid key:%012"llx, r_key);
-	else
-	{
-		if (isOK != 2) PrintAndLog("Found invalid key. ");	
 		PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");
 		c.arg[0] = false;
 		goto start;
+	} else {
+		isOK = 0;
+		printf("------------------------------------------------------------------\n");
+		PrintAndLog("Found valid key:%012"llx" \n", r_key);
 	}
 	
 	PrintAndLog("");
@@ -690,7 +680,7 @@ int CmdHF14AMfNested(const char *Cmd)
 			for (j = 0; j < 2; j++) {
 				if (e_sector[i].foundKey[j]) continue;
 				
-				res = mfCheckKeys(FirstBlockOfSector(i), j, 6, keyBlock, &key64);
+				res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64);
 				
 				if (!res) {
 					e_sector[i].Key[j] = key64;
@@ -974,7 +964,7 @@ int CmdHF14AMfChk(const char *Cmd)
 			uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt;
 			for (uint32_t c = 0; c < keycnt; c+=max_keys) {
 				uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c;
-				res = mfCheckKeys(b, t, size, &keyBlock[6*c], &key64);
+				res = mfCheckKeys(b, t, true, size, &keyBlock[6*c], &key64);
 				if (res != 1) {
 					if (!res) {
 						PrintAndLog("Found valid key:[%012"llx"]",key64);

client/mifarehost.c

@@ -183,7 +183,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo
 		crypto1_get_lfsr(statelists[0].head.slhead + i, &key64);
 		num_to_bytes(key64, 6, keyBlock);
 		key64 = 0;
-		if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, 1, keyBlock, &key64)) {
+		if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, false, 1, keyBlock, &key64)) {
 			num_to_bytes(key64, 6, resultKey);
 			break;
 		}
@@ -195,11 +195,11 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo
 	return 0;
 }
 
-int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){
+int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){
 
 	*key = 0;
 
-	UsbCommand c = {CMD_MIFARE_CHKKEYS, {blockNo, keyType, keycnt}};
+	UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType&0xff)<<8)), clear_trace, keycnt}};
 	memcpy(c.d.asBytes, keyBlock, 6 * keycnt);
 	SendCommand(&c);
 

client/mifarehost.h

@@ -50,7 +50,7 @@ typedef struct {
 extern char logHexFileName[FILE_PATH_SIZE];
 
 int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * ResultKeys, bool calibrate);
-int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key);
+int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key);
 
 int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount);
 int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount);

client/nonce2key/nonce2key.c

@@ -133,7 +133,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
 		key64 = *(last_keylist + i);
 		num_to_bytes(key64, 6, keyBlock);
 		key64 = 0;
-		if (!mfCheckKeys(0, 0, 1, keyBlock, &key64)) {
+		if (!mfCheckKeys(0, 0, false, 1, keyBlock, &key64)) {
 			*key = key64;
 			free(last_keylist);
 			last_keylist = NULL;